Back to blog

Fractional CISO vs Virtual CISO: What UK SMEs Actually Need

•5 min read

Search for security leadership support for a UK SME and you will hit two terms: fractional CISO and virtual CISO. Providers use them interchangeably, job ads mix them up, and most comparison content on the internet was written to fill a gap rather than to explain the market.

Here is the honest answer: in the UK market, these two terms usually describe the same thing. A senior security leader working with your business on a part-time, retained basis. If you are comparing providers on their job title alone, you are comparing the wrong thing. What actually differs is how the engagement is structured — and that is where SMEs get this decision right or wrong.

Why the terms get used interchangeably

Both models exist for the same reason: most SMEs do not need a full-time CISO. A permanent CISO in the UK runs roughly £120,000 to £180,000 a year, and most businesses under a few hundred staff cannot justify that role five days a week. What they need is serious security judgement in the room a few days a month — someone to set direction, own risk, and answer to the board, insurers and customers.

Both fractional and virtual CISO models deliver exactly that. Some providers call two retained days a week a fractional engagement; others call the same arrangement virtual. There is no standards body defining the terms, so the label tells you less than it appears to.

What the engagement actually looks like

Rather than comparing labels, compare the shape of the arrangement. These are the dimensions that genuinely differ between providers — under either name:

  • Days and rhythm: how many days a month, and whether they are fixed (for example, the first Tuesday of each month) or drawn on demand. Fixed rhythms produce better governance; on-demand arrangements tend to react rather than lead.
  • Scope: is the engagement strategy-only, or does it include hands-on work — configuring controls, reviewing your Microsoft 365 baseline, running supplier assessments? Some leaders stay at board level; others roll up their sleeves. Both are valid, but you should know which you are buying.
  • Deliverables: a security strategy, a risk register that actually gets updated, policy set, an incident response plan your team can follow, evidence packs for Cyber Essentials or ISO 27001. If a provider cannot list what lands in your inbox each month, you are buying a retainer, not an outcome.
  • Presence: do they attend your board or leadership meetings? Do they speak to your insurers or your largest customer's security team when a supplier assurance questionnaire arrives? That conversation is often the real job.
  • Cover: what happens when something goes wrong at 4am, or while your CISO-equivalent is on holiday? Some engagements include incident cover; others do not.

What UK SMEs should actually compare

When you are weighing two proposals, these questions separate a genuine security leader from an expensive pair of hands:

  • Regulatory grounding: can they explain how your UK GDPR accountability obligations apply to the systems you actually run, including any AI tools your team has adopted? A good fractional CISO reads your record of processing and tells you what is missing.
  • Certification pathway: if a customer or insurer has made Cyber Essentials Plus or ISO 27001 a condition of doing business, do they own that programme end to end — gap assessment, remediation, internal audit, certification support? This is where part-time security leadership earns its fee.
  • Evidence habits: insurers and enterprise customers increasingly ask for evidence, not assurances. Do they build the logging, reporting and review routines that produce that evidence continuously, or scramble for it when a renewal lands?
  • Honesty about fit: a good provider will tell you when you do not need them yet. If every conversation pushes you towards a bigger retainer, treat that as a signal.

A realistic progression for a growing SME

A pattern I see repeatedly, and one worth planning for:

Early stage, you bring in fractional support to build the foundations — strategy, policy set, a risk register, a Cyber Essentials submission. A few days a month is enough.

As you grow, customer scrutiny grows with you. Enterprise buyers start sending supplier assurance questionnaires. Cyber insurance renewals start asking harder questions. The monthly rhythm that worked at twenty staff leaves gaps at a hundred, and the engagement shifts towards a more continuous virtual model — more days, more operational presence, real incident cover.

The businesses that handle this well treat it as one relationship maturing, not two different services. The ones that struggle rip up the arrangement each time their circumstances change, usually under time pressure from a customer deadline.

The short version

Fractional CISO and virtual CISO are two labels for an overlapping market. Do not choose between the terms — choose the provider, and compare them on days, scope, deliverables, presence and cover. Ask what evidence they will produce for your insurers, your customers and your auditors. And if you are planning an AI pilot alongside all this, make sure whoever takes the security lead can talk about that too, because it is now a board question, not a technical one.

If you are weighing up security leadership support for your business and want a straight view on what you actually need, get in touch via the contact page.