A San Antonio vCISO retainer of 8 to 40 hours a month costs about $900 to $6,300 at local pay for a senior security manager, benefits included. Provider quotes come in above that, because labor is only part of what they charge for.
We couldn’t find a San Antonio firm that posts its vCISO price online. Houston firms that do publish one list $1,500 to $15,000 a month, as our Houston vCISO pricing guide shows. Uprite prices its own vCISO services in San Antonio by scope, so this page gives you the math instead of our number. It uses BLS pay for the 8-county metro, a benefits load, and the Texas and federal rules that decide how many hours you need. You can test any proposal against it, ours included.
One hour of senior security time costs a San Antonio employer about $115 at the mean and $157 at the 90th percentile once benefits are added. 8 hours a month comes to $900 to $1,260 in labor. 40 hours comes to $4,600 to $6,300. Hiring full time runs $19,900 to $27,200 a month. Headcount under Texas SB 2610 sets the starting hours, and CMMC, HIPAA, or FTC duties add to them.
How much does a vCISO cost per month in San Antonio?
A vCISO, or virtual chief information security officer, is an outside security leader you pay for a set number of hours each month. That person runs the risk assessment, writes and updates the security policies, reviews vendors, and reports to the owners. Software, monitoring, and penetration tests are priced on separate lines.
Below, hours become dollars at San Antonio pay. We set the hour bands from the work each size of company tends to need, and each dollar figure is hours times the loaded local wage from the next section.
| Retainer tier | Hours each month | San Antonio labor cost, mean to 90th percentile | Usually fits |
|---|---|---|---|
| Light advisory | 4 to 8 | $460 to $1,260 | Fewer than 20 employees and no federal rule in play |
| Program lead | 12 to 20 | $1,370 to $3,140 | A 20- to 99-person company building out IG1 safeguards |
| Compliance lead | 24 to 40 | $2,750 to $6,280 | 100 to 249 employees, or a CMMC, HIPAA, or FTC duty |
| Multi-site or audit year | 60 to 80 | $6,870 to $12,560 | Several locations, a Level 2 assessment, or an open audit |
| Full-time hire | About 173 | $19,860 to $27,220 | Security needs a full-time owner |
These numbers are a labor floor. They aren’t a price. A provider also pays for a backup person, tools, insurance, and a profit margin, so a quote above the floor is normal. Below it, ask who does the work and how senior they are.
Why does senior security time cost less in San Antonio than in Houston?
BLS counts 4,090 computer and information systems managers in the San Antonio-New Braunfels metro in its May 2025 wage survey. Its 8 counties are Bexar, Comal, Guadalupe, Medina, Kendall, Wilson, Atascosa, and Bandera. IT directors and heads of security share that job category. Mean pay is $80.11 an hour. Median pay is $163,490 a year, with $201,450 at the 75th percentile and $228,410 at the 90th.
Then add benefits. BLS’s Employer Costs for Employee Compensation put private employers at $46.89 an hour in total pay and benefits in June 2026, and $32.82 of that was wages. That’s a ratio of 1.43. Apply it to San Antonio pay and an hour costs $115 at the mean, $139 at the 75th percentile, and $157 at the 90th.
| BLS May 2025 measure | San Antonio | Houston | San Antonio difference |
|---|---|---|---|
| IT and security managers, mean hourly wage | $80.11 | $87.60 | 8.6% lower |
| IT and security managers, 90th percentile pay | $228,410 | $275,130 | 17.0% lower |
| Information security analysts, mean pay | $125,830 | $126,880 | 0.8% lower |
| Loaded hour at the 90th percentile | $157 | $189 | $32 less |
San Antonio’s discount sits at the top of the pay scale. Its best-paid security leaders earn 17% less than Houston’s, while the metro’s 1,350 information security analysts earn almost exactly what Houston analysts do. A vCISO retainer buys senior hours, so it gets more of that discount than a monitoring contract staffed by analysts. On a 20-hour retainer, the labor gap works out to $214 to $642 a month, depending on how senior the person is.
Why price from the upper percentiles at all? A vCISO signs off on the risk assessment and briefs the owners. We treat that as senior work, though BLS doesn’t measure it. If the person assigned to you is a mid-career manager, the median of about $112 an hour is the fairer yardstick.
How do you check an outside quote against San Antonio pay?
Turn the price into hours. Quotes from Houston or national firms are easier to judge once you know how many senior hours they would pay for at local rates.
- Take the monthly retainer from the proposal.
- Divide it by $157, the loaded 90th-percentile hour here, for the low hour count.
- Divide it by $115, the loaded mean, for the high hour count.
- Compare both counts with the hours the proposal actually commits to. Our ranking of San Antonio vCISO providers shows what each local firm puts in writing.
