A virtual CISO (vCISO) runs security for organizations that don’t have a full-time CISO. The job is the same as any CISO’s: set the strategy, own the risk decisions, build the program and report to leadership. The difference is that a vCISO does it part-time or on contract, often for several clients at once.
Nobody starts there. This roadmap is the order we’d climb it in, starting with a free course.
What security leaders actually do
At every level on this path, the work looks like this:
- Turn business goals and obligations into a security strategy.
- Decide how much risk the organization will accept, and track it.
- Build the team, the budget and the policies.
- Run audits, vendor reviews and incident command.
- Report to the board in plain language.
A vCISO adds the business side: scoping engagements, assessing a new client fast, and delivering a roadmap they’ll actually follow.
The leadership ladder
- Security manager. Run the security program for one organization.
- CISO. Own security strategy and governance, and report to the board.
- vCISO. Lead security programs as an advisor across several organizations.
The vCISO roadmap, phase by phase
Phase 1: Take the manager’s chair (free)
Start with the big picture. Our vCISO Pathway post covers how people move from analyst to CISO.
Then do the job. Security Manager Prep is free. You step into the security manager’s chair and leave with a Three-Year Security Program Plan: strategy, team, budget, risk appetite, audits, incident command and board reporting. Every deliverable gets AI-assisted feedback, and you earn vCISO I and 32 CPE hours.
Phase 2: Prepare for the CISO seat
CISO Prep ($349) covers governance, risk, building a security program and communicating with the board, with practice that prepares you for senior security management exams.
Phase 3: Lead as a vCISO
vCISO Mastery: Assess, Advise, Lead ($995) teaches you to lead security programs as a virtual CISO: assessments, roadmaps, board reporting and the business side of vCISO work, using the Cover6 Framework.
Prove it
Cover6 vCISO Challenge ($499): take one of 12 seeded client organizations from raw evidence to a board packet in 72 hours, then defend your advice in a written board session. Graded against a published rubric. No prerequisites.
Planning to take both? The vCISO Mastery + vCISO Challenge bundle puts them together.
Certifications on this path
- ISACA CISM: security management. CISM Exam Prep + Study Guide ($49)
- ISC2 CISSP: the broad senior security certification. CISSP Exam Prep + Study Guide ($49)
- PMI PMP: project management. PMP Exam Prep + Study Guide ($49)
- PECB Lead Cybersecurity Manager: cybersecurity program management. PECB’s official self-study course ($895), with the exam and certification fee included.
Manager or practitioner? How to choose
If you’d rather run the program and make the risk calls, this path fits. If you’d rather prove controls work and write the findings, start with the GRC Analyst Roadmap. Still not sure? Take the free career path assessment.
Start here
Security Manager Prep is free. Enroll on that page and build your Three-Year Security Program Plan. When you’re ready for the CISO seat, CISO Prep is the next step.