What a Fractional vCISO Is Actually Worth to a Small Business

What a Fractional vCISO Is Actually Worth to a Small Business

The number repeated most often in vCISO marketing is the salary comparison: a full-time Chief Information Security Officer costs, on average, somewhere between roughly $250,000 and $700,000 in total compensation depending on sector and seniority, with national averages commonly cited between $350,000 and $415,000, while a fractional engagement typically runs $3,000 to $15,000 a month.¹⁶ That comparison is accurate, and it is also not, by itself, the argument for why a small business should care. Almost no small business was ever going to hire a full-time CISO. The real question is not vCISO versus full-time CISO. It is vCISO versus nothing, because nothing is the actual alternative most small organizations are choosing by default.

What a vCISO provides that a small business genuinely cannot generate internally is judgment applied consistently over time, rather than technical execution alone. Most small businesses already own some security tools, or can readily buy them: endpoint protection, a firewall, a backup service. What they typically lack is someone who can look across all of it, understand which gaps actually matter given the organization's specific regulatory exposure and threat profile, and make a defensible case to ownership about where the next dollar of security spending should go.¹⁷ That is a different skill than configuring a firewall, and it is one a part-time IT contractor, however technically capable, is rarely positioned to provide, because their engagement is usually scoped around fixing what is broken rather than building and defending an ongoing program.

The value shows up most concretely in three situations. The first is regulatory and contractual pressure: a healthcare practice facing HIPAA obligations, a tax firm bound by IRS Publication 4557 and the FTC Safeguards Rule, a nonprofit answering a funder's security questionnaire, or any small business increasingly asked by a larger customer to complete a vendor security assessment before a contract is signed. A vCISO who has done this work across multiple clients typically has documentation templates already built and can move an organization from an unanswered questionnaire to a defensible response far faster than one building that response from a blank page.¹⁸ The second is incident preparation, distinct from incident response: a documented, tested plan for what happens in the first hours after a ransomware note appears or a breach is discovered, built before that day arrives rather than improvised during it. The third, least discussed in vCISO marketing material, is translation: explaining, in terms an owner actually finds decision-useful, why a specific investment matters, without inflating the threat to justify a sale or minimizing it to avoid an uncomfortable conversation.

The honest limitations deserve equal attention. A fractional arrangement means shared attention. A vCISO working with several clients is not available the instant an incident begins at two in the morning, and the engagement contract should say explicitly what response time and escalation path exist for exactly that scenario.¹⁹ A vCISO also does not replace the operational work of managing endpoints, monitoring alerts, or applying patches, which typically still requires an MSP, an internal IT contact, or an MDR provider working alongside the vCISO rather than instead of one. And the value of the relationship depends heavily on continuity. A vCISO engaged for a single project and then not retained leaves behind a policy binder rather than an ongoing program, and a policy binder nobody updates after year one ages out of relevance quickly as the business, and the regulatory landscape around it, both continue to change.

For a small business weighing whether this is worth the monthly cost, a more useful comparison than the CISO salary figure is a narrower one: what does the organization currently do when a customer sends a security questionnaire, when a regulator asks how patient or client data is protected, or when an employee reports a suspicious email? If the honest answer involves scrambling, forwarding the question to whoever seems most technical, or hoping it resolves itself, that gap is what a fractional vCISO is actually priced to close. It is not primarily a technology purchase. It is the purchase of someone whose job, part-time or not, is to have already thought through the questions before they get asked.

#CyberSecurity #FractionalCISO #SecurityLeadership #SMBCyberSecurity #GarlickGroup

16. “vCISO Cost in 2026: Pricing, Ranges & What Drives the Price,” Compass IT Compliance, March 24, 2026, https://www.compassitc.com/blog/how-much-does-a-virtual-ciso-vciso-cost-in-2026; and “Benefits of a vCISO for Companies with Limited Resources,” Zip Security, June 26, 2026, https://www.zipsec.com/blog/vciso-benefits-for-companies-with-limited-resources.

17. Zip Security, “Benefits of a vCISO for Companies with Limited Resources.”

18. “vCISO Pricing in 2026: What You'll Actually Pay,” SideChannel, June 20, 2026, https://sidechannel.com/blog/the-ultimate-guide-to-vciso-pricing-everything-you-need-to-know/.

