Moving from a vCISO to a full-time CISO
The signal to hire permanently is not headcount. It is that the work has become continuous rather than periodic, and that the retainer is being consumed by availability rather than judgement. When you are paying for four days a month and calling on eleven, you have already made the decision.
Most Canadian companies convert a vCISO retainer into a permanent hire somewhere between 250 and 500 staff, and the trigger is consumption rather than size: the retainer is routinely running over, the overage invoices are approaching the loaded cost of a hire, and the work that is spilling over is availability rather than expertise. The transition takes six to nine months from decision to a settled hire, and costs roughly $45,000 to $95,000 CAD in recruiting and overlap on top of the salary. Salary bands are on CISO salary in Canada.
250 to 500 Headcount where most Canadian companies convert
6 to 9 months Decision to settled hire
60 to 90 days Overlap worth paying for
Five signals it is time, and three that are not
The useful signals are about the shape of the work, not the size of the company.
| Signal | Why it counts | Weight |
|---|---|---|
| Overage is routine, not seasonal | A retainer running hot around an audit is normal. One running hot every month means the work is continuous | Strong |
| Security decisions are waiting on a scheduled call | Latency is the cost of a fractional arrangement, and it becomes material once decisions arrive daily | Strong |
| There are two or more security people to manage | Coaching and performance management do not compress into four days a month | Strong |
| A regulator or a large customer expects an internal accountable officer | OSFI-regulated institutions in particular. See OSFI regulated institutions | Decisive where it applies |
| Security is part of what you sell and the leader is in front of customers weekly | A fractional arrangement gets noticed by buyers, fairly or not | Moderate |
| You crossed 250 employees | Correlates with the real signals but causes nothing on its own | Weak |
| The board asked whether you have a CISO | A title question, usually answerable by explaining the arrangement properly | Weak |
| You just finished a certification | Post-certification is when the workload falls, not rises. This is the worst possible month to judge it | Misleading |
The point where the numbers cross
A retainer at 16 hours a month costs $48,000 to $72,000 CAD a year. At 40 hours a month it costs $72,000 to $144,000. A loaded first-year hire costs $300,000 to $450,000. On price alone the retainer wins at every level of consumption a retainer can support. Be sceptical of anyone selling the conversion as a saving.
| Hours a month actually used | Retainer cost | Hire, first year loaded | Which is right |
|---|---|---|---|
| Up to 16 | $48,000 to $72,000 | $300,000 to $450,000 | Retainer, clearly |
| 20 to 40 | $72,000 to $144,000 | $300,000 to $450,000 | Retainer on cost, but check the latency and management signals |
| 60 to 80, embedded | $144,000 to $300,000 | $300,000 to $450,000 | Close enough that the non-price signals decide it |
| Effectively full time | $300,000 plus, with no availability | $300,000 to $450,000 | Hire, and you should have started two quarters ago |
The row that decides most cases is the third. Once you are buying embedded time, you are paying near-salary money for someone who is still not yours on a Tuesday afternoon, and the remaining question is whether you can hire the person. In a thin Canadian market with a four to seven month search, "we should hire" and "we can hire" are different statements. Run your own numbers on the ROI calculator.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
Should the vCISO run the search?
Yes, and name the conflict. A vCISO helping you hire their replacement is being asked to end their own engagement. A good one does it well: the handover is a reference and the alternative is being fired later. Write it into the arrangement: a defined transition fee or a retained advisory month, so the work of hiring is paid rather than resented.
What they should own is the job description, the technical assessment of candidates and the honest brief on what the role involves. What they should not own is the final decision, because the person who will manage the hire has to choose them. The starting point for the posting is the vCISO job description, converted to a permanent role with the reporting line settled first. See who a CISO should report to, because a reporting line decided after the offer is a reporting line the candidate will renegotiate.
