Hiring a Fractional CISO? 7 Questions That Separate a Partner From a Logo

The short answer

A fractional chief information security officer (CISO) can be one of the best hires a young company makes. You get someone who has run security before, for a fraction of a full-time salary, at the stage when an enterprise buyer starts asking who your security leader is.

You can also get a logo: a senior name on your trust page and your sales deck who is rarely in the room. KORE1, a staffing firm that places fractional leaders, warns that when the price feels too low for a senior operator, you’re probably looking at a virtual CISO (vCISO) offering “where the senior name does the scoping call and junior staff does the actual work” (KORE1). That isn’t necessarily bad, KORE1 adds, as long as you know what you’re buying.

In my experience, the difference rarely shows in the first call. Both versions are smart, both have good references, and both use the same words. It shows in the answers to specific questions, especially when you ask for evidence instead of reassurance. Here are the seven I’d ask:

1. What did you ship for a client last month?
2. Whose name goes on our trust page, and what will that person stand behind?
3. If two of your clients have an incident on the same night, who answers ours?
4. Which artificial intelligence (AI) tools will touch our data, and who keeps the hours they save?
5. If we switched compliance platforms tomorrow, what would you lose?
6. Does your insurance cover what our customers’ contracts require?
7. When will you tell us to replace you, and will you help hire that person?

A word on where I’m sitting. My brother Jon and I run YSecurity, an on-demand cybersecurity team, so we compete with fractional CISOs for the same founders, and founders ask us these questions too. Please ask us all seven. We told the longer version of how we got here, and why we built YSecurity the way we did, in our founder story. If you’re still deciding whether you need security leadership at all, start with Jon’s guide, What Is a vCISO?, which covers what one costs, what one does and doesn’t do, and six questions of its own. This post assumes you’ve decided and you’re interviewing. Three of my seven sharpen questions from Jon’s list: client load, vendor ties and insurance.

At the end there’s a partner-or-logo scorecard that scores each candidate’s answers, writes your follow-up requests and prints an interview sheet you can take into the call.

Why everyone is fractional now

Fractional work is growing quickly from a small base. The newest numbers come from Revelio Labs, whose data, reported by the Financial Times in September, shows that “24 out of every 1,000 new executive positions advertised were fractional in 2026, up from just nine five years earlier” (Revelio Labs). Lightcast, the labor-market analytics firm, counted at least 34,000 US workers with “fractional” in their current job title in 2025, up 265 percent since 2019. There were 677 postings for fractional roles in all of 2025 and nearly 1,000 in the first seven months of 2026, and 97 percent of this year’s postings came from small and medium companies (Lightcast). Jon looked at what that wave of offers means for a founder whose first System and Organization Controls 2 (SOC 2) report just arrived, in The Week After Your SOC 2 Report Lands.

Prices vary as much as the titles do. Go Fractional’s 2026 report puts the average fractional CISO rate at $214 an hour, and KORE1 describes typical engagements as “usually 10 to 40 hours a month, at $3,000 to $20,000 monthly.” Jon’s guide breaks down what drives the price, and why a monthly retainer can cost more than it looks.

It isn’t only security. Chief AI officer roles are spreading too. The White House Office of Management and Budget (OMB) told every federal agency head to “retain or designate a Chief AI Officer (CAIO)” within 60 days (OMB memo M-25-21), and in IBM’s 2025 study of the role, “only 26% said they currently have a CAIO. This is up from 11% in 2023” (IBM). Go Fractional’s market data already lists an average rate for fractional chief AI officers: $218 an hour (Go Fractional). Amber McKenzie, a fractional chief data and AI officer, offered a good test in October for anyone hiring AI leadership: “could you write the job description today?” (Amber McKenzie on LinkedIn). The same test works for security.

Not everyone is a fan, and the skeptics are worth hearing, because their complaints are exactly what the seven questions test for. Lee McCabe, a private equity investor, wrote one of the most-discussed versions last year:

“All of a sudden, everyone's fractional.”

“One billed for a "brand refresh" that was literally the same deck they'd delivered to another portco six months earlier. Just find-and-replace on the logo.”

