How to start offering vCISO services as an MSP
The practical, no-platform-required path to selling security advisory. The client report is the wedge into the retainer.
Most small MSPs already do the work of a virtual CISO. They field the "are we secure?" question, they nudge clients toward MFA and backups, they sketch out what to fix next. What they rarely do is charge for it as a named service. That gap is the opportunity, and closing it does not require a heavyweight platform or a new hire. It requires one good deliverable and a repeatable motion.
What vCISO actually means for a 1 to 10 client MSP
Forget the enterprise framing. For a small MSP, a virtual CISO service is a standing agreement to own a client's security posture: assess where they stand, prioritize what matters, and report on progress over time. You are renting out judgment, not a product. The client gets a security function they could never justify hiring, and you get recurring revenue at the best margin in the business.
You do not need to be the deepest security expert alive to start. You need to be more organized about security than your client is, which, for most SMBs, is a low bar cleared by a clear framework and an honest read.
Why it is the highest-margin service you are not selling yet
Demand for security advisory has climbed sharply, and it is repeatedly cited as the most profitable line an MSP can add. The reason small shops skip it is rarely capability. It is the lack of a deliverable that justifies the price. Managed endpoints and patching feel concrete to a client. "Security advice" feels like air until you hand them something that makes the risk and the plan tangible.
The one deliverable that opens the conversation
A client-facing security brief is the wedge. Not a 60-page audit, not a tool dump, but a short, plain-English report a non-technical owner reads start to finish:
- An overall posture score and what it means in business terms
- Three to six prioritized findings, each with the real-world impact and a concrete next step
- What is already going well, so it does not read as a scare tactic
- A simple next-quarter plan
Put that in front of a business owner and the retainer conversation starts on its own. They can see what they are buying.
A four-step starter motion
- Pick one framework and stick to it. NIST CSF 2.0 is the right backbone for SMB work. It is recognized, it is plain enough to explain, and it cross-maps to the compliance questions clients actually ask.
- Assess one real client. Run a short posture assessment against the framework. Resist the urge to boil the ocean.
- Turn it into the brief. Translate findings into business risk. This is the step that takes longest by hand, and the step worth getting right.
- Present it, then propose the retainer. Walk the client through the report, then offer to own the roadmap quarter by quarter.
What to charge
Price against the revenue you unlock, not the hours you spend. A vCISO-style retainer for an SMB commonly runs a few thousand dollars a month. Start with one design-partner client at a fair rate, learn what lands, and raise from there. We go deeper on this in how much an MSP should charge for security.
Writing these reports by hand every month? Praxis Brief turns a scan export or six quick questions into a branded, client-ready security report, and you can generate one free for a real client to see how it reads. Try it.