Biased perspective, as we offer vCISO services in Australia - but depends on the compliance requirements per business. A fractional or vCISO option may work if the organisation is mature or willing to uplift.

Businesses in the more complex sectors we tend to see insource or utilise vCISO while they recruit internally.

Both options have their benefits, I think it comes down to ROI and where cash is as well. Sometimes expenditure on services is easier to green light than salaries.