Internal CISO vs vCISO: when each one fits and how to combine them without overpaying

A vCISO (virtual CISO) is a senior professional who takes on CISO duties in an organisation that does not need or cannot afford a full-time internal CISO. They work part-time (typically 2-8 days per month), bring experience equivalent to a CISO with 10-20 years of track record, and maintain continuity with the board, security operations and regulators. They are not a consultant who comes and goes: they are a permanent figure with partial presence.

An internal CISO with relevant experience for a regulated sector starts at €90-140k gross salary in Spain, before variable pay, benefits and social charges. Total employed cost typically sits at €130-200k per year. A vCISO at 4-8 days per month sits around €40-90k per year, with no social charges or benefits. The economic gap is real, but the models are not directly comparable: they cover different levels of dedication.

The sweet spot sits between 50 and 1,500 employees, especially in regulated sectors (financial, healthcare, public sector, critical industry, B2B SaaS). Smaller organisations usually rely on point consulting; larger ones typically justify an internal CISO by operational volume. vCISO also fits as a bridge: growing organisations that do not yet have the mass for an internal CISO but already carry regulatory obligations.

Neither framework demands a specific named role. NIS2 (article 20) holds the management body accountable and requires people with the capacity and knowledge to meet the obligations. DORA (articles 5-6) requires an ICT risk management function with independence and competence. A vCISO with appropriate dedication and documented traceability covers both requirements. What they do demand is that the role has board access, decision authority and real availability during incidents.

The main risk is the lack of day-to-day presence. An internal CISO absorbs context, corridor conversations and internal dynamics that a vCISO does not see. The most resilient way to mitigate that is a hybrid model: vCISO at the helm, with an internal manager or lead (junior or mid-level) as the operational arm. The vCISO brings seniority, governance and board relationship; the internal lead guarantees daily presence and execution.

A sensible service agreement includes: a 12-18 month roadmap with quarterly milestones, attendance at board meetings monthly or bi-monthly, documented governance (policies, risk maps, audit plan), incident availability with an SLA, and quantitative progress reporting. The measure is not 'vCISO hours' but outcome delivery: certifications closed, risks remediated, regulatory evidence produced.

Three signals: when the organisation crosses 1,500-2,000 employees, when the security area exceeds 10-12 headcount, or when an operation appears that demands sustained daily presence (active M&A, deep cloud transformation, regulated international expansion). A well-negotiated vCISO helps the transition: prepares the profile, takes part in the selection and runs an orderly handover.

We begin with a diagnostic session (1-2 days) covering current maturity, regulatory obligations, board priorities and technical dependencies. From that comes an initial roadmap and a realistic dedication agreement. After the first 90 days we hold a checkpoint with the board to validate focus and adjust what is needed. The service renews on annual commitments with clear exit clauses.