The service
Security advisory and vCISO
A named security lead for the board, and tenant reviews setting by setting.
Microsoft 365 and Azure security review
Compare
vCISO vs CISO: where the line sits
Past a certain scale and regulatory weight, hire a full-time CISO; below that line, a fractional security lead gives senior coverage without an executive salary.
Option A
vCISO
Option B
Full-time CISO
Defensive and advisory
Overview
Every business past a certain size needs someone accountable for security. The question is whether that someone is an executive on your payroll or a senior practitioner on a retainer. Black Shard sells the vCISO side; where the answer is to hire, we say so.
When to hire a full-time CISO
Past a certain headcount, regulatory weight and operational tempo, a full-time CISO is the right call and no retainer substitutes for one. Below that line, which is where most Australian small and mid-market businesses sit, a fractional lead delivers the senior work that matters: strategy, policy, a live risk register, board reporting, incident readiness. None of it requires paying an executive package for a role that fills a fraction of the week.
Side by side.
| Dimension | vCISO | Full-time CISO |
|---|---|---|
| Cost basis | An ongoing monthly retainer sized to you, or a one-off assessment to start. You pay for senior attention in the volume you need. | A full executive package: salary, superannuation, incentives, and the search cost to land the person. The cost runs at the same rate whether the quarter was quiet or on fire. |
| Seniority you can afford | The retainer buys senior time in slices. The lead comes from a firm that builds, operates and secures production software for its clients. | At a true executive package, you get what the title claims: someone who has carried security through incidents, audits and board cycles. Stretch a mid-level budget over the same title and you get someone who has not carried security through any of those. |
| Continuity and coverage | A named lead with a firm behind them. Leave, illness and resignation do not empty the seat. Nobody is on your floor every day. | Full-time presence and deep single-person context. The flipside: when that person resigns, the security function walks out the door with their notice period, and the rebuild starts from their head, because there is no document to start from. |
| Board accountability | Reporting the board can act on, delivered on a regular cadence, and a security voice in the room when the board needs one. Accountability for cyber risk stays with your directors in either model. | An executive who owns security on the org chart and answers for it in person. Where a regulator expects a named accountable owner, this is often the deciding fact. |
| Incident leadership | An incident response playbook your team can run, a tabletop exercise to pressure-test it, and senior direction during an incident. The first hour is still executed by your people, from a plan they have rehearsed. | A leader in the building for the whole incident lifecycle, who has drilled with the exact people who will respond. If incidents are frequent or existential to the business, this is what the salary buys. |
| Hiring timeline | No executive search required: scope the engagement, agree the cadence, start. If the seat is urgent because someone just resigned, it can hold the line while you run the executive search properly. | An executive search, then a notice period, then onboarding before the first strategy decision lands. Plan for the leadership gap in between. |
Cost basis
vCISO
An ongoing monthly retainer sized to you, or a one-off assessment to start. You pay for senior attention in the volume you need.
Full-time CISO
A full executive package: salary, superannuation, incentives, and the search cost to land the person. The cost runs at the same rate whether the quarter was quiet or on fire.
Seniority you can afford
vCISO
The retainer buys senior time in slices. The lead comes from a firm that builds, operates and secures production software for its clients.
Full-time CISO
At a true executive package, you get what the title claims: someone who has carried security through incidents, audits and board cycles. Stretch a mid-level budget over the same title and you get someone who has not carried security through any of those.
Continuity and coverage
vCISO
A named lead with a firm behind them. Leave, illness and resignation do not empty the seat. Nobody is on your floor every day.
Full-time CISO
Full-time presence and deep single-person context. The flipside: when that person resigns, the security function walks out the door with their notice period, and the rebuild starts from their head, because there is no document to start from.
Board accountability
vCISO
Reporting the board can act on, delivered on a regular cadence, and a security voice in the room when the board needs one. Accountability for cyber risk stays with your directors in either model.
Full-time CISO
An executive who owns security on the org chart and answers for it in person. Where a regulator expects a named accountable owner, this is often the deciding fact.
Incident leadership
vCISO
An incident response playbook your team can run, a tabletop exercise to pressure-test it, and senior direction during an incident. The first hour is still executed by your people, from a plan they have rehearsed.
Full-time CISO
A leader in the building for the whole incident lifecycle, who has drilled with the exact people who will respond. If incidents are frequent or existential to the business, this is what the salary buys.
Hiring timeline
vCISO
No executive search required: scope the engagement, agree the cadence, start. If the seat is urgent because someone just resigned, it can hold the line while you run the executive search properly.
Full-time CISO
An executive search, then a notice period, then onboarding before the first strategy decision lands. Plan for the leadership gap in between.
