Free tool
What does security leadership actually cost?
The salary is the part everyone knows. This works out the rest - employer NI, pension, recruitment, and the months where the role is funded but nobody is in it - on your assumptions, with the statutory rates cited.
In short
A UK employer carries National Insurance at 15% above the £5,000 secondary threshold, a minimum 3% pension contribution on qualifying earnings, on-costs for training and certification, and usually a recruitment fee of a fifth to a quarter of first-year salary. Add the months the role sits vacant and the months it takes to become effective, and the first-year figure is well above base pay. This model does that arithmetic from your own numbers.
Your assumptions
Every figure here is yours to set
We do not seed this with a salary benchmark. The range for security leadership is wide enough that one number would mislead more than it helped, so the sliders start somewhere round and you move them to whatever is true for you.
Your figure. We do not publish a benchmark, because the range for security leadership is wide enough that any single number would mislead.
Percentage of first-year salary. Contingency search and retained search sit at different points; use whatever your agency actually charges.
From opening the role to a signed start date, including notice period. This is the window in which nobody owns security.
From day one to knowing the estate, the people and the politics well enough to be making good calls unaided.
Certifications, training, conferences, equipment, professional memberships. Excludes tooling and any team beneath the role.
Whatever monthly figure you have been quoted, by anyone. Leave it at zero and the model tells you the break-even instead.
Year one, fully loaded
£172,971
1.22× the base salary before the recruitment fee lands.
- Base salary
- £120,000
- Employer NI
- £17,250
- Employer pension
- £1,321
- Training, certs, kit
- £8,000
- Loaded run rate
- £146,571
- Recruitment fee
- £26,400
The part nobody budgets
On these timings roughly 7.0 of the first 12 months have no effective security leadership - the vacancy, plus half the ramp. That puts the real figure at £34,594 per covered month.
Break-even
£14,414/mo
A retainer costing less than this is cheaper than the hire in year one, before any of the exclusions below.
Salary, fee and timings are your assumptions. The statutory rates are cited below. Nothing you enter is sent anywhere.
Not included
What this figure still leaves out
The number above is one person. It is not a security function, and treating it as one is how budgets get set at half of what the work needs.
- Any team beneath the role - analysts, engineers, a GRC lead
- Tooling, licences and platform costs
- Cover during holiday, sickness or notice periods
- The cost of a bad hire, or of the role turning over inside two years
- External audit, certification and penetration testing fees
The other side
Where an in-house hire wins outright
We sell a retained model, so take this section as the one worth reading closely. There are cases where the calculator is the wrong instrument and a permanent hire is simply correct.
Presence in the room
A permanent hire is in the corridor conversations, the hallway escalations and the meetings nobody thought to invite security to. A retained model can be brought in earlier by design, but it has to be designed - it does not happen by proximity.
Depth of institutional knowledge
Someone who has been in the business for three years knows which system nobody will admit is still running. That knowledge accrues with time in seat, and no engagement model shortcuts it entirely.
Scale
Past a certain size the work is genuinely a full-time role plus a team, and fractional leadership becomes the wrong instrument. The honest version of this calculator is that it stops making the case at some headcount.
Signalling
Some customers, insurers and investors want to see a named CISO on the org chart. That is not always a rational requirement, but it is a real one, and a retainer does not satisfy it in the same way.
Rates used
15%Employer National Insurance
Secondary Class 1 rate, charged on earnings above the £5,000 secondary threshold. Tax year 2026 to 2027.
HMRC - Rates and thresholds for employers 2026 to 2027 · verified 2026-08-27£5,000Secondary threshold
Annual earnings above which employer National Insurance is due. Tax year 2026 to 2027.
HMRC - Rates and thresholds for employers 2026 to 2027 · verified 2026-08-273%Employer pension minimum
Automatic enrolment minimum employer contribution, charged on qualifying earnings. Many employers pay more; this is the floor, so the model understates rather than overstates.
The Pensions Regulator - automatic enrolment contributions · verified 2026-08-27£6,240Qualifying earnings, lower limit
Lower limit of the qualifying earnings band for automatic enrolment. Tax year 2026 to 2027.
DWP - Review of the automatic enrolment earnings trigger and qualifying earnings band for 2026/27 · verified 2026-08-27£50,270Qualifying earnings, upper limit
Upper limit of the qualifying earnings band for automatic enrolment. Tax year 2026 to 2027.
DWP - Review of the automatic enrolment earnings trigger and qualifying earnings band for 2026/27 · verified 2026-08-27
Next
The number is the start of the argument, not the end of it
Cost decides very little on its own. What usually decides it is what the organisation actually needs the role to do in the next twelve months, and whether that is a standing presence or a sequence of pieces of work with an owner attached.
FAQ