How to get vCISO clients

A vCISO client is a retainer, so one signature is worth 12 to 36 months of revenue. That changes what you can afford to spend to win one, and it makes churn matter more than win rate.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Most fractional security leadership work in Canada is signed through people who already know the practitioner: former colleagues, past clients, and partner firms that cannot do the work themselves. Everything else on this page exists because those three run out. At a retainer of $3,000 to $12,000 CAD a month over a life of 12 to 36 months, a signed client is worth $36,000 to $432,000 CAD, with the middle of the market near $108,000 CAD. Spending $5,000 to $10,000 CAD to win one is defensible arithmetic.

This page is for the firms and independents in this directory, not the companies hiring them. We operate the directory and sell listings on it, so read the directory section knowing that.

Why retainer work changes the acquisition maths

A penetration testing firm selling a $14,000 CAD engagement cannot spend $8,000 acquiring the client. The engagement ends and the cost repeats. A vCISO pays it once and bills every month until somebody cancels.

So the number that governs a fractional practice is churn, not win rate. Average client life is roughly one divided by monthly churn, and that ratio moves lifetime value faster than any sales improvement.

That is a standard retention model applied to the Canadian retainer bands on vCISO pricing, not a survey. Run it on your own book. Most fractional practices have never calculated their churn, which is why the quarter after a cancellation goes into building a funnel instead of asking why the client left.

Where does vCISO work actually come from?

Work in cost per signed client, not cost per lead. Most marketing advice reports the second number. A fractional engagement takes three to six conversations with two or three people before anybody signs, so the gap between the two is large.

Those figures assume a retainer of $3,000 to $12,000 CAD a month, where Canadian mid-market work sits. At four hours a month for $1,500, paid search and conference sponsorship stop making sense long before the other channels do.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

The channel that produces your first clients

An independent who has just left a security leadership role starts with several hundred people who have watched them do the job. It is worth more than any funnel and it is almost always underworked, because asking former colleagues for work feels like an imposition.

It is not. The people best placed to hire a fractional CISO already know they need security leadership and have been told they cannot have a full-time hire. Working that list is the subject of your first ten vCISO clients, including what to charge before you have a reference.

Partner referrals, and the firms that cannot compete with you

The most underused channel in Canadian fractional security is the firm that sits next to the work and is barred from doing it. Independence rules stop a CPA firm that signs a SOC 2 opinion from building the control set for the same client. A managed service provider running a client's infrastructure cannot credibly own the risk decisions about it. A cyber insurance broker whose client just failed underwriting on a control question has nobody to hand them to, and neither does a litigator whose client has just been breached.

All four have clients who need a vCISO and cannot sell one. That is worth 10 to 20 percent of first year revenue, and it is durable in a way outbound is not: a partner who has been paid once calls again.

The partner conversation that goes wrong most often is with an MSSP, which usually believes it already provides security leadership. Answering that is on positioning against MSSPs.

Cold outbound and the CASL constraint

Outbound works for fractional security leadership, badly. It works when it names a specific situation the reader is in, and those situations are visible from outside the company.

1. Pick a trigger you can see: an announced US large customer, a funding round, a posted security engineer role with nobody above it, a breach notification, or the departure of the one person who held security.
2. Write to the person the trigger lands on. For a company under 200 people that is a CTO, a COO or a founder, not a CISO, because if there were a CISO they would not need you.
3. Say what you think their situation is in one sentence, and be willing to be wrong in public.
4. Offer something bounded. A paid assessment or a 45 minute review of their security questionnaire converts far better than an open-ended retainer pitch, because nobody signs a 24 month commitment off a cold email.
5. Stop after three attempts. The fourth does not convert and it costs the domain reputation you will want next year.

CASL applies and is stricter than the American equivalent. It requires express or implied consent for commercial electronic messages, an identifiable sender and a working unsubscribe, and the implied-consent grounds most B2B outbound advice assumes are narrower than they look. The carve-out that helps a new independent is the existing business relationship, which covers people you have done business with, so your former employer's vendor list is fair game in a way a purchased list is not. Read the rules before buying anything.

Writing, and what to write about

Publishing what you know is the only channel that gets cheaper over time, and the slowest to start. Six to twelve months before the first enquiries, then it keeps producing them at almost no ongoing cost.

The mistake is writing about your methodology. Nobody searches for it. They search for what something costs, whether they need it, and which of two things to buy. Here that means the price of a retainer, whether a fractional CISO can be named in a customer contract, what PIPEDA requires of a named accountable individual, and how a large buyer's security questionnaire gets answered. Put a real number in the first paragraph and say what your competitors will not.

Directories, including this one

We sell listings on this directory, so weigh what follows accordingly.

A directory is a capped channel. It produces the enquiries the site produces and no more, and a better position in a list nobody visits buys nothing. Ask any directory how much traffic it has, then whether its enquiries are people who have already decided to buy.

What a directory is good at is intent. Somebody comparing four fractional CISOs on a listing page has decided to buy security leadership and is choosing who provides it. That is later than a cold email reaches, which is why the close rate holds up and the volume does not.

What to do first, by size of practice

With fewer than five retainer clients, work the personal network and the partner channel and publish nothing. You do not have enough finished engagements to say anything a reader cannot get elsewhere, and a partner referral is the fastest route to client five.

Between five and fifteen, the constraint becomes capacity. Fifteen retainers is most of one person's week, so the practice either raises its rate or hires. What to charge and how to structure the hours is on pricing a vCISO retainer.

Past fifteen, the question is whether the practice can add people without adding the founder to every engagement. Coming from a project consultancy rather than an in-house role, the conversion problem is different and has its own arithmetic in from project work to retainer, including the case for staying on projects.

Common questions