Virtual CISO (vCISO)

Virtual CISO for SMBs: a part-time head of security.

Customers, insurers and new EU rules all ask who is responsible for cyber risk in your company. We take on that role part-time, so you have a clear answer. Up and running in one to two weeks.

book a free 25-minute consultation

Is this for you?

You will recognise at least one of these.

A customer sent you a security questionnaireAnd nobody in the company can answer it with confidence.
Your insurer asks new questions at renewalMulti-factor authentication, backups, an incident plan: they want proof.
A tender or a customer asks for ISO 27001And you need someone to lead the work up to the audit.
NIS2 may apply to you or to your customersAnd you need a clear answer, then a plan.
You have had a security incidentOr a near miss, and you want to be better prepared next time.

What is at stake

Someone has to own cyber risk. Today, it is probably you.

Auditors, insurers and large customers all ask the same question: who is responsible for security here? Without a clear answer, deals slow down and renewals get harder.

Hiring a full-time head of security is rarely realistic. In France and Germany the role pays €75,000–€120,000 a year in base salary, and €145,000–€230,000 in Dublin (Robert Half Salary Guides, 2026–27). A virtual CISO gives you the same senior leadership, part-time, at a size that fits your budget.

What you get

What changes for your business.

Clear answers for customers and insurers

We answer security questionnaires and due-diligence requests with you, so sales and renewals keep moving.

A plan you can afford

A 12-month plan that ranks risks by business impact and fits your budget, reviewed every quarter.

Rules people actually follow

Short policies your staff will read, from passwords to supplier checks, kept up to date as rules change.

Ready if something goes wrong

An incident plan your team has practised, and someone to lead the response and prepare the notifications you file.

Audits without the scramble

Evidence kept up to date all year, so certification, customer and internal audits hold no surprises.

Plain reports for management

A regular briefing on where you stand and what needs a decision, in plain language.

Who does what

We lead security. Your IT provider keeps running your systems.

What we lead

Set the priorities and the 12-month plan
Answer customer and insurer questionnaires with you
Write the policies and check they are followed
Oversee the rollout of security controls, sized to your business
Lead the response if an incident happens
Report to management and prepare audits

What stays with your IT provider

Install and configure the security tools
Apply updates and run the backups
Monitor your systems day to day

We review their work against the plan. You get one person accountable for security, not another IT vendor.

How it starts

From first call to a working plan in about a month.

01
Free call
25 minutes · no commitment
We talk about your business, what customers and insurers ask you, and what worries you. We tell you honestly if a virtual CISO is not the right fit.
02
Where you stand
Weeks 1–2
We review your current security and list the risks that matter most for your business.
03
Your plan
Weeks 2–4
A 12-month plan with priorities, owners and costs, agreed with management.
04
Ongoing leadership
Every month
We keep the plan moving: reviews, questionnaires, incident drills, audits and reports to management.

How it starts

Senior security leadership, without the full-time salary.

A fixed monthly fee and a 12-month commitment, never hourly. Larger programmes, where we lead your full security management system, add a one-time onboarding fee. You get the exact figure in the proposal after the call.

From: €1,200a month, excl. VAT
Duration: Active in 1–2 weeks
Your time: About 1 hour a week

Fixed quote after the free call.

book a free 25-minute consultation

For your IT manager, DPO or CFO

Eleven things the monthly fee covers.

Programme plans cover all eleven. The entry plan, from €1,200 a month, covers the essentials in advisory form: quarterly reviews, priority risks, core policies, an incident response plan, oversight of your security controls, a watch on the rules and an annual management briefing.

Security programme. We lead a security management system aligned with ISO 27001, sized for your business.
Risk management. A risk register and a treatment plan, reviewed every quarter.
Incident response. A plan, practised in tabletop exercises, and someone to lead the response and coordinate notifications to regulators, affected people and clients.
Compliance oversight. One view across GDPR, NIS2, DORA, ISO 27001 and PCI DSS, each obligation linked to a measure. Customer questionnaires answered with you.
Management reporting. Quarterly reviews and briefings that turn technical status into business decisions.
Internal audits. Planned and run in-house, plus preparation for certification audits where you need them.
Policies. Written, reviewed and kept current, then shared with and acknowledged by your staff.
Training and awareness. Yearly staff training, phishing simulations and awareness campaigns.
Security controls. We oversee the rollout of the measures your IT provider puts in place: right-sized, not over-engineered.
Monitoring. We check that the measures work, with a few clear indicators.
Continual improvement. Gaps and incidents turned into corrective actions, quarter after quarter.