Lee McCabe · Private equity, digital value creation, board member · November 18, 2025

Load the post from LinkedIn

David Mackey, a partner at Albany, listed seven situations where fractional leadership works, then drew the line in one sentence: “Fractional fails when you need someone who owns it, not someone juggling it” (David Mackey on LinkedIn). Both are fair. The answer to them isn’t to avoid fractional help. It’s to hire the version that owns things.

"The word fractional implies a level of expertise / seniority. But yes, it's a fancy word for part-time."

tbird24, who runs the Fractional Jobs board, on Hacker News, December 2024

Part time is fine. What you’re buying is judgment you can trust, and the interview is where you find out whether you have it. Yash Kosaraju, the CISO of Andreessen Horowitz (a16z), called a fractional CISO “a great resource” when Jon asked him on episode 104. Later in the same conversation, Yash described one of the more challenging moments of his career: a role he took after Box and left in under two months, because of things he “didn’t go deep into in the interview process.”

Interviews cut both ways, and his lesson holds on the buying side too. Going deep is what the next seven sections are for.

1. What did you ship for a client last month?

Ask it like this. “Show me something you personally produced for a client in the last 30 days. Redact whatever you need. Then show me what you’d deliver to us in month one.”

Why it matters now. The classic disappointment is paying for advice when you needed work. In December 2024, a Hacker News commenter who had spent two years hiring fractional executives, including a chief marketing officer, a finance chief and a technology chief, and was spending “$250k/yr on fractionals,” wrote that in their experience most fractionals “could simply be described as ‘paid advisors’.” When their engagements failed, it was either expectations nobody had written down or a fractional who “simply didn’t want to do anything other than join meetings and advise” (Hacker News). AI has made this easier to miss. A polished policy pack or roadmap deck is now cheap to produce, so a beautiful document proves less than it used to.

A partner hands you a redacted questionnaire they answered, a threat model, an incident runbook or a policy rewritten for a client’s actual stack, plus a month-one plan with named deliverables and dates. A logo talks about frameworks, shows you a template and offers to start with a strategy.

Evidence to ask for:

• One redacted artifact from the last 30 to 60 days, produced by the person who’d work with you.
• A month-one statement of work with named deliverables, dates and owners.
• A sample invoice or time log with task descriptions, so you can see what an hour buys.

The same commenter’s fix is the one I’d copy: “my #1 recommendation is to have a very specific and well written statement of work that you mutually agree on.” It’s also why we bill in 15-minute increments “with a clear description of every task,” as our on-demand team page puts it. Every hour should map to something you can point at.

Some buyers now check for templates, too. This spring, pseudonymous allegations about the compliance startup Delve, which Delve disputes, set off a long Hacker News thread about templated compliance work. One commenter described what a template means for a SOC 2 report, the security audit report enterprise customers ask for:

"If the SOC2 report is just a pre-populated template, it is meaningless."

emilycg, on Hacker News, March 2026

Delve’s response, as TechCrunch reported it, is that it offers “templates to help teams document their processes in accordance with compliance requirements,” and that “Draft templates are not the same as ‘pre-filled evidence’” (TechCrunch). Either way, the question for your candidate is the same: what did they produce, and for whom?

2. Whose name goes on our trust page?

Ask it like this. “When we publish a trust page or answer a security questionnaire, whose name stands behind it? What would you sign, and what would you refuse to sign?”

Why it matters now. Your trust page and your questionnaire answers are claims customers rely on, and the person behind them should know exactly what each one means. One of the clearest legal lessons of the last few years came from SolarWinds. The Securities and Exchange Commission (SEC) dismissed its remaining claims against the company and its CISO with prejudice in November 2025. In the July 2024 ruling that came before, “The only claims that were allowed to proceed concerned the representations in the website Security Statement” (Harvard Law School Forum on Corporate Governance). The lawyers’ advice since then is to make sure “governance processes tie public statements to verified technical facts.”

Even people who sell fractional CISO services acknowledge the hard part. Asked about accountability, Rob Black, who runs a fractional CISO firm, told IT Brew: “I think that is a fair criticism.” And: “Anytime you’re hiring an outside party, signing off on behalf of the company is a little challenging” (IT Brew).

