%20(9)%20(1).avif)
Key takeaways:
- US startups: monthly retainers typically run $3,000-$5,000 for foundational programs and $5,000-$9,000 for active compliance programs. Compliance-heavy or regulated environments run $10,000-$20,000+/month. Advisory-only retainers start around $1,500.
- EU startups: monthly retainers run €1,500-€2,500 for 1-2 days/month and €3,600-€5,500 for 3-4 days/month in Western Europe. NIS2 and GDPR governance add scope that increases cost compared to US-only programs.
- At typical startup retainers, a vCISO costs about 70-90% less than a full-time CISO's first year in the US ($350,000-$600,000+); in Western Europe, that first year costs about €180,000 (Germany) to €215,000 (France). A $5,000 retainer is $60,000 a year.
- Scope, frameworks, company maturity and engagement length move the quote. The compliance platform, audit fees and penetration testing are paid on top of it.
- For anything beyond a single task, a monthly retainer beats hourly billing: a vCISO who knows your environment and audit history doesn't charge you for ramp-up every time.
A vCISO (virtual CISO) costs most US startups $3,000 to $9,000 a month in 2026: $3,000 to $5,000 for a foundational security program and $5,000 to $9,000 while you run an active SOC 2 or ISO 27001 program. Advisory-only retainers start around $1,500 a month, and regulated companies managing several frameworks pay $10,000 to $20,000 or more. In Western Europe, 1 to 4 days of work a month costs €1,500 to €5,500, and in the UK about £1,350 to £6,000. Fractional CISO and CISO-as-a-service offers use the same pricing models; what changes the number is how many days a month you buy.
Below: the figures by engagement model, the prices providers publish, what each price tier includes, the six factors that move a quote, the costs outside the retainer with a first-year budget, and the comparison most founders need: a vCISO against a full-time CISO. If you are still deciding whether you need one at all, start with what a vCISO does.
By Marçal Santos, founder and CISO of SecureLeap (CISM, CDPSE), a former cybersecurity lead at Aircall, Citibank and Talkdesk with 20 years in enterprise security. SecureLeap sells vCISO services, so the ranges in this guide are market figures; our own price is in its own section below.
vCISO cost overview: US, EU and UK
The tables below give the headline monthly figures by scope. The breakdown by engagement model, tier and cost driver follows.
US monthly retainer
Hours for the upper three rows follow the retainer tiers Atlant Security publishes; the advisory row is our estimate at standard hourly rates. A day of work is about 8 hours, and the EU and UK tables below count days.
EU monthly retainer
EU rates reflect Western European markets (Germany, France, the Nordic countries). Southern European rates (Spain, Portugal, Italy) typically run 20-30% lower for comparable scope.
UK monthly retainer
Senior fractional CISO time in the UK runs about £1,200 to £1,500 a day. The published UK prices in the next section show where providers start.
These are market ranges for 2026, not SecureLeap prices. They are our estimates of where most startup engagements land, checked on 21 October 2026 against the prices vCISO providers publish in the US, Europe and the UK (listed in the next section). Individual quotes can fall outside them at both ends.
Published vCISO prices: US, Europe and the UK
Most vCISO providers only quote after a call. These ten publish a monthly price on their own site, shown as listed on 21 October 2026, before VAT. A starting price is not a quote, and what each tier includes differs.
Published entry prices start at $2,000 to $3,000 a month in US dollars, €1,200 to €3,600 in euros and £1,350 to £3,995 in the UK. The middle tiers, $5,000 to $6,500 and €4,800 to €4,900, fall inside the $5,000-$9,000 US band and the 3-4 day EU band above.
What each vCISO price tier includes
The same title covers very different jobs. This is what the money buys at each US tier, and what stays with your team.
For an example of what a vCISO program covers in practice, see how a 25-person cloud software startup ran its vCISO program through ISO 27001 certification.
Virtual CISO pricing models: retainer, hourly and project
Monthly retainer
A fixed monthly fee covering a defined number of hours or days per month.
The most cost-effective model for companies that need continuous security leadership: compliance program management, risk oversight, board reporting, and regular strategic touchpoints.
- US: $1,500-$20,000+ a month depending on scope. A startup running an active compliance program typically lands at $5,000-$9,000 a month.
