Somewhere between the Director seat and the full-time CISO seat sits a third option the market has been growing fast: selling CISO-level judgment to companies too small, too early, or too unwilling to fund the full-time version. Fractional CISO work is a real career, a real business, and, used deliberately, a real route to scope evidence. It is also a swamp of underpriced advisory work and liability nobody read the fine print on. I sit inside security leadership hiring at a large technology company, and fractional candidates now appear in a meaningful share of loops, so both the seller’s math and the buyer’s skepticism are worth writing down.
How much does a fractional CISO charge?
Fractional CISO rates in the US typically run $250 to $450 per hour, or monthly retainers from roughly $4,000 for a light advisory footprint to $15,000 or more for a day-plus per week with named accountability. Rates scale with regulatory complexity and whether you carry real decision authority or only advise. These are observed ranges, not survey figures.
What the work actually is
Strip the branding and fractional engagements cluster into three shapes:
Compliance-driven. The client needs SOC 2, ISO 27001, HIPAA, or a customer security questionnaire cleared to close deals. Scoped, outcome-shaped, and the easiest work to sell because the buyer already feels the pain in lost revenue. Also the most commoditized, since platforms and MSPs sell it as product.
Board- and investor-driven. A term sheet, an audit committee, an insurer, or a large customer asked “who owns security here?” and the honest answer was nobody. You become the answer for two to six days a month: risk assessment, roadmap, hiring plan, the board slide. This is the highest-leverage shape, because you are working at executive altitude, which is exactly the experience that compounds.
Incident-driven. They got burned, response is over, and adult supervision is now funded. Highest urgency, best rates, most likely to convert into a long retainer or a full-time offer.
What the work is not: hands-on-keyboard engineering at an hourly rate. The moment you are configuring the SIEM you have become an expensive contractor, and both the margin and the positioning collapse.
The money, honestly
Ranges observed in the current US market, with the usual caveat that these are typical bands, not survey precision:
- Hourly advisory: $250 to $450 per hour, with incident-adjacent and heavily regulated work reaching $500 or more.
- Monthly retainers: roughly $4,000 to $8,000 for a light footprint (a few days a month, advisory posture), $10,000 to $20,000 or more for a day-plus per week with named accountability, board attendance, and a roadmap you own.
- Via MSP or vCISO platform: expect the platform to bill the client a multiple of what reaches you. The trade is real: they fill your calendar, you keep less and build their brand instead of yours.
The portfolio math is what makes it attractive: three or four mid-band retainers gross more than most Director salaries, with more calendar control. The math nobody quotes is utilization. Selling, scoping, and switching between four client contexts consumes real hours that bill at zero, and most independents stabilize well below the naive clients-times-retainer number. Price accountability, not hours: the client is buying the right to put your judgment in front of their board and their insurer, and that is worth more than time.
Two non-negotiables before the first contract: an entity plus errors-and-omissions insurance, and an engagement letter that is explicit about decision authority and about what happens mid-incident. “Fractional” gets legally interesting on the worst day of the client’s year. Decide on paper, in advance, whether you are an advisor who recommends or an officer who decides, because plaintiff’s counsel will ask, and the scapegoat dynamics that apply to the full-time seat apply to you with less protection.
Landing the first clients
Every successful independent I have watched started with the same three channels, in this order:
The people who already trust you. Former employers, peers who moved companies, the VC or PE firms attached to companies you helped. The first client is almost never won cold; it is someone who has seen your judgment and now has budget-shaped pain. Announce the practice plainly to your network and name the three problems you solve.
Auditors, lawyers, and insurers. The professionals who sit next to your buyer at the moment the pain arrives. An audit firm that just failed a client on SOC 2 readiness, a breach counsel whose client has no security owner, a cyber insurer’s broker with a hairy renewal: each of these people needs a name to hand over, and they hand over the same few names for years. Being one of them is worth more than any amount of content marketing.
Deal-blocked founders. Startups lose enterprise deals on security questionnaires every week, and the founder experiences it as revenue, not as security. Positioning that leads with “I unblock enterprise deals” outsells “I reduce risk” every time, because it is priced against a number the buyer already knows.
Platforms and MSP partnerships are a legitimate fourth channel for filling early capacity while your own pipeline builds. Just go in knowing the trade you are making on rate and brand.
The career math: does it help you get the full-time seat?
This is the question that matters for most readers of this site, and the honest answer is: it depends entirely on which experience you accumulate.
What fractional work genuinely builds: board reps, breadth across environments and verticals, first-hundred-days pattern recognition, comfort selling security in business language, and executive network. A candidate who has presented to nine boards across four industries has an altitude asset most Directors lack, and it shows within minutes in a loop.
What it does not build, and what panels probe for: operating scope. Fractional advisors rarely own a budget through a planning cycle, rarely manage managers, rarely live with the twelve-month consequences of their own roadmap. In loops, fractional-heavy candidates get some version of “you have advised twelve companies; tell me about the last time you had to live inside your own decision for a year.” Candidates without a real answer stall exactly where the first-time CISO guide says Directors stall, just with better slideware.
The pattern that works: use fractional deliberately, not indefinitely. One or two years, anchored by at least one deep engagement where you hold named accountability, own the plan, hire people, and return to the same board quarter after quarter. That engagement is your scope story. Then either convert a client into your full-time seat, which is one of the most common quiet paths into a first CISO title, or run at the open market with the interview guide and a resume that frames the portfolio as evidence rather than as drift, per the resume guide.
What kills candidacies is the drift version: five years, a rotating cast of shallow retainers, no engagement anyone would call ownership. That profile reads as someone who opted out of accountability, and the market prices it accordingly.
Who should actually do this
Fractional work suits you if you already operate at Director-plus altitude, can sell (or can learn to sell, because you are the pipeline), tolerate income lumpiness, and want either lifestyle control or a deliberate bridge to the seat. It does not suit you if what you need is your first experience of executive accountability; you cannot rent out judgment you have not yet had to live with. If that is where you are, the becoming a CISO guide is the sequence to run first.
And whichever direction you take, keep your scope visible to the people staffing real seats. Converted clients and search firms are the two ways fractional executives land full-time titles; the CISO Network covers the second one quietly, with your profile anonymous until you approve each introduction.