A senior security leader, without the full-time salary.
I act as your CISO for a fixed monthly fee. I own the security and compliance program, answer the questionnaires and inspectors, and keep a written record that holds up. That now includes governing how your people use AI. I work with South Florida medical practices, maritime operators and small regulated firms.
What a fractional CISO does for you
The same job a full-time CISO does, scaled to the hours your business needs.
Security roadmap
A ranked risk register and a 12-month plan in plain language, kept current as your business changes.
Compliance program
I run the program for the rules that apply to you: the HIPAA Security Rule, the Coast Guard maritime cyber rule (33 CFR Part 101, Subpart F), and NIST CSF as a common backbone.
Customer and insurer questions
Security questionnaires, cyber-insurance applications and contract security terms answered accurately and consistently.
Vendor and third-party risk
Review of the vendors who touch your data or systems, including business associate agreements. I stood up a third-party risk program at a global bank and use the same method for small firms.
Incident readiness
A written response plan, a tabletop exercise, and someone to call when something goes wrong, from a phishing click to a lost laptop to ransomware.
Leadership reporting
A short written report for owners, partners or a board that says what changed, what is open and what it will cost to fix.
AI governance
Your staff are already using AI tools, and your vendors keep adding them. I take inventory, set the rules for what data can go where, review the AI vendors and keep the record your customers and insurer will ask for. See the AI governance offering.
Pricing
Fixed monthly fee, agreed in writing before we start. Pick the level that matches how much leadership you need. You can move up or down as your needs change.
Advisory
For businesses that have good people but no security leader.
- One 60-minute working session each month
- Risk register and roadmap, kept current
- Review of policies, contracts and BAAs you send me
- Email access between sessions, reply within two business days
Program
For businesses that need someone to own compliance, not just advise on it.
- Everything in Advisory
- I own one framework program end to end (HIPAA or maritime)
- Policies and procedures written for your environment
- Up to two vendor or BAA risk reviews per month
- AI use policy, approved-tools list and AI vendor reviews
- Two customer or insurer questionnaires per quarter
- A written leadership report each quarter
- Incident support during business hours
Officer of Record
For businesses that need a named, accountable officer.
- Everything in Program
- Named as your Cybersecurity Officer under the Coast Guard rule, which permits a third party, or as your outside security lead for HIPAA
- Two leadership calls each month
- Ongoing AI oversight: new tools reviewed before rollout, annual AI risk review
- Annual assessment update, drill and tabletop exercise
- Inspection or audit support, up to 20 hours per year
- Same-day incident response
Fixed-fee starting points
Not ready for a retainer? These are one-time engagements, and each one can lead into a retainer.
| Engagement | Fee | What you get |
|---|---|---|
| Questionnaire Sprint | $1,500 | One stalled customer or insurer security questionnaire answered accurately within 10 business days. |
| HIPAA Risk Assessment | $2,500–$3,500 | A documented HIPAA Security Rule risk analysis, gap report and remediation roadmap for a 1–5 physician practice. |
| Maritime Readiness Assessment | From $3,500 | Coverage determination, a documented cybersecurity assessment and a ranked gap list for tug and barge operators. |
| AI Readiness Assessment | From $3,500 | An inventory of the AI tools in use, where your data goes, and a ranked list of risks with a plan to fix them. |
Compare the alternatives
Your options for security leadership, side by side. Ranges are typical market figures, not quotes. Sources are listed at the bottom of the page.
| Full-time CISO | Hourly consulting firm | IT provider / MSP | SSA Virtual Fractional CISO | |
|---|---|---|---|---|
| Typical cost | $250,000–$450,000 in total pay at small and mid-size companies, plus benefits and recruiting | $200–$400 per hour, or $10,000–$75,000 for a defined project | Bundled into a monthly IT fee. Security leadership is usually not staffed | $1,500–$5,500 per month, fixed |
| Time to start | Three to six months to hire and ramp up | A few weeks to scope and contract | Already in place | Typically within two weeks of the discovery call |
| Who is accountable | Your employee, full time | The firm delivers a report, then moves on | They run your tools. Risk decisions stay with you | One named person, the same one every month |
| Rules covered | Depends on the hire’s background | Depends on who is assigned | Tool and device security, not compliance programs | HIPAA, Coast Guard maritime cyber compliance and AI governance, with NIST CSF and the NIST AI Risk Management Framework as the backbone |
| Commitment | Salary, benefits and equity | Per project | Annual or multi-year IT contract | Three-month minimum, then month to month |
| Best when | You have a large organization and a security team to lead | You need a one-time audit-grade project | You need help desk, patching and device management | You are a 5–200 person regulated business that needs leadership and records an inspector will accept |
How we get started
20-minute discovery call
You tell me what you run, what rules apply and what is driving the timing. I tell you what I’d do first, and whether a retainer makes sense.
Written scope
A one-page scope with the tier, the monthly fee and what is in and out. You approve it, or you walk away.
First 90 days
I assess where you stand, fix the biggest gaps first, and give you a short written report at the end of the quarter.
I treat everything you share as confidential, and I’m glad to sign an NDA before we start.
Who you’d be working with
I’m Laurence Kirby, founder of Spiral Security Advisors in Miami. I hold the C|CISO, CISA, CRISC, CDPSE, CEH and CTPRP certifications and have 20+ years across banking, government and security software. I run the work myself. You won’t be handed to a junior.
Questions people ask
Is a fractional CISO a real CISO?
It is the same role at part-time scale. I set the strategy, own the risk register, lead incident response and report to your leadership. What you don’t get is a full-time employee on site every day. For most businesses under 200 people, you don’t need one.
How many hours do I get?
I scope by outcomes and cadence, not a timesheet: sessions, reviews, reports and response times as listed in each tier. If you regularly need more, we move you up a tier or quote the extra work in writing.
Can you be our Cybersecurity Officer for the Coast Guard rule?
The Coast Guard rule allows the Cybersecurity Officer to be a third party. The Officer of Record tier is built for that. Whether the rule covers your vessels is a separate question, and the maritime page explains how to check.
Can you help us use AI safely?
Yes. AI governance is part of the retainer, and it is also sold on its own. I inventory the tools in use, set the rules for what data can go into them, review the vendors and write it all down. The AI governance page has the details and fees.
Do you replace our IT provider?
No. Your IT provider keeps running your devices and network. I set the security standards, check that they are met and own the compliance record.
Do you give legal advice or certify us?
No. My work is advisory. I don’t provide legal advice, and I don’t issue certifications, audits or attestations. I’ll tell you when you need an attorney or an independent auditor.
Can I cancel?
Yes. After the three-month minimum, retainers are month to month with 30 days’ notice. You keep every document I produce for you.
Book a discovery call
Pick a time that works. I’ll ask what you’re running and what’s driving the timing, and I’ll tell you honestly whether I can help.
Talk to me directly
305.481.4386Call or text and we’ll find a time. Or send a note with your best times and I’ll confirm within one business day.
Send a requestNo pitch on the call. If you don’t need me, I’ll say so.
Spiral Security Advisors LLC · Miami, Florida · Privacy Policy
Spiral Security Advisors provides advisory services only. Nothing here is an audit, attestation, certification, or legal advice, and no outcome with a regulator is guaranteed. Prices are starting points; final fees are set in a written scope before work begins.
Sources
- Consilien: vCISO cost and pricing, June 2026 (hourly rates, project fees, time to hire)
- KORE1: CISO salary guide, 2026 (small and mid-size company pay, drawn from IANS and Artico survey data)
- USCG Maritime Cyber Rule FAQ, January 2026