Some security leaders choose consulting for more autonomy, a broader mix of clients, and the chance to apply their experience across several organizations. But consulting is not simply an in-house CISO job with a different title: it can mean finding clients, selling services, handling business administration, and influencing decisions without having authority to implement them.
There is no representative statistic showing what share of full-time security leaders leave to become consultants. Surveys document pressure and thoughts about leaving, not what people do next. The choice is best understood as a trade: potentially more independence and variety in exchange for greater responsibility for business development, income continuity, and delivery.
Why do security leaders choose consulting?
Interviews with practitioners who made the move point to autonomy, variety, and wider impact as motivations. These are individual accounts, not evidence that most CISOs prefer consulting or that a particular share is making the transition.
More autonomy over how work is done
Antanas Kedys, founder and CEO of ACyber, described the appeal this way: “Consulting gives me more autonomy and control over how I work, while still letting me apply the same strategic approach to improving resilience, governance, and practical security execution,” he says. The degree of autonomy depends on the engagement: a consultant still has to meet client needs, deadlines, and agreed scope.
Applying experience across organizations
Some practitioners want to work on similar security challenges in more than one environment. Nikoloz Kokhreidze, founder of Mandos, said: “I was solving the same problems repeatedly in one company,” he says, “when I could solve them for multiple companies simultaneously, multiplying my impact and helping more businesses grow through pragmatic security leadership.” This describes his motivation; the work and impact available to another consultant will depend on their clients and services.
Demand for services is not a measure of career moves
Provider surveys suggest organizations are interested in virtual CISO (vCISO) services. Cynomi reported that 75% of surveyed North American MSPs and MSSPs described demand as very high in its 2024 study; in its 2025 study, 79% reported high SMB demand. These are provider-side assessments of service demand, not counts of security leaders leaving employment to consult. They show a potential market signal, not a guarantee of clients or work for an individual practitioner.
Does CISO role pressure push people toward consulting?
Survey results show that some CISOs are concerned about the role, but they measure different things and should not be combined into a single turnover estimate.
| Source and population | Finding | What it does—and does not—show |
|---|---|---|
| Trellix, survey of more than 500 CISOs across America, Europe, the Middle East, and Asia Pacific; announced October 15, 2024 | 91% agreed expanding responsibilities would lead to higher turnover; 49% said they did not see a future as a CISO; 84% believed the role should be split into technical CISO and business-focused BISO functions. | Respondents’ expectations and views, not observed turnover or evidence that they went into consulting. Trellix survey announcement. |
| Devo/Wakefield Research, 200 CISOs at organizations with at least $500 million in revenue; surveyed February 20–March 1, 2024 | 32% said they had thought about leaving their roles because of the changing threat and regulatory environment. | Reported consideration of leaving, not a completed departure or a next-job destination. Devo survey announcement. |
| Deloitte and NASCIO, state CISO study based on spring 2024 responses from all 50 states and the District of Columbia | Median state CISO tenure was 23 months. | A state-government finding; it should not be treated as a private-sector tenure estimate or a consulting-transition rate. 2024 Deloitte-NASCIO study. |
| IANS and Artico Search, public summary of a 2024 survey with more than 800 CISO responses, published in a 2025 guide | The summary describes typical time in the top CISO role at the same company as two to three years. | The full report is not freely visible on the summary page, and the figure does not identify consultants’ career paths. IANS and Artico Search guide. |
Role pressures may help explain why some leaders look for a different way to work, but they do not prove consulting is the answer. Trellix’s Harold Rivas framed the demands as a need for both perspectives: “CISOs need both a technical and business-focused lens – and we need to be strategic communicators.”
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOther evidence has different scope. ISC2’s 2024 study covers the cybersecurity workforce broadly, not only CISOs. The cited studies also do not provide a reliable comparison of earnings between employed CISO roles and independent consulting.
What kinds of security consulting can leaders pursue?
“Consulting” covers several arrangements. The day-to-day work, support, and responsibility for finding the next engagement can differ substantially by model.
Rank #3
| Path | Typical shape | Key trade-off |
|---|---|---|
| Consulting or service firm | Deliver client work within an established organization. | The firm provides a platform for client work, but the available evidence does not establish how pay or benefits compare with solo practice. |
| Independent vCISO or fractional practice | Provide ongoing part-time security leadership or advisory work to multiple clients. | Can offer variety and independence, while requiring client acquisition and coordination across engagements. |
| Retained advisory | Provide continuing advice under an agreed ongoing arrangement. | Work centers on advice and the agreed relationship; the consultant may not control whether the client implements recommendations. |
| Project-based or hourly consulting | Work on a defined need such as an assessment, roadmap, or compliance-related engagement, or provide time-based advice. | Scope and duration are tied to the engagement; continuity of work may vary. |
| Internal CISO role | Lead security within one organization. | Preserves an internal leadership remit, while responsibilities, resources, and alignment pressures vary by employer. |
Hitch Partners’ 2023 voluntary online survey included more than 100 full-time U.S.-based vCISO professionals, fielded June 13–July 31, 2023. It offers a view of people already doing vCISO work, not a representative estimate of all CISOs or a comparison proving one career model is preferable. Hitch Partners’ survey results.
How does consulting change the security leader’s job?
Security judgment, prioritization, crisis management, and the ability to explain technical risk in business terms carry over. What changes is the working relationship: an internal CISO can often direct teams and set internal priorities, while an external consultant generally advises a client that retains decision-making authority.
Advice replaces some direct authority
“As a CISO, you can mandate; as a consultant, you can only influence,” says Nigel Gibbons, director and senior advisor at NCC Group. That distinction matters when a client delays a recommendation or chooses a different priority. A consultant’s work may be to clarify risk and options, not to own implementation.
Communication becomes part of the service
Technical knowledge alone is not enough when a consultant must persuade leaders and teams to act. “All of your security and compliance knowledge is wasted if you cannot communicate to a business audience,” says Carlota Sage, founder of Pocket CISO. Translating security work into business consequences is central to earning trust and making advice usable.
Business operations become part of the workload
Independent practitioners must make time for sales, marketing, writing, client acquisition, accounting, and administrative tasks as well as delivery. Kokhreidze characterized that burden this way: “Eighty percent of your work is actually selling yourself,” says Kokhreidze. “You are first a business, and CISO second.” This is one interviewee’s description, not a measured allocation of consultants’ time.
The first client can also take time. One practitioner interviewed by CSO Online warned it could take 12–18 months to land a first client when prospective clients are not already asking for consulting. That is an individual warning, not a general forecast. CSO Online on the vCISO career path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
How can a security leader prepare for the transition?
Practitioners interviewed by CSO Online described building visibility, testing ideas, reconnecting with contacts, and identifying prospective clients before leaving an employed role. Those experiences are useful examples, not a statistically proven formula.
- Define the service and client. Decide which organizations you want to serve and what problems you can credibly solve, such as ongoing security leadership, an assessment, or a roadmap.
- Explain your value in client terms. Connect your experience to the business problems a client needs addressed; credibility depends on more than a senior title.
- Test interest and build visibility. Share useful expertise, reconnect with relevant contacts, and learn whether prospective clients have a need and a realistic route to engaging you.
- Plan for the business work. Account for prospecting, proposals, marketing, writing, invoicing, accounting, and switching between delivery and administration.
- Review engagement and professional risks. Devo’s sponsor-commissioned 2024 survey reported that respondents sought indemnification, insurance, or outside counsel. That finding is not legal advice or a blanket insurance recommendation: assess contracts and professional needs for your jurisdiction with qualified advisers.
What the evidence cannot tell you
The sources cited here do not establish what proportion of full-time security leaders leave specifically to become independent consultants, vCISOs, or fractional CISOs. Nor do they provide a dependable comparison of employed CISO earnings with independent-practice earnings. Intention-to-leave surveys and provider reports of demand answer different questions; neither tracks the career choices or likely income of a particular reader.
The direct explanations for choosing consulting come mainly from interviews with practitioners who made the move. Their accounts explain why those individuals chose it, not how common each motivation is. Market-demand figures come from surveys of service providers, while the state CISO tenure figure describes public-sector roles. Treat each finding within its stated population and scope.
For further context, see CSO Online on CISO resilience.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