Two prices from the Houston range show how it works. At $3,000 a month, San Antonio pay covers 19 to 26 senior hours. At $15,000 it covers 96 to 131 hours, which is more than half of a full-time schedule. If a proposal at that price commits to 20 hours, ask what the rest of the money pays for. Sometimes it’s a tool or a monitoring service bundled in, and that’s fine as long as the proposal lists it.
How many hours does Texas law point you toward?
Texas tied a breach defense to headcount in 2025. SB 2610 added chapter 542 to the Business and Commerce Code, effective September 1, 2025. It covers businesses with fewer than 250 employees that own or license sensitive personal information. If one of them had a qualifying cybersecurity program in place when a breach happened, a court can’t award exemplary damages against it. What qualifies depends on company size.
| Employees | What qualifies under chapter 542 | Hours we’d plan each month |
|---|---|---|
| Fewer than 20 | Simplified steps, like password policies and staff cybersecurity training | 4 to 8, or the free UTSA program |
| 20 to 99 | Moderate requirements that include CIS IG1 | 12 to 20 |
| 100 to 249 | A program built on an industry-recognized framework, NIST CSF or the ISO/IEC 27000 series for example | 24 to 40 |
| 250 or more | Outside chapter 542 | Driven by customer contracts, your insurer, and any regulator |
This safe harbor doesn’t block actual damages or a regulator. It also only helps if you can show the program existed on the date of the breach. For a company with 20 to 99 people, that’s where the vCISO hours go. CIS Implementation Group 1 has 56 safeguards, and someone has to put them in place, record when, and keep the records current. In a 45-person engineering office in Stone Oak, that job often lands on whoever handles IT part time.
What does CMMC add for defense contractors near Joint Base San Antonio?
Defense suppliers around Joint Base San Antonio and Port San Antonio work under the CMMC program in 32 CFR Part 170. Two parts of it change what a vCISO costs.
First, the schedule. Level 1 calls for a self-assessment every year against 15 basic requirements. A Level 2 self-assessment covers the 110 requirements in NIST SP 800-171 and repeats every 3 years, with an affirmation each year in between. On July 13, 2026, the Defense Department suspended the Phase 2 rollout of third-party Level 2 assessments, and the SBA welcomed the pause on behalf of small contractors. Contracts that carry DFARS 252.204-7012 still require the NIST SP 800-171 controls.
Second, the signature. Under 32 CFR 170.22, an Affirming Official confirms continuing compliance in SPRS after each assessment and every year after that. Section 170.4 defines that person as a senior representative from within the company. An outside vCISO can run the assessment, keep the evidence, and brief the official. Whoever’s name goes into SPRS has to be on your side, so the retainer should budget time for that briefing.
We’d plan a Level 1 shop in the 4- to 8-hour tier. A Level 2 shop with a system security plan and open POA&M items fits the 24- to 40-hour tier, and more in the year it assesses. Our CMMC scoping guide for San Antonio contractors covers which systems fall inside the boundary, and the boundary is what drives the hours.
Which other rules name a role a vCISO might fill?
Three federal rules come up often for San Antonio clients. Each names a person, and the rules differ on whether that person can work for an outside firm.
| Rule | Who it reaches in San Antonio | Role it names | Can an outside vCISO hold it? |
|---|---|---|---|
| CMMC, 32 CFR 170.22 | Defense contractors and their subcontractors | Affirming Official | No, it has to be a senior person inside the company |
| FTC Safeguards Rule, 16 CFR 314.4 | CPA firms, tax preparers, mortgage brokers, and car dealers | Qualified Individual | Yes, if your company keeps responsibility and a senior employee oversees the provider |
| HIPAA Security Rule, 45 CFR 164.308 | Medical and dental practices and their business associates | Security official | The rule doesn’t say, so ask counsel before you assign it |
Under the Safeguards Rule, someone also reports in writing to the board or a senior officer at least once a year. Small firms get a break under 16 CFR 314.6. Firms holding data on under 5,000 consumers can skip 4 of the requirements, which are the written risk assessment, continuous monitoring or annual testing, a written incident response plan, and the yearly report. A tax office in Alamo Heights with 1,800 clients may need a few hours a quarter, not a retainer. Our page on IT services for San Antonio accounting firms covers the rest of that stack.
For practices near the South Texas Medical Center, 45 CFR 164.308 requires an accurate and thorough risk analysis plus a named security official. Most of the billable time goes into that analysis. One common setup is an office manager in the security official role, with the vCISO doing the analysis and the policy work. Our HIPAA cybersecurity services in San Antonio page lists what that work includes.
Should you pay by retainer, by the hour, or by project?
Pick the model by asking whether you need an owner or a document. A monthly retainer fits when someone has to run reviews, track evidence, and report every year. Hourly billing fits a one-off, like a customer security questionnaire or a single board meeting, but nobody owns the program between calls. A fixed-fee project fits a first risk assessment or a set of policies, and it ends when the deliverable ships.