19. “CISO Salary Guide 2026: Base, Bonus, and Equity,” KORE1, accessed July 2026, https://www.kore1.com/ciso-salary-guide/.

The Router in the Closet: How Protected Is the Hardware Your ISP Gave You?

The Router in the Closet: How Protected Is the Hardware Your ISP Gave You?

Somewhere in most small offices, and in nearly every home, sits a router that arrived from the internet service provider, got plugged in on the day service was installed, and has not been touched since. It is the single device every other piece of network security depends on, and it is also, empirically, one of the least secured pieces of hardware most organizations own.

The scale of the problem is not speculative. An academic security analysis of forty commercial routers spanning fourteen brands, examining both default settings and the “deep default” settings that activate once common features are enabled, identified thirty distinct exploitable vulnerabilities: exposed local devices due to missing firewall protection on IPv6 traffic, weak wireless security protocols left active out of the box, unencrypted firmware update channels that could allow a malicious update to be substituted for a legitimate one, and concealed WPS PIN support tied to a trivially guessable PIN.⁹ A separate assessment citing federal research found that more than 65 percent of home routers were still running on default administrator credentials, meaning the username and password printed on the bottom of the device, the first thing any automated scanning tool tries.¹⁰ Internet-scanning tools index millions of such routers directly reachable from the public internet, and automated bots continuously probe for exactly this combination: a router with factory-default credentials still active years after installation.¹¹

ISP-provided routers carry a specific version of this problem beyond what applies to consumer routers generally. Many ship with settings locked at the provider level, meaning the office or household using the device cannot necessarily change everything a security-conscious user would want to change, even after finding the settings menu.¹² Firmware updates, when they happen, are typically pushed by the ISP on its own schedule rather than in response to a given office's risk profile, and there is often no visible way for the end user to confirm a device is current versus quietly running firmware that is years out of date. The device functions as a black box. It works, traffic flows, and there is no obvious signal indicating whether the firewall behind that working connection is doing anything close to what a security-conscious configuration would demand.

None of this means the hardware is useless as delivered. Most ISP routers provide basic network address translation and a stateful firewall that blocks unsolicited inbound connections by default, which handles a meaningful share of opportunistic scanning.¹³ The failures cluster around what happens after that baseline: weak or absent modern Wi-Fi encryption, WPS left enabled, default credentials never changed, no separation between the primary network and every guest device or smart-home gadget that joins it, and firmware that may not have been patched since installation day.

For a small office, the fix does not require abandoning ISP-provided equipment, though placing it into bridge mode behind a dedicated, business-grade router is the more defensible long-term choice where budget allows.¹⁴ Short of that, a handful of changes address the majority of documented risk: changing the default administrator password immediately, confirming WPA3, or at minimum WPA2, encryption is active rather than an older and weaker standard, disabling WPS entirely, and separating guest and IoT devices, smart thermostats, printers, security cameras, onto a distinct network or guest network so a compromised smart device cannot reach the computers handling client data.¹⁵ Each of these takes minutes. None requires replacing hardware. All of them were, in the routers researchers examined, disabled or unaddressed by default.

The uncomfortable truth is that most small offices spend real money on endpoint protection, email filtering, and staff training, while the device every one of those investments depends on for its connection to the outside world sits in a closet, unconfigured, exactly as it arrived. A firewall never reviewed since installation is not a firewall an office can meaningfully claim to have. It is a box that happens to be doing that job by default, for now, until a firmware vulnerability or a scanning bot finds otherwise.

#CyberSecurity #NetworkSecurity #HomeOfficeSecurity #SmallBusinessCyberSecurity #GarlickGroup

9. “Exposed by Default: A Security Analysis of Home Router Default Settings,” Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (2024), https://dl.acm.org/doi/10.1145/3634737.3637671.

10. “WiFi 6 Router Settings: 8 Alarming Security Risks,” Jazz Cyber Shield, May 23, 2026, https://blog.jazzcybershield.com/wifi-6-router-settings-security/.

11. “Home Network Security Guide 2026: Lock Down Your Router, Isolate IoT Devices,” Silent Security, March 20, 2026, https://silentsecurity.net/resources/home-network-security/.

