Provider comparison

vCISO providers compared 2026 (DACH)

Nine providers, eight criteria, every statement with its source. We offer a vCISO mandate ourselves, so we are in the first row. We only compare what each provider publishes on its own website.

Schedule vCISO Consultation Now

All information on other providers retrieved on 2 November 2026 from their own websites.

How we compared

Only the providers’ own statements

Every statement comes from the provider’s own website, retrieved on 2 November 2026. We do not use press coverage, review portals or estimates. The number in each cell leads to the source.

“Not published”

If a criterion is not on the provider’s website, we write “not published”. That says nothing about whether the provider offers it on request.

Same service, different names

vCISO, external CISO and CISO-as-a-Service name the same service. An external information security officer is a different role. Where a provider only offers that role, the row says so.

Report an error

If a statement has changed or we have rendered it incorrectly, we will correct it. Write to us using the contact form.

Go to the contact form

Nine providers at a glance

The superscript numbers lead to the sources below the table. Monthly prices as stated by the provider.

Provider	Service	Price published	Starting price per month	Scope	Platform in the mandate	Data storage and AI	Typical start	Named profiles public	NIS2, DORA, ISO 27001
Cybervizeour service	vCISO mandate¹	yes¹	€3,600 plus VAT, three packages¹	around 2 to 6 days a month, by package¹	yes, OdySecure is included in the mandate¹	hosting in Germany with OVHcloud; language model self-operated in Germany in the default mode²	usually within 14 days of the order¹	yes, seven profiles, three of them named, with certifications and track record³	NIS2, DORA and ISO 27001 named as services¹
ADVISORI	vCISO⁴	no, prices on request⁴	not published⁴	three packages by company size, no days or hours stated⁴	yes, Synthara platform in all packages⁴	AI platform Synthara named; location not published⁴	2 to 4 weeks; Starter package “ready immediately”⁴	one named contact with role and certifications⁴	NIS2, DORA and ISO 27001 named as services⁴
UBESAFE	External CISO in three tiers: support, mandate, interim⁵	yes⁵	€1,950 net (support), €3,900 net (mandate)⁵	around 1 day (support) and around 2 days (mandate) a month⁵	not published⁵	not published⁵	not published⁵	the managing director named as CISO⁵	NIS2 and ISO 27001 named; DORA not named⁵
Ingenieurgesellschaft ISM	External CISO (vCISO); a separate external information security officer service⁶	no (for the vCISO)⁶	not published⁶	1 to 4 days a month, on site or remote⁶	not published⁶	not published⁶	not published⁶	managing director named with degree; certifications not tied to a person⁷	NIS2 and ISO 27001 named as drivers; DORA named in the zero-trust section⁶
intersoft consulting	External CISO⁸	no⁸	not published⁸	from a few hours a month to full time⁸	training software Guardileo-Trainer named; ISMS platform not published⁸	not published⁸	not published⁸	team qualifications named, including ISO 27001 Lead Auditor⁸	ISO 27001 named as a service; DORA as a qualification; NIS2 as a separate consulting service in the menu⁸
Kertos	External information security officer on the Kertos platform (English page: “external CISO”); named person in the Premium package^{9, 10, 11}	no⁹	not published⁹	three packages (Essential, Pro, Premium), no hours stated¹¹	prerequisite: ISMS in the Kertos platform; whether the licence is part of the mandate is not published⁹	AI assistant KAIA; AWS hosting in Europe¹²	not published⁹	proof of qualifications on request⁹	ISO 27001 named as a service; NIS2 as a driver; DORA not named⁹
Deutsche Telekom mit Cynomi	vCISO service of Telekom B2B Europe on the Cynomi platform; according to the announcement first at Hrvatski Telekom, OTE, Slovak Telekom and T-Mobile Polska¹³	no¹³	not published¹³	not published¹³	service based on the Cynomi platform; whether the licence is part of the mandate is not published¹³	AI platform named; location not published^{13, 14}	not published¹³	not published¹³	NIS2 named; DORA in a manager’s quote; ISO 27001 not named in the announcement¹³
Cortina Consult	External information security officer (ISB)¹⁵	yes¹⁵	€275 (net or gross not stated), external information security officer¹⁵	around 1 hour (basic) to around 4 hours (active support) a month¹⁶	yes, ISMS software in the package¹⁵	software in German data centres; use of AI not published¹⁷	48 hours¹⁶	CEO named with qualifications¹⁶	ISO 27001 as a framework; NIS2 in the template library; DORA only in the “Frameworks” menu¹⁶
frag.hugo	External CISO in three packages (Hamburg page)¹⁸	yes^{18, 19}	€990 (Starter package); pricing page: €1,490 retainer “external CISO/DPO”^{18, 19}	4, 8 or 16 hours a month¹⁸	not published¹⁸	not published¹⁸	“Ready immediately” (general comparison table on the page)¹⁸	two named contacts; over 25 years of experience stated¹⁸	NIS2, DORA and ISO 27001 named as services¹⁸