When each is right.
vCISO
When a vCISO is the right call
- The security workload does not fill a week: policies, a risk register, vendor questionnaires, board reporting, an uplift program.
- There is no security hire yet, and a director or the head of engineering owns the problem on the side.
- You are working toward Essential Eight, SMB1001, ISO 27001 or Privacy Act readiness and need someone senior to run it.
- The board wants security reporting on a regular cadence.
- You are between security leaders and need the seat held, and the function documented, while the executive search runs.
- Clients and procurement teams are asking security questions the business cannot yet answer well.
Full-time CISO
When to hire the full-time CISO
- You operate under a heavy compliance regime that expects a named, accountable security executive.
- There is a security team to manage: analysts, engineers, an operations function of your own.
- The operational tempo is round-the-clock: your own monitoring, on-call rotations, and incidents as routine.
- Security is core to the product and the market position, and buyers audit you as a condition of doing business.
- The organisation is large enough that security decisions get made daily, in rooms a fractional lead is not in.
When to hire the full-time CISO, in full
There is a security team to manage: analysts, engineers, an operations function of your own. People management is a full-time job before any strategy gets done.
In depth
The detail behind the decision.
The signals that settle it
The signals that you have crossed into full-time territory are specific. Security headcount that needs a manager. A regulator that expects a named accountable executive. Incidents as a routine operational fact. Buyers who audit your security as a condition of the contract.
Above and below the line
Any two of those together and the answer is headcount: hire the CISO, pay the executive package, and give them the authority the title implies.
Below that line the security work looks different. It is episodic and strategic: a policy set that needs writing and then maintaining, a risk register that needs to stay current, an uplift program toward a framework, board reporting on a regular cadence, procurement questionnaires that keep arriving. That is senior work, and it deserves a senior head, for a fraction of a working week.
The mistake in the middle
The most common failure is the compromise between the two options: the budget will not stretch to a security executive, so the business hires someone cheaper and gives them the CISO title anyway.
A security engineer under a fractional lead
The result is a title without the experience the role assumes, a single person with no bench behind them, and a board that now believes the risk is owned when it is not. That hire costs more than either option.
If the daily workload exists but the executive budget does not, the better structure is usually inverted: a security engineer or analyst in-house doing the volume work, with a fractional lead above them setting direction, reviewing the output, and fronting the board. Senior judgement on a cadence, sitting over in-house capacity for the daily work, covers more than a mid-level generalist with an executive title.
How we run the fractional seat
Black Shard's vCISO service is a named security lead on a regular cadence.
The firm builds and operates production software under the obligations its clients carry. Our own certification: SMB1001:2026 Gold, issued by CyberCert. Every engagement runs least-privilege, with only the access the work requires.
Deliverables
The deliverables: a security strategy the business follows, policies and a risk register kept current between board meetings, and reporting a board can act on. An engagement can open with a posture assessment, so the first conversation starts from the current position.
The engagement shape is an ongoing monthly retainer, or a one-off assessment to start if you want to see the quality of the thinking before committing to a cadence. Delivered across Australia, remotely as standard and on site where the scope needs it.
Questions, answered.
What is the difference between a vCISO and a CISO?
A CISO is a full-time executive on the payroll who owns security on the org chart. A vCISO is a senior practitioner on a retainer who owns the same program for an agreed share of their time. The work overlaps: strategy, policy, the risk register, board reporting and incident readiness. The differences are cost basis, daily presence and continuity.
What does a vCISO do?
A named security lead who owns your security program: strategy, policies and a current risk register, board reporting, incident readiness with a response playbook and a tabletop exercise, and compliance programs toward Essential Eight, SMB1001, ISO 27001 or Privacy Act readiness. An engagement can start with a posture assessment against the Essential Eight and CIS Controls.
How much does a vCISO cost?
We do not publish figures. The number follows the scope of the work and the cadence the board wants. A one-off assessment is the cheapest way to find out, and it stands on its own whether or not a retainer follows.
Can a vCISO run our incident response?
A vCISO makes your team ready to run it, and provides senior direction during an incident. A retainer is not a round-the-clock monitoring service. The workable model is a playbook your people can execute in the first hour, a tabletop that proves they can, and a senior head engaged for the decisions that follow.
Is a vCISO enough to get us to ISO 27001 or Essential Eight readiness?
Yes. A fractional lead can own the whole readiness program: the gap analysis, the remediation plan, and the evidence trail an assessor expects. We run the same program on our own estate: Essential Eight Maturity Level 3, assessed September 2026.
Can we start with a vCISO and hire a full-time CISO later?
It is one of the most sensible paths available. The fractional lead builds the function, then helps you scope the executive role and hands the incoming CISO a working risk register and policy set instead of a blank page. A new CISO who inherits a documented function is productive in their first month.
