Security Leadership,
Without the Full-Time Salary

In practice, very little. Virtual CISO, vCISO, fractional CISO, outsourced CISO and CISO as a Service all describe the same arrangement: experienced security leadership delivered part-time rather than as a full-time employee.

Different providers prefer different labels, and some attach slightly different packaging to each. We offer the arrangement, whichever name you arrived with.

They are different jobs. IT support keeps systems running and fixes what breaks. A CISO decides what needs protecting, how much risk the business is willing to carry, which controls are worth the money, and what gets done first.

Plenty of businesses have perfectly good IT support and nobody holding the security strategy. That gap tends to show up the first time a large customer sends a security questionnaire.

It depends on the number of days a month and what you need delivered, so we scope it properly rather than quoting a headline figure. What we can say is that it is a small fraction of a full-time CISO, who in the UK commands a six-figure salary before employer's National Insurance, pension and recruitment costs.

Engagements typically start with a fixed-price baseline assessment so you can see the scale of the work before committing to a retainer.

No. The role is platform independent. We work across Microsoft 365, Google Workspace, Azure, on-premises servers, and the hybrid environments most growing businesses actually have.

We are experienced Microsoft specialists, so if you are a Microsoft business you will find that depth useful. But the security strategy comes first and the platform follows, not the other way round.

Quickly. Supplier assurance questionnaires are one of the most common reasons businesses first contact us, usually with a deadline attached.

We can normally help you answer one honestly and credibly within days, then use the gaps it exposes as the starting point for a longer term plan. Answering it accurately matters more than answering it well: overstating your controls in writing to a customer creates a much bigger problem later.

Probably not directly, if you are a typical business of 10 to 100 staff. As drafted, the Bill regulates operators of essential services, relevant digital service providers, larger managed service providers, designated critical suppliers, large data centres and large load controllers. Micro and small enterprises are generally excluded from these categories.

The more likely route is indirect. Regulated organisations have to manage risk across their supply chains, so if you sell to, or depend on, anyone in scope, their obligations will reach you through contract clauses and due diligence questionnaires. That is how most SMEs will first encounter this Bill.

There is one exception worth knowing. Regulators would be able to designate any supplier as critical, whatever its size, where disruption to it could significantly affect an essential or digital service. Being small is a baseline exemption rather than a guarantee.

Working out which of those applies to you is a short piece of work, and worth doing before a customer asks.

It is not law yet. The Bill was introduced on 12 November 2025, completed its Commons stages, and moved to the House of Lords on 17 June 2026. Royal Assent is widely expected during 2026, with duties phased in afterwards as regulators publish sector guidance.

Because it is still before Parliament, the detail can change. We would treat anyone quoting fixed compliance deadlines today with some caution. What is not in doubt is the direction of travel, which is why preparation is sensible now even though the deadline is not fixed.

Establish honestly whether you are in scope, directly or through your customers. Then work on the things that are useful regardless of the answer: Cyber Essentials certification, an incident response plan that could realistically meet a 24 hour notification clock, a current picture of who your suppliers are and what access they hold, and evidence you can hand to a customer without rewriting it each time.

None of that is wasted effort even if the Bill never touches you directly. It is the same work that wins contracts and satisfies insurers.

It is a fair question, and the honest answer depends on what you need. If you require a staffed 24/7 security operations centre, or support for several hundred users across multiple time zones, a larger provider is the better fit and we will tell you so.

For an organisation of 10 to 100 staff, being small is usually the advantage. CISSP is held by individuals rather than firms, so the qualification is the same wherever it sits. Cyber Essentials is one NCSC scheme assessed identically whoever guides you through it. What differs is who actually turns up: at a larger provider, first-line staff handle most tickets from scripts, and specialists are reached by escalation.

There is also a stability argument. The managed services sector is consolidating rapidly, with private equity backed groups acquiring smaller providers and migrating their clients onto standard service tiers. We are owner-run and not for sale.

No. We would rather you stayed because the work is worth it. Engagements are reviewed regularly and the number of days can go up during a certification push or an incident and back down when things are steady.

We are based in London and work with businesses across London and the Home Counties, including Surrey, Kent, Essex, Hertfordshire and Berkshire. A Virtual CISO engagement usually mixes on-site days for workshops, board sessions and assessments with remote work for everything else.