Running the handover
- Before the search opens, confirm you own the assessment, the risk register, the roadmap, the policy set and the evidence, in editable formats. If the exit package was not negotiated at signature, this is the moment you find out. The contract checklist covers the clause.
- During the search, hold the program flat. Starting a new certification while the leadership seat is being replaced is how programs go backwards.
- Overlap for 60 to 90 days. Budget the retainer running alongside the salary. It is the cheapest insurance available and the line finance always tries to cut.
- Hand over relationships, not just documents. The auditor, the two large customers who ask the hardest questions, the insurer's broker and the board chair. Documents transfer in a week and relationships take a quarter.
- Give the new CISO permission to disagree. Their first serious act of ownership is usually reversing something. If the outgoing vCISO is still on retainer and treats that as criticism, end the retainer.
- Keep a small advisory line for two quarters if the new hire wants it. Four hours a month of the person who built the program is worth more than any onboarding document.
The reverse move is legitimate too
Companies also go the other way, and it is not a failure. A CISO leaves, a business shrinks, or a program reaches a steady state where four days a month covers it. Backfilling a departed CISO with a retainer for two or three quarters buys time to decide what the role should be now, rather than reposting a job description written for a different company. It is also the right answer when the last hire did not work: the second failed search costs far more than the first.
What goes wrong
- Hiring the title, not the scope. Posting a CISO role that reports to the head of IT and owns no budget attracts senior candidates who leave inside a year. If that is the real scope, hire a director of security and keep the retainer for the board-facing part.
- Ending the retainer at the offer letter. The gap between signature and start is six to twelve weeks, and it usually contains an audit or a customer review.
- Expecting the hire to be a cost saving. It is not, at any realistic consumption level. It is a purchase of availability, ownership and management capacity, and it should be justified as that.
- Losing the record. Programs that lived in one person's head, with the register in their own document and the evidence in their drive, take a quarter to reconstruct. Insist the artifacts live in your systems from month one.
The earlier version of this decision is whether to hire anyone in security at all. Under 80 people the first hire should be an engineer, not a leader. Your first security hire, or not a hire covers the roles, the CAD bands and the case for buying the judgement fractionally instead.
Not sure whether to hire or renew
Tell us what your retainer is consuming and what is spilling over. We will price both paths with Canadian providers so the board sees the real comparison.
Get matchedCommon questions
When should we replace our vCISO with a full-time CISO?
When the retainer is running over every month rather than seasonally, when decisions are queueing for a scheduled call, when there are two or more security staff who need managing, or when a regulator expects an internal accountable officer. Headcount is a weak signal on its own, though most Canadian companies land between 250 and 500 staff when those conditions arrive together.
Is a full-time CISO cheaper than a vCISO at some point?
Not really. A loaded Canadian CISO hire costs $300,000 to $450,000 CAD in year one, and even an embedded vCISO at $25,000 a month comes to $300,000 with no employer burden, no recruiting fee and no severance risk. The hire buys availability, ownership and the ability to manage a team. Justify it that way, because a board that approves it as a saving will ask about the saving next year.
How long should the vCISO stay after the new CISO starts?
Sixty to ninety days of overlap, then optionally four hours a month for two quarters if the new leader asks for it. Beyond that the arrangement starts undermining the hire, because the organisation keeps routing questions to the person who has been answering them for two years.
Can our vCISO become our full-time CISO?
Sometimes, and it is the cleanest transition available when it works, because there is no ramp and no relationship loss. Two things usually stop it. Many career vCISOs left full-time roles deliberately and will not go back, and if they work through a firm there is normally a conversion fee of 20 to 30 per cent of first-year salary in the agreement. Ask early, and check the buyout clause before you get attached to the idea.
What if the hire does not work out?
Keep the relationship with the previous provider warm and keep your own copies of the program artifacts. A failed executive hire in Canada costs you notice or severance plus another four to seven month search, and the usual bridge is a retainer covering the interim so the program does not stall twice. That is a normal engagement and providers will not think less of you for asking.