- EU: €1,500-€15,000 a month depending on the days engaged. A 3-4 day retainer runs €3,600-€5,500 a month in Western Europe.
Hourly rate
Best suited for time-bound, discrete needs: a one-time risk assessment, a board presentation, a security questionnaire review, or a pre-audit gap check before committing to a full program.
- US: $200-$500 an hour. The standard range is $200-$300; senior practitioners reach $400-$500.
- EU: €150-€350 an hour.
The limitation of hourly billing: someone who doesn't know your environment, audit history and team adds ramp-up overhead to every engagement. For anything beyond a single task, a retainer delivers better outcomes at a lower effective hourly cost.
Project-based
A fixed fee for a specific deliverable: SOC 2 readiness, ISO 27001 implementation, a GDPR governance build, an incident response playbook, or a full security program from scratch.
- US: $3,000-$50,000+ depending on scope. A SOC 2 gap assessment alone typically runs $3,000-$5,000; a readiness project that takes a startup from gap assessment to audit-ready runs $10,000-$25,000; ISO 27001 implementation support runs $15,000-$40,000; and a full security program build $20,000-$50,000+.
- EU: comparable to the US for the same scope.
Most organisations that start with a project move to a retainer afterward to keep the program running through annual audit and surveillance cycles. The project builds the foundation; the retainer keeps it current.
What drives your vCISO cost up or down
Most of the variance in vCISO pricing comes from six factors. Know them before you compare quotes, or you end up comparing headline rates without knowing what each one includes.
1. Scope of services
A vCISO engaged for strategic advisory only (roadmap, risk decisions, the occasional board update) costs significantly less than one who also owns compliance program execution, manages audit facilitation, runs security awareness training, and answers enterprise security questionnaires.
Define exactly what's in scope before comparing quotes. Two providers quoting different monthly rates may be offering materially different scopes.
2. Compliance requirements and regulatory complexity
A startup pursuing SOC 2 Type 2 with a Security-only scope needs far less senior time than one simultaneously managing ISO 27001, GDPR, NIS2, and a customer-specific security framework.
Each compliance framework adds governance overhead, evidence management, and auditor coordination. Regulated sectors, such as fintech, healthtech, and govtech, push a quote toward the top tier of the US table ($10,000-$20,000+), because they need deeper regulatory expertise and more frequent compliance touchpoints.
3. Company size and starting security maturity
A 15-person startup with no security policies, no compliance platform, and no previous audit history needs significantly more hours in the first 3-6 months than a 100-person company with SOC 2 Type 2 already in place.
Most engagements front-load hours in the build phase, then settle into a lower maintenance cadence. Ask whether a provider's quoted rate reflects the build phase, the maintenance phase, or an average across both.
4. Engagement duration
Short-term engagements cost more per hour than long-term retainers. A provider on a 12-month retainer has predictable revenue and lower overhead per client, which translates to a lower effective rate.
A one-month pre-audit engagement carries a premium because the provider onboards quickly, works intensively, and exits cleanly. If your needs are ongoing, a retainer almost always delivers better value than stringing together short engagements.
5. Provider type: independent vs firm
An independent vCISO typically charges less than a firm that backs its lead with a team of specialists, like GRC analysts, cloud security architects, and compliance engineers.
Both models have merit. An independent offers direct continuity with the person doing the work and a genuine long-term advisory relationship. A firm offers depth: when the lead has a knowledge gap, a specialist covers it. The right choice depends on whether you need breadth of coverage (firm) or a trusted long-term advisor (independent).
6. EU regulatory context: NIS2 and GDPR
For EU-based startups and US companies expanding into Europe, the regulatory environment meaningfully affects the scope.
NIS2 introduced board-level accountability, a 24-hour early warning for significant incidents, and supply chain security obligations. Member states had to transpose it into national law by 17 October 2024. Most have; on 8 July 2026 the European Commission took Spain, France, Ireland and the Netherlands to the EU Court of Justice for not having done so yet. Check the national law in each country you operate in. GDPR adds data governance work that is continuous rather than one-time.
That means a vCISO covering EU regulatory compliance needs current knowledge of both frameworks and how they interact with ISO 27001: an expertise that not all providers have and that carries a premium in the market.
Costs outside the retainer, and what to ask before you sign
A vCISO retainer pays for security leadership. Budget separately for:
- The compliance platform: Vanta, Drata or Secureframe licences are a separate cost, whether you buy direct or through a partner (SecureLeap resells all three at a 20% partner discount). You can benchmark licence costsbefore you sign.
- Audit fees: the SOC 2 audit firm or ISO 27001 certification body is paid on top of the vCISO fee. See SOC 2 audit costs.
- Penetration testing: a separate engagement, often needed before an audit or a large enterprise deal. See penetration test pricing.
- Engineering time: someone on your team still implements the technical controls.
- The build phase: the first 3-6 months take more hours than maintenance, so check which phase a quote is priced for.
Example: a first-year budget with SOC 2
A 20-person SaaS startup with one web application hires a vCISO at the foundational tier to build its security program and take it through a first SOC 2 Type 2 audit within the year. Using the figures in our SOC 2 cost guide and penetration testing cost guide:
Add 40 to 150 hours of your own team's time. If SOC 2 is the only goal and someone inside the company can own security after the audit, a fixed-fee readiness project costs less than a year of retainer: $20,000 to $35,000 all-in for most small and mid-size SaaS companies. A retainer pays off when you also need someone to own security decisions, customer security reviews and the program after the report.
Four questions to ask every provider
- How many hours or days a month does the fee include, and what is the rate beyond them?
- Who does the hands-on work (policies, evidence collection, questionnaires): the vCISO, a junior analyst, or your team?
- Is the senior person you met the one who will do the work?
- What is the minimum term, and the notice period?
For the rest of the hiring process, see how to hire a fractional CISO. To compare providers, see our lists of vCISO companies for US startups and vCISO companies for European startups.
vCISO vs full-time CISO: cost comparison
The financial case for a vCISO over a full-time hire is straightforward. The more useful question is whether your company needs 40 hours a week of security leadership or 10 to 20.
"Most startups I work with don't need a full-time CISO yet. They need one senior person who owns the security decisions, with more hours before an audit and fewer once the program runs," says Marçal Santos, founder and CISO of SecureLeap.
US cost comparison
In the US and Canada, most CISOs earn between $250,000 and $700,000 a year in total compensation. In the IANS Research and Artico Search 2025 benchmark of 566 CISOs, technology and financial services paid the most, averaging $844,000 and $744,000. Closer to startup scale, CISOs at companies with up to $1 billion in revenue averaged $415,000.
"Midmarket CISOs are being asked to do more with less, stretching across IT, risk, and compliance while navigating flat org charts and limited visibility," said Steve Martano, a partner at Artico Search and IANS faculty member, when that report came out.
Year one all-in cost, including salary, benefits, equity, and recruiting, typically runs $350,000-$600,000+.
- vCISO at $5,000 a month = $60,000 a year
- vCISO at $9,000 a month = $108,000 a year
- vCISO at $15,000 a month = $180,000 a year (still less than a full-time CISO's base salary)
EU cost comparison
A worked example for France and Germany, with each assumption stated so you can swap in your own:
- Base salary: €130,000. CISOs at venture-backed scale-ups in Germany, France and the Netherlands earn €105,000 to €162,000 in base salary.
- Employer contributions in France: 42%, close to the 44% that URSSAF's salary simulator gives for an executive on €130,000. That brings the fully loaded cost to about €184,600 a year.
- Employer contributions in Germany: about €20,000 a year, around 15%, because contributions stop at €101,400 of salary for pension and unemployment insurance and at €69,750 for health and care insurance (2026 ceilings). The fully loaded cost is about €150,000. Other countries differ, so use your own rate.
- Recruiting fee of 20% of salary (€26,000), the low end of a typical executive search fee, plus €4,000 of onboarding: year one comes to about €214,600 in France and about €180,000 in Germany.
- Five years in France, with 5% annual raises and one replacement hire: about €1.08 million.
Against that:
- vCISO at €5,000 a month = €60,000 a year
- Over five years, with a 3% annual increase: about €319,000, roughly 30% of the French five-year cost
Side-by-side comparison:
The question isn't whether a full-time CISO costs more; it does, by a wide margin. The question is how many hours of security leadership your company needs. As a rule of thumb, a full-time CISO starts to make sense somewhere between 150 and 300 employees, or once security work fills most of a week. For the non-cost side of the decision, see vCISO vs full-time CISO.