A partner tells you which claims they’d put their name behind, shows you the evidence for each, joins the customer’s security call and says plainly what they’d refuse to sign. A logo lends a name and leaves the answers to you.

Evidence to ask for:

• The exact wording they’d publish on your trust page, with the evidence behind each line.
• Who signs questionnaires and attestations, and who joins the call when a buyer’s security team has follow-ups.
• One thing they’ve refused to sign for a client, and why.

Our two posts this week are about exactly this: Monday’s on questionnaire answers that are enabled but not enforced, and Wednesday’s on who signs for each AI agent. A good fractional leader should have an opinion about both. If buyer security reviews are where your deals stall, that’s what our Sales Support service is for.

3. If two clients need you tonight, who answers us?

Ask it like this. “How many clients do you have right now? If two of them have an incident on the same night, who picks up our call, and have they already been in our Slack?”

Why it matters now. Concurrency is the honest limit of any part-time model, and two or three clients is the norm across fractional roles. In Go Fractional’s April 2026 survey of 213 fractional professionals, “Half of surveyed fractional professionals manage two or three clients at once” (Go Fractional), and about 7 percent carried six or more (2026 report). KORE1 is blunt about the extreme case: “A fractional CISO with ten other clients on retainer cannot be your on-call through a live ransomware event.” Its suggested test is a good one: “Ask the fractional directly what their last three weekend calls looked like” (KORE1).

Whoever answers should already know which of your data the business can’t run without, the question Michael Brooks, a vCISO, urged businesses to ask themselves on episode 7 of our podcast.

A partner names the backup who’d answer, shows you that the backup already has access and context, and tells you about the last time two incidents overlapped. A logo tells you they’re always reachable.

Evidence to ask for:

• Their current client count, and the hours each client gets.
• The named backup, already in your Slack before anything goes wrong.
• A real example of covering two incidents at once, and their last three weekend calls.

This is the question where a team has a structural edge over one person, and a Hacker News commenter made the case well:

"Why shouldn't I as a client get 10 hours a week from an architect and 5 hours a week from a security expert instead of paying for a whole one?"

hinkley, on Hacker News, August 2025

That’s the model we built: a dedicated lead who joins your Slack and stand-ups, backed by “45+ operators across compliance, pen testing, product and AI security,” as our on-demand team page says. Whoever you hire, ask the same thing: who answers when your lead is answering someone else?

4. Which AI tools will touch our data?

Ask it like this. “Which AI tools and agents will you use on our work? Whose accounts do they run under, what do they keep, and when AI saves you an hour, who keeps it?”

Why it matters now. Security advisors adopted AI fast. Cynomi, which sells a platform for vCISO providers, surveyed 200 security leaders at managed service providers for its 2025 report and found that “Among providers offering vCISO services, 81% are already using AI or automation,” with “an average 68% reduction in cybersecurity and compliance workload over the past 12 months” (Help Net Security). That’s mostly good news. It also raises two questions many contracts don’t answer yet: where your data goes, and what happens to the price. One respondent to Go Fractional’s survey asked the second one out loud: “how should we reprice?” (Go Fractional).

A partner gives you the list of tools in writing, with accounts, retention and training terms, and bills in a way where AI efficiency shows up as fewer billed hours. A logo says they use best-in-class tools, and keeps the margin.

Evidence to ask for:

• A written list of the AI tools and agents that will touch your data, whose accounts they run under, and how long they keep it.
• Whether your data trains any model, and the contract clause that says so.
• How billing reflects work an AI did.

If their agents will hold keys to your systems, ask the questions from Wednesday’s post: one key per agent, a named owner, a cap and an off switch. Our AI access control audits start from the same list. And because we bill in 15-minute increments with a description of every task, the hours AI saves on your work show up as minutes you don’t pay for.

5. If we switched compliance platforms, what would you lose?

Ask it like this. “If we chose a different compliance platform or security tool tomorrow, would anything change for you? Please list every vendor relationship you have, in writing.”

Why it matters now. Many compliance platforms run partner programs for advisors, and they say so on their own pages. Thoropass asks, “Are you a fractional CISO, a Managed Service Provider (MSP), a Managed Security Service Provider (MSSP), an Infosec Consulting firm?” and offers “discounted pricing and referral rewards” (Thoropass). Vanta’s service-provider page speaks to “vCISOs, MSPs, and MSSPs” and invites them to “Increase margins, expand your client base, and break into new markets” (Vanta). Drata’s channel program, structured across three tiers, offers “MDF credits,” meaning market development funds (Drata). Secureframe offers service providers “A free NFR license,” a not-for-resale license (Secureframe). Sprinto promises referral partners “generous lifetime rewards” (Sprinto). None of those pages publish the amounts.

These programs are legal, common and often useful, and plenty of excellent advisors belong to one. The test is disclosure, and at least one platform is writing that standard for its own partners. A Sprinto job posting for a delivery partnerships manager lists, among the things that person will build, an arrangement where audit and assurance partners “will operate under independence-protected, non-contingent commercial models,” with standards covering “referral transparency” (Sprinto). It’s written for auditors, and it’s a fair standard to ask of an advisor too.

A partner gives you the list without being asked twice, and can explain why the recommendation would be the same without it. A logo recommends a platform before asking what you sell.

Evidence to ask for:

• A written list of every vendor relationship: partner tiers, referral rewards, discounts, market development funds, free licenses.
• For each tool they recommend, the reason it fits your company specifically.
• What they’d recommend if your budget were zero.

Here’s our answer, quoted from our service pages as written: “We have no relationships with vendors. On purpose.” In full, “YSecurity has no relationship with any vendor,” which means “no resale margins, no referral fees, no partner tiers, no certification quotas to hit.” The reason is the one this post is about: “A relationship like that would compromise our ability to show up as your true partner, so we don’t have one.” And “when a free, open-source tool beats a seven-figure platform for your use case, that’s exactly what you’ll hear from us.”

6. Does your insurance cover what our customers require?

Ask it like this. “Can you send your certificate of insurance and your indemnification terms, so we can compare them with what our largest customers require of us?”

Why it matters now. Enterprise contracts push requirements down to you, and some flow on to whoever helps you meet them. KORE1 describes a common mismatch: “Most fractional contracts cap indemnification at $1 to $2 million,” while a customer that is a hospital system, a bank or a government prime contractor may “require $5 million or $10 million in cyber liability flow-through.” In KORE1’s words, “This has killed more engagements at contract stage than any other single issue on our desk” (KORE1). That’s a staffing firm’s view, and the arithmetic is easy to check against your own contracts.

Coverage for security leaders themselves is uneven too. In 2024, CSO Online reported a Heidrick & Struggles finding about directors and officers (D&O) insurance: “38% of CISOs aren’t covered by their companies’ D&O insurance and a further 18% don’t even know if they’re covered.” Lisa Hall, then the CISO of SafeBase, added: “A lot of CISOs are also taking out errors and omissions insurance personally” (CSO Online).

A partner sends the certificate before you ask twice, puts the limits next to your customers’ requirements and tells you where the gap is. A logo tells you they’re fully insured.

Evidence to ask for:

• A certificate of insurance showing professional liability, errors and omissions, and cyber limits.
• The indemnification cap in their contract.
• Your largest customers’ flow-down requirements, side by side with both.

Those requirements usually live in the security exhibit attached to your customer contract, and I wrote about reading that exhibit earlier this month. Have your counsel read the indemnity clause; I’m not a lawyer, and this isn’t legal advice.

7. When will you tell us to replace you?

Ask it like this. “What would make you tell us to hire a full-time security leader? And when that day comes, will you help us hire them?”

Why it matters now. A fractional engagement should be built to end well. Northwoods Security Notes, a security newsletter, puts it in one line, “The best fractional CISOs make themselves unnecessary,” and names the green flag most people miss: “they can tell you when you’ve outgrown them” (Northwoods Security Notes). Riviera Partners, an executive search firm, says a fractional CISO, a vCISO engagement or a strong engineering leader with security ownership “can credibly cover the function for another 12 to 18 months in the right circumstances,” and warns that “Forcing the hire before the organization can support it is its own failure mode” (Hunt Scanlon Media).

