The Carlyle GroupSyndicatedPortfolio
Portfolio Chief Technology OfficerCyber Security Consultancy · fractional, interim and permanent cyber security leaders
Cyber Security Consultancy · fractional or interim CISO, briefed and shortlisted
cyber security consultancy from Fractional Quest means a fractional or interim CISO working in your business on a fractional, interim or permanent basis. Fractional Quest is a recruitment agency, not a consulting firm: we do not employ consultants or sell a team. We find a fractional or interim CISO for your brief — fractional, interim or permanent — and they contract with you directly.
Reviewed by Fractional Quest · updated 23 October 2026 · 5 sources linked below
- 3–5our shortlist
Fractional seats our founder has held
Climatise
One Up Productions
CK Delta
In the press
- Financial TimesThe executives going ‘fractional’, not freelance
- International FinanceRenting the C-suite, and why the fractional executive era has arrived
The agency
What a cyber security consultancy covers
This page sets out what a cyber security consultancy engagement covers, how fractional, project and interim compare, how it runs and what the market publishes on rates. The board below shows current security leadership roles.
Cyber security consultancy at leadership level is about ownership, not advice. The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.
Fractional Quest is a recruitment agency, not a consulting firm: we do not employ consultants or sell a team. We find a fractional or interim CISO for your brief — fractional, interim or permanent — and they contract with you directly.
Companies searching for a cyber security consultant at board level want a fractional CISO consultant — often called a virtual CISO services — who owns security risk a few days a week. For certification work see ISO 27001 consultant.
The seat in more depth: CISO services · CISO recruitment agency · CISO consultants.
On the board · last 90 days
Current security leadership roles on the board
From our jobs feed. Where a posting states no rate, “est” is our estimate from the seat’s published band; ◆ marks days a week the posting states.
6 of 6 roles
Function
Engagement
- Reg Advantage LtdSyndicatedFractionalProduction Lead and Fractional CTO
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI (FTC)
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI
- Green Orbit LtdSyndicatedFractionalFractional CTO Wanted | Green Orbit | Initially Equity Only | UK-Based
- Maxima Opus Ltd | Cloud, Cyber & CTO ConsultingSyndicatedFractionalFractional CTO
Every fractional role in the UK is on the fractional jobs board.
Three seats
What does a fractional seat look like in practice?
Three fractional seats our founder has held. Real companies, named with their permission; we state only what the seat covered.
Fractional seats our founder has held
ClimatiseFractional · go-to-marketA carbon-reporting software company that needed go-to-market leadership before a full-time hire.
- Seat
- Fractional go-to-market lead
- Days
- Two days a week
- Scope
- Go-to-market
One Up ProductionsFractional · go-to-marketA production company that needed both the go-to-market strategy and its execution.
- Seat
- Fractional go-to-market: strategy and execution
- Days
- Two days a week
- Scope
- Go-to-market
CK DeltaFractional · technologyTechnology work: tech stack implementation.
- Seat
- Fractional technology lead
These are seats our founder has held, not placements.
The scope
What an engagement covers — and what it does not
In scope. The information security strategy and risk register; policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.
Not in scope. Security operations, monitoring and penetration testing are delivered by an engineering team or a managed provider. A CISO consultant directs and assures them.
The neighbouring seats. The CISO owns security risk; the CIO owns systems. Keeping them separate gives the board an independent view of risk.
When companies look for cyber security consultancy: A customer security questionnaire you cannot answer, a tender requiring certification, an incident, or an insurer or investor asking who owns cyber risk.
The process
How does a brief become a shortlist?
Six steps, one accountable person at each. We don’t promise a shortlist by a date; the weeks below are what a well-scoped brief usually takes.
- Day 001The 15-minute callThe seat, the engagement shape, the days or hours, the start date and the budget. No account needed; a call or a written brief.You and us
- Week 102Scope agreed in writingThe outcome the seat exists for, which days, and how the engagement will run for IR35. A brief that describes a person rather than a job, we rewrite with you.Us
- Weeks 1–203Search and approachWe approach people who aren’t looking and verify prior tenure in the seat at your scale and stage.Us
- Weeks 2–304References, taken by usFrom recent clients and boards: what they delivered, not what they titled it.Us
- Week 305Shortlist of three to fiveEach with day rate or salary, availability and IR35 position set out. You interview and decide.You
- Week 406Kick-offScope, first-month outcomes and the contract agreed before day one.You, them and us
What it costs
CISO rates what the published benchmarks say
Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate.
| Benchmark | Published figure | Source |
|---|---|---|
| Fractional CISO day rate | £1,200–£2,000 | Optima Europe |
| Interim CISO day rate | £1,000–£1,500 | Barclay Simpson |
| Permanent CISO salary (25th–75th percentile) | £96,250–£161,750 | Robert Half 2026 |
Your figures
What does part of a CISO’s week cost?
