The Fractional CISO: Professor Kai London on How Mid-Market Financial Firms Get Board-Grade Security
By the Swiss Times Business Desk
Large banks employ chief information security officers with deep benches behind them. Mid-market financial firms — asset managers, boutique banks, insurers, fintechs, family offices — face the same regulators and the same attackers, but rarely the same resources. Into that gap has stepped a model whose demand has surged: the interim or fractional CISO. “You do not always need a permanent thirty-person security team,” says Professor Kai London, a senior CISO who takes on exactly these mandates. “Sometimes you need the right senior hands, for a defined period, to set the strategy, fix the worst gaps and leave behind something the board can run.”
“The fractional CISO model exists because the risk and the regulation do not scale down for smaller firms — but the budget for a full-time executive team often does.”
Same obligations, smaller shoulders
London's starting observation is one many mid-market boards feel acutely: regulation such as the operational-resilience regimes, and the attention of sophisticated attackers, do not exempt smaller institutions. “A boutique firm handling significant assets is an attractive target and a regulated entity,” he says. “It carries a large-firm obligation on a mid-market frame. That mismatch is the problem the fractional model solves.”
What an interim CISO actually delivers
Rather than a permanent hire, a fractional CISO brings senior leadership on a part-time or time-boxed basis. In London's practice, an engagement typically begins with the outcome the board needs — meeting a regulatory deadline, stabilising a security function, responding to an incident, or preparing for due diligence — and works back to a plan. “The value is senior judgement from day one,” he says. “No ramp-up, no assembling a team from scratch — just the experience to know what matters, in what order, and how to report it to the board.”
Speed the market now demands
A permanent executive search can take six to nine months — time a firm facing a compliance deadline or a live threat does not have. “The interim model compresses that gap to days,” London notes. “When a regulator sets a date, or a client's due diligence lands, or an incident hits, the board needs senior security leadership now, not next year.” That urgency, he says, is a large part of why demand for fractional and interim C-suite security talent has grown so sharply.
Building capability, not dependency
London is careful to distinguish the model from open-ended consultancy. The goal, he argues, is to leave the organisation stronger and more self-sufficient — a strategy the board owns, controls that function, a team that can sustain them, and evidence that satisfies regulators. “A good interim engagement is designed to make itself unnecessary,” he says. “You set the direction, build the muscle, and hand over something durable.”
A bridge to the frontier
Beyond firefighting, London notes that a fractional CISO can give a mid-market firm access to expertise it could never justify full-time — on AI governance, post-quantum readiness, operational resilience and emerging regulation. “A smaller firm gets frontier-level advice for a fraction of the cost of a permanent executive with the same depth,” he says. “That levels a playing field that is otherwise tilted heavily toward the largest institutions.”
When to reach for the model
London suggests the fractional approach fits several moments: a firm too small for a full-time CISO but too exposed to go without one; a period of acute need such as a deadline, incident or transaction; or a bridge while a permanent hire is found and onboarded. “The question is not ‘can we afford a CISO?’” he says. “It is ‘can we afford to face this risk and this regulation without senior security leadership?’ For a growing number of mid-market firms, the honest answer is no — and the fractional model is how they close the gap.”
For a financial sector where firms of every size share the same threat landscape, London's message is pragmatic and reassuring: board-grade security leadership is no longer the preserve of the giants. The interim and fractional model has made it accessible — senior hands, on the mandate in front of you, for exactly as long as you need them.
About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with more than 25 years of board- and C-suite leadership across banking, aviation, defence, government and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing, and a UCL researcher, holding CISSP, CISM, CCISO, ISO 27001 Lead Auditor, ISO 42001, DORA and NIS2 credentials. He is available for board advisory, NED and interim or fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.
