There Aren’t Enough CISOs. 95% of Clients Will Pay Their Provider to Fill In.
Cybercrime Magazine ·
According to Cybersecurity Ventures, there are about 35,000 CISOs worldwide. Cynomi’s 2026 State of vCISO Report shows what clients need from the providers who could fill the gap. Sausalito, Calif. – Oct. 29, 2026 – Watch the YouTube video There are around 35,000 chief information The post There Aren’t Enough CISOs. 95% of Clients Will Pay Their Provider to Fill In. appeared first on Cybercrime Magazine .
Sausalito, Calif. – Oct. 29, 2026
– Watch the YouTube video
There are around 35,000 chief information security officers employed worldwide in 2026, according to Cybersecurity Ventures , up only slightly from 32,000 in 2023. Cybersecurity Ventures estimates about 7,750 of them work in the U.S., and puts the number of businesses in operation at roughly 359 million. That is about 10,000 businesses for every CISO.
No hiring plan closes that gap. Cybersecurity Ventures predicts 3.5 million unfilled cybersecurity jobs globally as of 2024–2025, and the figure is being recalculated for 2026. Every IT position is now a cybersecurity position too, which spreads the demand across teams that were never staffed for it. Senior security leaders are a small slice of that workforce, and they are priced for the companies that can afford them. The median annual pay for a CISO is $321,000 according to Glassdoor, and $385,000 according to Salary.com, as gathered by Cybersecurity Ventures in its 2026 CISO Report.
For most businesses, then, the real question is where CISO-level judgment comes from when hiring a CISO is not an option. For many of them, the answer is the managed service provider or managed security service provider they already pay.
Cynomi’s 2026 State of vCISO Report surveyed both sides of that relationship for the first time: 200 senior leaders at MSPs, MSSPs and vCISO firms, and 200 IT, cybersecurity, risk and compliance leaders at organizations that buy managed security. Every client surveyed already works with an outside security provider.
What those clients say is missing is not more detection. Among clients using a managed detection and response (MDR) provider, 0% say their strategic needs are fully met. 61% say they need more guidance, and 39% say their provider does detection and response only.
The monitoring is running. The judgment on top of it, what to fix first, what it will cost, what the board should hear, is the strategic guidance these clients say their provider is not delivering.
The report’s headline finding is that 95 percent of clients would be more likely to increase their overall security spend if their provider delivered more proactive planning and strategic guidance. 83% would be likely to buy strategic advisory as a standalone service. Strategic advice and risk visibility are the top two retention drivers for providers and clients alike, while pricing and packaging rank last.
For a business that cannot hire a $321,000 executive, a provider who brings that judgment as part of a monthly service is the practical route to security leadership. For the provider, it is the next margin. Nearly half of providers (47%) already consider MDR commoditized.
The providers are not there yet. Only 28% offer vCISO services today: 5% of MSPs and 32% of MSSPs. Providers say 56% of their clients, on average, ask for strategic guidance beyond fixing technical issues, but 70% still deliver advisory mainly through quarterly business reviews, and only 7% through a client portal or dashboard.
The talent constraint that keeps most companies from hiring a CISO applies to providers too. A provider cannot put a senior security leader on every account any more than a 50-person company can hire one. Which means the advisory has to be delivered differently: by a team, to a standard, across every client.
That is also where a provider can take a wrong turn. Faced with client compliance questions, a common instinct is to buy a governance, risk and compliance tool. A GRC tool documents controls for one company’s audit. It answers “are we compliant with this framework?” and it does that job well.
What a client without a CISO needs is different. It needs someone to assess where its security stands, decide what matters most for its business, fix things in order, and measure again next quarter. That is a security program , and compliance is an outcome of running one. The work runs in a loop: baseline, prioritized roadmap, remediation, and a fresh score to show the client what changed. Clients value the compliance outcome, but the goal behind it is broader: reducing overall business risk is the top goal for 53% of clients, and not one named maximizing cybersecurity ROI as their top goal.
Platforms built for service providers, such as Cynomi , the Security Growth Platform for MSPs, MSSPs and vCISO firms powered by CISO Intelligence, are designed for that second job: running a security program across a whole client base, with the audit falling out of the work rather than driving it.
“MSPs and MSSPs have spent a decade building operational excellence in detection and response. That work is valuable, but clients now see it as the baseline,” said Erin McLean, Chief Marketing Officer at Cynomi. “The data is clear that the next margin opportunity is advisory. The challenge is delivering it consistently across hundreds of clients without hiring a CISO for each one.”
With 35,000 CISOs and hundreds of millions of businesses, most organizations will get their security leadership from a provider or not at all. The providers who standardize that leadership, deliver it continuously, and price it as a service of its own are the ones who will close the gap, for their clients and for their own margins.
The full 2026 State of vCISO Report is available now.
The 2026 State of vCISO Report surveyed 400 respondents in the U.S. in August 2026 through Global Surveyz, an independent research firm: 200 senior leaders at MSP, MSSP and vCISO firms with 20 or more employees, and 200 IT, cybersecurity, risk or compliance leaders at client organizations.
Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:
Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.
The post There Aren’t Enough CISOs. 95% of Clients Will Pay Their Provider to Fill In. appeared first on Cybercrime Magazine .