Cybervizeour service

vCISO mandate¹

Price published: yes¹
Starting price per month: €3,600 plus VAT, three packages¹
Scope: around 2 to 6 days a month, by package¹
Platform in the mandate: yes, OdySecure is included in the mandate¹
Data storage and AI: hosting in Germany with OVHcloud; language model self-operated in Germany in the default mode²
Typical start: usually within 14 days of the order¹
Named profiles public: yes, seven profiles, three of them named, with certifications and track record³
NIS2, DORA, ISO 27001: NIS2, DORA and ISO 27001 named as services¹

ADVISORI

vCISO⁴

Price published: no, prices on request⁴
Starting price per month: not published⁴
Scope: three packages by company size, no days or hours stated⁴
Platform in the mandate: yes, Synthara platform in all packages⁴
Data storage and AI: AI platform Synthara named; location not published⁴
Typical start: 2 to 4 weeks; Starter package “ready immediately”⁴
Named profiles public: one named contact with role and certifications⁴
NIS2, DORA, ISO 27001: NIS2, DORA and ISO 27001 named as services⁴

UBESAFE

External CISO in three tiers: support, mandate, interim⁵

Price published: yes⁵
Starting price per month: €1,950 net (support), €3,900 net (mandate)⁵
Scope: around 1 day (support) and around 2 days (mandate) a month⁵
Platform in the mandate: not published⁵
Data storage and AI: not published⁵
Typical start: not published⁵
Named profiles public: the managing director named as CISO⁵
NIS2, DORA, ISO 27001: NIS2 and ISO 27001 named; DORA not named⁵

Ingenieurgesellschaft ISM

External CISO (vCISO); a separate external information security officer service⁶

Price published: no (for the vCISO)⁶
Starting price per month: not published⁶
Scope: 1 to 4 days a month, on site or remote⁶
Platform in the mandate: not published⁶
Data storage and AI: not published⁶
Typical start: not published⁶
Named profiles public: managing director named with degree; certifications not tied to a person⁷
NIS2, DORA, ISO 27001: NIS2 and ISO 27001 named as drivers; DORA named in the zero-trust section⁶

intersoft consulting

External CISO⁸

Price published: no⁸
Starting price per month: not published⁸
Scope: from a few hours a month to full time⁸
Platform in the mandate: training software Guardileo-Trainer named; ISMS platform not published⁸
Data storage and AI: not published⁸
Typical start: not published⁸
Named profiles public: team qualifications named, including ISO 27001 Lead Auditor⁸
NIS2, DORA, ISO 27001: ISO 27001 named as a service; DORA as a qualification; NIS2 as a separate consulting service in the menu⁸

Kertos

External information security officer on the Kertos platform (English page: “external CISO”); named person in the Premium package^{9, 10, 11}

Price published: no⁹
Starting price per month: not published⁹
Scope: three packages (Essential, Pro, Premium), no hours stated¹¹
Platform in the mandate: prerequisite: ISMS in the Kertos platform; whether the licence is part of the mandate is not published⁹
Data storage and AI: AI assistant KAIA; AWS hosting in Europe¹²
Typical start: not published⁹
Named profiles public: proof of qualifications on request⁹
NIS2, DORA, ISO 27001: ISO 27001 named as a service; NIS2 as a driver; DORA not named⁹

Deutsche Telekom mit Cynomi

vCISO service of Telekom B2B Europe on the Cynomi platform; according to the announcement first at Hrvatski Telekom, OTE, Slovak Telekom and T-Mobile Polska¹³

Price published: no¹³
Starting price per month: not published¹³
Scope: not published¹³
Platform in the mandate: service based on the Cynomi platform; whether the licence is part of the mandate is not published¹³
Data storage and AI: AI platform named; location not published^{13, 14}
Typical start: not published¹³
Named profiles public: not published¹³
NIS2, DORA, ISO 27001: NIS2 named; DORA in a manager’s quote; ISO 27001 not named in the announcement¹³

