Your first ten vCISO clients
The first three come from people who have already watched you do the job. The hard part is deciding what you are before you call, and charging a real price with nothing to point at.
If you have just left an in-house security leadership role in Canada, your first two or three clients will almost certainly come from your own network inside the first 90 days, and clients four through ten will take the following year. Charge $3,000 to $6,000 CAD a month from the first engagement even with no references, sell a paid assessment at $5,000 to $20,000 CAD before any retainer, and anchor every conversation against the $275,000 to $540,000 CAD a full-time CISO costs a Canadian company in year one rather than against a consultant's day rate.
2 to 3 Clients from your own network in the first 90 days
$3,000 Monthly floor, CAD, even with no references
Those first-90-day figures are what the arithmetic supports, not a survey. A security leader leaving a role in a Canadian city has a few hundred former colleagues, vendors and peers, a small share of them at companies under pressure to have security leadership, and a fraction of those will talk this quarter. It is not a large funnel and it does not need to be. You only need ten.
Decide what you sell before you call anyone
The most common mistake in the first month is offering security leadership to anyone who will pay for it. It fills a calendar and produces the weakest possible pitch: a buyer choosing between four fractional CISOs cannot tell them apart and defaults to price.
Pick one trigger and one shape of company, and describe yourself in terms of the situation rather than the service. Something a former colleague can repeat in a sentence when the subject comes up in a meeting you are not in.
| Weak | Strong | Why the second one travels |
|---|---|---|
| Fractional CISO services for growing companies | I get Canadian B2B software companies of 40 to 150 people through a first SOC 2 without hiring a security team | Names the buyer, the trigger and the outcome, so somebody can refer you without asking what you do |
| Security leadership and governance advisory | I run security for companies that just lost the only person who held it | Describes a moment a listener can recognise happening at a company they know |
| Risk management and compliance expertise | I sit between a Canadian company and its large customers' security questionnaires so the deals stop stalling | Attaches to revenue, which is the only budget line that is never contested |
You can widen later. Nobody has ever failed as a fractional CISO because their first-year positioning was too narrow, and a great many have failed because it was interchangeable.
Working the list you already have
Write down every former colleague, vendor account manager, peer from an industry group, auditor, recruiter and ex-manager you have. Sort them by whether they can hire, refer, or neither, and treat the groups differently. Most of the list is referrers, and treating a referrer like a prospect wastes the more valuable of the two.
- Tell everybody what you are doing before you ask anybody for anything. A short note saying you have left and what you are now doing, with no request in it, is the highest-return message you will send all year.
- Talk to the referrers first. Vendors, auditors and recruiters see companies in your target shape every week and have no competing interest in the work.
- Ask referrers a specific question rather than for referrals. Who have you seen this quarter that lost their security lead and has not replaced them is a question people can answer. Do you know anyone who needs a vCISO is not.
- With people who could hire you, do not pitch a retainer. Offer to look at the thing they are already worried about, which is usually a customer questionnaire, an insurance renewal or an audit finding.
- Charge for the second conversation. The free first look is fine and normal. A free second one establishes that your time is free.
CASL applies to all of this, though its existing business relationship ground covers people and companies you have done business with. A former employer's vendor list is not a list you bought, and the distinction matters if anyone asks.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
What do you charge with no references?
Three approaches get used and only one of them survives contact with the second year.
| Approach | First year effect | What it costs in year two |
|---|---|---|
| Discount the monthly retainer to $1,500 to $2,500 CAD | Closes fastest | The price is now your price. Raising it means renegotiating with every early client at once, and early clients are the ones who refer |
| Work free or on a pilot | Closes fast, produces a reference | Free work is deprioritised by the client, so it rarely produces the outcome you need for the reference. The engagement also has no internal sponsor defending its budget, because there is none |
| Hold the rate, sell a paid assessment first, shorten the term | Closes slower | Nothing. The assessment is the reference, the rate is intact, and a 90 day term is easier to approve than a discount is to reverse |
| Position | Discount the commitment, never the rate. Term and scope are recoverable, price is not. | |
The paid assessment gets money in the door while the retainer conversation is still going. It produces a written artefact you can show the next prospect, with permission, and lets you quote the retainer knowing the environment instead of guessing. The retainer structure is on pricing a vCISO retainer.
