For a founder whose Lovable or Bolt app already works, fractional CTO vs agency is a choice between buying a person’s month and buying a team’s hours. A third option buys neither: a fixed-scope package sells a published list of work with a dated finish. Which one fits depends on whether the work is already a known list.
What you are actually buying: fractional CTO vs agency vs a fixed-scope sprint
A fractional CTO sells decisions, most often by the month. An agency retainer usually sells a monthly block of a team’s hours. A fixed-scope package sells a published list of work with evidence per item. A freelancer sells one fix by the hour. Which you need, in my reading, depends on whether the list is known.
This page is the buying guide in a series on production hardening, and it covers one decision: who to pay once the app runs. The cells below are my reading of what each purchase delivers, not any seller’s description, and none of them carries a figure.
| Option | What you get | The unit it is priced in | Wrong buy when |
|---|---|---|---|
| A fractional CTO | Decisions, hiring help, a roadmap | Most often the month or the hour; sometimes a fixed fee for one agreed piece of work, or the day | The work is already a known list of fixes and nobody needs to set a direction |
| An agency retainer | A team’s hours, with the work agreed as the month goes | Usually a monthly block of hours | The app needs hardening before it needs features |
| A fixed-scope package | A published list of work, a dated finish, evidence for each item | One price for the published list | Nobody has read the code yet, or what you need is ongoing leadership |
| A freelancer or rescue shop | One person, or a small shop, on one job | The hour or the job | The problem is bigger than one fix and nobody has written it down |
| A vCISO | A part-time security lead | A monthly retainer, in my reading | The app has never had a security test |
What a fractional CTO is, as a role, has its own page: what a fractional CTO is. So does the question of whether one touches the code, in what a fractional CTO does, and who writes the code. How an agency quote is assembled sits in what an app development agency charges, and the freelancer row’s most common job, a stalled build, is covered in hiring a developer to finish an app.
A few neighbors are different purchases or different questions, and I only point at them. A full-time hire is hiring a CTO for your startup. A cofounder is paid in equity, which is the comparison in fractional CTO vs technical cofounder. The outsourced, part-time and interim labels are decoded in what outsourced, part-time and interim CTO mean. Keeping a running app alive (you, one repair at a time, somebody by the month, somebody ongoing) is a separate choice with its own table in who maintains an AI-built app.
Sellers also use other names for the same five rows. Fractional CTO vs consultant comes down to what you get: a consultant sells advice by the hour, and what that advice can and cannot settle is in what an app development consultant does. A technical advisor, as I read the title, does the consultant’s job under another name; the roles and responsibilities come down to advice, sometimes on a small retainer, with the building left to somebody else. “Technical partner” is a phrase with a page of its own, what a technical partner arrangement owns, and I leave the definition there.
An engineer on demand is an engineer’s hours sold a booking at a time, and most sellers under that name offer field, hardware and design engineers rather than software developers. The software versions, the on-demand and dedicated developers offered for one app, are unpacked in on-demand developers and the words sellers use.
If you built the app as one of the vibe coders and now want a fractional CTO for it, what changes when a generator wrote the code is covered in a fractional CTO for an AI-built app. Whether anyone who ever hired a fractional CTO got their money’s worth turns, in my reading, on the same split as the rest of this page, direction or a list of work, and the direction-or-work test is linked in the fractional CTO section below.
What it costs
The unit decides what the money buys. A fractional CTO is sold most often by the month or the hour, sometimes by a fixed fee or the day; an agency retainer usually by a monthly block of hours; a freelancer by the hour or the job; a fixed-scope package by its list. Compare the outcome, not the rate.
| Option | The unit it is sold in | Where the published numbers live |
|---|---|---|
| A fractional CTO | Four units: the hour, the day, the month, a fixed fee for one agreed piece of work | The cost article linked below this table, sorted by unit and dated |
| An agency retainer | Usually a monthly fee for a block of hours; sometimes an unlimited-requests plan with a capacity limit in place of an hour count | The retainer article’s table of sellers that print a figure |
| A freelancer | The hour or the job | Each freelancer’s own profile or quote (my reading) |
| A vCISO or virtual CIO | A monthly retainer or the hour (my reading) | vCISO: the SOC 2 consultants page; virtual CIO: not stated here |
| A fixed-scope package | One price for the published list | The seller’s own page, fixed before work starts (my reading) |
I don’t restate any fractional CTO figures here. The published numbers, each in the unit its seller uses, are collected in fractional CTO cost by the unit it is sold in. The retainer article records one detail that matters before you compare a monthly fee with anything: a contract-template publisher it cites tells developers to set an hourly rate and multiply it by the estimated hours to arrive at the retainer fee. So a monthly fee is, as I read it, an hours guess paid in advance.
vCISO numbers belong to SOC 2 compliance consultants, which prices the security retainer and walks the standards route. In my reading, virtual CIO rates are quoted in the same two units, and this page gives no figure for one.
