Why Pricing Is the Hardest Part of a vCISO Practice
Most vCISOs undercharge. They know this. The problem is not confidence — it is structure. Without a clear pricing model, every new client engagement becomes a custom negotiation. You end up with a portfolio of clients all paying different rates for loosely defined scopes, and you cannot tell which ones are profitable until it is too late.
Pricing is the difference between a sustainable practice and an expensive job. If you are building a vCISO practice — whether as an independent consultant, an MSSP adding security services, or a firm scaling beyond a handful of clients — your pricing model determines your ceiling.
If you are still deciding whether to make the jump into vCISO services, our overview of what a vCISO does covers the role and when organizations typically need one.
The Four Pricing Models
Model 1: Hourly Billing
How it works: You bill by the hour at a fixed rate. The client pays for time spent.
Typical ranges: Hourly rates for vCISO services range broadly based on experience, geography, and specialization. Senior practitioners with framework expertise and industry credentials command premium rates, while those building initial experience price lower to build a client base.
When it works: Short-term assessments, gap analyses, incident response support, or advisory engagements where scope is genuinely unpredictable. Hourly billing is also reasonable for initial engagements where neither party knows the true scope yet.
When it fails: Ongoing vCISO relationships. Hourly billing penalizes efficiency — the faster you solve problems, the less you earn. It also creates budget anxiety for clients, who hesitate to call you because the meter is running. The result is clients who under-use your services and then blame you when something goes wrong.
Model 2: Monthly Retainer
How it works: A fixed monthly fee for a defined scope of services. The scope might be expressed as a set of deliverables (monthly risk review, quarterly board report, annual policy update) or as a time allocation (20 hours per month).
When it works: Established vCISO relationships with predictable scope. Retainers give both parties budget certainty and encourage the client to actually use your services rather than hoarding hours.
Key consideration: Time-based retainers (e.g., "20 hours per month") still have the efficiency penalty of hourly billing — just with a cap. Deliverable-based retainers ("monthly risk review, quarterly board report, continuous compliance monitoring") reward you for working smarter, not longer.
Model 3: Per-Client Flat Fee
How it works: A single monthly price per client, regardless of hours. This is the model most vCISO practices aspire to because it scales — your revenue grows with client count, not with hours worked.
When it works: When you have standardized your delivery enough that you know the true cost of serving each client. This typically requires a GRC platform that automates evidence collection, risk monitoring, and reporting so that per-client labor stays predictable.
The math: Calculate your per-client tool cost (GRC platform, communication tools, insurance) and add your labor cost per client (be honest about time spent on onboarding, ongoing monitoring, client communication, and reporting). That is your cost basis. Price above it with enough margin to cover overhead, unbillable time, and profit.
Model 4: Value-Based Pricing
How it works: You price based on the value you deliver — the contracts the client wins because they have SOC 2, the insurance premium reduction from a strong risk posture, the breach cost avoided. The price is a fraction of the value created.
When it works: When you can clearly articulate and measure the value. If your vCISO program helped a client close a $2M enterprise deal that required SOC 2, a $5K monthly fee is easy to justify. The challenge is that value is often hard to attribute directly and varies by client.
Practical advice: Pure value-based pricing is rare in practice. Most successful vCISO practices use it as a framing tool — pricing retainers or flat fees and then justifying the price in value terms during the sales conversation.
Calculating Your True Cost Basis
Most vCISOs calculate cost basis wrong because they count only direct labor. Your true cost basis per client includes:
Direct costs:
- Your time (or your team's time) spent on client work, including meetings, reviews, reporting, and ad hoc requests
- Platform and tool costs allocated per client
- Any subcontractor costs (penetration testing, specialized assessments)
Indirect costs that get ignored:
- Sales and onboarding time for new clients (often 10-20 hours that never get billed)
- Administrative overhead: invoicing, contract management, client communication that is not billable
- Continuing education and certification maintenance
- Insurance (E&O, cyber liability for your own firm)
- Unbillable time between client engagements
- Platform time spent on internal operations (your own firm's compliance, marketing, business development)
If you are not tracking these costs, you are guessing at margins. And most vCISOs who guess discover they are making less per hour than they did as a salaried CISO — with more risk and no benefits.
The Margin Trap
The margin trap works like this: you sign a client at a monthly retainer that looks profitable. Then scope creep happens. The client calls with "quick questions" that take an hour. Board meetings get added. A vendor assessment comes in that was not in scope. You absorb the work because raising the issue feels uncomfortable, and before you know it, the engagement is underwater.
The fix is not better contracts (though those help). The fix is delivery infrastructure that keeps your per-client cost stable even as client needs fluctuate. This is where platform automation matters most.
When your vCISO tech stack handles evidence collection, risk monitoring, compliance tracking, and reporting automatically, the "quick question" takes 5 minutes instead of an hour because the answer is already in the dashboard. The board report generates itself from real data instead of requiring a day of manual preparation.
The practices that maintain healthy margins are the ones where the platform does the repetitive work and the vCISO spends time on judgment, communication, and strategy — the things that cannot be automated.
