You're probably wondering...

A permanent CISO is a significant investment in Australia — typically A$180,000–A$300,000+ in base salary, before super, benefits and recruitment costs. It can also take months to secure the right person and get them started. A fractional model gives you access to senior security leadership at a lower cost and with far more flexibility, because the engagement is scoped to what your business actually needs. We tailor that scope rather than offering a one-size-fits-all price.

Consultants typically come in, run an assessment, write a report, and leave — you're left to execute with no ongoing accountability. A vCISO retainer puts a named CISO on your org chart and your security documentation. They attend your board meetings, mentor your team, manage your compliance programme month after month, and remain accountable for outcomes — not just deliverables. Different engagement, different commercial model, different accountability.

Our primary focus is Essential Eight (ACSC), ISO 27001, NIST CSF, Australian Privacy Act and the 13 Australian Privacy Principles, PCI DSS, and Cyber Security Act 2024 readiness. We also work with SOC 2 and GDPR for clients with global customers. Tell us your compliance target and we'll confirm fit before engagement.

We use AI tooling for attack surface discovery, continuous risk scoring, policy gap analysis, and compliance evidence gathering — tasks that traditionally took analyst-weeks now run continuously. The AI doesn't replace judgement; it amplifies it. You get sharper insights faster, and we spend our hours on the strategic work that genuinely requires human experience.

Most of our retainer engagements fall into one of four buyer profiles. Smaller businesses under 50 staff who need a credible named CISO on the org chart for tenders, insurers, and customers. Scaling SMBs in the 50–200 range working through a compliance programme. Mid-market organisations from 200 to around 1,000 staff that need board-level cyber leadership, often in regulated sectors. And businesses needing a near-full-time bridge role — pre or post incident, during transformation, or while recruiting a permanent hire. The common factor is not headcount, it is complexity. We match the engagement to your situation, not your org chart size.

Within a week of signed engagement. We deliberately keep a limited number of active clients at any time to maintain quality — which means availability changes month to month. Book a discovery call and we'll confirm current capacity.

They solve different problems and one is not a cheaper version of the other. A vCISO retainer is ongoing security leadership — a named CISO on your org chart and security documentation, accountable for outcomes across months and quarters, there between sessions when something breaks. Expert Days and named packages are project work — defined scope, defined deliverables, fixed price for fixed scope, no ongoing commitment. Use a retainer when you need continuity. Use a package when you need a specific deliverable. Most engagements start with a Cyber Health Check, which is a 2-week productised package that produces real artefacts and helps you decide which path makes sense afterwards.

Both. Most engagements are remote-first with periodic on-site visits for workshops, board presentations, and incident response. We can increase on-site presence where it adds genuine value — tell us what your business needs and we'll structure it accordingly.