Everyone sells vCISO services. Most companies buying one have no idea what they're actually getting.
The title sounds impressive. Virtual Chief Information Security Officer. But when I talk to founders who've hired a vCISO before and weren't happy, the complaint is always the same: "They showed up once a month, gave us a report we didn't read, and nothing changed."
That's not a vCISO. That's a consultant with a recurring invoice. There's nothing wrong with this, it's just not what a vCISO does.
Here's what a vCISO should actually be doing for your company, week to week.
Week to week operations
A good vCISO is embedded in your business. Not full-time, but consistently present. For most companies between 15 and 150 employees, that's 10 to 20 hours per week. Here's where those hours go.
Driving the compliance program. SOC 2, HIPAA, ISO 27001, HITRUST, whatever your customers require. The vCISO owns the roadmap, manages the GRC platform, coordinates with auditors, prepares evidence, and keeps the program moving between audits. Not once a year during audit season. Every week. Controls don't maintain themselves.
Answering security questionnaires. Enterprise customers send these constantly. A good vCISO has a response library built from your actual controls and can turn around a 200-question questionnaire in days, not weeks. They know how to answer specifically and defensibly because they built the controls being described.
Managing vendor risk. Reviewing vendor SOC 2 reports, maintaining BAAs and DPAs, keeping the vendor register current, and evaluating new vendors before they're onboarded. When a vendor has a security incident, the vCISO assesses the impact and coordinates the response.
Running access reviews. Quarterly reviews of who has access to what, across every system. Identifying orphaned accounts, over-privileged users, and access that no longer matches someone's role. Documenting the review for your auditor.
Coordinating incident response. When something goes wrong, the vCISO is the first call. They coordinate containment, work with forensics, manage the insurance carrier relationship, and handle customer and regulatory communication. Between incidents, they maintain the IR plan and run tabletop exercises.
Advising leadership. Translating technical risk into business language for the CEO, board, or investors. “Here's our risk posture, here's what we've done, here's what's next, here's what I need from you.” One page, once a quarter, clear enough for a non-technical board member to understand.
Managing security tools. Overseeing your EDR, MDM, SIEM or logging, email security, and cloud security configuration. Not necessarily configuring them directly (that might be your MSP or IT team), but ensuring they're tuned, monitored, and actually providing value.
Training and awareness. Running security awareness training, phishing simulations, and new-hire security onboarding. Keeping the team current on threats relevant to your industry.
Policy maintenance. Keeping your policies current, accurate, and aligned with how the company actually operates. Policies that were written for SOC 2 readiness 18 months ago and never updated don't pass audit scrutiny.
What a vCISO is NOT
A vCISO is not a penetration tester. They'll coordinate the pen test and manage remediation, but they're not the one running Burp Suite against your application.
A vCISO is not your IT helpdesk. They don't reset passwords, deploy laptops, or troubleshoot WiFi. That's your MSP or IT team.
A vCISO is not a project consultant who shows up, delivers a report, and disappears. They're an ongoing member of your leadership team who owns a critical function.
A vCISO is not a tool. Platforms like Drata, Vanta, and Rippling automate evidence collection and monitoring. They don't make decisions, advise leadership, coordinate auditors, or respond to incidents. The vCISO uses these tools. They don't replace the vCISO.
When you need one
The trigger is usually one of these: a customer asks a security question you can't answer, a deal stalls because you don't have SOC 2, you're entering healthcare and HIPAA is now relevant, your board or investors start asking about security, or you've had an incident and realized nobody owns the response.
For most companies, the right time is when you have 15 to 50 employees and security has become important enough to need dedicated attention but not enough to justify a $250,000 full-time hire.
What it costs
$3,000 to $8,000 per month depending on scope, complexity, and the number of frameworks you're managing. Compare that to a full-time CISO at $200,000 to $350,000 in total compensation.
The vCISO model gives you experienced security leadership at a fraction of the cost, and you get someone who's seen dozens of environments across multiple industries, not just yours. That breadth of experience is a feature, not a limitation.
How to evaluate a vCISO
What does their engagement cadence look like? If the answer is “monthly check-ins,” that's a consultant, not a vCISO. You want weekly involvement at minimum.
How many clients do they manage simultaneously? If it's 30, you're getting 2 hours a week. If it's 5 to 8, you're getting real attention.
What's their compliance experience? Can they manage SOC 2, HIPAA, HITRUST, and ISO 27001? Do they have auditor relationships? Have they actually been through the audit process, not just prepared for it?
How do they handle incidents? What's their response time? Who do they coordinate with? Have they managed a real incident before?
Can they provide references? Talk to a current client. Ask whether the vCISO is proactive or reactive. Whether they drive the program or wait to be asked. Whether they've made the client's life easier or just added another meeting to the calendar.
What we do
At Com-Sec, vCISO services are our core offering. We embed with your team, drive your security and compliance program, coordinate auditors and pen testers, answer your customer questionnaires, manage your vendor risk, and serve as your security leadership. We're not a monthly check-in. We're your security team.
For healthcare and health tech companies, we bring deep experience across HIPAA, HITRUST (e1, i1, and r2), SOC 2, and ISO 27001. We've managed compliance programs for companies from pre-revenue through acquisition.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies, with deep expertise in healthcare and health tech.