You have decided the organization needs outside help with security, and now you are looking at two options that sound similar and cost very different amounts. One firm proposes an assessment with a report at the end. Another proposes an ongoing retainer with a named person who would act as your security director on a part-time basis. Both use the word expert. Both have references. The question of fractional security director vs security consultant comes up in almost every conversation I have with executives, and the honest answer is that they are different tools for different problems.
I have worked on both sides of this line. I have delivered assessments and walked away, and I have owned programs for organizations that had nobody else to own them. The distinction is simple once you see it. A consultant answers a bounded question and leaves. A fractional director takes responsibility for the program and stays. Which one you need depends on whether your problem is a question or a gap.
What a Security Consultant Actually Delivers
A good consultant is hired to answer something specific. Is this building’s access control adequate? Does our workplace violence policy meet the standard our insurer expects? Should we renew this guard contract or rebid it? The consultant scopes the work, does the fieldwork, writes the findings, presents them to leadership, and the engagement ends. The deliverable is knowledge, packaged so that someone inside your organization can act on it.
That model works well when two things are true. First, the question really is bounded, so that a competent outsider can answer it in weeks rather than living with it for years. Second, someone inside the organization has the authority and the time to carry the recommendations forward. When both conditions hold, a consultant is the efficient choice and I recommend one without hesitation. When either condition fails, the report goes into a drawer, and I have seen that drawer in a great many organizations.
What a Fractional Security Director Actually Owns
A fractional director is a different arrangement entirely. The person is your security director, with the same responsibilities a full-time director would carry, on a schedule and retainer sized to the organization. They own the policies, the vendor relationships, the incident response process, the budget request, the training calendar, and the briefing to leadership. When something goes wrong at two in the morning, they are the one who gets the call and the one who is accountable for how ready the organization was.
The value here is continuity. A program is a living thing. Guard contracts drift from their post orders, credential lists fill with people who left, new sites open, new threats emerge, and policies written three years ago quietly stop matching how the business runs. Someone has to notice, and someone has to have the standing to fix it. A consultant can tell you what is wrong on the day they visit. A fractional director is responsible for what is true every day after.
When to Hire a Consultant
Hire a consultant when you already have someone who owns security and that person needs an outside view on a specific matter. A full-time director who wants an independent audit before a board presentation is a good example. So is a facilities leader who has managed security capably for years and wants a second opinion on a new building design. So is any organization facing one discrete event, such as a merger, a relocation, or a regulatory deadline, where the work has a clear start and finish.
Before you sign, write down the question you are paying to have answered and confirm the proposal answers exactly that. Then name the person inside your organization who will own the recommendations after the consultant leaves, and make sure they agree to it. If you cannot name that person, you do not have a consulting problem. You have a leadership gap, and a report will not close it.
When to Hire a Fractional Director
Hire a fractional director when nobody in the organization owns security as their primary responsibility. This describes most mid-sized organizations I encounter. Security has been assigned to facilities, or HR, or the COO’s chief of staff, and that person is doing their best with no background and no time. Incidents get handled one at a time. Vendors are managed by whoever signed the contract. Nobody can tell the board with confidence whether the organization is protected, because nobody has tested it.
The tell is usually a pattern rather than a single event. If you have commissioned an assessment before and most of it was never implemented, that is the pattern. If you have had two or three incidents that each felt like the first one, that is the pattern. If your guard vendor has been in place for years and nobody has read the contract since it was signed, that is the pattern. In each case the missing ingredient is ownership, and ownership is exactly what a fractional director provides.
A Warning About Vendors Who Assess and Then Sell
There is a third option on the market that presents itself as one of the first two, and I want you to recognize it. Many integrators, guard companies, and technology providers offer a free or low-cost security assessment. The assessment is real work and the people doing it are often competent. But the company’s revenue comes from what it sells afterward, and the findings have a way of pointing toward cameras, sensors, and staffing that the same company happens to provide.
This is not an accusation of dishonesty. It is a description of incentives. A vendor cannot be expected to recommend that you need less of what they sell, or that a policy change would solve what they would rather solve with hardware. If you accept a vendor assessment, treat it as a sales proposal and have someone independent review it before you fund anything. Ask any consultant or fractional director you interview whether they accept commissions, referral fees, or resale margins from the products they recommend. The right answer is no, in writing.
How to Decide This Week
Sit down with your leadership team and answer three questions in plain language. Who owns security in this organization today, by name? What did we do with the last outside report we paid for? When was the last time someone tested a security assumption instead of accepting it? If the first answer is a person with the background and the time, and the second is that the recommendations were implemented, a consultant will serve you well the next time you have a question. If the answers are uncomfortable, you already know which option you need. I laid out the doctrine behind that last question in Until Tested: Security Is Only Assumed, and it applies to this decision as much as any other: do not assume the organization is covered because someone was given the title.
Go Deeper
For the full picture of the role, including how it is scoped, priced, and measured, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director goes into the consultant comparison in far more depth, with the questions I would ask before signing either kind of agreement.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply