For companies that need senior security judgement, not a full-time headcount
A fractional CISO who sets the rules and takes the hard calls
Fractional works when you have someone in the building who can make the Tuesday decisions and you need a senior person to set the rules, take the hard calls, and be credible to the board, the auditors, and your biggest customers. It doesn't work as a cheap full-time CISO. I've written about how to decide between the two, and I'd rather you read that and decide against me than hire a fraction of a role that needs a whole one.
What a fractional engagement with me looks like
A fixed number of days a month, agreed up front, with a named deputy on your side who runs the day to day. In those days: the programme gets direction and a plan; risk acceptances get an owner and an expiry date; the incident process gets named decision-makers and a rehearsal; the board gets a briefing it can decide on, in writing, from me; and the security questionnaires from your customers get answered by someone whose signature means something. Between days, I'm reachable for the decisions that can't wait, and we agree in advance what those are.
What I don't do in a fractional role is run your incident response hour by hour, manage your team's performance reviews, or sit in every architecture meeting. If you need those, you need a full-time leader, and I'll say so.
The regulators mostly don't care which, as long as someone's named
The FTC's Safeguards Rule and New York's financial regulation both allow the designated security leader to be a service provider, provided your organisation keeps responsibility and someone senior oversees the arrangement. Public companies have to describe who manages cyber risk and what their expertise is. A fractional CISO satisfies all of that if the role is real. It doesn't if it's a name on a form.
Where this works best
Companies under a few hundred people, outside the most heavily regulated sectors, with a competent IT or engineering lead. Companies between CISOs who need continuity without a rushed hire. Companies that need the programme built, documented, and handed over, with the option to hire into a role that's now defined. And companies facing a specific event, a customer audit, an insurance renewal, a board that's started asking questions, where senior judgement for a season is worth more than a permanent hire.
Where this comes from
Thirty years of leading security, about twenty of them hands-on in incident response and operations, and a long run of serving as the subject-matter expert for organisations from startups to national governments. Most of that work is under NDA. What I can say here, I do; the rest we talk about in confidence.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Set a Sustainable Workload for a Security Team?
- Research How Can a Board Verify That Cyber Risk Is Improving?
- Short Full-Time CISO or Fractional CISO: How Do You Decide?
- Short The CISO just resigned. What do we do in the next 30 days?
- Short What should a new CISO deliver in the first 90 days?
Related work.
Other ways I'm engaged on the same problems.
- An interim CISO who holds the line while you hire wellFull accountability for security for a defined period, so the search can take the time a good hire needs.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CEOs and COOs of growing companies who need a security leader before they can justify a full-time one.
- Boards that want a credible, independent security voice on a part-time basis.
- Organisations between CISOs who need the function to keep working while they hire.