When to hire a CISO - and what a vCISO does until then

Most companies feel the need for security leadership before they can justify a full-time Chief Information Security Officer. This is especially true for regulated technology companies in the 50 to 250 employee range - the point where customers start sending security questionnaires, auditors expect a named owner, and, for financial entities, regulators expect demonstrable operational resilience. The work is real and continuous. But a full-time CISO is a senior, expensive hire that typically takes six to nine months to recruit well, and the role is often only half-utilised at this stage of a company's growth.

The result is a common and awkward compromise: security leadership gets bolted onto an existing engineering lead, VP of Engineering, or CTO. That person is capable, but they are also conflicted. They own the systems that security is supposed to independently assess. Asking the person who built and ships the platform to also be the person who reports its security risks to the board creates a structural conflict of interest that auditors, customers, and regulators all recognise. It also means security competes for attention with delivery deadlines, and delivery usually wins.

This post is about how to think through that gap - what CISO-level leadership actually is, what a virtual CISO (vCISO) or Managed ISMS retainer provides in the meantime, and how to know when it is genuinely time to hire in-house.

What CISO-level leadership actually is

It helps to separate the leadership function from the tooling and operational work that often gets confused with it. Buying a SIEM, running vulnerability scans, and configuring endpoint protection are security activities, but they are not security leadership. CISO-level leadership is a governance function, and it has four core components.

An owned security risk picture. Someone accountable maintains a current, honest view of the organisation's security risks - not a spreadsheet that gets updated the week before an audit, but a living understanding of what could go wrong, how likely it is, and what the business impact would be. This is the foundation everything else rests on.

A risk-linked roadmap. Security investment should follow risk, not vendor marketing or the loudest questionnaire. A CISO translates the risk picture into a prioritised, sequenced roadmap that the business can resource and track, with each item traceable back to a risk it reduces.

Board-level reporting. The board and executive team need security risk communicated in terms they can act on: what the material exposures are, what is being done about them, what residual risk the company is accepting, and where investment is needed. This is a translation skill as much as a technical one.

Stewardship of the ISMS against real risk. If the company runs an information security management system - whether certified to ISO 27001 or not - someone has to keep it aligned to the actual business, not let it drift into a paperwork exercise. That means owning the risk register, the Statement of Applicability, internal audit follow-up, and continual improvement.

For financial entities, there is a fifth, non-optional component: continuous regulatory obligations. Under the Digital Operational Resilience Act (DORA), ICT risk management, incident classification and reporting, resilience testing, and third-party risk oversight are ongoing duties with supervisory consequences, not one-time projects. That work needs a named, accountable owner every day of the year, not only at audit time.

What a vCISO or Managed ISMS retainer provides in the meantime

A vCISO engagement, delivered as a managed ISMS retainer, is designed to provide exactly the leadership functions above, right-sized to a company that does not yet need a full-time hire. Done properly, it delivers:

• Named leadership. A specific, accountable person who owns the security function, attends the meetings that matter, and can be pointed to on a questionnaire or in an audit as the security lead.
• A maintained risk register. A current, business-specific view of security risk that is reviewed on a regular cadence, not reconstructed under deadline pressure.
• A risk-linked roadmap. A prioritised plan the executive team can resource, with clear sequencing and rationale.
• Board and executive reporting. Regular, decision-useful reporting on security posture, material risks, and progress against the roadmap.
• ISMS upkeep. Ongoing maintenance of the management system - risk reviews, internal audits, control evidence, supplier assessments, and corrective actions - so the ISMS reflects reality and survives external scrutiny. This is the day-to-day ongoing support that keeps certification meaningful between audits.
• Incident-response readiness. A tested incident-response capability with defined roles, escalation paths, and, for financial entities, the classification and regulatory-reporting steps DORA requires.

The advantage of the retainer model at this stage is proportionality. The company gets senior leadership attention scaled to what it actually needs, without carrying a full executive salary and without the six-to-nine-month recruitment gap during which security has no clear owner.

The honest part: when to hire a full-time CISO

A vCISO is a bridge, not a permanent substitute for in-house leadership. There are clear signals that it is time to hire a full-time CISO, and a good vCISO will tell you when you have reached them rather than trying to entrench.

The usual triggers are scale and complexity. When the security function needs to grow into a team of several people who require daily direction, when security decisions are being made multiple times a day and cannot wait for a scheduled retainer touchpoint, when the regulatory footprint expands across multiple jurisdictions, or when security becomes a core part of the company's commercial strategy and product - those are moments that justify a dedicated, embedded executive.

The mark of a well-run vCISO engagement is that it makes the eventual handover easy. By the time you hire, the risk register, roadmap, ISMS documentation, board reporting cadence, and supplier records already exist and are current. The incoming CISO inherits a functioning program with institutional knowledge captured, not a blank page or a pile of undocumented decisions. A good vCISO plans for that handover from the start and hands over cleanly, rather than making themselves indispensable.

Accountability stays with the company

One important point of principle. A vCISO provides security leadership as a service, but accountability for security decisions and their consequences remains with the company and its board. The retainer brings the expertise, the discipline, and the day-to-day ownership of the work; it does not transfer legal or governance accountability off the executive team. The best engagements are explicit about this - the vCISO advises, maintains, reports, and recommends, and the company decides. That clarity is what keeps the arrangement both effective and defensible in front of auditors and regulators.

Where Kellwick fits

Kellwick provides vCISO and Managed ISMS retainers for growing regulated technology companies that need real security leadership before a full-time CISO is justified. If you are weighing when to hire in-house and how to bridge the gap, see how the managed ISMS retainer is structured and what ongoing support covers between audits.