Expect months 1 to 3 to cost more than the rest of the year. Inventorying devices and accounts, a first risk assessment, and first-draft policies all land in that window. Plenty of providers quote a one-time fee for it and drop to a lighter retainer afterward. A flat schedule from the first month to the last deserves a question about where that start-up work went.
Before you sign, make sure the proposal names these things.
- Who’s assigned to you, and who covers when they’re out
- What happens to hours you don’t use
- Which records you keep if the contract ends, including the policies, the risk register, and the assessment evidence
- How after-hours incident time is billed
Records matter here because a chapter 542 defense and a CMMC affirmation both rest on dated evidence. If that evidence lives only in a provider’s portal, you may not get it back after you leave.
When does a full-time CISO make sense for a San Antonio company?
A full-time security manager paid the San Antonio mean costs about $238,300 a year with benefits, or $19,860 a month. At the 90th percentile it’s $326,600 a year, about $27,220 a month. Recruiting fees and the months the seat sits empty come on top of that.
Providers bill above labor cost, so the switch point comes before a full schedule. At $15,000, a retainer is already 76% of a full-time manager at the local mean. Past about 80 hours a month, a hire is usually the better deal, and keeping the vCISO on for a quarter while the new hire settles in is a common hand-off.
An analyst is a different job. San Antonio’s information security analysts average $125,830 a year, about $179,900 with benefits, and they spend their days in the tools and the alerts. Setting risk priorities and briefing the owners usually needs someone more senior. Pairing a vCISO with a managed security team covers both.
A vCISO isn’t a vCIO either. Our vCIO services in San Antonio cover technology budgets and roadmaps, while the vCISO covers security risk and the rules above. Smaller companies sometimes buy both from one provider, but they’re separate scopes with separate hours.
Is there a free starting point in San Antonio?
There is, and it’s local. UTSA’s Small Business Development Center leads the Texas Small Business Cybersecurity Assistance Center, announced in November 2024 with a 2-year, $1 million SBA grant. Eligible Texas small businesses can get as many as 40 free hours with a vCISO, plus assessments and training. Since the 2-year grant started in late 2024, it’s close to its end date, so call the UTSA SBDC to confirm it’s still taking businesses.
That block of hours won’t run a program for a year. For a company under 20 people, it’s enough to get starter policies written and staff training scheduled, which is close to what chapter 542 asks at that size.
How does Uprite price vCISO work in San Antonio?
We quote vCISO work after a scoping review. We count your employees, check which of the rules above apply, list your locations, and read what your customers and insurer already ask for. Your vCISO then works with our San Antonio managed security team, which starts at $40 per user per month and answers tickets in 5 minutes on average. Policies, alerts, and evidence all sit in one shared record.
Our San Antonio cybersecurity cost guide breaks out price bands for the rest of the security stack, and managed IT plans are listed on our pricing page. Uprite isn’t a law firm, so ask counsel how these rules apply to your business.
What San Antonio owners ask about vCISO pricing
How much is an hour of vCISO time in San Antonio?
About $115 to $157 is what a San Antonio employer pays for an hour of senior security time, using May 2025 BLS wages for the metro’s 4,090 IT and security managers, multiplied by 1.43 for benefits. Outside firms bill above that.
Can our vCISO sign the CMMC affirmation in SPRS?
No. 32 CFR 170.22 calls for a senior representative from within your company to affirm compliance. Your vCISO can prepare the self-assessment and the evidence, then brief the person who signs.
We’re a 12-person office. Is a monthly retainer worth it?
Usually not. Chapter 542 only expects simplified steps from a business with fewer than 20 employees, and UTSA’s free center or a few advisory hours a quarter can cover them. That changes at 20 employees, when the CIS Controls IG1 tier starts, or when a contract brings in CMMC or the FTC Safeguards Rule.
Why would a San Antonio vCISO cost less than one in Houston?
Senior security pay is lower here, and the gap is widest at the top. BLS puts the 90th-percentile San Antonio manager at $228,410 a year against $275,130 in Houston, a 17% difference, while security analyst pay is nearly the same in both metros. A provider with local staff and local pay has room to price lower. A firm based somewhere else may not pass that on, so convert its quote to hours and compare.
Does the CMMC Phase 2 pause mean we can skip a vCISO this year?
Not if your contracts carry DFARS 252.204-7012. July’s suspension paused third-party Level 2 certification, and the NIST SP 800-171 controls and the yearly affirmation for any status you’ve posted in SPRS still apply.
Send us your headcount, the contracts and rules you work under, and what your insurer asks for. We’ll return a written San Antonio vCISO scope with the monthly hours listed, and you can keep it whether or not you hire us.
Speak to a vCISO