12. Jazz Cyber Shield, “WiFi 6 Router Settings.”

13. “15 Essential Home Network Security Settings to Turn On in 2026,” Vecosys, June 9, 2026, https://www.vecosys.com/home-network-security-settings-2026/.

14. Jazz Cyber Shield, “WiFi 6 Router Settings.”

15. Vecosys, “15 Essential Home Network Security Settings”; and Silent Security, “Home Network Security Guide 2026.”

Is Microsoft Defender Enough? A Small Office Without a Network

Is Microsoft Defender Enough? A Small Office Without a Network

A question worth asking honestly, because the honest answer is more useful than the reassuring one: for a small office of a handful of standalone computers, no server, no domain, nothing resembling an internal network beyond a shared internet connection, is Microsoft Defender enough?

The qualified answer is yes, as a foundation, and no, as a complete answer, and the two halves are worth separating.

Start with what Defender actually is in this setting. Windows ships with Microsoft Defender Antivirus built in at no additional cost. For an office that upgrades to Microsoft Defender for Business, available standalone or bundled into Microsoft 365 Business Premium and built specifically for organizations of up to 300 users, the coverage extends meaningfully: endpoint detection and response, automated investigation and remediation, attack surface reduction rules, and vulnerability management, running on the same backend threat intelligence behind Microsoft's enterprise product.⁵ Independent assessment of the standalone product describes it as a credible endpoint security tool in its own right.⁶ For an office without dedicated IT staff, the appeal is real: deployment is closer to a script or package install than a specialized rollout, and policy management runs through a single portal rather than a console built for a full security operations team.

That is a genuinely capable baseline for endpoint protection specifically. It is not, on its own, complete protection for the office, because the office is not just its endpoints.

The gaps are consistent across independent assessments of the standalone product. It does not include dedicated identity threat detection, monitoring for compromised credentials or unusual sign-in behavior beyond basic conditional access. It does not include mailbox-level security beyond what a given Microsoft 365 tier happens to bundle, which matters given how often small-business compromise begins with a phishing email rather than a malware file dropped directly onto a device.⁷ It includes no built-in security awareness training, no phishing simulation, and no twenty-four-hour human-monitored response. Defender generates alerts and can take some automated action, but a small office without dedicated IT is, in practice, the party responsible for noticing and interpreting what it flags.⁸ An alert sitting unread in a portal nobody checks protects nobody, regardless of how sophisticated the detection engine behind it is.

This is where the absence of an internal network actually cuts both ways. An office with no shared network, no domain controller, no file server, nothing for an intruder to move laterally across after compromising one machine, has a genuinely smaller attack surface than a networked office of equivalent size. But that same absence of centralized infrastructure usually means there is no centralized point of visibility either: each machine is functionally its own island, and whatever protects it needs to be sufficient on its own rather than backstopped by a network-level firewall watching traffic between machines. Defender for Business, cloud-managed rather than dependent on local infrastructure, is reasonably well suited to that specific shape of small office, arguably more so than tools built around the assumption of a managed local network.

The practical recommendation is not to replace Defender but to complete it. For an office of this size, that typically means: Defender for Business or Microsoft 365 Business Premium for the endpoint and email layer it does cover; a genuine second look at whatever phishing protection is or is not included at the current subscription tier; basic staff training on recognizing phishing, since the person remains the most commonly exploited part of any small office's defenses regardless of what software runs on the machine; and some periodic human review of what Defender is actually flagging, whether that comes from an outsourced IT provider, an MDR add-on, or a vCISO relationship that checks in on a schedule rather than only after something has already gone wrong.

Microsoft Defender is not a weak product wearing a strong brand name. But adequate endpoint protection and adequate protection for the office are not the same claim, and the gap between them is exactly what a small office without dedicated security staff is least equipped to notice on its own.

#CyberSecurity #MicrosoftDefender #EndpointProtection #SmallBusinessIT #GarlickGroup

5. “Microsoft Defender for Business: How SMBs Get Enterprise-Grade Endpoint Security Without the Price Tag,” Windows News, accessed July 2026, https://windowsnews.ai/article/microsoft-defender-for-business-how-smbs-get-enterprise-grade-endpoint-security-without-the-price-ta.432543; and Microsoft, “Microsoft Defender for Business Frequently Asked Questions,” Microsoft Learn, accessed July 2026, https://learn.microsoft.com/en-us/defender-business/mdb-faq.

