When You Cannot Hire a CISO: Why Fractional Leadership Wins
Security ownership used to be treated as a technical question. In 2025, that no longer works.
Regulation has moved the centre of gravity from the IT function to management accountability. DORA and NIS2 raise the bar for resilience, risk oversight, incident handling, and governance. The EU AI Act adds another layer, with obligations starting in February 2025 that force organisations to ask a new question: who owns AI risk when there is no AI governance leader?
For many midmarket organisations, the obvious answer, hire a full-time Chief Information Security Officer, is not financially realistic. IANS 2025 compensation data puts the average midmarket CISO salary at US$415K. That figure helps explain why fractional leadership is moving from a stopgap option to a practical operating model.
Security accountability now sits with management
DORA applies from 17 January 2025 for financial entities in scope. Its message is clear: digital operational resilience is a management issue, not only a technology issue. Organisations must understand ICT risk, test resilience, manage third-party risk, and handle incidents with discipline.
NIS2 also strengthens the accountability model. Management bodies must approve cybersecurity risk measures, oversee implementation, and can face consequences when duties are ignored. That changes the internal conversation.
A missing CISO does not mean missing accountability. It means accountability has to be assigned more clearly.
In practice, management needs answers to questions such as:
Who accepts cyber risk on behalf of the organisation?
Who reports risk in terms the board can understand?
Who validates whether controls match regulatory expectations?
Who owns incident readiness before an incident occurs?
Who challenges third-party risk, especially for critical suppliers?
If these questions sit informally across IT, legal, compliance, and operations, gaps appear quickly. Everyone contributes, but nobody owns the system.
The AI Act creates a new ownership gap
From 2 February 2025, parts of the EU AI Act begin to apply, including rules around prohibited AI practices and AI literacy obligations. The full compliance timetable runs in stages, but the governance signal is already here.
AI risk is not the same as traditional cybersecurity risk, yet the two now overlap. AI tools can affect data leakage, access control, model misuse, intellectual property, bias, vendor risk, and decision accountability. That means AI governance cannot live only in innovation teams or legal review.
The gap appears when the organisation has:
AI tools already in use, but no inventory
Staff using public AI systems with sensitive data
No policy for acceptable AI use
No clear owner for AI risk assessment
No link between security controls and AI deployment decisions
This is where a security leader needs to connect ciso, AI governance, strategy into one operating model. The work is not just policy writing. It is deciding how the organisation will approve, monitor, and restrict AI use in a way that fits its risk profile.
Hiring a full-time CISO is often the wrong first move
A mature enterprise may need a full-time CISO with a team, budget, and board mandate. Many organisations are not there yet.
For a midmarket company, the cost can be hard to justify. The IANS 2025 figure of US$415K for average midmarket CISO salary does not include the wider cost of building a security leadership function around that person. Even when budget exists, hiring can be slow. The market for experienced leaders is competitive, and the role requires a rare mix of technical knowledge, regulatory awareness, communication skill, and business judgement.
There is also a sequencing problem. If the organisation has no clear security operating model, hiring one senior leader may not solve the issue. The new CISO may first need to define the basics:
Governance forums
Risk reporting
Incident roles
Supplier review
Policy ownership
Control priorities
Regulatory mapping
AI use rules
That is foundational leadership work. It does not always require a full-time executive from day one.
Fractional leadership gives structure before headcount
Fractional security leadership means bringing in experienced leadership for a defined amount of time, often a few days per month, with a clear mandate. It can function as a virtual ciso model, an interim leadership role, or an advisory layer for management.
The value is focus. A fractional leader can help management move from scattered activity to a working system.
A practical first 90 days might include:
Confirm ownership
Define who owns security risk, who approves exceptions, and who reports to management.
Map regulatory duties
Identify which DORA, NIS2, and AI Act obligations matter for the organisation.
Create an executive risk view
Replace technical noise with a short set of business risk indicators.
Set incident decision rules
Clarify who decides, who communicates, and when escalation happens.
Build an AI use policy
Create rules for staff use, data handling, tool approval, and monitoring.
Prioritise controls
Focus budget on the controls that reduce the most relevant risks first.
This model gives management access to senior judgement without committing immediately to a US$415K salary. It also creates the foundation for a future full-time hire if the organisation grows into that need.
What good ownership looks like by the end of 2025
Good security ownership is visible. It does not rely on heroics from IT or last-minute compliance work.
By the end of 2025, a well-run organisation should be able to show:
Management has reviewed cyber and AI risks.
Security responsibilities are written down.
Incident response roles have been tested.
Critical suppliers have been assessed.
AI use has clear rules and approval paths.
Risk reporting uses business language.
Security investment follows a documented priority list.
This matters because regulators, insurers, customers, and partners increasingly ask the same question in different ways: who is accountable?
The answer cannot be “the IT team” if management has never set direction or accepted risk. It also cannot be “legal” if no one understands the technical exposure. Ownership needs a bridge between governance and execution.
Fractional leadership wins because the problem is urgent
DORA, NIS2, and the EU AI Act are changing the standard for security leadership. They do not require every organisation to hire a full-time CISO immediately, but they do require management to take ownership seriously.
Fractional leadership works because it answers the real need: senior security judgement, clear accountability, and a practical governance model that fits the organisation’s size.
For organisations that cannot justify or recruit a full-time CISO, the choice is not between doing nothing and spending US$415K. There is a better middle path.
If security and AI risk ownership are unclear in your organisation, start by getting the leadership model right. Learn more about how fractional security leadership can support your team here: explore the virtual CISO service.
This article is for general information only and is not legal advice. For regulatory interpretation, seek qualified legal guidance.
