Fractional executive IT advisory for SA SMBs who are too small for a full-time CTO but too complex for IT decisions to sit with the office manager. Technology strategy, operational leadership, security governance, plugged in at exec level and accountable to business outcomes.
Most SMBs reach a point, usually somewhere between 10 and 200 staff, where their IT decisions start to matter at a strategic level, but they can't yet justify a R1.5m-a-year CTO. Vendor consolidation decisions, platform migrations, cybersecurity investment, regulatory exposure, buy-vs-build on line-of-business software, AI adoption questions, M&A technical due diligence. These decisions shouldn't be made by the operations manager, the accountant, or the loudest person in the room. But hiring a full-time technology executive to make them is overkill.
Fractional CTO/CIO/CISO engagements solve this. You get access to a senior technologist who shows up in your exec meetings, understands your business, and is accountable for the technology decisions that would otherwise either get made badly or not get made at all. Four to eight hours a month is enough for most businesses, scaled up for intensive periods like a migration, system selection, or incident response.
Right role when you're a product business, a technology-driven service business, or scaling into technology-based offerings. Covers: technology strategy and roadmap, architecture decisions, build-vs-buy, vendor and platform selection, technical due diligence on acquisitions or partnerships, R&D direction, hiring technical staff.
Right role when IT supports your business operations but isn't the product. Covers: operational IT strategy, IT budget allocation, capacity planning, vendor management, governance frameworks, risk register, business continuity planning, measuring IT performance against business outcomes.
Right role when you have meaningful data liability, regulatory exposure, or you've been required by a client or insurer to demonstrate a security programme. Covers: security posture, security governance and risk programme, incident response readiness, security training oversight, board-level security reporting.
In practice, most SA SMBs don't need three separate executives, a 50-person professional services firm needs one experienced technologist who can cover all the bases. We blend the roles based on what your business actually needs this quarter.
What we're not: writing code (that's a different engagement), running your helpdesk (that's managed IT), replacing your technical team if you have one (we work alongside them). The vCTO/vCIO/vCISO role is specifically a senior technologist's perspective on decisions that are expensive to get wrong.
Who this isn't for: businesses whose IT is simple enough that managed IT with occasional advisory covers it, businesses looking for a cheap substitute for strategy consulting (we're a technology leadership role, not McKinsey), or businesses who want someone to just rubber-stamp decisions already made (we'll say what we think, even when it's inconvenient).
A vCTO focuses on technology strategy, architecture, and build-vs-buy decisions. The right role when you're a product business or scaling into technology-driven offerings. A vCIO focuses on operational IT: capacity planning, vendor management, IT budget allocation, governance. The right role when IT supports your business but isn't the product. A vCISO focuses on security posture, security governance and risk management, and incident response readiness.
For most SMBs, we blend elements of all three, a 50-person professional services firm doesn't need three separate executives, just one experienced technologist who covers all the bases.
Fractional CTO/CIO/CISO engagements in South Africa typically run between R15,000 and R45,000 per month depending on hours and scope. For context: a full-time CTO at an SA SMB commands R1.2m to R2m per year all-in, which most 10-200 staff businesses can't justify.
A fractional engagement of 4-8 hours per month gives you access to senior technology leadership for a fraction of the full-time cost, scaled to the actual decisions you need help with. We quote a fixed monthly fee after understanding scope.
In a typical month, a vCTO engagement includes: one monthly working session with the exec team (1-2 hours) covering progress, decisions, and the next quarter's priorities; attending ad-hoc technology decision meetings (vendor evaluations, architecture reviews, build-vs-buy discussions, technical due diligence on acquisitions); reviewing architecture or code where that unlocks a business decision; writing short decision memos that go in your governance pack; and being on hand for 30-minute phone calls when something urgent comes up.
We're not writing code; we're giving you the senior technologist's perspective on decisions that are expensive to get wrong.
Our vCISO engagements cover: strategic security posture, incident response plan maintenance and rehearsals, breach notification support if an incident occurs, vendor risk assessment and management, security training programme oversight, and board-level security reporting.
The scope is strategic and advisory; the technical implementation (your access controls, logging, encryption, backup, patching) can either be run by your internal team under our governance, or by us as a separate managed services engagement.
Yes, and it's a reasonable path. The common pattern is: start with vCTO/vCIO on general technology oversight, discover that security governance needs more attention than the initial scope allowed for, and add dedicated vCISO hours when a specific trigger emerges, a regulatory review, a client security questionnaire, a near-miss incident, a board-level request. We prefer to flex the scope rather than lock you into a tier you've outgrown.
Management consultants bring frameworks and process; a vCTO brings technology-specific experience and ongoing accountability. We make real technology recommendations ("use Azure*, not AWS*, because your team already knows M365 identity"), own the outcomes of those recommendations (we're still here in six months when the thing is running), and give you the operational experience of someone who's actually deployed what we recommend. A consultant will give you a deck; we'll give you a working system and the roadmap to improve it.
* Products named on this page are examples of the stack we deploy. Actual recommendations depend on your environment, scale, and existing licensing. We have zero commission arrangements with any vendor. Recommendations are made on technical fit alone.