Cyber WaveConsulting
Fractional CISO

Security leadership, without the $300k hire

A senior security leader for a fixed number of hours each month. The same person, a clear roadmap, and board papers your directors will actually read.

From $3,500 a month
The problem

Most Australian companies between 50 and 500 people are in the same position.

Security has become a board-level question, a customer question and an insurance question. But a full-time CISO is a $300,000+ salary, a three-month search, and another ninety days before anything changes.

What you get

Clear priorities and confident answers

  • A prioritised roadmap you can act on. Sequenced and costed, so you know exactly what you're fixing first and why it earns its place at the top.
  • Confident answers for everyone who asks the hard questions. Security questionnaires completed, board papers written in plain business language, insurer and auditor requests handled cleanly.
  • A living risk register that grows with your business and stays genuinely useful.
  • Certification that follows naturally. ISO 27001, SOC 2, Essential Eight, APRA CPS 234 and CPS 230, and Privacy Act obligations. Build a strong program and compliance comes along with it.
  • Vendor and third-party risk under control, including the due diligence your own customers increasingly ask you to demonstrate.
How it works

A rhythm you can rely on

  1. Month one: getting oriented

    I learn your environment, your obligations, your history, and what your leadership genuinely cares about. You finish the month with a clear view of where you stand and a roadmap you can start on immediately.

  2. Every month: dedicated time

    A fixed block of hours: standing time with you, standing time with your engineering or IT lead, and a written update polished enough to forward straight to your board.

  3. Every quarter: taking stock

    What's moved, what's next, and where to push harder. Momentum is the thing worth protecting, and the quarterly review is how we protect it.

My commitments

What you can hold me to

The same advisor, every month

You build context once, and it compounds from there. If I ever need to hand over, you get a full documented handover and the final say on who takes it.

Completely independent advice

No margins, no referral fees, no vendor commissions. When I tell you that you don't need a tool, that advice is worth just as much as when I recommend one.

Your success comes first

Most clients are building toward a program strong enough to hand to a full-time hire. When that day comes, I'd rather help you recruit them than quietly bill a retainer for years.

Plans

Choose the level of support you need

Fixed hours each month, month to month, with 30 days' notice.

Getting started

Foundation

16 hours a month

Security leadership for companies getting serious for the first time.

You've won a customer who sends security questionnaires. Or you're chasing SOC 2. Or your first enterprise deal stalled at procurement and you realised nobody here owns this.

Foundation gives you one accountable security leader without the overhead of a hire. We'll pick one framework and go after it properly, answer the questions your customers and insurers are asking, and build a roadmap you can actually work through.

Included

  • A prioritised security roadmap
  • One framework program (SOC 2, ISO 27001 or Essential Eight)
  • Customer security questionnaires answered
  • A maintained risk register
  • Monthly written update
  • Direct access when something happens

Best for: pre-revenue through to around 50 staff.

Growing

Standard

32 hours a month

For companies where security has become a board conversation.

You're being audited, questioned by customers, and asked for updates by your board, often in the same week. Standard is built for the point where security stops being a project and becomes a function.

You get enough time to run a real program: framework work progressing, third-party risk under control, board papers your directors will actually engage with, and a quarterly review that tracks momentum rather than activity.

Included

  • Everything in Foundation
  • Quarterly board reporting
  • Vendor and third-party risk management
  • Incident response plan development
  • Multi-framework support
  • Standing time with your engineering or IT lead

Best for: 50 to 250 staff with an active compliance program.

Regulated

Enterprise

48 hours a month

For regulated businesses and companies with real exposure.

APRA CPS 234 and CPS 230. The SOCI Act. Essential Eight against government contracts. Multiple entities, multiple clouds, and a vendor ecosystem that keeps growing. This is where security leadership becomes a genuinely executive job.

Enterprise means I'm in your committee meetings, in front of your regulators and auditors, and close enough to your business to make calls in real time rather than at the next scheduled catch-up.

Included

  • Everything in Standard
  • Regulator and auditor representation
  • Board and committee attendance
  • Multi-entity governance
  • Security program ownership
  • Priority availability during incidents

Best for: 250+ staff, or any organisation with formal regulatory obligations.

FAQ

Fractional CISO questions

What is a fractional CISO?

A fractional CISO (sometimes called a virtual CISO or vCISO) is a senior security leader you engage for a fixed number of hours each month instead of hiring full time. You get someone accountable for security, a prioritised roadmap and board-ready reporting, without a $300,000+ salary or a months-long search.

How much does a fractional CISO cost with Cyber Wave?

Plans start from $3,500 a month. Each plan is a fixed block of hours: Foundation is 16 hours a month, Standard is 32 hours and Enterprise is 48 hours.

Is there a lock-in contract?

No. Plans run month to month with 30 days' notice.

Which frameworks and regulations do you cover?

ISO 27001, SOC 2, the Essential Eight, APRA CPS 234 and CPS 230, the SOCI Act and Privacy Act obligations. The aim is a strong security program that makes compliance follow naturally.

Who is a fractional CISO right for?

Australian companies of roughly 50 to 500 people that need security leadership but can't justify a full-time CISO: for example, companies answering customer security questionnaires, preparing for SOC 2 or ISO 27001, reporting to a board, or meeting APRA or SOCI Act obligations.

Will I always work with the same person?

Yes. You work with Bill Robson every month. If a handover is ever needed, you get a full documented handover and the final say on who takes it.

Do you sell or resell security products?

No. Cyber Wave has no parent company, reseller agreements, referral fees or vendor commissions, so recommendations are independent.

Do you work outside Victoria?

Yes. Cyber Wave is based in Victoria and works with companies Australia-wide.

Not sure which plan fits?

Book a free 30-minute call. We'll talk through where you are and what you actually need, even if the answer isn't a retainer.

Book a free 30-minute call