A fractional CISO for companies that need one but can’t hire one
I sit in your leadership meetings, not beside them. Board updates, the security questionnaire blocking a deal, the incident plan nobody’s tested, the vendor who keeps missing their own SLA. That’s the job, for mid-sized UK and European companies that need senior security leadership without a full-time executive salary.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
There aren’t enough CISOs to go around
Roughly 35,000 full-time CISOs work worldwide, against an estimated 359 million businesses. Nearly every Fortune 500 company has one. Almost none of the mid-sized businesses that make up most of the economy do, and AI is automating away the junior analyst roles that used to train the next generation. For most of this market, fractional leadership isn’t the cheap substitute for a real CISO. It’s the only version that’s actually available.
Signs you need one
- Security questionnaires are slowing down or blocking deals, and nobody owns the answers.
- The board or your investors have started asking about cyber risk, and the answer is your IT manager or your MSP.
- A regulation like NIS2 now makes your management body personally accountable for security.
- Your cyber insurer’s renewal questions are getting harder, or the premium jumped.
- You have an incident response plan, but nobody has ever rehearsed it.
- People are adopting AI tools faster than anyone is deciding whether they should.
What’s included
Board and audit committee reporting
Quarterly security risk briefings in plain language, with the decisions the board actually needs to make.
Security strategy and roadmap
A prioritised plan tied to your business risks and budget, not to whatever the latest vendor pitch was.
Deal support and questionnaires
Security questionnaires and customer due diligence handled accurately and fast, so they stop blocking sales.
Incident readiness
Incident response playbooks and tabletop exercises, tested before you need them, so nobody is improvising when something breaks.
Supplier and MSP oversight
Someone on your side holding your IT providers and security vendors to what they promised, and reading the contract before anyone signs it.
Compliance ownership
Keeping ISO 27001, NIS2, GDPR and AI governance work running between audits instead of in a panic before them.
How it works
Every retainer starts with the fixed-fee 3-week diagnostic. I go through your infrastructure, access controls, supplier list and the AI tools people are actually using, then hand you a straight gap list and a roadmap ranked by what matters first. That tells us both what the retainer needs to cover, so it’s scoped to your situation rather than sold as a package.
The retainer itself is ongoing, not occasional: a regular rhythm of leadership meetings, board reporting and hands-on work, with time agreed up front and a fixed monthly fee. Most of it runs remotely in UK and Central European business hours, with on-site days booked as a block for board meetings, workshops and exercises.
To be straight about what this isn’t: I don’t provide 24/7 on-call incident command. What I do is make sure your incident plan is written, rehearsed and backed by the right retained response provider, so that when something happens at 3am your team already knows what to do and who to call.
Background
Twenty-five years in IT, cyber security, cloud and infrastructure across retail, manufacturing and financial services. CISSP and ISO/IEC 27001 Lead Auditor. I’ve sat in the room while a vendor tried to sell a board a six-figure platform to fix a problem a spreadsheet and a firm email would have solved, and I’ve watched consultants hand over a deck built to scare a board into a bigger contract. That’s not how I work.
Common questions
What is a fractional CISO?
A fractional or virtual CISO (vCISO) is a senior security leader who works for your company part time, on a retainer, rather than as a full-time employee. You get the same strategic leadership, board reporting and accountability, scaled to what a mid-sized business actually needs.
How much time do you spend with us each month?
It depends on your situation, which is why the retainer is scoped after the diagnostic rather than before. The time and the monthly fee are fixed and agreed up front, so you always know what you’re getting and what it costs.
How is this different from what our MSP provides?
Your MSP runs your IT and often some security tooling. A CISO decides what security the business needs, reports risk to the board, and holds providers, including the MSP, to account. Those roles work best when they aren’t the same organisation.
Can you work with our board from Sydney?
Yes. The practice is built for UK and European clients: meetings and day-to-day work run in UK and Central European business hours, and on-site days are booked as a block when being in the room matters, such as board meetings and tabletop exercises.
Do you provide incident response?
I make sure you’re ready for incidents: a written plan, rehearsed with your team, and the right retained incident response provider in place. I don’t offer 24/7 on-call incident command myself, and I’d be wary of any one-person practice that claims to.