Virtual CISO (vCISO)

Cybervize offers vCISO packages from €3,600/month (basic retainer with about 2 days per month) up to roughly €8,500/month (senior retainer with 5-6 days per month). Hourly rates for spot engagements run €200-350/hour. For context: published retainers for external CISO and ISO mandates in the DACH region range from under €1,000/month for narrow ISO packages to around €8,000/month for full vCISO mandates; typical day rates for senior security advisory sit at €1,600 to €2,500 (own survey of public price lists, August 2026). Our pricing is transparent. The full cost comparison is in the post Virtual CISO costs.

For an example scenario at roughly 200 employees the standard package at €4,900/month is usually the fit. It covers the CISO time, access to the OdySecure security platform with ISMS, assessment, BCM and TPRM, a monthly steering call with management, a quarterly risk report and incident-response readiness. Compared to a full-time CISO at €135,000 to €200,000 annual cost of employment, the vCISO retainer at €58,800/year is well under half the cost, without losing C-level cybersecurity leadership. Detailed calculation is in the pricing pillar post.

Smaller and mid-market companies have four lower-cost alternatives to a full-time CISO: (1) vCISO (Virtual CISO), external CISO on retainer, from €3,600/month; (2) Fractional CISO, partial CISO function, often 1-2 days per month; (3) Interim CISO, temporary full-time coverage during vacancies; (4) CISO-as-a-service platform like Cybervize, which combines human advisory with ISMS tooling. For most SMEs the vCISO model is the most cost-effective alternative: you get C-level cybersecurity leadership without the €150,000+/year fixed cost of a permanent CISO.

CISO (Chief Information Security Officer) is the strategic cybersecurity leadership role at C-level, traditionally as a permanent hire. vCISO (Virtual CISO) is the same role delivered as an external, flexible service on a retainer, typically remote, often cross-industry. ISO (Information Security Officer / Informationssicherheitsbeauftragter in German) is the operational role under BSI-IT-Grundschutz and ISO 27001, usually one level below the CISO and more focused on implementation than on strategy. Cybervize delivers both vCISO and ISO/ISB mandates depending on the depth of responsibility you need.

The vCISO service is particularly suitable for medium-sized companies that need cybersecurity expertise at C-level but don't want to finance a full-time position. The service is also ideal for companies in growth phases or with temporary increased security needs.

The AI platform complements human expertise by performing automated risk assessments, monitoring compliance requirements, and generating action proposals. It serves as a central dashboard for all security aspects of your company.

Our vCISO service typically starts within the first week after contract signature. After a structured onboarding with baseline assessment, measures are prioritised and the platform is configured to your requirements.

We have experience in numerous industries, including financial services, healthcare, manufacturing, public sector, and technology companies. Our expertise covers industry-specific security requirements and compliance regulations.

A full-time CISO is a permanent position with annual salaries starting at 150,000 EUR plus overhead. A vCISO (Virtual CISO) provides the same strategic cybersecurity leadership at C-level, but as a flexible, external service. You get an experienced CISO on demand who manages your security strategy without the fixed costs of a permanent hire. This makes it the cost-effective alternative, especially for mid-market companies.

An external CISO brings cross-industry experience from numerous companies and is immediately available without lengthy recruitment. As an external leader, they act independently and objectively in security assessments and audits. Especially during vacancies, while searching for a permanent CISO, or when facing urgent compliance requirements like NIS-2 or ISO 27001, an external CISO is the fastest solution.

Yes. The vCISO is not limited to mid-market. Corporates use the same path: permanent CISO function on OdySecure, senior CISO retainer bookable as an add-on. What changes is the level of expansion: corporate modules of the platform (multi-entity rollout, auditor-accepted group reporting, multi-country) and a project-based daily rate instead of the €/month retainer. If you only need to bridge a short-term vacancy, Interim CISO is the right line, not vCISO.

The vCISO is a permanent staffing of the security function on the platform, senior CISO retainer bookable as an add-on: ongoing, on a monthly cadence, integrated for the long term. The Interim CISO is a short-term bridge across a specific vacancy or crisis (CISO departure, audit preparation, post-incident stabilisation), project-based, usually without the platform, no lock-in. Both lines are standalone: you can start with Interim CISO and switch to vCISO later, or book vCISO directly.