Rate × days × weeks, against a loaded full-time package. Move the sliders; the numbers redraw.
- CISO band £1,200–£2,000 (Optima Europe)
Year-one cost, fractional
£147,200
Fractional costs less in year one by£7,588
Our arithmetic. £135,250 Robert Half 2026 median salary + employer NI at 15% above £5,000 (HMRC) = £154,788. Excludes pension, bonus and any search fee.
Against the alternatives
Four ways to buy cyber security expertise fractional, project, interim or permanent
The same cyber security problem can be bought four ways. The difference is who does the work, for how long, and who is accountable afterwards.
| Fractional cyber security leader | Project consultancy firm | Interim executive | Permanent hire | |
|---|---|---|---|---|
| What you buy | A fractional or interim CISO, days a week | A defined deliverable | A leader full-time for a fixed term | A full-time leader for years |
| Who does the work | One named senior person | A team, often with a partner who sold it | One named senior person | Your employee |
| Accountable after | Yes — they stay | No — the project ends | Until the hand-over | Yes |
| Best when | You need senior judgement every week, not every day | The work is a one-off with a clear output | You need full-time cover or a change led now | The seat is full-time work for years |
| Usual contract | Contract for services, often via the leader’s company | Statement of work | Day-rate contract for the mandate | Employment contract |
The decision
When cyber security consultancy is the right call
Three situations, and the shape that fits each.
- QuestionnairesCustomers asking hard questionsSecurity questionnaires are blocking deals. A fractional CISO puts the policies, controls and answers in place.
- IncidentAfter a breachAn incident has happened. An interim CISO leads response, remediation and the regulator and customer conversations.
- CertificationA certification deadlineA contract needs Cyber Essentials or ISO 27001 by a date. A fractional or interim CISO runs the programme.
Vetting
How do we vet a cyber security consultant?
Five stages before anyone reaches a shortlist of three to five.
- Pedigree screenTenureWe verify prior tenure in the seat, at the scale and stage you need. No consultant presenting as an executive.
- Mandate fitFitFit to your stage, sector and the problem the seat exists to solve, not a CV keyword.
- Reference deep-diveVerifyWe take references ourselves, from recent clients and boards: what they delivered, not what they titled it.
- ShortlistShortlistThree to five candidates, each with day rate, availability and IR35 position set out.
- Kick-offStartScope, first-month outcomes and the contract agreed before day one.
The full process is on how we vet.
how it runs
How our cyber security consultancy works from brief to the first ninety days
Brief. A scoping call on the problem, the shape (fractional days, an interim mandate or a permanent seat), the start date and what success looks like in the first ninety days. A good brief names the decisions the cyber security leader will own.
Shortlist. We search for your brief and come back with a shortlist of 3–5, each with day rate or salary, availability and IR35 position set out, assessed through our five-stage vetting.
Contract. You choose; the consultant contracts with you directly, usually through their own company for fractional and interim work. Agree how the engagement will run in practice, because that decides its IR35 status — HMRC’s guidance for clients sets out who makes the determination.
Cadence. A fractional cyber security leader works best on fixed days with a standing slot with the CEO. Review the days each quarter. An interim works to a written mandate with review points and a hand-over date.
fractional or firm
Fractional cyber security consultant or a cyber security consultancy firm? who stays accountable
Cyber security consultancy firms usually sell testing and technical services: penetration tests, audits, managed detection. They need someone on your side who owns the risk and decides what to fix first.
A fractional cyber security consultant is a different purchase: one senior person who holds the brief week after week and answers for the outcome. A fractional CISO, often called a virtual CISO, gives a business a named security leader on a standing weekly commitment: the strategy, the policies and the board conversation, with operations delivered by the team or a provider.
Out of scope either way. Security operations, monitoring and penetration testing are delivered by an engineering team or a managed provider. A CISO consultant directs and assures them.
