vCISO for Crypto Companies: Scope, Deliverables and Cost

By the Guardian team Updated November 2026 6 min read

Quick answer. A vCISO is a part-time, outside security leader who owns your security program, including keys, signers and contract roles. Vendors SideChannel and Cynomi publish $200 to $400 an hour and $1,500 to $20,000 a month.

Watch: vCISO for Crypto Companies: Scope, Deliverables and Cost 1:43

Video transcript

A full-time CISO is expensive. A virtual CISO provides that leadership part-time, on contract.

At companies up to one billion in revenue, CISOs average four hundred fifteen thousand dollars in total compensation, per IANS Research and Artico Search.

Beyond policies and board reporting, a crypto program must cover keys and signers, contract roles, multisig signing, onchain vendors and the offchain surface.

Keys, signers, infrastructure and people caused 72 to 74 percent of hack losses in 2024 and 2025, per Guardian's analysis of DefiLlama data.

Expect documents, not just meetings: an inventory in month one, controls like a signing policy in month two, and evidence by day ninety.

Vendors SideChannel and Cynomi publish two hundred to four hundred dollars an hour, and fifteen hundred to twenty thousand a month. SideChannel lists implementation, tools and audits as extra.

Generic programs can treat keys like passwords and leave contract powers off the register. A vCISO works part-time hours, so pair one with monitoring and response around the clock.

Guardian does not sell a vCISO. Managed Security embeds engineers with your team: a threat model, MDR on every alert, multisig review and compliance scoring.

Managed Security has a ninety day guarantee: Guardian detects and resolves a high-severity issue, or you don't pay. Read the article, or talk to Guardian at guardian.security.

Every crypto company needs someone who owns security. A full-time chief information security officer (CISO) is expensive.

IANS Research and Artico Search report average total compensation of $415,000 for CISOs at companies with up to $1B in annual revenue. Their 2025 average for financial services CISOs in the US and Canada was $744,000.

A virtual CISO (vCISO) provides that leadership part-time, on contract. Here is what one should own at a crypto company, what to expect in 90 days, and what it costs.

What a vCISO Covers

The core job matches a full-time CISO's: own the security program and answer for it to the board.

NYDFS Part 500 gives a useful outline.

There, the CISO must report in writing at least annually to the board or equivalent governing body. Where applicable, the report covers six areas.

Confidentiality of nonpublic information, and integrity and security of information systems
Policies and procedures
Material cybersecurity risks
How well the program works overall
Material cybersecurity events in the period
Plans to fix material gaps

What crypto adds

At a crypto company, the program must also cover the systems that move funds.

Keys and signers: who holds each key, on what device, and what a quorum needs.
Contract roles: who can upgrade, pause, mint or move funds, and how fast.
Multisig signing: what a signer actually sees before approving.
Onchain vendors: custodians, RPC providers, oracles and bridges.
The offchain surface: cloud, code host, domains and the frontend.

That is where the losses are. Per Guardian's analysis of DefiLlama data, keys, signers, infrastructure and people caused 72% to 74% of hack losses in 2024 and 2025.

The full breakdown is in onchain vs offchain attacks.

When a CISO is required

Some regulators name the role outright:

Rule	What it requires	Outsourced CISO?
NYDFS, 23 NYCRR 500.4	Designate a CISO; written board report at least annually	Allowed: affiliate or third-party provider
VARA Technology and Information Rulebook, Rule I.1	Appoint a CISO, separate from the Compliance Officer	Not addressed in Rule I.1

Under NYDFS, if your CISO works for a provider, you keep responsibility for compliance. You must name a senior person to oversee the provider.

You must also require the provider to maintain a cybersecurity program that protects you. For VARA, ask counsel whether an outside provider can fill the role.

The First 90 Days

A good vCISO produces documents you can use, not just meetings. Expect these by day 90.

Days 1 to 30: inventory

An asset inventory: contracts, wallets, cloud accounts, repositories, domains and vendors.
A map of every key and role that can move funds or change contracts.
An access review of who can reach production, signing and customer data.
A risk register of the top risks, each with an owner.

Days 31 to 60: controls

A signing policy: thresholds, signer devices and checks before every signature.
Release rules: branch protection, review gates and deployment approvals.
An incident plan naming who can pause, who decides and who calls whom.
A vendor register, with an exit plan for the vendor you depend on most.

Days 61 to 90: evidence

A tabletop exercise, such as a lost signer key or a hijacked admin account.
A first board report on the program, its risks and its gaps.
A 12-month roadmap, ordered by risk removed.
An evidence pack for banks, exchanges, partners and regulators.

For the incident plan itself, see how to write an incident response plan.

What a vCISO Costs

We found no independent survey of vCISO prices. These ranges come from two vendors in the vCISO market:

Model	SideChannel (April 2026)	Cynomi (updated December 2025)
Hourly	$200 to $400	$200 to $300
Monthly retainer	$1,500 to $20,000, by company size	$2,600 to $11,600 or more
Fixed project	$10,000 to $75,000	$5,000 to $50,000 or more

SideChannel says its numbers come "from actual engagements, not market surveys." It says clients in regulated industries, or with several frameworks, typically run $10,000 to $20,000 a month.

Read the scope. SideChannel lists implementation labor, tools and audits as costs on top of the retainer.

Cynomi names what moves the price:

Scope of services and engagement length
Experience, industry expertise and certifications
Company size and IT complexity
Regulatory requirements
Location, plus onboarding, tooling and travel

We found no published price for a crypto-specific vCISO.

Quantstamp offers one, covering roadmap, architecture, vendor risk, compliance, incident preparedness, and key management and signing. Its page lists no price.

Where Generic vCISOs Fall Short Onchain

A program built for enterprise IT can miss what actually moves funds.

Keys are treated like passwords. SSO and MFA policies do not cover signer devices, key ceremonies or quorums.
Contract powers are off the register. An upgrade or pause role is a privileged account that lives onchain.
Signing is assumed safe. A signer approves what the screen shows. See our signing interface guide on Bybit.
Response stops at a page. Onchain, containment means pausing a contract, which needs a key and a rehearsed path.
Nobody is on call. A vCISO works part-time hours; attackers do not.

As Guardian puts it, for digital asset teams "the money is right there, it moves instantly, and recourse is minimal." Pair any vCISO with 24/7 monitoring and response.

Questions to Ask a Provider

Who is our vCISO by name, and how many other clients do they carry?
Have they run a key ceremony, a signer rotation or an onchain incident?
Can they read our contracts and map privileged roles themselves?
What does the retainer include, and what is billed as implementation?
Who responds at 3 AM, and under what SLA?
Is the evidence mapped to the rules we answer to, such as NYDFS or VARA?
If we are under NYDFS, who on our side oversees you?
If we leave, do we keep the policies, registers and tooling?

How Guardian Fits

Guardian does not sell a vCISO service. Whoever leads your program, Managed Security embeds Guardian engineers with your team.

On day one, Guardian locks everything down:

A complete map of your assets
A threat model of every path to your funds
Shield pentesting of everything facing the internet
Your single points of failure fixed
Controls and verification gates put in place

Then it runs around the clock. An MDR team works every alert, with a 15-minute SLA on Critical alerts.

Guardian's security operations team reviews every multisig transaction before it is signed. Helix audits every repository, and advisories are matched to your stack.

Managed Security's operational control register holds 118 controls, from keys and multisig to secrets and devices.

For governance, Regulatory & Compliance scores your program against NIST CSF 2.0, ISO 27001 and CCSS. Its board reporting follows the shape rules ask for, such as the CISO's annual written report under NYDFS 500.4.

Managed Security is backed by a 90-day guarantee: Guardian detects and resolves a high-severity issue in the first 90 days, or you don't pay.

Frequently Asked Questions

What does a vCISO do for a crypto company?

A vCISO owns the security program part-time: the risk register, policies, vendor risk, incident readiness and reporting to the board. At a crypto company it should also cover keys, signers, privileged contract roles and multisig signing.

How much does a vCISO cost?

Vendors SideChannel and Cynomi publish $200 to $400 an hour, $1,500 to $20,000 a month on retainer, and $5,000 to $75,000 per project. SideChannel puts regulated firms at $10,000 to $20,000 a month, with implementation, tools and audits extra.

Can a vCISO be your CISO under NYDFS Part 500?

Part 500 lets the CISO be employed by an affiliate or a third-party service provider. The covered entity keeps responsibility for compliance and must name a senior person to oversee the provider. Confirm how it applies to you with counsel.

Does Guardian offer a vCISO?

No. Guardian does not sell a vCISO service. Managed Security embeds Guardian engineers with your team, keeps a threat model of every path to your funds, responds around the clock and produces the evidence regulators ask for.

Sources

Put security engineers behind your program

Guardian Managed Security embeds engineers with your team, keeps a live threat model of every path to your funds, and responds around the clock.

Talk to Guardian Explore Managed Security