Are you past the point where a full-time hire wins?
Almost every company gets to the point where renting security leadership stops being the better deal. This works out whether you are there yet, and names the specific thresholds you have crossed rather than handing you an adjective.
A fractional arrangement wins while the security decisions are few, large and spaced out. A full-time hire wins once the decisions are constant, the context needed to make them cannot be reloaded twice a month, and somebody has to be in the building when things go wrong. The crossover is not a headcount number, which is why headcount alone gives the wrong answer so often.
Six questions. The recommendation appears on this page with the thresholds listed both ways, and nothing is emailed anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
The six thresholds
Each answer contributes to one score, and the recommendation is a band of that score rather than a single trigger, because no one of these decides it alone. A hundred person company with no regulator, one framework and a quiet two years is a fractional company. A sixty person company under a sector regulator, holding three frameworks, with a board that wants somebody on staff to call, is not.
The heaviest weights sit on regulatory exposure and on what the board expects, because both create an obligation that has to be met by a person with a title and an employment contract. Engineering headcount is the next heaviest, since the volume of same-day decisions scales with it. Total headcount carries the least weight of the six, and it is the one most companies decide on.
The middle band is real and it is where a lot of companies actually sit. It means the next hire is usually not a CISO at all. It is an internal security manager or engineer who does the work, with the fractional arrangement kept for the judgement and the board-facing part, which is a cheaper and faster answer than a search for a senior executive. See the first security hire and moving from a vCISO to a full-time CISO.
Common questions
Why does this not compare salaries?
Because there is no large published Canadian survey of security leadership compensation, so any single figure quoted at you is assembled from posted roles and recruiter guidance rather than measured. The bands that do exist, with their sources and their width stated honestly, are on CISO salary in Canada, and the full cost of an internal function, which is never one salary, is on the cost of an in-house security team. If the decision really is about money, run the ROI calculator, which shows its assumptions.
Our board asked for a CISO. Is that the end of the discussion?
Often it is, and pretending otherwise wastes a quarter. What is worth testing first is what they are actually asking for, because the request is usually about accountability and reporting rather than a title. A board that wants somebody to call at nine at night on a Sunday wants an employee. A board that wants a quarterly paper and a name in the minutes may be satisfied by an internal executive who owns security with outside support behind them.
Can we hire and keep the fractional arrangement?
Yes, and it is a common shape for the first year. The new hire owns delivery and the outside person stays on a small number of hours for judgement, board material and the things a first security hire has not seen before. Write the handover into the contract at the start rather than negotiating it during a resignation. The contract checklist covers that clause.
What if we cannot find anyone to hire?
Then the answer is a fractional arrangement whatever the score says, and the score becomes the argument for the budget you will need when the market turns. Senior security hiring in Canada outside Toronto, Montreal and Vancouver commonly takes longer than a quarter, and an empty seat provides no security at all.
Does the answer change after an acquisition or a funding round?
Yes, usually upward, because both add reporting obligations and both add people quickly. Run this again after either, and after any change of regulator. The thresholds most likely to move are regulatory exposure and board expectations, which are the two that weigh heaviest.