Find your fit
Both seats deal with risk and both touch AI, so the line between them blurs fast. Here is the plain version. A virtual CISO owns your security program, all of it, including the AI tools your people already use. A fractional Chief AI Officer owns your AI program: what you build, what it has to earn, and how it stays governed. The two meet on AI security, and at large companies that part rarely sits with the CISO. An October 2026 IANS Research benchmark of 1,400 CISOs and security professionals found only 7% of CISOs at companies above $10 billion in revenue own AI governance.
| Virtual CISO (vCISO) | Fractional Chief AI Officer (vCAIO) | |
|---|---|---|
| Owns | The security program across the whole company: people, systems, vendors, and the AI tools in daily use. | The AI program: which bets get funded, which models ship, who builds them, and to what standards. |
| The question it answers | Are we protected, and can we prove it to the people who ask? | Is our AI worth the money, and is it governed well enough to scale? |
| Measured by | Risk in dollars, audit results, time to detect and respond. | Return on each AI use case, time to production, regulatory readiness. |
| Frameworks | NIST CSF, ISO 27001, SOC 2, plus your sector's rules. | NIST AI RMF, the EU AI Act, ISO 42001, the OWASP Top 10 for LLMs, and the OWASP Top 10 for Agentic Applications. |
| Usually starts when | A customer questionnaire, an audit, or a board question about security lands and nobody owns the answer. | AI money is moving faster than anyone can say what it returns or who signs off. |
Answer yes or no to each. I'll show you where I would start. If you'd rather read the rules yourself, every path and the reason for it is listed below.
Start here if nobody owns security, or the security questions coming in outrun your answers, and AI is mostly tools your people use.
You need someone in the CISO seat who builds the program, answers the questionnaire, and stands in front of the board. The AI tools already in use get governed inside that program, so you don't need a second executive for them.
How the vCISO work runsStart here if security already has an owner and the answers hold up, but AI is a real bet and nobody owns it.
Your security leader keeps the security program. I take the AI portfolio: what gets funded, what it has to return, who builds it, and governance that maps to the NIST AI RMF, the EU AI Act, and ISO 42001. I work alongside your CISO on AI security so nothing falls between the two seats.
What a fractional CAIO coversStart here if you have a security gap and an AI program with no owner.
One engagement where I hold both seats. The security program and the AI program run from the same risk register and report to the board in one voice, so the overlap on AI security has a single owner instead of two people assuming the other has it. RISE and CARE were built as a pair for this case. We start with whichever gap is costing you more and bring the other in on a schedule we agree up front.
Talk about both seatsStart here if security and AI both have owners and what you want is independent judgment over them, for your board, your investors, or your portfolio.
You don't need someone running a program. You need someone who has run one to test the plan, pressure the numbers, and tell the board what they need to decide. That's an advisory or board seat, without the day-to-day.
Advisory and board seats