Standing. Check professional standing before you sign: the NCSC Cyber Security Toolkit for Boards — what a board should expect from the person who owns cyber risk; the NCSC’s Cyber Essentials scheme — the minimum standard of cyber security the Government recommends for organisations of all sizes.
The right route
Agency, recruiter, interim or permanent?
Three taps. Say how much senior work there is, for how long, and whether it is one leader or a run of hires; the tool names the route.
The route · Fractional recruiter
An embedded fractional recruiter.
A hiring plan to work through below the leadership team is a talent-acquisition job: a recruiter inside your business for part of the week, paid for their time. We don’t supply them; the page below explains the role.
The route · Non-executive director
A non-executive director.
Independent oversight and constructive challenge, not executive direction. We recruit NEDs through the same brief process.
The route · Advisor
An advisor, not yet a seat.
Less than a day a week of senior input is advisory. Buy it as a scoped engagement; when it grows into a day or more, brief us for a fractional executive.
The route · Interim
An interim executive.
Four or five days for a fixed period is interim: cover for a departure, a turnaround or a transaction. The IIM puts the UK average at £907 a day and ten months.
The route · Permanent
A permanent search.
Four or five days of work, ongoing, is a full-time seat. We recruit permanent executives through the same brief process.
The route · Fractional executive
Brief a fractional recruitment agency.
Senior judgement for part of the week: a fractional CFO, CTO, CMO or COO on one to three days. We come back with a shortlist of three to five, each with day rate, availability and IR35 position set out.
We recruit executives. We don’t supply embedded fractional recruiters; where that is the right route, the tool says so.
Clients
What do companies say about our fractional work?
From a company where our founder has held a fractional seat. Name and logo given with the client’s permission.
“Excellent fractional support for building both our go-to-market strategy and our execution.”
Charlie AndersonDirector, One Up ProductionsWhere we are
Where is Fractional Quest?
Where we are
71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Fractional Quest Ltd, registered in England and Wales, no. 17322105. This is our registered office; meetings are by appointment, and most briefs start on a 15-minute call.
Questions
Cyber Security Consultancy questions, answered
Cyber security consultancy puts senior cyber security expertise into a business. Through Fractional Quest that means a fractional or interim CISO on a fractional, interim or permanent basis, owning: the information security strategy and risk register; policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises.
Fractional Quest is a recruitment agency, not a consulting firm: we do not employ consultants or sell a team. We find a fractional or interim CISO for your brief — fractional, interim or permanent — and they contract with you directly. You get one named senior person rather than a team sold by a partner, and they stay accountable for as long as you need them.
Fractional when you need senior cyber security judgement every week but not every day; a project consultancy when the work is a one-off with a clear deliverable; interim when you need full-time cover or a change led now; permanent when the seat is full-time work for years.
It depends on the shape and the days. Published bands for the seat: Fractional CISO day rate £1,200–£2,000 (Optima Europe); Interim CISO day rate £1,000–£1,500 (Barclay Simpson); Permanent CISO salary (25th–75th percentile) £96,250–£161,750 (Robert Half 2026). Fractional Quest publishes no fees; each candidate on a shortlist states their own rate, so the cost of cyber security consultancy is the rate times the days you agree.
It depends on how the engagement runs in practice — control, substitution and whether the cyber security consultant is part and parcel of your organisation, not on the label "consultant". For medium and large private-sector clients the client makes the status determination. Every candidate on our shortlist states their IR35 position.
Ownership of cyber risk: strategy, policies, controls, certification, incident readiness and board reporting. Through Fractional Quest it is held by a named fractional or interim CISO, who directs any testing or managed services you buy.
The NCSC describes Cyber Essentials as the minimum standard it recommends for organisations of all sizes. Many contracts ask for it; larger customers and regulated sectors often expect more, such as ISO 27001.
Sources
Where does every figure on this page come from?
The primary publisher for each number, linked. Where a figure is our own arithmetic, the page says so where it appears.
- Optima Europe
- HMRC
- legislation.gov.uk
- 1
- 2Understanding off-payroll working (IR35) HMRCStatus depends on how the engagement runs; medium and large clients make the determination.
- 3Rates and thresholds for employers 2026 to 2027 HMRCEmployer National Insurance at 15% above £5,000 a year.
- 4
- 5Employment Agencies Act 1973 legislation.gov.ukThe law a recruitment agency works under; no fee to a work-seeker.