6. “Is Microsoft Defender Enough for MSP Clients?,” Guardz, accessed July 2026, https://guardz.com/blog/is-microsoft-defender-enough-for-msp-clients/.

7. “Is Microsoft Defender Enough for Small Business Security?,” Mimecast, March 17, 2026, https://www.mimecast.com/blog/is-microsoft-defender-enough-for-small-business-security/.

8. Guardz, “Is Microsoft Defender Enough for MSP Clients?”

EDR, MDR, XDR: What the Acronyms Actually Buy You

 EDR, MDR, XDR: What the Acronyms Actually Buy You

Cybersecurity vendors have never met an acronym they did not want to sell. Three in particular circulate through nearly every conversation about protecting a small business today: EDR, MDR, and XDR. They are related, but not interchangeable, and the relationship is not a simple hierarchy where XDR is a better MDR is a better EDR. Each term answers a different question: where does detection happen, what data feeds it, and who is actually watching.

Endpoint Detection and Response, EDR, is the foundational layer. It is software installed on individual devices, laptops, desktops, servers, that continuously captures process activity, file system changes, registry modifications, and network connections at the device level.1 Where traditional antivirus looks for known malware signatures, EDR watches behavior: a legitimate program suddenly encrypting hundreds of files, a script spawning an unexpected child process, a login from an unfamiliar location. That behavioral approach catches threats signature-based antivirus misses entirely, including novel malware and techniques that repurpose an organization's own legitimate tools against it.2 EDR generates telemetry and, in most products, some automated response, isolating a device, killing a malicious process. What it does not generate on its own is a person watching the alerts.

That gap is what Managed Detection and Response, MDR, fills. MDR is less a distinct technology than a service wrapped around EDR or similar detection tooling: a vendor-operated security operations center that watches telemetry around the clock, triages what the software flags, and acts on genuine threats rather than forwarding alerts to an inbox nobody has time to read.3 For a small office with no internal security staff, this is frequently the more consequential purchase. Software generating ten thousand alerts a month and unable to distinguish a false positive from an active intrusion protects no one; the analyst reviewing those alerts at two in the morning is what turns detection into a stopped attack. Provider quality varies substantially, and the sharpest question to ask any MDR vendor is what authority they hold to act without calling first, isolating a device, disabling a compromised account, because a provider who must wait for permission mid-incident offers less protection than the contract implies.

Extended Detection and Response, XDR, addresses a different limitation. EDR, however well monitored, sees only the endpoint. XDR correlates telemetry across endpoints, network traffic, cloud workloads, email, and identity systems into a single platform, so an attack visible only as a strange login here and a suspicious file there gets recognized as one connected event rather than several isolated, low-priority alerts.4 This matters because modern intrusions rarely stay confined to a single layer. A phishing email compromises a mailbox, the attacker authenticates into a cloud application with that access, and moves from there to a file server, three systems, three alert streams, and without correlation, three unrelated-looking low-priority tickets rather than one urgent one.

For most small organizations, the practical decision is not choosing among the three so much as recognizing which gaps genuinely matter to them. A five-person office with a handful of laptops and little cloud infrastructure has less need for cross-layer correlation than for reliable endpoint monitoring paired with a human who actually looks at what it finds. Standalone EDR with no one watching it is a false sense of security. XDR's cross-platform correlation is of limited value to an organization with almost nothing to correlate across. For most small and mid-sized businesses, EDR paired with a competent MDR provider covers the realistic threat surface at a cost that scales with headcount rather than enterprise licensing tiers. XDR earns its cost once an organization's footprint spans multiple cloud services, several offices, and enough identity complexity that software benefits from doing the correlation first.

None of the three, purchased alone, substitutes for the others. EDR without monitoring is unattended software. MDR without a capable underlying detection layer is a service watching nothing worthwhile. XDR without the operational maturity to act on what it correlates is an expensive dashboard. The acronym that matters least is the one on the marketing page. The question that matters is narrower: for this specific office, this specific footprint, who is actually looking, and what can they do the moment they see something wrong.

#CyberSecurity #EndpointSecurity #ThreatDetection #MDR #GarlickGroup

1. “EDR vs MDR vs XDR: Everything You Need to Know,” CrowdStrike, March 24, 2026, https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-mdr-vs-xdr/.

