.png){kind=small}
Information Security Gap & Risk Assessment
A clear starting point for your security roadmap.
Virtual CISO (vCISO)
Senior security leadership, without a full-time hire.
A ThreatGaurd virtual CISO gives your organisation an experienced security leader who sets strategy, reports to the board, runs your security and compliance programmes and guides your teams, for the time you need.
Why it matters
Every organisation needs security leadership. Not every one needs it full time.
Customers, regulators, insurers and boards expect someone to own cyber risk. Yet a full-time CISO is a significant hire, can take months to recruit and may be more than a growing organisation needs today.
A virtual CISO fills that gap with experienced leadership on a flexible basis: a clear strategy, steady progress and a trusted voice for your board and customers.
-
No clear owner for security
Responsibility is spread across IT, compliance and management, so important decisions fall between the gaps.
-
Board questions without answers
Leaders are asked about cyber risk, budgets and incidents, but lack a clear, defensible view to share.
-
Growing compliance pressure
Security questionnaires, audits and certifications pile up without a plan or someone to lead them.
Your first 90 days
Clear progress from the very first month.
Every engagement starts with understanding your business. This is a typical first 90 days, before your vCISO moves into ongoing leadership.
-
Step 1: Days 1 to 30: Understand
Meet stakeholders and review current controls, risks, incidents and obligations.
What you get
A current-state assessment and your top risks
-
Step 2: Days 31 to 60: Plan
Agree priorities, budget and a security roadmap with leadership.
What you get
A 12-month roadmap and a board briefing
-
Step 3: Days 61 to 90: Early wins
Start the highest-value improvements and put governance in place.
What you get
Quick wins, core policies and a risk register
-
Step 4: Ongoing: Lead and report
Run the programme, guide your teams and report progress regularly.
What you get
Regular board reports and steady progress
What your vCISO does
Leadership across every part of your security programme.
Your vCISO focuses on the areas that matter most to your business. Priorities are agreed with you and reviewed regularly.
-
Security strategy and roadmap
A clear plan that links security investment to business goals.
- Current-state assessment and target state
- A 12-month security roadmap
- Security budget planning
-
Board and executive reporting
A trusted voice on cyber risk for leadership and the board.
- Regular cyber risk reports
- Briefings on incidents and threats
- Metrics that show progress over time
-
Policy and governance
The rules and roles that make security work day to day.
- Security policies and standards
- Roles, responsibilities and committees
- Exception and risk acceptance process
-
Risk and compliance programmes
Leadership for the frameworks your customers and regulators expect.
- ISO 27001, SOC 2 and privacy programmes
- Customer security questionnaires and audits
- Risk register and treatment plans
-
Third-party risk
Confidence in the suppliers who handle your data and systems.
- Supplier security assessments
- Security requirements in contracts
- Ongoing supplier reviews
-
Incident readiness
Preparation, and steady leadership when something goes wrong.
- Incident response plan and playbooks
- Tabletop exercises with leadership
- Guidance during and after incidents
Full-time or virtual?
Experienced leadership, sized to your organisation.
A vCISO gives you the leadership of a senior security executive, with the flexibility to match your size and stage of growth.
| Topic | Full-time CISO | ThreatGaurd vCISO |
|---|---|---|
| Commitment | A permanent senior hire, with salary, benefits and recruitment costs. | A flexible engagement sized to your needs, without a permanent hire. |
| Time to start | Senior security hires can take months to recruit. | Can start once scope is agreed, usually within weeks. |
| Experience | The experience of one individual. | Backed by a wider team across testing, cloud and compliance. |
| Flexibility | Fixed capacity, whatever the workload. | Time scaled up or down as priorities change. |
| Best for | Large organisations that need full-time security leadership. | Growing and mid-sized organisations, or teams between CISOs. |
Many organisations start with a vCISO and hire a full-time CISO once the programme has grown. Your vCISO can help define that role and hand over smoothly.
Engagement models
Choose the level of leadership you need.
The time commitment is agreed with you and can change as your priorities and programme grow.
-
Advisory
Regular guidance and check-ins for leadership, with support for board updates and key decisions.
Best for
Organisations with an IT team that needs senior direction.
-
Most common
Programme leadership
Hands-on leadership of your security and compliance programme, with involvement every week.
Best for
Most growing organisations. Steady, visible progress.
-
Interim CISO
Close to full-time cover while you recruit a permanent CISO or go through a major change.
Best for
Leadership gaps, mergers and major transformations.
Frameworks we work with
- NIST CSF 2.0
- ISO/IEC 27001
- CIS Controls v8
- SOC 2
- ISO 22301
- India DPDP Act
Deliverables
Visible progress your board can follow.
- Security strategy and roadmap Priorities, investments and timelines agreed with leadership.
- Board and executive reports Regular, plain-language reports on risk, progress and the decisions needed.
- Policy and governance framework Policies, roles and processes that work without constant oversight.
- Risk register Your key risks, owners and treatment plans, kept up to date.
- Programme progress reviews Regular reviews of what has been delivered and what comes next.
Month 1
Month 12
-
Policies in place 40% to 95%
-
Critical risks treated 20% to 85%
-
Staff trained 35% to 92%
-
Key suppliers assessed 15% to 80%
Average compliance
28%month 1,88%month 12
Board update
Quarterly cyber risk report presented to the board
Related services
Services your vCISO can draw on.
-
-
ISO 27001 & SOC 2 Readiness
Prepare for the certifications your customers ask for.
-
Managed Vulnerability Management
Continuous discovery, prioritisation and verified fixes.
-
Business Continuity & Disaster Recovery
Plans and exercises that keep the business running.
FAQ
Questions leaders ask about a virtual CISO
Can’t find your answer? Our team is happy to help.
What is a virtual CISO?
A virtual CISO is an experienced security leader who provides CISO-level leadership on a part-time or flexible basis. They set strategy, run your security programme, report to leadership and guide your teams, without the cost of a full-time executive.
Who is a vCISO right for?
Growing and mid-sized organisations that need security leadership but not a full-time executive, organisations between CISOs, and companies facing customer, investor or regulatory pressure to show strong security governance.
How much time does a vCISO spend with us?
It depends on the engagement model. Advisory engagements involve regular check-ins, while programme leadership and interim CISO roles involve much more time. The commitment is agreed upfront and can change as your needs change.
Will the vCISO work with our existing IT and security teams?
Yes. Your vCISO works alongside your internal teams and providers, sets priorities, removes blockers and helps your people grow, rather than replacing them.
Can the vCISO present to our board?
Yes. Clear board and executive reporting is a core part of the role, including regular cyber risk updates and briefings on major incidents or decisions.
Who is accountable for security decisions?
Accountability for security ultimately sits with your organisation’s leadership. Your vCISO provides leadership, advice and programme management, and the responsibilities are defined clearly in the engagement agreement.
How quickly can a vCISO start?
Once the scope and engagement model are agreed, an engagement can usually start within a few weeks, beginning with the first 90-day plan.
How is the cost calculated?
Cost depends on the engagement model, the time commitment and the size and complexity of your organisation. After an initial conversation you receive a clear proposal, usually as a monthly retainer.
Get started
Give your organisation the security leadership it needs.
Tell us about your organisation, your current team and what is driving the need. We will come back with a recommended engagement model, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.