There seems to be a news report every day about the latest security breach. Securing the privacy of company information, user information, and customer data is a top priority for most companies. It’s critical that businesses build a robust cybersecurity strategy around these goals. To design this strategy, companies typically hire a Chief Information Security Officer (CISO) if they can afford and find one. The best CISOs have fought multiple battles with hackers. They may even employ Sun Tzu and ‘The Art of War’ strategies in building a companies cybersecurity program.
Most small to medium-sized businesses need the expertise of these grizzled warriors but are unable to find them or afford them. So what is one to do? Give up and let the hackers have their way inside your company? Fortunately, there’s an alternative strategy that businesses are employing – the mercenary. Just kidding, they’re hiring a virtual CISO.
Going Virtual
Businesses are making the switch to a virtual Chief Information Security Officer (vCISO) to provide cybersecurity leadership at a fraction of the cost of hiring a full-time CISO. By hiring a vCISO, a business gains access to a veteran with the knowledge, strategies, and experience needed to manage and build an effective cybersecurity program.
Going virtual with a cybersecurity professional is no different than trusting a General Practitioner doctor for your medical advice or a lawyer for your legal contracts. You wouldn’t ordinarily hire a lawyer or doctor full-time for your family or business, so why hire a full-time cybersecurity professional? Now, I know what you’re thinking… do I even need a part-time vCISO in my business?
Cybersecurity Leadership Is More Important Than Ever Before
Cybersecurity leadership is essential in modern business, as digital transformations are happening everywhere in business. Employers have transitioned employees from office workers to remote workers due to COVID-19 introducing a myriad of new threats to the business. On-premise servers and applications have migrated to the cloud introducing their own set of new risks. These transformations require strong cybersecurity leadership to avoid unexpected attacks by hackers exploiting hidden weaknesses.
Cost
Larger companies may be able to cover the enormous costs of a full-time CISO, on average costing $267,335 annually. Most small or medium-sized businesses (SMBs) can’t afford to pay cybersecurity professionals that much money, but that doesn’t mean they should neglect cybersecurity altogether. SMBs can cut payroll costs significantly by turning to vCISOs. vCISOs on average cost 30-40% less than a full-time CISO. It’s important to note that the cut in cost doesn’t necessarily mean a cut in expertise.
Expertise
Experts consider vCISOs to have ‘greater expertise‘ compared to full-time CISOs. The reason being that they aren’t limited to working with one single customer. CISOs are stuck with the business they work for, allowing those CISOs to only have experience with that one company or previous companies. vCISOs have a variety of businesses they work for, managing all the customers at once. Multiple customers are beneficial to vCISOs as they bring the successes (and lessons learned) they face in other organizations into your own.
Reduced Risk
Hiring a vCISO gives businesses access to resources or staff that wouldn’t be available with a full-time CISO. For example, your vCISO may not be an expert in setting up a Phishing Test or running a Network Analysis, but the vCISO can bring in experts that they know professionally to assist in the processes.
It may come as a surprise to some, but vCISOs can do everything virtually that an in-house CISO can do:
- Protecting confidentiality, integrity, and availability of data in your business or your client’s businesses
- Long-term cybersecurity strategy and program development
- Policy governance, risk, and compliance program framework development
- Risk assessments
- Risk management
- Security awareness training
- Developing secure business and communication practices
- Reporting on security operations
- Monitoring for critical vulnerability alerts like the Domain Controller Zerologin Vulnerability from Aug. 2020
- Defining metrics to measure program success
- Management of personnel and vendor relationships
- Integration and management of other third-party security services
Okay, I’m Interested, Now What?
- Subscription/Contract
- Paid monthly at a fixed rate, helping whenever needed.
- Per-Use Basis
- Paid at an hourly rate, oftentimes less prioritized than the contracted customers.
- Hybrid
- Combination of Subscription and Per-Use model.
- Ex: vCISO contractually agreed to assist business (planning, risk assessment, training, etc) up to 20 hours a month, at a fixed monthly rate. If the vCISO is needed more than 20 hours in a month they charge the business an hourly rate for the extra hours.
- Combination of Subscription and Per-Use model.
vCISOs are more important than ever, more and more companies are working remotely as the pandemic of 2020 continues. Coronavirus has enlightened businesses, showing them that a lot more can be done virtually than they may think. vCISOs are ahead of the curve, make the switch today to a seasoned vCISO to help turn our company’s cybersecurity around.