What does a vCISO do?

Strip the acronym away and the role is accountability. Someone in the company has to be able to say — to a buyer, an auditor, an insurer, or the board — “here is what could hurt us, here is what we’ve decided to do about it, and here is the proof,” and be right. Everything a vCISO does in a given week traces back to keeping those three statements true.

What makes the job fractional-friendly is its rhythm. Security leadership is not forty hours of decisions a week; it’s a handful of high-stakes judgment calls wrapped in a large volume of recurring operational work — evidence, reviews, questionnaires, vendor checks. A good vCISO engagement splits those layers deliberately: the leader makes the calls, and an operating layer keeps the machinery running between them.

That split is the difference between vCISO offerings. Some sell you only the judgment and leave the machinery to your engineers. Agency’s version ships both: a named security leader backed by U.S.-based forward-deployed engineers, supercharged by proprietary AI, so the roadmap and the work it generates live with one accountable provider.

A security engineer builds and fixes: hardens infrastructure, tunes detection, patches what scanners find. Their output is systems. A vCISO decides which of that work matters most, in what order, and answers for the outcome — they might never touch a terminal, but they own what the terminal work adds up to.

A compliance manager runs the paperwork engine for frameworks already chosen: evidence deadlines, policy renewals, audit logistics. Valuable — and much narrower. The vCISO chooses the frameworks, owns the risks that live outside any audit’s scope, and carries the conversations a coordinator can’t: pricing a risk for the board, or defending a control decision to an enterprise buyer’s security team.

Mature programs need all three functions. The practical question at most growing companies is who supplies the other two while headcount stays flat — which is why Agency pairs the leader with a managed execution team instead of leaving the engineering and coordination to whoever has slack that sprint.

Ninety days in, you should be able to point at artifacts: a risk register you recognize your company in, a roadmap with owners and dates, an audit calendar, questionnaires going out on time, and at least one report written for leadership rather than for the vendor’s own renewal. If all you can point at is a slide deck from month one, you hired a very expensive author.

The other tell is load. A working vCISO engagement takes work off your engineers — evidence requests stop landing in their sprint, buyer reviews stop routing to the CTO. If security tasks on your roadmap multiplied instead, the leadership came without hands. What that split should cost is its own question — covered honestly in Managed Comply pricing.