AI is changing the vCISO game
Virtual CISO (vCISO) services have moved from niche to mainstream, with vCISO services adoption 2025 data showing a more than threefold increase in just one year. According to Cynomi’s 2025 State of the Virtual CISO report, 67% of MSPs and MSSPs now offer vCISO services, up from just 21% in 2024. This sharp increase aligns with the previous year’s predictions, when nearly three-quarters of non-adopters stated they planned to launch these services by the end of 2025.
Potential value of AI in enhancing cybersecurity and compliance services (Source: Cynomi)
“When we launched the State of the vCISO survey three years ago, it was clear that service providers were just beginning to recognize the potential of strategic cybersecurity offerings. Today, that shift is in full swing,” said David Primor, Ph.D., CEO of Cynomi.
Demand is strongest among SMB clients
SMBs are driving the trend. Among the 200 security leaders surveyed, 79% reported high demand for vCISO services from their SMB clients, with larger providers more likely to report strong interest. For example, 86% of companies with over 1,000 employees noted high demand, compared to 68% of smaller firms. This suggests that as providers grow, their customers expect more proactive, structured cybersecurity support.
The report also found that the definition of vCISO services is broadening. What started as high-level consulting now includes tasks like risk assessments, compliance readiness, roadmap development, and cyber resilience planning. This expansion positions the vCISO as a hands-on contributor to ongoing security operations.
Operational barriers persist, but most plan to adopt
Despite the momentum, some barriers remain. Among providers that haven’t yet adopted vCISO services, the top concerns are profitability (35%), high startup costs (33%), and limited access to skilled cybersecurity staff (32%). Only 3% of non-adopters have no plans to offer vCISO services, and most of the rest aim to launch by 2026.
Those who have already made the leap report strong business and security benefits. Improved customer security topped the list (43%), followed by upselling opportunities (41%), higher margins (40%), and easier customer acquisition (38%). Interestingly, even providers who haven’t yet adopted vCISO services see similar advantages, suggesting broad agreement on the model’s value.
AI is now central to vCISO service delivery
AI and automation are becoming essential to how vCISO services are delivered. Among providers offering vCISO services, 81% are already using AI or automation, with another 15% planning to do so within a year. The result is significant time savings — an average 68% reduction in cybersecurity and compliance workload over the past 12 months. In fact, 42% of respondents reported workload reductions of over 80%.
AI is being used across a range of tasks, from compliance monitoring and task prioritization to reporting and risk assessments. Nearly all providers (95%) believe AI will improve service delivery, and most expect it to eventually save at least 50% of their current labor time.
This shift reflects the broader trend of vCISO services adoption 2025, driven by both client expectations and operational efficiency gains.