The first full-time hire usually isn’t a CISO. Yash told Jon on episode 104 that the first security hire is “mostly a staff level, senior staff level engineer that can be independent,” and Rami McCarthy’s rule of thumb is to hire “when security is an unavoidable distraction from scaling your business” (High Signal Security).

If you have investors with a security bench, ask them too. Yash described the requests a16z’s portfolio companies bring him:

Listen · Yash Kosaraju on episode 104, from 3:15

A partner gives you written triggers, shows you a job description and interview loop they’ve run, and offers a reference from a past handoff. A logo tells you that you won’t need anyone else.

Evidence to ask for:

• Their written trigger for a full-time hire: hours a week of senior attention, regulated data, a team that needs a leader, or several of these at once.
• A job description and an interview loop they’ve actually run.
• A reference from a client who made that hire.

If you’re about to run that search, Jon’s conversation with Polina Morozov, then a security recruiter at Grammarly, on episode 46 is about what it takes to land strong security talent. We laid out the trade-offs between hiring in-house, bringing in an on-demand team and waiting in In-House, On-Demand, or YOLO?, and the hire-or-rent question was the topic of our October 6 fireside chat for founders, The Wrong Security Hire Burns Your B2B GTM Pipeline.

Our own agreement starts with “Love us, or let us go. Very simple,” with an optional monthly cap and no long-term contract. That’s the same test from the other side: a partner who can be let go any month has to earn the next one.

Score your candidates

Use this during or right after each interview. Pick the answer closest to what you heard. The scorecard scores each candidate, flags the answers that should stop a deal, writes your follow-up requests, and prints an interview sheet you can take into the next call.

Interactive · 5 minutes per candidate · Runs in your browser

Partner or logo? Score each candidate's answers

One candidate at a time, up to four, compared side by side. Leave a question on "Didn't ask yet" until you've asked it. Load the example to see how it reads.

Candidate, kept in this browser

The scorecard needs JavaScript. The seven questions, and what a partner and a logo answer to each, are written out above.

Score another candidate Load the example Remove this candidate Start over

…verdict for this candidate

…score, out of 14

…answers that sounded like a partner

…follow-ups to send

Print the interview sheet Download the sheet (.html) Download the scorecard (.md) Copy the follow-up email

Everything here runs in your browser and is saved only in this browser, candidate names included. A score is where the decision starts.

Ask us the seven questions →

We get your email and this candidate's scores, never candidate names. Sasha or Jon replies to set up a call where you ask us all seven, and we answer with evidence. No sequence.

The contract that keeps a partner a partner

Good answers in an interview are promises. The contract is where they become obligations. Whoever you hire, I’d ask for these in writing:

1. A statement of work with named monthly deliverables, dates and the person who produces each one.
2. The named lead and the named backup, with response times for an incident.
3. The AI clause: which tools touch your data, under whose accounts, what’s retained, and that nothing trains a model without your consent.
4. Written disclosure of every vendor relationship, updated when it changes.
5. Insurance and indemnity that match your customer contracts, checked against the security exhibits you’ve signed.
6. Ownership: every policy, risk register, evidence file and account in your company’s name, from day one.
7. The handoff: the trigger for a full-time hire, help hiring that person, and no lock-in.

Running the interview

A few things make the seven questions work better in practice:

• Send the questions a day ahead. Evidence takes time to pull together, and a candidate who has it will bring it.
• Interview the person who’d do the work, as well as the person selling it. KORE1’s warning about the scoping call is the reason.
• Score each answer right after the call, while you still remember what you actually heard. The scorecard above takes about five minutes.
• Ask for every yes in writing within a week. The scorecard’s follow-up email is a ready-made request.
• Call one reference who made a full-time hire with them. That checks question 7 with someone who lived it.

If you’d like to hear how we answer all seven, book fifteen minutes with Jon or me, and bring the scorecard. We’d ask the same of anyone you’re comparing us with.