The vCISO case is usually made on cost, which is the weakest version of it. If cost decided the question nobody would ever hire a CISO, and plainly they do.
Here is the argument as it should be put to a board, including the parts that cut the other way.
Dimension 1: total cost, not salary
The comparison people make is retainer against salary. The comparison that is actually true is retainer against fully loaded cost: salary, employer national insurance, pension, benefits, recruitment fees typically 20 to 30 per cent of first-year salary, and the ramp period before a new hire is effective.
There is a second component people leave out entirely. A CISO is a leadership role, and leadership without delivery capacity means the roadmap they produce gets implemented by engineers borrowed from product, or not at all. A retained engagement that includes delivery is buying two things.
[CLIENT INPUT REQUIRED - Q15] Indicative retainer and comparison figures are being confirmed against delivered engagements before publication. This brief deliberately does not publish a cost range that has not been verified - a number on a business case is exactly the number that gets quoted back in a negotiation.
Dimension 2: time to effectiveness
A CISO search runs three to six months to a signed offer, and notice periods at that level are commonly three months. Six to nine months from decision to someone being in post is normal, and then there is a ramp.
Against a certification deadline that is already committed, or an enterprise deal blocked on a security review this quarter, that timeline frequently makes the hire irrelevant to the problem that triggered it. This is one of the more common reasons organisations start fractional and hire later.
Dimension 3: continuity
A single senior hire is a single point of failure with holidays, illness and a notice period. The average tenure in the role across the profession is short enough that the question of what happens when they leave is a live one rather than a theoretical one.
A retained engagement is backed by a team, which means cover exists and institutional knowledge does not walk out in one go. That is worth stating in the paper explicitly, because boards understand key person risk in every other context.
Dimension 4: breadth against depth
A single hire is one person's skill set. AI governance, ISO certification, supply chain assurance, incident response and cloud security are genuinely different specialisms, and nobody is deep in all of them.
A retained model draws on whichever specialism the roadmap needs this quarter. The counter-argument is real: a permanent hire accumulates context about your organisation that a rotating team does not, which is exactly why a vCISO engagement should be a named individual rather than a pool.
Where the case fails
Put this in the paper too. It is more persuasive than omitting it, and a board that finds the counter-argument themselves will discount everything else.
Hiring is the better answer when there is a security team to build and lead, when the role is genuinely a full week of work, when regulatory obligations require an employed approved person, or when the primary objective is culture change - which needs someone in the building rather than someone excellent who is present four days a month.
The recommendation that usually holds
For organisations between roughly 50 and 1,000 people with no existing security team, fractional leadership first is normally the right sequence: it is available now, it costs materially less while the position is being established, and it leaves behind a risk register, a roadmap, a policy set and a certification position that make the eventual permanent hire far more successful than a standing start would.
The security leadership cost model runs this arithmetic on your own figures, including the employer National Insurance, pension and recruitment costs that a salary comparison leaves out.
A direct comparison across all four dimensions is set out separately, including how to work out which situation you are in.