A virtual or fractional Chief Information Security Officer gives your business board-level security leadership without the cost or commitment of a full-time hire. Here's what that actually means in practice — and how to know if it's the right move for your organisation.
The market uses "vCISO" and "fractional CISO" interchangeably, but there is a meaningful difference worth understanding before you engage anyone.
A vCISO operates primarily in an advisory capacity — typically remote, providing strategic guidance, reviewing policies, and delivering reports. Think of it as having a senior security consultant on retainer who you can call upon when you need direction.
Valuable for: organisations that have some security capability in-house and need high-level oversight and compliance guidance, without needing someone embedded in the business day-to-day.
A fractional CISO is genuinely embedded in your leadership team — attending board meetings, presenting to investors, mentoring your IT team, driving your compliance programme, and taking accountability for outcomes, not just deliverables.
The difference is ownership. A fractional CISO doesn't write a report and leave. They stay, they execute, and they're accountable for results — exactly what a full-time CISO would be, on a fractional time basis.
At Portcullis Security, we operate as a fractional CISO — not an advisory-only service. We take ownership of your security programme and remain accountable for its outcomes.
Most organisations don't realise they need this until one of these moments arrives. The smart ones act before that.
Directors are under increasing legal obligation to govern cyber risk. When they start asking, you need someone in the room who can respond with authority — not a printout from an IT manager.
Larger clients, particularly in finance, government supply chains, and healthcare, now routinely ask about your security leadership as part of vendor onboarding. "We have an IT team" is no longer sufficient.
Investors and their due diligence teams scrutinise security governance closely. A credible, documented security programme — led by a named CISO — materially reduces perceived risk and protects your valuation.
ISO 27001, Essential Eight, APRA CPS 234, the Cyber Security Act 2024, SOC 2 — compliance frameworks with teeth. Navigating them without someone who has done it before is slow and expensive.
IT operations and security strategy are fundamentally different disciplines. Asking one person — or one team — to do both means neither gets done properly. Security strategy requires dedicated, senior attention.
A ransomware event, a data breach notification, or a phishing campaign that almost succeeded. Each of these is a signal that your security posture has gaps that need senior leadership, not just technical fixes.
The numbers make the case plainly. This is a straightforward business decision once you see it laid out.
| Consideration | Full-Time CISO | Fractional CISO | No CISO |
|---|---|---|---|
| Annual Cost (AU) | $220K–$350K+ incl. super & benefits | A fraction of full-time cost — scoped to context | $0 until an incident — then potentially millions |
| Time to Operational | 3–6 months to hire & onboard | 2–4 weeks | — |
| Security Strategy | ✓ Full ownership | ✓ Full ownership | ✗ |
| Board & Investor Reporting | ✓ | ✓ | ✗ |
| Compliance Programme | ✓ | ✓ | ✗ or piecemeal |
| Incident Response Leadership | ✓ | ✓ | ✗ |
| Suitable for SMB/Mid-Market | ✗ Rarely justified | ✓ Ideal fit | — High risk |
| Flexibility / Scalability | ✗ Fixed cost | ✓ Scales with need | — |
Not reports. Not recommendations that gather dust. These are the actual activities that constitute a well-run fractional CISO engagement.
Assess your current posture, identify genuine gaps (not a checklist exercise), and build a prioritised, costed roadmap aligned to your business objectives and risk appetite.
Lead your organisation through Essential Eight maturity uplift, ISO 27001 certification, APRA CPS 234 obligations, the Cyber Security Act 2024, Privacy Act compliance, and SOC 2 — from gap analysis to audit-ready.
Translate technical risk into business language. Attend board meetings, present to the audit and risk committee, brief investors, and provide the governance documentation your directors need to fulfil their obligations.
Build and maintain a living risk register. Identify, score, and prioritise cyber risks in business terms. Ensure risk treatment decisions are documented and defensible — to boards, insurers, and regulators alike.
Develop and test your incident response plan before you need it. Run tabletop exercises with your leadership team. Ensure you know exactly who does what in the first 24 hours of a breach — including your obligations under the NDB Scheme.
Upskill your IT team, embed security thinking into engineering and product decisions, and build a security culture that doesn't rely on a single person. The goal is to make your organisation less dependent over time, not more.
Assess the security posture of critical suppliers and technology vendors. Implement a third-party risk management framework that satisfies both your own governance requirements and those of your enterprise clients.
Develop an information security policy suite that is proportionate, practical, and actually followed — not a shelf of documents nobody reads. Including acceptable use, access control, data classification, and supplier security policies.
Consultants come in, run an assessment, write a report, and leave — handing you a document and a bill. You are left to interpret it, prioritise it, and execute it with whatever internal resource you have available.
A fractional CISO engagement with Portcullis Security is fundamentally different. You get the same senior security executive who has led the security function for two ASX-listed organisations — one of Australia's largest retailers and one of its largest FMCG businesses — embedded in your leadership team.
Not a rotation of junior analysts managed from a distance. Not templates filled in by someone who read the framework last month. Genuine executive leadership, applied to your business, with accountability for outcomes.
'The board doesn't want another report. They want to know the business is protected. That requires a CISO — not a consultant.'
Credentials & Experience
The organisations Portcullis Security works with are typically 20–500 staff, growth-stage or established businesses in regulated sectors, founder-led companies preparing for capital raises, and organisations navigating their first serious compliance requirement. If that's you, get in touch.
A 30-minute call costs nothing. We'll tell you honestly whether this is the right move for your business — and if it isn't, we'll tell you that too.
Book a Free Discovery Call Get the Free Essential Eight Checklist