vCISO and Advisory

Security advisory sells strategy, governance, and the security-executive function rather than deployed technology. The most notable recent development in the segment is the productization of the CISO's judgment into software a service provider can resell at scale. In April 2025, Cynomi — an AI-driven platform that lets a single analyst deliver virtual-CISO services to dozens of clients — raised a $37M Series B co-led by Insight Partners and Entrée Capital, after tripling ARR in 2024. The defining tension is whether value stays with the scarce human advisor or migrates to the platform that lets a non-expert deliver expert work.

What advisory is, and the vCISO wedge

Security advisory is the non-implementation layer of services: it sells decisions, governance, and assurance rather than deployed technology or an operated SOC. It spans a spectrum from one-off projects to an ongoing seat in the org chart:

• Strategy & architecture advisory — "what should our security program be?" Roadmaps, target operating models, board reporting, security architecture reviews.
• Risk, governance & compliance advisory — risk assessments, framework alignment (NIST CSF, ISO 27001, SOC 2, CMMC), audit readiness, policy design. Overlaps with Consulting & the Big Four and GRC/TPRM.
• vCISO (virtual / fractional CISO) — an outsourced security executive: someone who owns the security program part-time, sets strategy, runs the risk register, reports to the board, and is accountable — without the ~$400K+ full-time cost.

The vCISO is the wedge that turns advisory from a project business into a recurring-revenue business — and that is why it is the part of advisory attracting capital. A project assessment is lumpy and ends; a vCISO retainer renews monthly, embeds in the client's operations, and becomes the anchor relationship through which everything else (MDR, compliance tooling, IR retainers) is cross-sold. For an MSP or MSSP, the vCISO is the trusted-advisor seat at the top of the account — the position from which margin is captured across the whole stack.

Why the vCISO market is growing

The demand drivers are durable and compounding. A full-time CISO is expensive, scarce, and a flight risk — the chronic talent shortage prices a competent security executive out of reach for the entire mid-market and SMB. Meanwhile regulation keeps manufacturing demand: cyber-insurance questionnaires, SEC disclosure rules, CMMC for the defense base, DORA in EU finserv, and customer security questionnaires all require someone accountable to own the program. The SMB and mid-market cannot hire that person, so they rent them.

The market reflects it. The vCISO market was valued at roughly $1.4B in 2024–2025 and is projected to compound at a ~12–15% CAGR toward $2.5–4B by the early 2030s (Business Research Insights). The sharper signal is on the supply side: MSP/MSSP adoption of vCISO offerings surged from ~21% in 2024 to ~67% in 2025 per Cynomi's State of the vCISO survey (Channel Insider) — a step-change that says the channel has decided vCISO is a core attach motion, not a boutique luxury.

The named-player map

The advisory layer has four kinds of actor, with entirely different economics and defensibility:

vCISO platforms (the productizers) — software that lets a service provider deliver vCISO work at scale; the value is the tooling, sold per-client to MSPs/MSSPs: - Cynomi — the category leader for the MSP/MSSP channel; AI-driven assessment, automated security posture, remediation roadmaps, board-ready reporting; $37M Series B (Apr 2025, Insight Partners/Entrée Capital), tripled ARR in 2024, ELEVATE partner program (2025). CISOSHARE, vCISO Services platforms, and emerging agentic-GRC tools sit nearby.

vCISO-as-a-service providers (the deliverers) — firms that staff and deliver fractional CISO engagements directly: - Specialists and platforms such as Fractional CISO, Cybeready/advisory boutiques, DeepSeas, regional MSSPs with vCISO practices, and the advisory arms of GuidePoint, Optiv, Coalfire, Bishop Fox (04 leaders). The Big Four (04d) deliver the enterprise equivalent under a different label ("CISO advisory").

Boutique / independent advisors — the high-end human craft: ex-CISOs selling judgment and board credibility one relationship at a time. High trust, high rate, non-scalable — the asset walks out the door.

Strategy & risk consultancies — the broader governance practices (overlapping 04d / 03i GRC) that wrap vCISO inside a larger compliance and transformation sale.

The differentiation that matters for M&A: the platform captures a software multiple; the delivered-service firm captures a sticky but labor-bound retainer; the boutique is an acqui-hire whose value is the person. The single best asset in the stack is the firm that has used a platform (its own or Cynomi's) to convert advisory from a person-bound service into a repeatable, recurring product — because it has broken the labor ceiling that caps every other actor here.

How the money works: the platform arbitrage

A traditional vCISO engagement is labor-bound: one experienced advisor can credibly own maybe 5–10 client programs before quality degrades, so revenue scales linearly with scarce, expensive headcount and margins are capped by salary. The platform changes the equation. By automating the assessment, the framework mapping, the remediation roadmap, and the board reporting, a tool like Cynomi lets one analyst serve 20–40 clients — the same arbitrage that 04a MSSP and 04f PTaaS describe, applied to the executive function. The provider's gross margin expands, the offering becomes packageable and resellable, and the revenue converts from project-lumpy to subscription-smooth — which is precisely what re-rates the multiple from a services number toward a software one. This is why the capital is flowing to the platforms and to the service providers who have adopted them, not to the boutiques.

The bear case

The bull case: vCISO rides three durable tailwinds — the CISO talent shortage, regulation-as-demand-engine, and a channel that has decided vCISO is core — and the platform layer converts a labor-bound craft into recurring software margin. Three counterweights. First, AI may disintermediate the advisor entirely — if agentic GRC and "AI security analyst" copilots get good enough that the SMB buys the tool directly (or its existing MSP bundle includes it for free), the human vCISO premium compresses and the value pools in the platform vendor, not the service firm — exactly the disruption Cynomi itself is building toward, and a double-edged one for the deliverers. Second, trust and accountability resist automation — a board wants a named human accountable for security decisions and willing to stand behind them; that liability and relationship may keep an expensive person in the loop longer than the software thesis assumes, capping the margin re-rating. Third, the platform may be a feature, not a company — vCISO tooling could be absorbed into the broader MSP RMM/PSA and GRC suites (the 03i bundlers), leaving standalone platforms squeezed. Falsifiable test: watch whether vCISO platforms grow ARR and net retention while holding price as agentic-GRC features ship inside MSP suites (thesis holds — the platform is a durable category), or whether MSPs default to bundled tooling and the standalone platform's growth stalls (thesis weakens to "vCISO is a feature of the MSP stack").

→ Cross-references: Service Providers, MSSP, The Agentic SOC, Consulting & the Big Four, GRC & TPRM, Commercial Due Diligence, Operator Economics.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.