A fractional CTO in the UK is sold in the same units: the UK figures on the fractional CTO cost page are a day rate and a monthly band, in pounds. A list of the best fractional executive firms is a directory, and a directory shows a rate, not a fit, in my reading; where to find a person, channel by channel, and when the arrangement is the wrong purchase for one working app, is in how to hire a fractional CTO when your app already works.
When to pick each
The pick follows what is missing: a fractional CTO when it is direction, an agency when it is a feature roadmap and no team, a fixed-scope package when it is a known list on one codebase, and a freelancer when it is one broken thing. If nobody has read the code, I’d buy the reading first.
Each purchase below gets a fits line and a does-not-fit line. All of it is my reading, and where another article on this site already covers the reasoning I point to it instead of repeating it.
A fractional CTO
It fits when the missing thing is direction: who to hire, which architecture to commit to, or an investor asking who the technical lead is. The signals, and the test that guide puts as “Is the thing you are short of direction, or work?”, are in when you need a fractional CTO, so I won’t repeat them. It fits less well when the work is already a list, and the situations where it is the wrong purchase for one working app are in the hiring guide linked under costs. The risk I’d name is a retainer that runs for months while a known list stays open.
An agency retainer
An agency retainer fits when there is a roadmap of features and no team to build them. It does not fit when the app needs hardening first, as I see it, because a retainer prices hours rather than the outcome, and hardening competes with new features for the same hours. Whether a monthly block is worth buying at all is the hours test for a web developer retainer. When an agency is the right shape for one working app, and when it is not, is the agency article’s own section, linked in the first part of this page.
A fixed-scope sprint
This purchase fits when the work is a known list on one codebase, with a dated finish and evidence for each item. It does not fit when nobody has read the code yet, because then the list is unknown and the reading comes first; that reading is what a technical due diligence consultant sells. It also does not fit when the need is ongoing leadership. The write-code article’s FAQ on a list of things to fix rather than a direction to set gives the same answer from the fractional CTO’s side: buy the fixing.
A freelancer or a rescue shop
One broken thing with a small fix is freelancer work, and so is a stalled project that needs finishing, which the finishing guide in the first section covers. To rescue a failed software project, I’d go in this order: a reading first, then a written list, then a purchase against that list. The choice between an hourly rate or fixed price, and when hours are the honest answer, has its own page.
vCISO, virtual CIO and fractional executives: what each retainer actually buys
A vCISO (virtual chief information security officer) is, in my reading, the security version of a fractional CTO: a part-time security lead bought as a monthly retainer. It fits when a customer asks for a named security owner, and not when the app has never been tested, because the retainer would start by buying the test.
A virtual CISO and a virtual chief security officer are the same purchase under longer names. vCISO vs CISO is fractional versus full-time again, and the FAQ below takes it. A virtual CIO is the IT version of the arrangement; what the CIO role covers is set out in NIST’s glossary entry for Chief Information Officer, written for US federal agencies, and the FAQ below gives its words.
A security consultant, next to these, is an hourly adviser on the same questions with no standing role in the company, as I see it. Outsourcing cyber security means buying one of these, or a managed service that watches the systems for you (my reading).
The retainer earns its fee when a customer questionnaire or a standard asks who owns security, and the standards route sits on the SOC 2 consultants page linked under costs. When the app has never had an outside test, the test is the first purchase: web application security testing services covers what that buys, and affordable penetration testing covers the smaller-budget version.
Agency, offshore, outsourced or white-label: which of the five purchases each one is
An outsource software development company, an offshore team and a white-label partner are not new kinds of purchase, in my reading. Each is a team or a person doing the work from another company or another country, so read it as the agency row or the freelancer row of the table, with the same wrong-buy line.
