Most comparisons of fractional and full-time CISOs stop at compensation. Compensation is the smallest of the four costs in this decision, and it is the only one that appears on a quote. The other three, acquisition, continuity and coverage, decide whether the organization is actually led.

The Market Numbers, Read Correctly

The most rigorous current benchmark is the 2025 IANS and Artico Search study of more than 550 CISOs in the United States and Canada. It found that most CISOs earn between $250,000 and $700,000 in total compensation, that pay rose 6.7 percent in 2025 while security budgets grew only 4 percent, and that 70 percent of CISOs now receive equity.

That last figure explains why published salary figures disagree so widely. Sites that report cash alone, such as PayScale at about $184,000, and sites that include more of the package, such as Salary.com at about $385,000, are describing the same executive. A board that budgets from a cash-only source will underestimate the real cost of a full-time hire.

Fractional pricing is less well measured. The ranges most often published, roughly $3,000 to $20,000 a month, come from firms that sell the service, and should be read with that in mind. Even so, the arithmetic is instructive: a fractional engagement at the top of that range costs $240,000 a year, which is the bottom of the full-time range. At the high end, the two models cost the same. Price does not separate them. Scope does.

Four Costs, Not One

CostFull-Time CISOFractional CISO
CompensationMost between $250,000 and $700,000 in total compensation, with equity for 70 percent.Commonly quoted at $36,000 to $240,000 a year, depending on scope.
AcquisitionA search that often runs six to twelve months, recruiting fees, and an interim gap while the seat is empty.Typically weeks to start. The cost is onboarding someone who will see the organization part-time.
ContinuityTenure estimates range from 18 to 26 months to over three years. Each departure resets relationships, context and the roadmap.Continuity depends on the provider. Knowledge often lives with one person and leaves with them.
CoverageA full working week of senior attention, and a named person when an incident happens.A rationed number of hours a month. Work beyond the allotment is billed or deferred.

Read across the rows, each model trades one risk for another. The full-time model buys coverage and pays for it in acquisition and continuity risk. The fractional model buys speed and price and pays for it in coverage.

Continuity Is the Cost No One Budgets

CISO tenure is widely quoted at 18 to 26 months, a figure that has circulated for years. More recent data is more encouraging: the 2025 Hitch Partners survey found an average current tenure of 39 months, up 11 percent from the year before. The same survey found that tenure at companies with fewer than 250 employees is significantly shorter.

The disagreement between sources matters less than the pattern inside them. The organizations most likely to hire their first CISO, smaller and growing ones, are also the ones where CISOs stay the shortest time. For them, the question is not only what a leader costs, but what the program loses each time the leader changes. Heidrick and Struggles found that nearly half of surveyed CISOs had no adequate internal successor in place.

Where Each Model Fails

The Full-Time Model

It fails at the transitions. A vacancy leaves the program without direction for months, and a new leader typically spends the first quarter rebuilding the picture the previous one had. It also concentrates knowledge in one person, which is the same single point of failure security programs are designed to eliminate elsewhere.

The Fractional Model

It fails between sessions. A signal that arrives on a Tuesday waits for the next scheduled block of hours. An incident at two in the morning tests whether the retainer includes one. And many engagements are advisory only: they produce recommendations, and leave the organization to find someone to carry them out.

The Failure Both Share

In both models, a large share of the leader's time goes to assembling the picture: pulling findings from separate technologies, reconciling them, and translating them for the board. That work is necessary, but it is not leadership. It is the part of the job that consumes the hours a fractional leader does not have and the attention a full-time leader should be spending on decisions.

The Regulatory Dimension

Since 2023, the U.S. Securities and Exchange Commission has required public companies to disclose a material cybersecurity incident within four business days of determining it is material, and to describe their cybersecurity governance in annual filings. The rule applies to public companies, but its effect is broader: customers, insurers and acquirers increasingly ask private companies the same questions.

The practical consequence is that governance must be demonstrable at any moment, not assembled before a quarterly meeting. That requirement favors whichever model can show, on demand, what the organization knows and what it decided. It is a requirement about continuity of information more than about the leader's employment status.

A Decision Framework

SignalPoints Toward
Public company, or a regulator that names a security officerFull-time, or a structure that guarantees named, continuous accountability
A security team of several people to direct every dayFull-time
Security embedded in the product, with daily engineering decisionsFull-time
First security leader, with the program still being definedFractional first, then reassess at twelve months
A certification or customer demand with a fixed deadlineFractional, scoped to the deadline and to what follows it
An acquisition, a platform change or rapid growthEither, provided coverage is contracted for the period of change

An Illustration

The figures below are illustrative, drawn from the ranges above, and do not describe a specific organization.

Consider an 800-person company that must maintain SOC 2 and ISO 27001, sells to enterprise customers, and has a security team of three. A full-time hire at $300,000 in total compensation, plus recruiting fees and a six-month search, costs well over $350,000 in the first year and leaves half of that year without a leader. A fractional engagement at $12,000 a month costs $144,000 and starts within weeks, but provides a fraction of the senior attention.

The right answer depends less on those totals than on two questions: can the three-person team run the program day to day with part-time direction, and can the fractional leader see what the team sees between sessions? If both answers are yes, fractional wins for now. If either is no, the lower price buys less than it appears to.

Five Questions to Ask Before Choosing

  1. Who sees a new signal between the leader's working sessions, and how quickly does it reach a decision?
  2. Who is accountable for an incident at two in the morning, by name?
  3. How is the board report produced, and how long does it take to assemble?
  4. What does the organization keep when the leader leaves?
  5. How much of the leader's time goes to gathering information, and how much to deciding?

Conclusion

Fractional and full-time are not a cheap option and an expensive one. They are two different bets on where risk will come from: a full-time hire bets against gaps in coverage, a fractional engagement bets against the cost of a seat the organization cannot yet fill. Either bet fails if the program's information lives in separate tools and in one person's head. That is the problem AQUILA C4I was built to solve, whichever model an organization chooses.

Sources

CH

Mr. Chen Heffer

Founder & CEO, CyTech

Founder and CEO of CyTech, the company behind AQUILA. Inventor of the CRAM™ methodology and author of the CISO Training Series.

← All insights