vCISO vs. Full-Time CISO: Is the $300k Salary Becoming a Luxury Vanity Metric?

We’re seeing a massive shift toward vCISO (Virtual CISO) retainers for SMBs and mid-market enterprises. Instead of paying $250k–$350k+ base salary for a full-time executive sitting in internal meetings, companies get fractional access to high-level strategy, cloud oversight (AWS/M365), and compliance frameworks (ISO 27001/GDPR) at a fraction of the cost.

I’m curious to get everyone’s take on a few open questions about the model:

1. If a major breach hits during a vCISO engagement, where does actual board accountability sit compared to an in-house executive?

2. How do you stop a vCISO from just dropping a 50-page audit binder on a small IT team that has zero bandwidth to actually implement the recommendations?

3. A retainer covers strategy and monthly updates, but what happens when ransomware hits at 2 AM on a Sunday? Can a fractional team scale up on an hour's notice?

Curious to hear from both sides: fractional consultants, internal CISOs, and IT directors who have managed these contracts!