The rules and standards one engagement covers.

EU LAW

NIS2

EU cybersecurity law for mid-sized and larger companies in 18 sectors, and for their suppliers through contracts.

EU LAW · FINANCE

DORA

IT resilience rules for banks, insurers and other financial entities, and for the IT suppliers they rely on.

EU LAW

EU GDPR

Personal data protection: breach response, impact assessments and coordination with your DPO.

CERTIFICATION

ISO 27001

The security certification customers ask for. Led by a PECB-certified ISO 27001 Lead Auditor.

PRIVACY · CERTIFICATION

ISO 27701

Certifiable privacy management. Since the 2025 edition it stands on its own; ISO 27001 is no longer a prerequisite.

PAYMENTS

PCI DSS

Card-payment security: scope, self-assessment guidance and oversight of the fixes.

Same accountability. Different cost structure.

Factor	Cyber-Management vCISO	Full-time CISO
Annual cost	From €14,400 a year (€1,200 a month, excl. VAT); scope sized to your needs	€75,000–€120,000 base salary in France and Germany, €145,000–€230,000 in Dublin (Robert Half, 2026–27), before benefits and recruitment
Time to start	1–2 weeks from the first call	3–6 months to recruit, onboard and ramp up
Breadth of expertise	One senior consultant working across frameworks and sectors, bringing in specialists (for example penetration testers) for specific tasks	Limited to the person hired
Flexibility	More time during an audit or an incident, less at steady state	Fixed headcount, difficult and costly to adjust
Continuity	Everything documented in your own tools and transferable: no knowledge locked in one person's head	A departure leaves an immediate leadership gap
Best suited for	Companies of 10–500 staff under EU rules or customer pressure	Large companies with full-time security teams

FAQ

What owners and IT managers ask us.

How is a vCISO different from a security consultant?

A consultant delivers a project, then steps back. A vCISO runs your security programme over time (priorities, risk, reporting and compliance) and reports to you. Accountability stays with your management. A vCISO often brings in consultants for specific work, such as penetration tests, and makes sure their findings are acted on.

How much of our time does it take?

Typically about an hour a week for your contact person: a short regular meeting, answers to our questions and decisions. More during an audit or an incident.

Do you replace our IT team or provider?

No. We set the priorities, write the rules, check the work and report to management. Your IT team or provider keeps installing, configuring and running your systems. We make sure their technical work adds up to the plan.

Can a vCISO take us through ISO 27001 certification?

Yes, it is one of the most common outcomes. Your consultant holds the PECB ISO/IEC 27001 Lead Auditor certification. We design your management system, run the internal audit, prepare you for the certification audit and stay through the surveillance audits that follow.

What happens if we have an incident?

Your vCISO coordinates the response with your IT team or provider: decisions, the notifications you file, customer communication and recovery, with specialist forensic support where needed. Deadlines are short: 72 hours for a GDPR personal data breach, and under NIS2 a first alert within 24 hours where the law applies.

How is the engagement priced?

A fixed monthly fee with a 12-month commitment, never hourly. It starts at €1,200 a month excl. VAT for smaller companies. Larger programmes, where we lead your full security management system, add a one-time onboarding fee. You get the exact figures in the proposal after the free call, before you commit.

Can we hire a full-time CISO later?

Yes, and we plan for it. We can help define the role, write the job description and brief candidates. Everything the vCISO built (policies, processes, risk register) is documented in your tools and transfers cleanly.

Where do you work?

Across the EU, in English or French: France (mainland and overseas regions), Belgium, Luxembourg, Switzerland and the wider European market. Remote by default, on-site when it helps. Most clients are in regulated sectors or handle a lot of personal or commercial data.