What SecureLeap charges for a vCISO
SecureLeap's Navigator plan starts at $2,500 a month (€2,500 in euros), within the advisory price band above, and covers security guidance, risk assessment and priorities, a security roadmap, and policies written and maintained, while your team owns execution. Co-Pilot adds security questionnaires, vendor risk reviews and a security leader for your audits and customer calls. Captain is full executive support: everything in Co-Pilot, plus your security leader in front of the board, running your security program end to end.
We quote Co-Pilot and Captain after a free 30-minute call, as a fixed monthly retainer that changes only if the scope does, and any plan can also run as a fixed-scope project or hourly. Every engagement is led by Marçal Santos, with no junior consultants and no account manager handoffs. Compare the three vCISO plans and what each includes.
Is a vCISO worth it for a startup?
Four situations where a vCISO usually pays for itself:
- Enterprise deals are stalling: security reviews are holding up revenue, and one enterprise contract can be worth more than a year of vCISO fees.
- Compliance deadlines are real: a vCISO owns the program and hits the deadline without pulling your engineers off the roadmap.
- Investors are asking: someone who can present your security program credibly removes a common source of delay in due diligence.
- The CTO is drowning: a vCISO makes the security decisions so your CTO can focus on the product.
If none of these apply yet, you may not need one. Seven signs a startup needs a vCISO is a two-minute self-check.
Not sure which tier fits your stage? Book a free 30-minute call with Marçal to scope it.
Frequently asked questions on vCISO cost
How much does a vCISO cost per month?
For US startups, a vCISO (virtual CISO) retainer typically runs $3,000-$5,000 a month for a foundational security program and $5,000-$9,000 for an active SOC 2 or ISO 27001 program. Advisory-only retainers start around $1,500, and compliance-heavy or regulated environments pay $10,000-$20,000+ a month. In Western Europe, retainers run €1,500-€2,500 a month for 1-2 days of work and €3,600-€5,500 for 3-4 days.
What is the typical vCISO hourly rate?
In the US, experienced vCISOs charge $200-$500 an hour. The standard range is $200-$300, with senior practitioners at $400-$500. In the EU, rates run €150-€350 an hour.
Is fractional CISO pricing different from vCISO pricing?
Not in structure. Fractional CISO, virtual CISO and CISO as a service describe the same part-time security leadership, sold on the same retainer, hourly and project models. Offers that include more days a month simply move up the tiers above.
Is a vCISO cheaper than a full-time CISO?
Yes, significantly. A full-time CISO in the US costs $350,000-$600,000+ in year one, while a vCISO at $5,000 a month costs $60,000 a year: at typical startup retainers, about 70-90% less. In Western Europe, a full-time CISO costs about €180,000 (Germany) to €215,000 (France) in year one, against €60,000 a year for a €5,000 retainer.
Does a vCISO cost more for EU regulatory compliance?
Yes, modestly. EU-specific requirements, such as ongoing GDPR governance, NIS2 compliance, and cross-border data transfer mechanisms, add scope that doesn't exist in a US-only program.
Expect 15-25% higher retainer costs for a vCISO actively managing EU regulatory obligations than for one providing US-only strategic guidance at the same scope.
Can a vCISO handle both US and EU compliance?
Yes, and for US companies expanding internationally, this is one of the strongest arguments for the model. A vCISO with dual-framework experience (SOC 2 and ISO 27001, HIPAA and GDPR) can design one integrated compliance program that satisfies both markets, instead of hiring separate advisors for each.
SecureLeap works with US startups expanding into Europe, mapping existing SOC 2 controls to ISO 27001 and building GDPR governance into the same program.
What is included in a typical vCISO retainer?
It depends on the tier. A foundational retainer covers security strategy and a risk roadmap, policies, risk assessment, vendor risk, incident response planning and security awareness training. An active compliance retainer adds program management, evidence oversight, auditor coordination and customer security reviews, and the top tier adds regular board and investor reporting. On an advisory-only retainer, the vCISO advises and your team does the work.
What's typically excluded: hands-on technical implementation (your engineering team), 24/7 security monitoring (an MSSP function), penetration testing (a separate engagement), and compliance platform licences and audit fees. Confirm exactly what's included before signing.
%20(61).png)
%20(58).avif)
%20(57).avif)