The vCISO market,
mapped as business models.
There are dozens of virtual and fractional CISO providers, but only five business models underneath them. This guide maps each one on the Business Model Canvas, then groups them by economics and plots them on a single map. The goal is simple: help you see how the models actually differ, what each is good at, and the trade-offs that come with it, so you can choose the fit for your stage.
The five vCISO business models
Each model below is shown on the Business Model Canvas: the nine building blocks of how that type of provider operates. The rail underneath shows the economics that shape what you pay for, what you can expect, and what to watch for. The value proposition block is highlighted, because that is where these models differ most.
Solo / Independent Practitioner
- Direct access to one named senior leader
- High trust, founder-to-founder
- Far cheaper than a full-time hire
- You get the expert, not a junior
- A handful of auditors and pentest contacts
- Compliance platforms (referral)
- Tool vendors for hand-offs
- Doing the work personally
- Advisory, policy writing
- Audit and SOC 2 prep
- Board reporting
- The individual's reputation
- Decades of experience
- Personal network
- CISSP / CISM credentials
- Deeply personal, high touch
- An advisor, not a vendor
- Personal network and referrals
- LinkedIn and conference relationships
- SMB and early-stage startups (under 100)
- First-time security buyers
- One or two clients at a time
- Very low. The provider's own time, a few tool subscriptions, and insurance. Most of the cost is simply their available hours.
- Monthly retainer $3K-$10K (10-40 hrs)
- Project fees (readiness, assessments)
How the vCISO models compare
The five models sort along one line: how far the service is decoupled from human hours. The further right, the more it behaves like software, which usually means lower cost per unit but a lighter personal relationship. The further left, the more you are buying a specific person's time and judgment. Neither end is better. They fit different stages.
| Model | How it scales | Defensibility | Typical annual cost | What you pay for | Main trade-off |
|---|---|---|---|---|---|
| Solo practitioner | none | Personal trust | $36K-$120K / yr | One senior person's time, on retainer | One person is a single point of failure, with no built-in backup |
| vCISO-first boutique | linear | Method, brand, and bench | $60K-$250K / yr | A tiered retainer for a team and a method | Quality depends on which senior you get and their availability |
| Scaled productized firm | mixed | Brand plus owned product | $80K-$400K+ / yr | A retainer plus an optional software subscription | Running a service and a product at once can split focus |
| MSSP-integrated | high | Data, telemetry, switching cost | $150K-$1M+ / yr | A managed-operations contract with advisory included | Advisory can be lighter than the operations beneath it; check seniority |
| Enterprise / GSI | high | Brand, clearances, relationships | $250K-multi-$M | Project and day-rate engagements | Built for large engagements; smaller firms can be overpriced or underserved |
Where each vCISO model fits
Two axes that matter when you are choosing: how the work is delivered (senior humans vs. product and automation) and who it is built for (volume SMB vs. bespoke enterprise). Where a provider sits tells you a lot about what working with them will feel like.
Most providers make you choose: a boutique that advises but does not run anything, or an operations shop priced for the enterprise. IOmergent is built for the middle. Senior security leadership combined with managed cloud security (CSPM, SSPM, and MDR) and AI governance. You get the judgment of a boutique and the execution of an operations provider from one team, at a mid-market price.