A San Antonio company should bring in a vCISO first when a customer, regulator, or insurer is asking for security answers it can’t give, and a vCIO first when nobody is planning its technology spending. Plenty of growing firms end up with both.
Here’s a situation we run into. A 60-person engineering firm off Loop 1604 gets a security questionnaire from a prime contractor, and the same month the warranty on its file server runs out. The owner has both on one desk and tends to call them both IT problems. They really aren’t the same kind of work, and they usually need different people. Our vCISO services in San Antonio begin by working out which one is costing the firm more right now.
The vCIO decides what technology you buy and when, and the vCISO figures out how much risk you’re carrying and how to bring it down. If a contract, HIPAA, the FTC Safeguards Rule, or an insurance renewal is asking for a named security lead, start with the vCISO. If your headaches are old equipment, surprise invoices, or growth with no roadmap, start with the vCIO. Our fully managed IT plans already include one.
What is the difference between a vCISO and a vCIO?
A vCIO is a technology executive you bring in from outside, part-time. They own the IT roadmap, the budget, and the vendor choices. A vCISO is the security version of that. They own the risk assessment, the security program, and the security reports that go to leadership.
| Question | vCIO | vCISO |
|---|---|---|
| Main job | Plan technology spending and upgrades | Find and reduce security risk |
| Typical output | A 12-month roadmap and a line-item IT budget | A risk register, written policies, and an incident plan |
| Who usually asks for one | The owner or CFO, after a year of surprise IT bills | A customer, a regulator, an auditor, or an insurer |
| How you judge the work | Fewer emergencies and a budget that holds | Fewer open risks and clean answers on questionnaires |
| Who should get the reports | The owner and whoever approves spending | The owner directly, not only the IT lead |
There’s some overlap, since both of them care about backups, patching, and how Microsoft 365 is set up. Where they differ is the question they’re hired to answer. The vCIO is asking what the business should buy next. The vCISO is asking what happens when something breaks, and whether you could show an auditor you’d been careful.
Why do San Antonio companies mix the two roles up?
Part of the confusion comes from how the government counts these jobs. The BLS profile for computer and information systems managers includes CIOs, and it also includes managers who run a single area like cybersecurity. They all sit under code 11-3021. In May 2025, BLS counted 4,090 of them in the San Antonio-New Braunfels metro, and their mean annual wage was $166,630. That’s about 8.5% below the Houston mean of $182,200.
San Antonio has more security analysts than you might expect. The same survey counts 1,350 here, earning a mean of $125,830, which works out to about 3 IT managers for every analyst. Houston’s ratio is closer to 6 to 1, so for its size this metro has a lot of hands-on security people.
The other source of confusion is that a lot of small companies already have something close to a vCIO. Their managed IT provider holds a quarterly review, and security comes up in it. That review is worth having, but nobody in the room has signed up to own the risk, so it isn’t a security program.
Which situations point to a vCISO first?
Go with the vCISO first when someone outside the company wants proof. Here are the usual cases.
- A prime contractor or federal customer asks you to map your controls to NIST SP 800-171. This comes up for suppliers around Port San Antonio and Joint Base San Antonio.
- You keep patient records, and HIPAA’s administrative safeguards say you must name a security official.
- You run a CPA firm, tax prep office, mortgage brokerage, or car dealership. The FTC Safeguards Rule says a Qualified Individual must run your program.
- Your cyber insurance renewal asks who is in charge of security, and nobody is.
- You had an incident or a near miss, and nobody knew what to do in the first hour.
There’s also a Texas deadline to think about. Section 521.053 of the Business and Commerce Code says a breach that involves 250 or more Texans must be reported to the Attorney General within 30 days after you determine it happened. The Attorney General puts those reports on a public list, and we pulled that list on November 9, 2026. It had 25 reports from organizations in the San Antonio area published between November 1, 2025 and November 6, 2026. Medical providers filed 9 of them. 23 of the reports gave both a start date and a discovery date, and the median time between them was 26 days.
A breach that runs for close to a month before anyone notices has a lot of time to spread. Much of a vCISO’s first quarter goes into shortening that window with logging and alerts. The vCISO also writes the plan for the 30-day report, including who calls the insurer, the lawyer, and the Attorney General.
Which situations point to a vCIO first?
We’d point you to the vCIO first if the trouble is cost and planning. Maybe half your laptops are out of warranty and no one has a date to replace them. Maybe a few software subscriptions went up at renewal and nobody caught it. Maybe you’re signing a lease in Boerne or New Braunfels and nobody has asked what the network and phones there will cost. In each case you need a plan and a budget before you need a risk report.