Do not sell yourself as a cheap CISO
The pitch that a fractional CISO is a discounted full-time one is the easiest to make and it sets a ceiling you will spend years under. It invites the buyer to treat the arrangement as temporary, compare your monthly fee with a salary divided by twelve, and end it the moment they can afford a hire. Say the other thing instead: for a company of 40 to 150 people, one or two days a month of a senior person is the right amount of security leadership, and a full-time hire at that size is overbuying. That claim survives the day they can afford the salary. The comparison for buyers is on fractional CISO cost.
What to have in place before the first invoice
None of this is interesting and all of it will be asked for by the first client with a procurement function. Most of it takes an afternoon if you do it before you need it, and two weeks of delay if you do not.
0 of 0 done ·
Clients four through ten
The network runs out around client three, and the second year is where most new practices stall. The first three already trusted you, so they taught you nothing about finding a stranger.
Two channels produce clients four through ten. Partner referral from firms that sit next to the work and cannot do it: managed service providers, CPA firms that issue SOC 2 opinions, cyber insurance brokers and privacy counsel. Each has clients who need security leadership and no way to supply it, and 10 to 20 percent of first year revenue is the going rate for the introduction. The other is publishing, which takes six to twelve months to produce anything and then keeps producing. Both are on how to get vCISO clients.
The objection you will hit most often here is that the company already has a managed security provider and believes that covers it. That conversation is on positioning against MSSPs.
How many clients is ten
Ten retainer clients at 16 hours a month is 160 hours, a full working month, leaving nothing for selling, writing or the two weeks a year when three clients all have an audit. A single practitioner sustains six to eight retainers of that size, or four to five if any are program leadership at 30 hours. At ten you either raise prices and shed the smallest clients or add a second person. Raise prices, for at least another year.
Get listed while you are building
A free listing puts a new practice in front of Canadian companies looking for fractional security leadership. It costs nothing, you write it yourself, and matched enquiries are free.
List your firmCommon questions
How do I get my first vCISO client after leaving an in-house role?
From your own network, and faster than you expect. Tell every former colleague, vendor, auditor and peer what you are now doing before you ask any of them for anything, then go back to the ones who see companies in your target shape and ask a specific question about who has lost their security lead. Two or three engagements inside 90 days is a reasonable expectation from a normal Canadian security career.
What should I charge for my first vCISO engagement?
$3,000 to $6,000 CAD a month, with a paid assessment of $5,000 to $20,000 CAD in front of it. Do not discount the monthly rate to win the first client. Discount the commitment instead by offering 90 days rather than a year, because a short term is easy to extend and a low price is very hard to raise.
Do I need insurance and a company to sell fractional CISO work?
You need both before the first client with a procurement function, which arrives sooner than most people plan for. Incorporate, get professional liability and cyber cover at the limit your target buyers ask for, which is commonly $2,000,000 CAD, and have a master services agreement ready. None of it is difficult and all of it delays a signature if you start when the contract arrives.
Should I take work from my former employer?
Often it is the obvious first engagement and sometimes it is prohibited. Read the non-solicitation and non-compete terms in the agreement you just left under before you raise it, and if the terms are ambiguous get an opinion rather than a friend's view. Starting a practice inside a dispute with the company most of your references work at is an expensive way to win one client.
How many vCISO clients can one person carry?
Six to eight advisory retainers at around 16 hours a month, or four to five if the engagements are program leadership at 30 hours or more. Ten is where a single practitioner runs out of week, and the answer at that point is usually to raise prices and release the smallest clients rather than to hire, because the first hire has to be sold as well as paid for.