Your Buyer Wants a Named Security Owner. You Do Not Have One

The message is short and it does not sound like a crisis. Their security team asks: who is your CISO, or who owns security at your company, and can we get them on a call.

You do not have a CISO. You have a founder who reads about security, a senior engineer who set up the VPN, and a Notion page called Security Policies that nobody has opened since last year. The deal is real, it is large, and it is now waiting on an answer you do not have.

This is one of the most common ways an enterprise deal stalls. It is worth being precise about what is actually being asked, because the obvious reading of it is wrong.

What the buyer is actually asking for

They are not asking whether you have a C-level headcount. A twelve-person company obviously does not have a CISO, and the reviewer knows that before they ask.

They are asking three things at once.

• Is there one accountable person. Someone whose name goes next to security, who can make a decision without convening a committee.
• Can that person hold a technical conversation. Their security engineers want to ask about tenant isolation, key management, and your access model, and get real answers rather than a sales deck.
• Will someone still be accountable in a year. They are signing a multi-year contract. They want security to be a function, not a mood.

The subtext is risk transfer. The reviewer needs a name to put in their file. When you answer that the whole team owns security, they hear that nobody owns security, because in their own organization that sentence is precisely how things fall through.

Why we all own security is the wrong answer

It is a fine engineering culture value. It is a bad answer to a vendor security review.

Distributed ownership works when everyone involved is senior and the stakes are internal. In a review, it produces the exact failure the buyer is screening for: an open question with no obvious next step and no one to route it to. When they ask who signs off on a risk exception, the answer that we would discuss it as a team is not something they can write down.

You do not need to hire an executive to fix this. You need a name, a real one, attached to someone who can actually do the job.

What a named security owner does on a blocked deal

On a deal that is stuck, the work is narrower and far more concrete than a job description suggests:

• Takes the buyer call and answers the technical questions directly, in their language
• Completes or corrects the security questionnaire so the answers are accurate and defensible
• Triages the buyer objections into must-fix-before-signing and can-credibly-commit-to
• Closes the blocking control gaps, hands-on
• Owns the SOC 2 path if the contract requires a report

That is a bounded piece of work with a finish line: the deal clears procurement. It is a different shape from running a security program indefinitely, and that difference is where most of the confusion about these engagements lives.

Which engagement you actually want

Fractional CISO, virtual CISO, vCISO, interim CISO, CISO-as-a-Service, fractional head of security. The market has six names for roughly one role, and the naming tells you almost nothing. The useful question is not what it is called. It is what triggered the conversation.

Sort by trigger and it gets simple.

A specific deal is stuck right now

This is the enterprise-deal engagement. The scope is defined by the deal. You get a named CISO the buyer can engage directly, fast questionnaire completion, objection triage, and hands-on remediation of whatever is blocking. It ends when the deal clears. Take this one when there is a contract with a name and a number on it, waiting.

The seat was full and now it is empty

This is an interim CISO. Your security leader left, or you are mid-audit and the owner is gone. You already have a program and it needs continuity: the in-flight audit stays on track, customer reviews still get answered, and your eventual permanent hire inherits an organized handoff instead of wreckage. The trigger is a departure or a crunch, not a deal.

Security keeps coming up and nobody owns it

This is the ongoing fractional CISO engagement, also sold as CISO-as-a-Service. Not one deal, a program: roadmap, board reporting, vendor and third-party risk, policy, and compliance ownership, month over month. The trigger is repetition. When the third questionnaire of the quarter arrives, or the board starts asking, you have outgrown the ad-hoc approach.

You are building the function and making your first hires

This is a fractional head of security. The goal is a security function that eventually does not need us: a strategy, the first security roles defined and hired well, and a transition plan to bring it in-house.

Plenty of teams start at the first and end up at the third, because the deal that forced the conversation is rarely the last deal. But start with the trigger you actually have, not the org chart you imagine.

What it costs

A fractional or virtual CISO typically runs $3,000 to $15,000 per month, against a base salary of $300,000 or more for a full-time CISO before equity and benefits. Our own fractional CISO work runs roughly $3K to $8K per month, and it is an operator engagement rather than advisory, which means someone does the work instead of pointing at it. The full breakdown is in our guide to what a fractional CISO costs.

The monthly rate is usually not what decides it. The calendar is. Hiring a senior security leader takes three to six months, and a strong candidate may not exist in your market at all. Your deal does not have three to six months. That timing gap, more than the salary, is why this path exists.

When you should not do this

Two cases worth naming.

If your buyer literally requires a full-time employee in the CISO seat, which is rare outside certain regulated environments, a fractional engagement will not satisfy the contract. Ask your champion to confirm that requirement in writing before you assume it, because it is more often an assumption on your side than a rule on theirs.

And if you genuinely have someone internal who owns security, can hold the technical call, and simply has no time this month, you may not need leadership at all. You may just need the review taken off their plate. That is a smaller and cheaper problem, and we would tell you so.

Where we come in

We do the enterprise-deal version of this constantly, because it is the trigger that brings most people to us in the first place. You get a named security leader your buyer can engage directly, the questionnaire handled, and the blocking gaps closed. Our founder is a published security researcher with six CVEs who has taken a product through SOC 2 Type II covering 76 controls, so the person on your buyer call has built the thing rather than only advised on it.

We are the prep partner, not the auditor. If the contract requires a SOC 2 report, we get you audit-ready and coordinate the independent CPA firm that signs it, because that signature can only come from a licensed firm that is separate from whoever prepared you.