Old equipment is also a security problem. A laptop that can’t get updates any more is an easy way in. Replacing it on a schedule is a budget call, so it belongs to the vCIO. When a company has a lot of that old gear, we often suggest the roadmap go first, because the vCISO’s list of risks shrinks once the gear is replaced.
| What’s happening | Start with | Why |
|---|---|---|
| A customer sent a security questionnaire or NIST 800-171 flowdown | vCISO | Someone has to own the answers and sign them |
| HIPAA or the FTC Safeguards Rule applies to you | vCISO | Both rules expect a named person running the program |
| Insurance renewal asks who owns security | vCISO | Underwriters use the answer when they review the application |
| IT costs are rising with no plan | vCIO | A budget and a refresh schedule fix this first |
| You’re opening a new location or adding staff | vCIO | The roadmap sets the network, licenses, and hardware |
| Both problems at once | vCIO you already have, plus a vCISO | Fix whoever is missing, then make the two talk |
What does each role cost in San Antonio?
A full-time hire in either role costs about the same, because BLS puts them in the same pay code. Start with the $166,630 mean. Private employers paid $46.89 an hour in total compensation in June 2026 against $32.82 in wages, according to BLS employer cost data. That’s a 1.43 multiplier, so the loaded cost is about $238,281 a year, or $19,857 a month.
Part-time rates are harder to pin down, since most providers don’t publish them. In our ranking of the best vCISO providers in San Antonio, only 1 of 5 local firms posted a range. The best public yardstick is the federal GSA CALC rate database. On November 9, 2026, it held 96 hourly rates from 63 vendors for labor categories titled chief information security officer, with a median of $205.48. Categories titled chief information officer had 11 rates from 10 vendors and a median of $245.19. These are ceiling prices on federal contracts, so treat them as an upper reference, not a quote.
| Option | Hours a month | Cost a month |
|---|---|---|
| vCISO at the CALC median | 20 | $4,110 |
| vCISO at the CALC median | 40 | $8,219 |
| vCIO at the CALC median | 20 | $4,904 |
| Full-time CIO or CISO, loaded | About 173 | $19,857 |
The hours matter more than the rate. At the CISO median, 20 hours a month costs about a fifth of a full-time hire. The two lines meet near 97 hours a month, so a company that would keep someone busy most of every week should price a hire.
Can one person do both jobs?
Yes, in some cases, and it costs less. Take a 30-person office with no regulated data. One experienced advisor can plan its spending and also watch its risk.
It gets harder as the stakes go up. Nobody should be the only one grading a firewall they picked, and whoever owns the budget has a natural reason to say the current tools are fine. NIST’s Cybersecurity Framework 2.0 added a Govern function in 2024 that asks companies to set clear roles and authority for cybersecurity. It doesn’t say those roles need to be different people. Our own rule of thumb is that past about 100 employees, or under HIPAA, the FTC rule, or a defense contract, the security reports should come from someone who doesn’t also own the technology budget.
Texas law also rewards a written program. Chapter 542 of the Business and Commerce Code limits exemplary damages after a breach for businesses under 250 employees that kept a qualifying cybersecurity program. The vCISO keeps that program up to date. The vCIO may still pay for the tools in it.
How does Uprite split the vCIO and vCISO work in San Antonio?
On our fully managed IT plans, the vCIO comes with the monthly per-user fee. Our vCIO services in San Antonio page covers the quarterly reviews and the line-item budget. If you’re already a managed client, you have a vCIO. The open question is whether you also need a vCISO.
We price vCISO work by scope after a short review, so this page has no vCISO price. In the review we count your employees and check which of the rules above apply. We also look at what your customers and your insurer want from you. Sometimes the vCIO is enough for now, and we tell you that. If it isn’t, the vCISO works with our managed security services in San Antonio. Then the person writing the program and the team watching alerts use the same records.
Our cybersecurity cost guide for San Antonio lists the security costs line by line. Uprite isn’t a law firm, so ask your lawyer how these rules apply to you. You can also contact our San Antonio team to talk it through.
vCISO and vCIO questions from San Antonio companies
Is a vCIO the same thing as a vCISO?
No. The vCIO handles technology spending, upgrades, and vendors. The vCISO handles security risk, policies, and incident plans, and the two work together a lot.
We’re a defense supplier near Port San Antonio. Which do we hire first?
Usually the vCISO. Somebody has to own the NIST SP 800-171 gaps, write the plan of action, and stand behind the score you submit. After that, a vCIO can budget for the fixes.
Can our managed IT provider’s vCIO cover cybersecurity too?
Often yes for a small office with no regulated data. If HIPAA, the FTC Safeguards Rule, or a defense contract applies, we’d add a separate vCISO who reports to the owner.
Does a San Antonio medical practice need a vCISO for HIPAA?
Not by that name. HIPAA requires a security official, and a small practice can give that title to its office manager. A vCISO can then do the risk analysis and write the policies, which the rule expects to be documented.
How many hours a month does each role usually take?
It depends on the work. A vCISO’s first quarter takes more hours because of the risk assessment and the policies. Audits and office moves add hours to either role for a few weeks.
Who should the vCISO report to?
The owner or the CEO. If reports only go through the IT lead or the vCIO, bad news can get buried, and the owner is the one who signs the insurance application.
Tell us what you’re dealing with, such as a security questionnaire, an insurance renewal, or an IT bill that keeps going up. We’ll tell you which role your San Antonio company needs first. Sometimes the answer is that you already have it.
Talk to a vCISO