2. “EDR vs. MDR vs. XDR vs. MXDR: Choosing the Right Security in 2026,” SISA, https://www.sisainfosec.com/blogs/edr-vs-mdr-vs-xdr-key-differences-2024/.

3. “MDR vs. EDR vs. XDR: What's the Difference and Which Do You Need?,” Safe Security, February 23, 2026, https://safe.security/resources/insights/mdr-vs-edr-vs-xdr-whats-the-difference-and-which-do-you-need/.

4. “EDR, XDR, and MDR Explained for Business,” Connection Technologies, accessed July 2026, https://connection-technologies.co.uk/help/cyber-security/edr-mdr-xdr-explained-business.

Zero Trust Is Not a Product: What NIST Actually Means by the Term

 Zero Trust Is Not a Product: What NIST Actually Means by the Term

Few phrases in cybersecurity marketing have traveled further from their origin than “zero trust.” Vendors attach it to firewalls, identity platforms, network segmentation tools, and cloud access brokers, often with little connection to what the term was built to describe. The National Institute of Standards and Technology published the definitive account in August 2020, Special Publication 800-207, and it describes an architecture, not a product line.23

The core idea is a genuine departure from how network security worked for the previous two decades. Traditional security assumed that a user or device inside the corporate perimeter, connected to the office network, sitting behind the firewall, could be trusted more than one outside it. Zero trust architecture removes that assumption entirely. NIST's own language is precise on this point: an attacker is assumed to be present in the environment already, and an enterprise-owned network is treated as no more trustworthy than any other.24 Every request for access to every resource gets evaluated on its own terms, using identity, device posture, and context, regardless of where the request originates.

NIST organizes this around seven tenets. Among them: every data source and computing service counts as a resource requiring protection, all communication is secured regardless of network location, and access to individual resources is granted per session rather than persistently.25 None of these tenets specify a vendor, a product category, or a purchase. They specify design principles an organization can implement with tools it may already own, such as multifactor authentication, least-privilege access controls, and network segmentation, deployed according to a different underlying logic than before.

This distinction carries practical consequences. An organization that purchases a product marketed as “zero trust” without changing how access decisions get made has bought a name, not an architecture. A more useful question than “do we have zero trust” is a narrower one: can someone explain, for any given system, why a specific user has access to it, and would that access survive a review conducted today rather than one conducted at onboarding eighteen months ago?

Buzzwords earn their reputation honestly. They describe something real, get adopted as a sales term faster than the underlying practice can spread, and end up meaning everything and nothing at once. Zero trust is a genuine architectural principle with a specific federal definition behind it. Whether an organization has actually implemented it is a separate question from whether someone on a sales call used the phrase.

#CyberSecurity #ZeroTrust #NIST #InfoSec #GarlickGroup

23. National Institute of Standards and Technology, “Zero Trust Architecture: NIST Publishes SP 800-207,” August 2020, https://www.nist.gov/news-events/news/2020/08/zero-trust-architecture-nist-publishes-sp-800-207.

24. Scott Rose et al., Zero Trust Architecture, NIST Special Publication 800-207 (Gaithersburg, MD: National Institute of Standards and Technology, August 2020), https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf.

25. “What Is NIST SP 800-207? Zero Trust Architecture Framework,” Palo Alto Networks, https://www.paloaltonetworks.com/cyberpedia/what-is-nist-sp-800-207.

The Real Math Behind HIPAA Fines: Small, Frequent, and Rising

 The Real Math Behind HIPAA Fines: Small, Frequent, and Rising

The headline settlement numbers in cybersecurity enforcement can mislead. A seven-figure fine against a national health system makes news. It also obscures what enforcement actually looks like for the overwhelming majority of covered entities, which are small.

In 2025, the Office for Civil Rights levied more than $6.6 million in HIPAA penalties across the year, spread over enforcement actions ranging from roughly $10,000 for a small rural provider to $350,000 for a larger organization.18 The corrective action plans attached to those settlements — mandatory risk analyses, staff retraining, multi-year monitoring — are often more burdensome to a small practice than the monetary penalty itself.19 Fines get the attention. Corrective action plans do the actual damage to a practice's time and staffing.