Packaging Your Services Into Tiers
Tiered packaging solves two problems: it gives clients clear options at different price points, and it gives you a natural upsell path as the relationship matures.
Tier 1: Assessment Package
What is included: Initial risk assessment, gap analysis against one compliance framework, risk register build, remediation roadmap, executive summary.
Duration: One-time engagement, typically 4-8 weeks.
Positioning: This is your entry point. It gives the client immediate value and gives you the information needed to scope an ongoing engagement accurately. Many vCISOs price assessments at a slight discount because the real value is the retainer that follows.
Tier 2: Compliance Program
What is included: Ongoing compliance management for one or two frameworks, monthly risk register review, quarterly executive reporting, policy management, evidence collection, audit preparation support.
Duration: 12-month retainer (monthly billing).
Positioning: This is the core of most vCISO practices. The client gets continuous compliance coverage and you get predictable recurring revenue. Platform automation is essential at this tier to maintain margins.
Tier 3: Full vCISO Program
What is included: Everything in Tier 2 plus security strategy development, board-level reporting, vendor risk management, incident response oversight, security awareness program management, and participation in executive meetings.
Duration: 12-month retainer with annual renewal.
Positioning: This is the premium tier for clients who need a strategic security leader but cannot justify a full-time CISO salary. The vCISO functions as a member of the executive team, not just a compliance manager.
The state of the vCISO market in 2026 shows growing demand across all three tiers, with the strongest growth in Tier 2 and Tier 3 as more mid-market companies recognize they need ongoing security leadership.
Structuring a Winning Proposal
Your proposal is a sales document, not a contract. It should answer three questions in order:
1. What is the problem? Summarize the findings from your discovery call or assessment. Mirror the client's language — if they said "we keep failing vendor security questionnaires," use those exact words.
2. What will we do about it? Describe your recommended tier in clear deliverables. Avoid jargon. "Monthly review of your risk register with updated scores and new mitigation tasks" is better than "continuous risk management."
3. What does it cost and what do you get? Present the price alongside the value. If the client needs SOC 2 to close enterprise deals, frame the price against the revenue those deals represent. If they need CMMC for DoD contracts, frame it against contract values.
Include a timeline. Clients want to know when they will see results. "Risk register built in week 2, first board report in month 2, audit-ready by month 6" gives them a roadmap.
If you are an MSP looking to add vCISO services to your offering, our guide on transitioning from MSP to MSSP covers the operational changes beyond just pricing.
When and How to Raise Prices
Raise prices when:
- Your cost basis increases — platform costs, insurance, certifications, subcontractors
- Your scope has crept — if you are consistently delivering more than the contracted scope, the next renewal should reflect reality
- Your expertise increases — new certifications, new framework competencies, published thought leadership, successful audit outcomes
- Market rates have shifted — if peers with similar experience and capabilities are charging more, your pricing signals lower value
- You are at capacity — if you cannot take new clients, your prices are too low. Raising prices is how you grow revenue without growing hours
How to raise prices:
Give notice. 60 to 90 days before renewal is standard. Frame the increase in terms of what has changed — expanded scope, new capabilities, market alignment. Never apologize for a price increase. If your work delivers value, the price should reflect it.
For existing clients, consider grandfathering current rates for a transition period (one quarter at the old rate) to maintain goodwill. For new clients, implement the new pricing immediately.
BlueRadius works with vCISO practitioners building and scaling their practices, from initial pricing strategy through platform selection and client delivery optimization.
Frequently Asked Questions
What is the most common vCISO pricing model?
Monthly retainers are the most common model for ongoing vCISO engagements. They provide budget predictability for the client and revenue predictability for the practitioner. Deliverable-based retainers are preferred over time-based retainers because they reward efficiency.
How do I know if my vCISO pricing is too low?
If you are consistently working more hours per client than planned, cannot take new clients without burning out, or have never had a prospect push back on price, you are likely underpriced. Track your actual hours per client against your quoted scope for two months — the data will tell you.
Should I charge separately for tools and platform costs?
Most vCISO practices include platform costs in their pricing rather than passing them through as a separate line item. Clients prefer a single price, and bundling tools into your fee lets you present the platform as part of your methodology rather than an expense.
How do I handle scope creep without damaging the client relationship?
Document scope clearly in your agreement and track out-of-scope requests. When a pattern emerges, address it proactively: "Over the past quarter, we've handled X, Y, and Z outside our agreed scope. I'm happy to include these going forward — here's what the expanded scope looks like." Frame it as a service upgrade, not a complaint.
When should an MSP start offering vCISO services?
When your MSP clients start asking security questions you cannot answer with managed IT alone — vendor security questionnaires, compliance requirements, cyber insurance applications, or board-level security reporting. These are signals that the market is pulling you toward vCISO services.
Building or scaling a vCISO practice? Start your free trial of Radius360 — the platform built for multi-client vCISO delivery with per-client dashboards, automated evidence collection, and board-ready reporting. For practice-building guidance, connect with BlueRadius.
The vCISO Playbook
Lesson 3 of 10