vCISO vs Fractional CISO: what’s actually different?

Virtual CISO, vCISO, and Fractional CISO are terms that get used almost interchangeably. Ask three providers what they mean by each and you’ll often get three different answers.

That makes “vCISO vs Fractional CISO” a frustrating question to answer with a clean comparison table, because the labels alone don’t tell you much about what you’re actually buying.

The distinction worth understanding isn’t really between “virtual” and “fractional”. It’s between an engagement built around senior security leadership and one built around delivering a list of activities.

What is a vCISO?

A vCISO, or virtual CISO, is an outsourced security leader who works with your business for part of the time rather than as a full-time employee. The idea is to give a company access to experienced CISO-level security leadership without hiring a permanent executive.

The word “virtual” doesn’t mean the work is remote or automated. It means the role isn’t a full-time, in-house position. In practice, what a vCISO engagement actually involves varies enormously between providers.

What is a Fractional CISO?

A Fractional CISO is also an experienced security leader who works with your business for part of the time. Cyber Increment uses Fractional CISO rather than vCISO because the engagement is centred on active senior leadership and involvement in the business.

The word “fractional” is meant to describe a senior leader who is genuinely embedded, part of the time, rather than a service delivered from a distance against a template.

Why the terminology overlaps

In most of the market, virtual CISO and Fractional CISO describe roughly the same thing: experienced security leadership without a full-time hire. Plenty of providers use both terms for the same service.

So if you’re choosing between a “vCISO” and a “Fractional CISO”, the labels won’t tell you which is the better fit. What tells you is what each engagement actually involves.

The distinction that matters: leadership vs checklist

The real difference to look for is whether the engagement is structured around security leadership or around a fixed checklist of activities.

A checklist-driven service tends to arrive with a templated set of audits, policies, and reports. That activity can be useful, particularly when you need to satisfy a specific compliance requirement, but it isn’t the same as owning security direction.

A leadership-focused engagement is about understanding the business, setting priorities, working with your leadership team, and helping the organisation make better security decisions. The goal isn’t to make security look busy. It’s to give it direction.

What good looks like in either model

Whatever the provider calls it, a strong engagement should cover more than a folder of policies:

• Security strategy and priorities that reflect your business, not a generic template
• Executive and board-level security leadership, not just technical delivery
• Senior direction for your internal teams and suppliers
• Incident readiness and resilience, not only policies on paper
• Support for customer, partner, and growth conversations where security matters

When a checklist-style service might be enough

There are situations where a more templated engagement is genuinely sufficient. If the immediate need is to meet a specific compliance requirement, produce a set of policies, or complete a defined piece of work, a narrower service can make sense.

A security consultant brought in for a defined problem is often the right call when you need specialist expertise on a specific issue rather than ongoing leadership. The useful question is whether you need someone to own security direction, or someone to deliver a defined piece of work.

When you need the leadership version

If security has grown beyond what your technical leadership can reasonably own alongside everything else, customers or the board are asking harder security questions, or security activity exists but there’s no clear strategy, that’s the territory where leadership-focused engagement earns its place.

The same applies when the company is growing and security decisions are becoming more consequential, when compliance is happening but the business needs security leadership beyond passing an audit, or when you need experienced leadership while deciding whether or when to make a permanent CISO hire.

What to ask a provider

If you’re comparing vCISO and Fractional CISO offerings, the questions that separate them are usually about depth of involvement rather than price:

1. 01Who actually does the work, and how senior are they?
2. 02Is the engagement built around your business and priorities, or a standard template?
3. 03Will they work with your leadership team and board, or only with your technical team?
4. 04Do they own security direction, or deliver a fixed scope of activities?
5. 05What happens when priorities change, or when something goes wrong?

How Cyber Increment thinks about it

Cyber Increment uses Fractional CISO because the engagement is centred on active senior leadership and involvement in the business, not a checklist delivered from the outside.

If you’re trying to work out which model is right for your business, the Fractional CISO page sets out the remit, how an engagement works, and when it fits.