Outsourced CISO (vCISO): the CISO function filled, without creating the post

A vCISO (Virtual CISO) is an external Chief Information Security Officer who fills a company's CISO function on a mandate instead of as a full-time hire. At Cybervize the mandate is ongoing, covers two to six days a month and starts at €3,600/month, with the OdySecure platform included. The vCISO carries out the security work and keeps management informed on an ongoing basis. Duties and accountability stay with your company and its management.

Cybervize offers vCISO packages from €3,600/month (basic retainer with about 2 days per month) up to roughly €8,500/month (senior retainer with 5-6 days per month). Hourly rates for spot engagements run €200-350/hour. Published retainers for external CISO and ISO mandates in the DACH region range from under €1,000/month for narrow ISO packages to around €8,000/month for full vCISO mandates; typical day rates for senior security advisory sit at €1,600 to €2,500 (own survey of public price lists, August 2026). Our pricing is transparent. The full cost comparison is in the post Virtual CISO costs.

For an example scenario at roughly 200 employees the standard package at €4,900/month is usually the fit. It covers two C-level meetings per month, two brief alignment meetings per week, weekly reports via dashboard or email, building and maintaining a compliance catalogue, and access to the OdySecure security platform. Compared to a full-time CISO at €135,000 to €200,000 annual cost of employment, the vCISO retainer at €58,800/year is well under half the cost, without losing C-level cybersecurity leadership. Detailed calculation is in the pricing pillar post.

Smaller and mid-market companies have four lower-cost alternatives to a full-time CISO: (1) vCISO (Virtual CISO), external CISO on retainer, from €3,600/month; (2) Fractional CISO, partial CISO function, often 1-2 days per month; (3) Interim CISO, temporary full-time coverage during vacancies; (4) vCISO with its own ISMS platform, which is how Cybervize works: the OdySecure platform is part of the mandate and the evidence is built there. For most SMEs the vCISO model is the most cost-effective alternative: you get C-level cybersecurity leadership without the €135,000 to €200,000 annual cost of employment of a permanent CISO.

CISO (Chief Information Security Officer) is the strategic cybersecurity leadership role at C-level, traditionally as a permanent hire. vCISO (Virtual CISO) is the same role delivered as an external, flexible service on a retainer, typically remote, often cross-industry. ISO (Information Security Officer / Informationssicherheitsbeauftragter in German) is the operational role under BSI-IT-Grundschutz and ISO 27001, usually one level below the CISO and more focused on implementation than on strategy. Cybervize delivers both vCISO and ISO/ISB mandates depending on the scope you need.

The vCISO service is particularly suitable for medium-sized companies that need cybersecurity expertise at C-level but don't want to finance a full-time position. The service is also ideal for companies in growth phases or with temporary increased security needs.

Access to the OdySecure platform is part of the mandate, with no separate licence to pay. The platform supports your vCISO's work: it assists with risk assessments, keeps track of compliance requirements and proposes measures. Your vCISO uses it to steer the ISMS and the reporting to management.

Our vCISO service typically starts within the first week after contract signature. After a structured onboarding with baseline assessment, measures are prioritised and the platform is configured to your requirements.

We have experience in numerous industries, including financial services, healthcare, manufacturing, public sector, and technology companies. Our expertise covers industry-specific security requirements and compliance regulations.

A full-time CISO is a permanent position with an ongoing cost of employment of €135,000 to €200,000 per year. A vCISO (Virtual CISO) provides the same strategic cybersecurity leadership at C-level, but as a flexible, external service. You get an experienced CISO on demand who manages your security strategy without the fixed costs of a permanent hire. This makes it the cost-effective alternative, especially for mid-market companies.

An external CISO brings cross-industry experience from numerous companies and is immediately available without lengthy recruitment. As an external leader, they act independently and objectively in security assessments and audits. Especially during vacancies, while searching for a permanent CISO, or when facing urgent compliance requirements like NIS-2 or ISO 27001, an external CISO is the fastest solution.

Yes. The vCISO is not limited to mid-market. Corporates use the same mandate: we fill the CISO function on a permanent basis, with the OdySecure platform included. What changes is the scope: corporate modules of the platform (multi-entity rollout, auditor-accepted group reporting, multi-country) and a project-based daily rate instead of the €/month retainer. If you only need to bridge a short-term vacancy, Interim CISO is the right choice, not vCISO.

The vCISO is a permanent mandate: we fill your CISO function on an ongoing monthly basis, with the OdySecure platform included in the mandate. The Interim CISO is a short-term bridge across a specific vacancy or crisis (CISO departure, audit preparation, post-incident stabilisation), project-based, usually without the platform, no lock-in. Both lines are standalone: you can start with Interim CISO and switch to vCISO later, or book vCISO directly.