Board-ready risk intelligence.
Without the enterprise price tag.

COMMON QUESTIONS

Pricing questions

• How much does a vCISO cost?

  vCISO pricing runs three delivery models: platform-augmented subscriptions like vCISO Lite ($299–$1,499/mo), traditional consultancy retainers ($3,000–$20,000/mo per Pivot Point Security), and independent hourly consultants ($200–$400/hr). The in-house alternative averages $415,000/yr in total comp (IANS Research / Artico Search, 2025). Full teardown at /blog/vciso-pricing-2026.

• What are typical vCISO rates?

  vCISO rates depend on the delivery model. Subscription platforms like vCISO Lite bundle software and vCISO advisory at a flat monthly rate ($299-$1,499/mo, with consultant hours included on the Ultra and Enterprise tiers), and platform automation absorbs the routine work. Retainer consultancies quote monthly for a bucket of hours — typically $250-$400/hr fully loaded when you divide the retainer by delivered hours. Hourly independents charge $200-$400/hr for senior work with no platform, no vendor tooling, and no evidence collection. When comparing rates, always ask what's included: a $300/hr consultant who then bills separately for compliance software, vendor questionnaire time, and policy drafting will cost 2-4x the sticker rate over a year.

• vCISO hourly rate vs. subscription — which is cheaper?

  For most SMBs, subscription is cheaper by a factor of 2-5x once you include the full workload. Hourly billing (typically $200-$400/hr) is priced for episodic work: a 20-hour policy update, a one-time audit prep sprint, an incident response. It stops being cheap the moment you need continuous work — evidence collection, vendor reviews, questionnaire responses, board reporting — because a 100-hour-per-year workload at $300/hr is $30K, and that's before any software you'd need to actually run the program. A subscription at $499-$999/mo covers the same 100-hour workload PLUS the platform PLUS your tier's vendor and questionnaire allowance. Hourly is right if your need is truly episodic; subscription is right if the security program is ongoing.

• How does fractional CISO pricing compare to vCISO subscription pricing?

  Fractional CISO and vCISO are frequently used interchangeably, but the pricing models differ sharply. Fractional CISOs are typically retained at 5-15 hours per week on a monthly contract, priced $8,000-$20,000/mo — closer to a part-time employee than a service. vCISO subscriptions bundle a smaller amount of dedicated consultant time (on vCISO Lite, 4 hours/mo on Ultra and a dedicated advisor on Enterprise) with a compliance platform that handles the heavy repetitive lifting (evidence collection, vendor scans, questionnaire drafts). Result: vCISO subscriptions run $299-$1,499/mo — 10-30x cheaper — because the platform absorbs the hours a fractional CISO would spend on routine work. Pick fractional when you need a security leader effectively in the seat 40+ hours/mo; pick vCISO subscription when you need a working security program without paying a leader to do software's job.

• How does CISO-as-a-Service pricing work?

  CISO-as-a-Service (CaaS) pricing is typically structured one of three ways. (1) Tiered subscription — a fixed monthly rate ($299-$1,499/mo for platform-augmented, $2,000-$8,000/mo for consultancy-led) that includes deliverables plus, at the higher tiers, a defined amount of CISO time. (2) Retainer-plus-project — a base monthly fee for standing capacity ($3,000-$6,000/mo typical) with project work billed separately at hourly rates. (3) Outcome-based — pricing tied to a specific deliverable (SOC 2 readiness, ISO 27001 certification, vendor risk program stand-up), typically $15,000-$50,000 per outcome. Most SMBs are best served by tiered subscription unless a specific audit is on the calendar; outcome-based pricing suits audit-driven timelines but stops covering you the moment the deliverable ships.

• How does vCISO Lite compare to Vanta or Drata pricing?

  Vanta, Drata, and Secureframe do not sell first-party vCISO services — they all push customers to partner consultancies through their Service Provider / Concierge / Partner programs. That means the buyer pays for the platform ($10,000-$80,000+/yr) plus a separate consultancy retainer ($3,000-$20,000/mo). vCISO Lite is a platform-augmented vCISO at one price: the platform starts at $299/mo, and the Ultra and Enterprise tiers add dedicated vCISO hours. Total cost difference is typically 3-10x.

• Can I see a demo before buying?

  Yes. Book a personalized walkthrough at /contact and we will show you how vCISO Lite handles your specific compliance frameworks, vendor count, and reporting needs. Demos are typically 30 minutes and we walk through real customer data structures (anonymized) so you can see exactly what evidence collection, policy generation, and board reporting look like inside the platform.

• Can I change plans later?

  Yes. You can upgrade or downgrade your plan at any time. Changes take effect immediately, and we will prorate your billing.

• Are there any hidden fees?

  No. The price you see is the price you pay. No per-seat fees, no setup costs, no surprise charges.

• What's the difference between Ultra's diligence capabilities and Other20's diligence services?

  Ultra is a software subscription which provides you with the tools you need to run cyber diligence and investment planning on your own — with secure data rooms you run in your own tenant, for your own organization. Other20's diligence services are engagement-based — we run the assessment for you on an acquisition target and deliver a board-ready report. If you are evaluating a target you do not yet operate, start with Other20 services. If you want ongoing risk quantification for your own business, Ultra includes those tools.

• What payment methods do you accept?

  We accept all major credit cards (Visa, Mastercard, Amex) and can invoice for annual Business, Ultra, and Enterprise plans.

• Is there a discount for nonprofits?

  Yes. We offer 50% off for registered nonprofits. Contact us with proof of status to get your discount code.

• Can I get custom pricing?

  Absolutely. Need more CISO hours, single-tenant hosting, or bring-your-own-keys? Contact our sales team to build a custom package.