The penalty structure has been rising steadily with inflation. As of January 28, 2026, the calendar-year maximum for the most serious tier, willful neglect not corrected in time, reached $2,190,294.20 That figure is a ceiling rather than a typical outcome, but it establishes the scale regulators are working within, and inflation adjustments happen automatically each year regardless of any broader rulemaking.

OCR's enforcement priorities in 2026 have concentrated on two initiatives it has run consistently: risk analysis failures, and increasingly, ransomware. Ransomware is not, strictly, a distinct legal violation. It functions as a forcing mechanism that exposes whatever underlying Security Rule failure was already present.21 An organization that suffers a ransomware incident while maintaining a current, documented risk analysis stands in a fundamentally different legal position than one that did not, independent of whether the attack itself could have been prevented. April 2026 alone brought four new settlements from separate ransomware investigations, part of nineteen completed ransomware-related enforcement actions and thirteen completed under OCR's Risk Analysis Initiative specifically.22

The pattern across nearly every published settlement is the same finding, restated: no current risk analysis, or a risk analysis that existed on paper but did not reflect the organization's actual systems. For a small practice, a nonprofit, or a tax firm holding comparably sensitive data, the lesson is not that breaches are inevitable; most organizations of that size never suffer a reportable incident. The lesson is that when OCR investigates, following any breach, complaint, or audit, the risk analysis is the first document requested and the most common reason a routine incident becomes a six-figure settlement.

#CyberSecurity #DataBreach #HIPAACompliance #RiskMitigation #GarlickGroup

18. Healthcare Law Insights, “Major HIPAA Security Rule Changes.”

19. WCHSB Insights, “HIPAA in 2026.”

20. Compliancy Group, “The Proposed HIPAA Security Rule Update.”

21. WCHSB Insights, “HIPAA in 2026.”

22. WCHSB Insights, “HIPAA in 2026.”

From Annual Checkbox to Continuous Evidence: Why the Audit Model Is Breaking

From Annual Checkbox to Continuous Evidence: Why the Audit Model Is Breaking

The annual audit has a predictable rhythm. An assessor arrives, requests a stack of documentation, samples a handful of controls, and issues a report describing the state of the organization on the days the assessor happened to be looking. For years that rhythm was good enough. It no longer is, and the reason has less to do with the sophistication of attackers than with the number of people now asking the same question in slightly different ways.

Sixty-six percent of organizations report difficulty managing overlapping regulatory frameworks — HIPAA and state privacy law for a healthcare client, GLBA and IRS Publication 4557 for a tax practice, ISO 27001 and a customer's vendor security questionnaire for almost anyone with commercial clients.¹⁶ Each framework wants its own evidence, on its own schedule, often for controls that substantively overlap. Answering every request from scratch is how a compliance function becomes a full-time administrative burden rather than a tool for managing risk.

The response gaining traction, particularly under frameworks like CMMC 2.0 and current ISO 27001 guidance, is continuous compliance: systems that generate evidence as a byproduct of operating securely, rather than as a separate exercise performed once a year.¹⁷ A patch management tool that logs remediation timelines is also, without additional effort, generating the evidence an auditor would otherwise request by hand. Access reviews conducted quarterly as routine practice produce a paper trail that satisfies multiple frameworks simultaneously, because the underlying control, who has access to what and why, is the same control regardless of which regulation is asking about it.

This shift matters most for organizations too small to carry dedicated compliance staff. The annual audit model assumes someone can be pulled off other work for two weeks to assemble documentation. Continuous compliance assumes the documentation already exists because the underlying practice is already happening. That is a different kind of investment: smaller, ongoing, embedded in normal operations, rather than large and disruptive and concentrated in the weeks before an assessor's visit.

None of this eliminates the audit itself. External validation still matters, for regulators and for customers who will not simply take an organization's word for its own security. What changes is the posture going into that audit. Evidence collection becomes a constant background process rather than a scramble.

#CyberSecurity #ComplianceManagement #ISO27001 #CMMC #GarlickGroup

16. “Virtual CISO (vCISO): Expert Security on a Flexible Budget,” Linford & Co., April 27, 2026, https://linfordco.com/blog/virtual-ciso/.

17. Linford & Co., “Virtual CISO.”