Cortina Consult

External information security officer (ISB)¹⁵

Price published: yes¹⁵
Starting price per month: €275 (net or gross not stated), external information security officer¹⁵
Scope: around 1 hour (basic) to around 4 hours (active support) a month¹⁶
Platform in the mandate: yes, ISMS software in the package¹⁵
Data storage and AI: software in German data centres; use of AI not published¹⁷
Typical start: 48 hours¹⁶
Named profiles public: CEO named with qualifications¹⁶
NIS2, DORA, ISO 27001: ISO 27001 as a framework; NIS2 in the template library; DORA only in the “Frameworks” menu¹⁶

frag.hugo

External CISO in three packages (Hamburg page)¹⁸

Price published: yes^{18, 19}
Starting price per month: €990 (Starter package); pricing page: €1,490 retainer “external CISO/DPO”^{18, 19}
Scope: 4, 8 or 16 hours a month¹⁸
Platform in the mandate: not published¹⁸
Data storage and AI: not published¹⁸
Typical start: “Ready immediately” (general comparison table on the page)¹⁸
Named profiles public: two named contacts; over 25 years of experience stated¹⁸
NIS2, DORA, ISO 27001: NIS2, DORA and ISO 27001 named as services¹⁸

Sources

All pages retrieved on 2 November 2026.

1Cybervize, vCISO mandate, retrieved on 2 November 2026
2Cybervize, Trust Center, retrieved on 2 November 2026
3Cybervize, vCISO profiles, retrieved on 2 November 2026
4ADVISORI, vCISO, retrieved on 2 November 2026
5UBESAFE, external CISO, retrieved on 2 November 2026
6Ingenieurgesellschaft ISM, vCISO, retrieved on 2 November 2026
7Ingenieurgesellschaft ISM, about us, retrieved on 2 November 2026
8intersoft consulting, external CISO, retrieved on 2 November 2026
9Kertos, external information security officer (German page), retrieved on 2 November 2026
10Kertos, external CISO (English page), retrieved on 2 November 2026
11Kertos, managed compliance, retrieved on 2 November 2026
12Kertos, AI agent KAIA, retrieved on 2 November 2026
13Telekom B2B Europe, announcement of 7 September 2025, retrieved on 2 November 2026
14Cynomi, security, retrieved on 2 November 2026
15Cortina Consult, external information security officer, retrieved on 2 November 2026
16Cortina Consult, external information security officer pricing, retrieved on 2 November 2026
17Cortina Consult, software, retrieved on 2 November 2026
18frag.hugo, external CISO (Hamburg page), retrieved on 2 November 2026
19frag.hugo, pricing, retrieved on 2 November 2026

What you get with us

No other provider in the table publishes all eight criteria. We publish them all:

Price and scope up front

From €3,600 a month for around two days, three packages up to around six days. You know what the mandate costs before the first conversation.

Platform in the mandate

OdySecure is included in the price. Risks, measures and evidence sit in one system from day one, without a second licence.

Operated in Germany

The platform runs in data centres in Germany, and in the default mode the language model is self-operated in Germany. This is published in our Trust Center.

You can see who comes

Seven vCISO profiles with certifications, industries and track record, three of them named. Your vCISO usually starts within 14 days of the order.

Our vCISO profiles

Is the vCISO mandate right for you?

In the first conversation we clarify your obligations, the scope and the start. You can read the price and the profiles on our website beforehand.

Schedule vCISO Consultation Now

Frequently asked questions about the comparison

How do I compare vCISO providers?

Ask every provider the same questions: what does the mandate cost per month, and how many days does it include? Is a platform for risks and evidence included, or is it a separate licence? Where is your data stored, and where does any AI run? Who exactly will be assigned, with which certifications? How quickly does the vCISO start? And does the service cover the frameworks that apply to you, such as NIS2, DORA or ISO 27001? The table above answers these questions for nine providers, as far as they are public.

What is the difference between a vCISO and an external information security officer?

The vCISO fills the leadership function for information security: they steer the security programme, report to management and lead the implementation. An external information security officer usually covers the officer role with fewer hours. In both cases, duties and accountability remain with management.

Why is Cybervize itself in the table?

Because we offer a vCISO mandate and are a competitor ourselves. That is why we only compare statements each provider publishes on its website, and link every source. You can check every cell.

How current is the information?

We retrieved all information on other providers from their websites on 2 November 2026. Providers change prices and services, so the linked provider page always prevails. We review the information regularly.