You have looked at what a full-time security director costs, added benefits and a support budget to the salary, and concluded that it is a line item for companies several times your size. That conclusion is correct as far as it goes. A seasoned director is an executive-level hire, and a company of a few hundred people cannot justify one and usually cannot keep one busy. So the question of whether a small company can afford a security director gets answered with a no, and security goes back to being handled on the side by whoever has the least ability to say no.
I want to reframe the question, because the way it is usually asked hides the real math. The choice is rarely between a director and nothing. It is between paying for security leadership deliberately and paying for its absence in ways that never show up on a single line of the budget. Once you see the second column, the affordability question looks different.
What You Are Already Paying Without One
Start with the guard contract, if you have one. It was probably priced by the vendor, negotiated by someone without security expertise, and renewed without anyone comparing the scope to what the organization actually needs. In my experience, contracts managed this way carry hours, posts, or premiums that a knowledgeable director would trim in the first quarter. Then look at technology. Cameras, access control, alarm monitoring, and visitor systems bought on a vendor’s recommendation are routinely oversized for the risk and undersized for the actual problem. A director who reviews proposals with no stake in the sale changes what gets bought and what gets declined.
Then count executive time. Every incident, every insurer questionnaire, every uncomfortable question from the board, every vendor renewal lands on a COO, a CFO, or an HR director who has to work it from scratch. Those hours are the most expensive the company has, and they are being spent on work that a specialist would do faster and better. Add the exposure that comes from policies nobody follows, credentials nobody audits, and threats nobody has a process for, and the cost of not having a director is substantial. It is simply spread across enough budgets that no one sees it whole.
Why the Full-Time Model Does Not Fit
The problem with a full-time hire for a small or mid-sized company is not only the salary. It is the mismatch between the work and the week. Security leadership at this size is executive work: setting direction, owning policy, managing vendors, briefing leadership, running the incident process, and testing whether any of it works. That work is essential and it is also intermittent. It fills a few days a month in a steady state and a great deal more during an incident or a build-out. A full-time director in a company of two hundred people either invents work to fill the calendar or drifts into managing the guard desk, and neither is what you were paying for.
The other failure mode is hiring down. A company that cannot afford an experienced director hires a security manager instead, someone capable of running the contract and the badge system but without the background or the standing to lead. The organization now has a security title and believes the gap is closed. What it has is a manager without a director, which is the most common configuration I find in organizations that are surprised by their own incidents.
The Fractional Model and What It Costs
The model that fits is the same one small companies already use for finance, legal, and human resources leadership. A fractional security director is an experienced executive who serves as your director on a part-time retainer, typically a set number of days per month with defined availability for incidents. The organization gets director-level judgment, ownership of the program, and a person accountable to leadership, at a fraction of a full-time executive’s total cost. The exact number depends on the size of the organization, the number of sites, and the risk profile, but for most companies it lands in the range of a senior manager’s salary rather than an executive’s, and often well below.
The retainer is also easier to justify because it is measurable against what it replaces. In the first year, a competent fractional director typically finds savings in the guard contract and the technology pipeline that offset a meaningful share of the fee. Beyond the money, the organization gains something it did not have: a person who can tell the board with evidence whether the company is protected, and who is responsible for the answer.
How to Size the Engagement for a Small Company
Begin by writing down what you need the role to own. For most small companies the list is the guard or reception arrangement, access control, incident response, workplace violence prevention, vendor management, and the annual conversation with the insurer. Then estimate how many sites and how many people that covers. A single site with a few hundred employees usually needs a few days a month. Multiple sites, a public-facing operation, or a recent incident push the number up. Ask any director you interview to propose a scope and a schedule against that list, and to explain what they would do in the first ninety days.
Structure the agreement so that it can grow or shrink. A heavier first quarter for the assessment and the initial fixes, followed by a lighter steady-state retainer, is the pattern that works best in my experience. Make sure incident availability is defined in writing, including what counts as an incident and how quickly the director responds. And insist that the director accepts no commissions, referral fees, or resale margins from anything they recommend. That single clause is what makes their advice on spending worth more than it costs.
What to Do Before You Spend Anything
You can test the case for yourself in a week without spending a dollar. Pull the guard contract and the last twelve months of invoices and ask whether anyone can explain why the hours are what they are. Request the active credential list and count the names that should not be on it. Ask your managers what they would do if a terminated employee made a threat, and see whether the answers match each other or match anything written down. Then pick one thing the organization assumes is working, the alarm, a locked door, the evacuation route, and check it. This is the doctrine behind Until Tested: Security Is Only Assumed. If those checks come back clean, you may be one of the small companies that is doing fine on its own. If they do not, you now know what you are already paying for, and the question of whether you can afford a director answers itself.
Go Deeper
For a full explanation of the model, including how engagements are scoped and what to look for in a director, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the affordability case in detail and walks through how small and mid-sized organizations structure and measure the engagement.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply