Security is the role on this site where coaching the founder helps least. A founder can and should learn the basics, but security compliance is specialist work, and an enterprise customer’s security team will not accept a founder’s self-taught answers for long. The real choice at $1M to $5M is between basic hygiene with training and a fractional CISO, and the trigger is usually a customer.
The running example
A founder runs a $2.5M software company that sells scheduling tools to clinics. Fourteen employees use laptops with no central management. Passwords sit in a shared document. A regional hospital group wants to buy and has sent a security questionnaire, a business associate agreement under HIPAA and a request for the SOC 2 report the company does not have.
When training and an IT provider are enough
At the smallest size, with no sensitive data and no enterprise customers asking, security is mostly hygiene. A founder can learn enough to require multi-factor authentication everywhere, use a password manager, manage devices centrally, keep backups and train staff on phishing. A managed IT provider can set most of this up. Security awareness training for staff is cheap and widely available. Dedicated coaching for founders on security leadership is uncommon; on this site, the closest programs are leadership and AI and automation coaching, and many vCISO firms offer coaching for internal security leads.
When to hire a fractional CISO
Hire when security has to be proven to someone outside the company. The triggers: an enterprise or healthcare customer asks for SOC 2, ISO 27001 or a completed questionnaire; you handle health, payment or government data; a cyber insurance renewal asks detailed control questions; or an incident has happened. At this size, a fractional CISO at advisory or program level typically costs $4,000 to $10,000 a month, with audit fees and compliance software on top.
For our founder, the hospital group is the trigger, and it is not optional. HIPAA obligations come with the business associate agreement, and the deal depends on a credible security program. A fractional CISO would run a risk assessment, write the policies, fix the obvious gaps such as passwords and device management, answer the questionnaire and set a path to a SOC 2 report. Many healthcare buyers will proceed with a signed agreement and a dated plan while the audit is under way.
When to do both
The useful combination is a fractional CISO who trains the team as part of the program. Ask for it: security awareness training for staff, and coaching for whoever runs IT or engineering so that daily operations follow the policies. Some vCISO firms also coach an internal security lead as the company grows, which can be a path to replacing the fractional with a full-time hire later. For the founder, an hour with the CISO each month on what changed and why is usually enough.
A simple test
Ask who outside the company will judge your security in the next year. If the answer is nobody, invest in hygiene, training and a good IT provider. If the answer is a customer, an insurer, a regulator or a buyer, hire a fractional CISO. If you want your team to carry more of the work over time, build training into the CISO’s scope.
Fractional CISOs and related coaching programs are listed side by side on this site.