Podcast Episode: Fractional Security Leadership

Pip: Commissioner William Epps spent seven years in federal law enforcement, including time at one of the most protected buildings in the world — and now he's asking whether your organization even knows who's in charge of security.

Mara: That's the thread running through everything WILL published this week. We're covering when organizations actually need security leadership, how to choose the right model, and what fractional leadership realistically costs.

Pip: Let's start with the question that probably makes a few executives uncomfortable — do you actually need a security director?

When the Security Chair Is Empty

Mara: The frame here is deceptively simple: can your CEO get a straight answer about who owns security? The post puts it directly — "A CEO should be able to ask who is responsible for the organization's security and receive an answer that explains how the work gets done."

Pip: And if the answer changes depending on which department picks up the phone, that's not a security program — that's a relay race with no finish line.

Mara: Right, and the post is careful not to blame the people currently filling the gap. Facilities, HR, and technology staff are often managing demanding responsibilities already. The question is whether those efforts have been organized into a workable security function with enough time and authority behind it.

Pip: There's a useful diagnostic buried in here: look at which security issues have landed on your desk more than once. Not occasional questions — recurring patterns. If every important decision has to be reconstructed from separate conversations, the organization is relying on individual memory rather than structure.

Mara: The companion piece on when a company needs a security director frames the same problem from the warning-sign angle — reactive decisions, no one who can name the top five risks, vendors driving your security posture instead of an internal leader holding them accountable.

Pip: That piece also names the compounding damage: fragmented spending, unclear emergency roles, employees losing confidence in leadership's ability to keep them safe.

Mara: Both posts converge on the same point — the most expensive failures aren't the result of a single bad day. They're the result of years without clear ownership. That's the real cost of waiting.

Pip: Which raises the obvious next question: once you've decided you need leadership, what form should it take?

Fractional or Full-Time: Matching the Model to the Moment

Mara: The post on fractional versus full-time security directors opens with a direct warning: "Choose the wrong model for your security leadership and you will either overspend for unused capacity or underinvest and leave material risk on the table."

Pip: So the choice isn't philosophical — it has a price tag in both directions.

Mara: Exactly. A full-time director is an executive role — strategy, team management, board reporting, regulatory relationships — and in most U.S. markets that means low-to-mid six figures annually before benefits and overhead. The post says that investment makes sense when security risk is material to valuation, brand, or regulatory exposure, and when there's enough complexity to keep a seasoned leader fully engaged.

Pip: The fractional model is the same expertise, bought in the quantity you actually need. The post lays out a four-phase transition path — stabilize, architect, recruit, transition — for organizations that start fractional and grow into a full-time hire.

Mara: The piece on fractional director versus security consultant draws the sharper line. A consultant answers a defined question and hands the report back to you. A fractional director stays — prioritizing actions, sequencing investments, sitting with your leadership team when key decisions get made, not just when a report is requested.

Pip: In other words: consultant reports that sit on a shelf are a symptom, not a strategy.

Mara: The post puts it plainly — most organizations that struggle with security aren't suffering from a lack of reports. They're suffering from a lack of leadership and continuity. That's the distinction that determines which model you actually need.

Pip: And once you've landed on the right model, the next question is what it actually costs.

What Fractional Leadership Actually Costs

Mara: The cost post is honest about the variability: scope, industry, company size, and engagement model all move the number. But it draws one line clearly — "If the fee you are being quoted is so low that it would not reasonably cover executive-level time and preparation, you are not buying leadership — you are buying occasional advice."

Pip: That's a useful filter. Cheap fractional leadership and no leadership can look identical on a spreadsheet until something goes wrong.

Mara: The post walks through three pricing structures — hourly for short scoped work, monthly retainers for ongoing leadership, and project-based fees for defined outcomes like building a first security program or preparing for a major client review. Most organizations land on retainers, with scope tied to defined hours and clear responsibilities.

Mara: On the return side, the post frames value across four dimensions: clarity on risk posture, confidence with boards and regulators, better spending decisions against a deliberate roadmap, and a security culture that operates as discipline rather than emergency reaction.

Pip: The comparison to full-time cost is the part that tends to move the conversation — salary plus benefits plus overhead plus a six-to-twelve month search, versus leadership that can be in place within weeks.

Mara: The post is clear that for organizations with heavy regulatory exposure or high security volume, a full-time leader is absolutely warranted. The fractional model isn't a permanent workaround — it's the right-sized answer for the right moment in an organization's growth.

Pip: The throughline across all of this is pretty simple: the question was never whether you need security leadership. It's whether you'll get ahead of it or wait for an incident to answer for you.

Mara: And the next episode will keep pulling on that thread — more from this site on what security leadership actually looks like in practice.