How to price vCISO services

Which vCISO pricing models are there?

Cynomi names three: a per-client monthly retainer, hourly or project-based fees, and tiered packaging. In practice a practice combines them: a retainer for continuing oversight, a fixed-price project for a bounded deliverable, and hourly rates as the overage when a retainer allowance runs out.

• Retainer. A fixed monthly fee for a defined scope and hours. Predictable for both sides; hour caps can run out during an incident or audit sprint.
• Project. A fixed price for a defined deliverable such as a readiness assessment. It ends when the deliverable does, so it often leads into a retainer.
• Tiered packages. Two or three named retainer levels, each with a stated scope and hours, so a client can move up as the programme matures.

Cynomi's three models are the structure the sections below follow.

What do consultancies and MSPs charge per client each month?

Two sources publish tier bands. Cynomi writes for MSPs; Consilien describes its own client pricing as a vCISO provider.

• Cynomi (published 28 April 2026) lists a core security advisory tier at $1,000 to $1,500 a month, a full vCISO programme at $2,000 to $3,500 and strategic advisory at $3,500 to $5,000, for clients of 50 to 500 employees.
• Consilien (published 26 June 2026) bands retainers by client size: $1,500 to $4,000 a month under 50 people, $3,000 to $7,000 at 50 to 200 people, $5,000 to $12,000 at 200 to 500 people, and $10,000 to $20,000 where several frameworks apply.

The two differ in provider and scope, so use them to bracket your own tiers, not as a market average. The same figures from a buyer's side are on the vCISO cost guide.

How many hours should a retainer include, and what happens on overage?

Tie each tier to a stated number of hours and say what happens beyond it. Consilien pairs its bands with 5 to 8 hours a month for the smallest clients, 8 to 15 for first-framework work and 10 to 20 for active audit work, rising to 20 hours and up for multi-framework clients.

For overage, vCSO.ai reports $250 to $400 an hour above the monthly allotment and warns buyers to watch the overage line rather than the headline retainer. Stating your overage rate and your scope boundaries in the proposal avoids disputes later.

What is utilisation and why does it set your margin?

Utilisation is the share of your available working hours that you can bill. A retainer earns the same fee however many hours it takes, so each unplanned hour lowers revenue per delivery hour. Track delivery hours per client each month against the hours the tier assumes, and reprice or tighten scope where they keep running over.

What does the software behind the service cost per client?

Where GetCybr fits: it is software for the delivery side, priced per client per month on the tier each client needs. GetCybr Comply is platform software only; the human vCISO is supplied and priced separately.

Public partner rates have no platform fee: Monitor $49, Audit $99 and Comply $199 per client per month, with Brand and Connect included for every account. These are catalog list rates before any volume discount or annual prepay; platform pricing shows how those change them. The calculator below takes this cost from the same catalog.

What margin does a retainer earn?

It depends on your hours and your cost of delivery, so the calculator uses your own numbers. None of the sources checked publishes a delivery margin for vCISO services, so this page does not quote one. The starting values are placeholders, not benchmarks.

How do you set a tier price?

1. Write the scope of each tier and the hours it assumes, using your own delivery records where you have them.
2. Multiply those hours by your cost per delivery hour, add the platform cost per client, then divide by (1 minus the gross margin you want) to get the fee. Example: 70% margin means dividing cost by 0.3.
3. Compare the result with the published bands above to see whether the tier sits inside the range clients are quoted.
4. State the overage rate and the boundary of scope in writing, and review utilisation each quarter.

Sources

Every market figure above was read from the page linked here; the list shows each page's accessed date. These are provider-published prices, not audited market data or GetCybr prices. Ranges a source does not publish are shown as not published; no delivery margin is published by any of them.

1. vCISO Cost & Pricing: What Fractional CISO Services Run, Consilien (published 26 June 2026), accessed 2 November 2026. Used for: Retainer bands by company size with hours a month, hourly advisory of $200–$400, fixed project fees of $10,000–$75,000, and four cost drivers (scope, compliance, IT complexity, seniority).
2. vCISO Pricing Models for MSPs: How to Price Security Advisory Services in 2026, Cynomi (published 28 April 2026), accessed 2 November 2026. Used for: Per-client monthly retainer tiers for SMB clients of 50–500 employees (core $1,000–$1,500, full programme $2,000–$3,500, strategic $3,500–$5,000) and hourly rates of $150–$300; names per-client retainer, hourly or project, and tiered packaging as the pricing models.
3. 2026 vCISO Pricing Benchmark: Published Rates, vCSO.ai (dated 17 July 2026), accessed 2 November 2026. Used for: Retainer overage of $250–$400 an hour above the monthly allotment; every figure is provider-published and no independent survey of actual vCISO invoices exists.