Growing companies feel this most. They need executive security leadership but can't always justify a full-time CISO.
Fractional CISO services fill that gap, though providers differ widely in what they actually do. This article compares five providers, explains what the services include, and offers a framework for matching one to your size, industry, and risk profile.
Key Takeaways
- A fractional CISO delivers executive security direction without a permanent hire.
- Judge engagement depth, support staff, and outcomes, not the label.
- Demand comes from audits, customer reviews, leadership gaps, and post-incident recovery.
- DeepSeas pairs vCISO leadership with GRC, offensive security, and MDR.
Overview of Fractional CISO Services in the US Market
What a fractional CISO is
A fractional CISO is an experienced security executive who works part-time, on an interim basis, or on contract. ISACA describes virtual CISOs as typically remote, often serving multiple clients, with qualifications and responsibilities similar to a full-time CISO. Core work covers strategy, risk management, governance, executive reporting, and program oversight.
When companies need one
- No internal security leader
- Rapid growth or an acquisition that outpaced the security program
- SOC 2, HIPAA, or ISO 27001 preparation
- Cyber insurance requirements
- Customer security questionnaires stalling deals
- M&A due diligence
- Post-breach remediation
- A CISO who just left
How it differs from neighboring roles
- CIO: leads overall technology strategy; the CISO leads security strategy and risk.
- MDR provider: monitors and responds to threats, but doesn't set program direction.
- Penetration tester: finds vulnerabilities; doesn't own the roadmap.
- Compliance consultant: prepares for audits, often without executive accountability.
- Outsourced IT: runs systems, not risk decisions.
Terms like fractional, virtual, and interim aren't standardized. The contract's scope, availability, and deliverables matter more than the title. Accountability stays with your board and executives, as ISACA notes. A contractor can't absorb it.
Compare the providers below on executive involvement, delivery resources, framework experience, independence, scalability, and evidence of results.
Top Fractional CISO Services in the US
This comparison is not an endorsement of every marketing claim. Provider details can change, so confirm current scope and availability directly before signing.
DeepSeas
DeepSeas, based in San Diego, offers a Virtual CISO program built around a partially dedicated Virtual Security Advisor (VSA) who delivers CISO-equivalent expertise. Its Strategic Security Advisory programs run as a subscription, with options ranging from office-hours advisors to full-time vCISOs, Deputy CISOs, and interim leadership.
The engagement follows four phases:
- VSA Program Mobilization (3 weeks)
- Cyber Domain Assessment (3 weeks)
- Prioritize and Plan Transformation (2 weeks)
- Continuous Improvement and Cyber Defense Oversight (ongoing)
The vCISO sets strategy, builds the roadmap and budget, establishes reporting cadence, and handles board, insurer, and enterprise-customer security conversations.
DeepSeas has about 30 years in cyber defense and serves nearly 1,000 organizations. Its advisors include John Matis (CISSP, CEH, three-time CISO), Keith Robertson (former Fortune 500 CSO), and Barry Hofecker (CISM, 30 years in governance and compliance).
In one case, a healthcare provider used a DeepSeas vCISO after a leadership departure to maintain HIPAA compliance and strengthen identity management.
| Factor | DeepSeas |
|---|---|
| Engagement model | Partially dedicated VSA; subscription options from office hours to full-time, Deputy, and interim |
| Frameworks and sectors | NIST, ISO 27001, SOC 2, HIPAA, PCI, CMMC, FedRAMP, SOX; healthcare, higher education, government, financial services, manufacturing |
| Supporting capabilities | GRC, offensive security, threat intelligence, MDR, CyberFusion SOC; works with existing tools |
Its Frost & Sullivan award is for MDR, not the CISO service. Pricing and availability aren't published, so ask during scoping. Separate services like MDR are bought separately from the CISO role.
Fractional CISO
Fractional CISO provides a virtual CISO plus a cybersecurity analyst, described as a US-based team. That pairing separates executive advice from hands-on documentation and execution. Its scope covers program design and management, plus SOC 2 and ISO 27001 readiness.
It also lists ISO 42001, GovRAMP, HIPAA, CMMC, FedRAMP, and TX-RAMP. Its stated independence position is "no kickbacks, ever" on tool recommendations. That's a narrower claim than a blanket zero-conflict guarantee, so ask about it directly.
| Factor | Fractional CISO |
|---|---|
| Delivery team | Senior vCISO plus analyst |
| Frameworks | SOC 2, ISO 27001/42001, HIPAA, CMMC, FedRAMP |
| Best fit | Compliance-heavy SaaS and technology firms facing enterprise sales reviews |
Individual vCISO credentials aren't named on its service page, so request bios.
Point Solutions Security
Point Solutions Security, based in Denver, emphasizes leadership that supports internal IT teams or managed service providers instead of handing over a report. Its vCISO work includes strategic planning, policy and program development, risk and gap assessment, and audit readiness.
It lists SOC 2, HIPAA, ISO, and PCI, with sectors including defense and aerospace, SaaS, manufacturing, and local government. Its published success stories cite an unnamed US defense contractor and a municipal organization. A sector list isn't proof of named engagements, so ask for references.
| Factor | Point Solutions |
|---|---|
| Delivery approach | Leadership working alongside IT or MSP staff |
| Capabilities | Gap analysis, policy, audit readiness, planning |
| Best fit and limits | Teams needing hands-on leadership; clarify staffing depth and 24/7 response |
Assura, Inc.
Assura's Virtual ISO® includes a fractional CISO, with primary and backup Information Security Officers, documentation, monthly dashboards, and risk and remediation planning.
It lists a broad framework set: CJIS, CMMC, GDPR, HIPAA/HITECH, ISO 27001, NIST, PCI DSS, SOX, GLBA, FERPA, FFIEC, and SOC 2. Examples span education, government, and healthcare.
Its AuditArmor® guarantee is the standout. Assura promises its work will meet identified frameworks "unless waived by you," defends that work at no extra cost through the exit conference, and revises deliverables for free. The guarantee page doesn't state a dollar amount or deadline, so ask about exclusions and responsibility boundaries.
| Factor | Assura |
|---|---|
| Service model | Primary and backup officers; governance, risk, and documentation |
| Extensions | Broader compliance coverage; confirm which services are optional |
| Safeguards | AuditArmor® audit defense; clarify terms in writing |
CyberSecOp
CyberSecOp, based in New York and Stamford, offers a dedicated vCISO who integrates with the organization, manages and advises IT and security teams, briefs the board, and delivers monthly reports. It lists NIST, PCI DSS, ISO, GDPR, and NYDFS, and describes itself as a CMMC-AB RPO and ISO 27001 implementer.
It also provides audits, penetration testing, MDR, and incident response. Its service pages don't spell out interim or transition scope, so confirm start timelines. Its Gartner Peer Insights claim covers consulting reviews generally, not the vCISO service.
| Factor | CyberSecOp |
|---|---|
| Engagement | Dedicated vCISO with monthly reporting |
| Frameworks | NIST, PCI DSS, ISO, GDPR, NYDFS |
| Trade-offs | Verify interim availability and long-term continuity |
How We Chose the Best Fractional CISO Services
We applied the same criteria to every provider and relied on official service pages, case studies, and credible third parties. Don't pick a provider just because it appears on a "top" list, including this one.
Executive presence and accountability
- Does the CISO join leadership or board discussions?
- Do they translate technical risk into business decisions?
- Do they own a roadmap and deliver recurring risk reports?
- Can they support customer and regulator conversations?
Delivery depth and technical reach
- Does the CISO work alone or with analysts, GRC specialists, responders, or a SOC?
- Are 24/7 monitoring, penetration testing, and incident response included or priced separately?
Fit, independence, and transparency
- US industry and framework experience
- Tool neutrality and conflict-of-interest disclosure
- Onboarding, escalation, and contract flexibility
- Pricing structure and measurable first-phase outcomes
- Ability to hand off to a future internal CISO
NIST's 2023 virtual CSO draft points to board updates, supplier evaluation, and termination procedures. It's a draft, not a standard, but it's a useful checklist.
Conclusion
The best fractional CISO is the one that fits your risk profile, regulatory obligations, internal staffing, and appetite for hands-on help. Brand recognition matters less.
Before signing, confirm:
- Scope and decision rights
- Reporting cadence and incident responsibilities
- Framework experience and supporting resources
- Success measures
DeepSeas suits organizations that want expert-led CISO advisory alongside GRC, offensive security, threat intelligence, MDR, and SOC capabilities. Map your current gaps first, then decide which combination of services you actually need.
Frequently Asked Questions
How much does a Fractional CISO cost?
Pricing depends on time commitment, company size, risk complexity, frameworks, urgency, and implementation support. One provider guide cites roughly $20,000 to $350,000+ per year, about $120,000 for mid-market. That range is provider-authored, not a market average.
What does a Fractional CISO do?
They set security strategy, manage risk, oversee governance and compliance, report to executives, and prepare for incidents. They also manage vendors and coordinate with internal IT or security teams.
What is a CISO and what does a CISO do?
The Chief Information Security Officer is the executive accountable for an organization's security direction, risk decisions, governance, and resilience. They communicate risk to leadership and stakeholders.
What is the difference between a CIO and a CISO?
A CIO leads technology strategy and IT operations. A CISO focuses on security, cyber risk, and data protection. In smaller organizations, the roles can overlap.
Can AI replace a CISO?
No. AI helps with monitoring, analysis, documentation, and reporting. It can't own risk acceptance, stakeholder communication, accountability, or incident leadership.
Is CISO a high position?
Generally, yes. It's a senior leadership role, though title level and reporting lines vary. Only 9% of US CISOs report directly to the CEO, per Heidrick & Struggles.
