Cybersecurity consulting for mid-market companies

Pricing depends on the engagement model. Point-in-time assessments and NIS-2 gap analyses typically land in the mid to high four-figure range. Operational engagements like a vCISO from €3,600/month (basic retainer) up to €8,500/month (senior retainer) are the mid-market alternative to a full-time CISO (€135,000 to €200,000 a year fully loaded). Training is offered as fixed-price packages. Important: mid-market consulting should work with clear deliverables and fixed prices, not open T&M hour buckets.

For mid-market companies, a vCISO (Virtual CISO) is usually the more economical choice. A full-time CISO costs €135,000 to €200,000 a year fully loaded and is oversized for 1-2 days/week of actual demand. A vCISO brings several years of information security experience into a 2-6-day-per-month retainer, starts within a few days, and scales with demand. A full-time hire only becomes economical at much larger companies or under high regulatory load (financial services, critical infrastructure).

For a typical mid-market company with one to three sites, realistic timing is 8 to 12 weeks for audit-ready readiness: gap assessment (2 to 3 weeks), prioritised measure roadmap (1 to 2 weeks), quick-wins implementation and documentation (5 to 7 weeks). Prerequisite: management commitment and named contacts from IT, legal and business units. Holding structures with multiple subsidiaries need 16 to 20 weeks. The legally binding compliance statement remains a matter for counsel.

Where no one in-house is named to lead security, the vCISO mandate is the direct route: we fill the CISO function (2 to 6 days/month), carry out the implementation of NIS-2 and ISO 27001 and keep the evidence. The OdySecure platform is included in the mandate. If you have your own CISO, you license OdySecure on its own: an assessment for the baseline, compliance work and evidence on one data layer. Pure advisory mandates without an operational arm tend to leave mid-market clients with stacks of recommendations and no implementation partner, and therefore little measurable security improvement.

Recommended approach: (1) group-wide ISMS umbrella with a unified question catalogue, (2) site-specific assessments via a multi-site platform with a consolidated corporate report, (3) maturity-level differentiation instead of a one-size mandate; IT-heavy subsidiaries and production sites have requirements that differ in kind, (4) central governance with decentralised owner roles through a 4-role model (Admin / Owner / Reviewer / User), (5) board-level corporate report at the push of a button. This keeps compliance auditable without suffocating local sites.

Mid-market doesn't need a scaled-down enterprise template. Key differences: (1) fixed prices and clear deliverables instead of open T&M mandates, (2) operational involvement instead of pure PowerPoint advisory, (3) one person with C-level experience instead of a junior team with senior reviewer, (4) lean tools instead of enterprise GRC suites with six-figure license fees, (5) direct senior consultant access instead of escalation chains. Mid-market companies buy consulting for a concrete outcome, not for a methodology.

The mandatory baseline depends on industry and size: NIS-2 for essential and important entities from 50 employees, or with turnover and balance sheet each above €10m, across 18 sectors, DORA for financial services, TISAX/VDA ISA for automotive suppliers, IEC 62443 for OT-heavy industrial operations, BSI IT-Grundschutz as a pragmatic baseline, ISO 27001 as the internationally recognised ISMS standard. In practice, Cybervize recommends a multi-standard approach with a shared data layer: one answered control catalogue covers several standards in parallel.

Cybervize focuses particularly on manufacturing, financial services, critical infrastructure (KRITIS), telecommunications and mid-market holdings with multiple subsidiaries. The common pattern: high regulatory load (NIS-2, DORA, KRITIS regulation), specialised risk profile (OT/IT convergence, supply chain, M&A) and at the same time security teams too small for full coverage. An external mandate closes the gap between obligation and internal capacity, without expensive in-house headcount expansion.

We advise remotely and across sites, including companies with several locations. We come on site when a meeting calls for it.