Outsourced application development, like outsourced software development services in general, means another company’s staff working on your code, and an offshore software development company is the same arrangement run from another country. An offshore team is that company’s people assigned to you; an outsourced engineering team is the same thing named by what the people do. Outsourcing web developers, and outsourcing applications whole, lands on the agency row when a company employs the people and on the freelancer row when one person does the work. IT sourcing is the procurement department’s word for choosing among these suppliers. The unit and the wrong-buy line follow whichever row it lands on, in my reading.
What an outsourcing company actually sells, and what working with one in another country involves, is answered in should I outsource app development. A low quote from abroad has its own gaps, listed in what a cheap offshore quote leaves out. Who holds which contract when an agency passes work to a hidden partner is what a white-label partnership is.
Whichever row it lands on, who owns the code, the provider accounts and the domain when the work ends is a checklist of its own: the nine things to check are in your name.
In the Production Hardening Sprint, deliverable 2.8 moves every service the product depends on (database, hosting, payments, email, AI, domain) into an account the founder owns, with the founder as the owner role, billing in the founder’s name, and any previous builder removed. Deliverable 2.8 is verified this way: an inventory listing each provider, the owning account, the owner role holder, and the date the previous builder’s access was removed. Deliverable 7.11 keeps the application in a version-controlled repository and on a hosting account the founder controls, deployable through a documented pipeline, independent of the tool that generated it.
Questions to ask before you pay
Interviewing a fractional CTO has its own list, what to ask before hiring a fractional CTO, and the questions that sort a cofounder bargain from a paid firm are in the technical-partner article linked in the first section. Freelancer against agency on five axes is a freelancer or an agency, for one app that already runs; the two cells below on who reads the code agree with that table.
The table asks the same five questions of four purchases. Each cell is my reading in a short phrase, and no seller is named.
| Question | Fractional CTO | Agency retainer | Fixed-scope package | Freelancer |
|---|---|---|---|---|
| What exactly is delivered, in writing? | A person’s days or hours, plus whatever the roadmap sets | A block of team hours; features agreed as the month goes | The published list, item by item | The job as quoted, often in a message thread |
| What ends it? | Notice under the contract | Notice, or the block running out | The dated finish and the handover | The job being done, or either side stopping |
| Who reads the code before quoting? | Often nobody until the engagement starts | Often a salesperson first; the reading comes after you commit | The people who will do the work, before the list is fixed | Usually the person who will do the work, if they look at all |
| What evidence do I get per item? | Decisions and documents, rarely per item | Closed tickets, if anyone tracks them | Evidence for each item on the list | The fix itself and a message saying it is done |
| Who answers after handover, and for how long? | The same person, while the retainer runs | The agency, while the contract runs | A support window stated before the work starts | The same person, if they are still available |
One question gets the same right answer in every column: whose name is on the accounts during the work and after it. The checklist for that is the ownership article linked in the outsourcing section.
Where the sprint fits
The Production Hardening Sprint covers one codebase. Its ten working days begin at the agreed kickoff, once the required repository and environment access is available. At handover you receive the updated codebase, tests and deployment configuration; a readiness report and technical due diligence pack; instructions for releases, backups, recovery and incident response; guidance and automated checks for future AI-assisted changes; and a recorded handover and codebase walkthrough. Post-handover support is 14 calendar days of fixes for defects in the delivered sprint work and 30 calendar days of async access for questions about the handover and architecture. Building new product features or modules, completing unfinished core features or business workflows, and rebuilding core functionality that does not yet perform its intended job sit outside the sprint. The app’s current framework and hosting setup are the starting point. The whole list is on the published scope.
Once real growth arrives, the next list is a different one: the scaling readiness checklist for startups.
Common questions about fractional help, agencies and outsourcing
Is outsourcing a dying concept?
For a founder with one small app, the more useful question, in my reading, is which unit you are buying: a team’s hours, a person’s month or a list of work. This page makes no market-trend call on outsourcing. What matters for your app, as I see it, is whether the unit you pay in matches work you can already name.
What are 10 examples of outsourcing?
Ten things a small SaaS can buy from outside instead of hiring for, in my own list and not a market survey: hosting, payments, email delivery, customer support, bookkeeping, design, feature work, a security test, a code review and recruiting.
Feature work, the security test and the code review are where the purchases on this page come in.
What are the key differences between a vCISO and a CISO?
A vCISO is usually bought by the month and works part-time; a CISO is employed full-time. The security work itself can overlap. The difference, in my reading, is how much of a person you get and on what terms.
What does a virtual CIO do?
The NIST glossary, drawing on 44 U.S.C. and writing about US federal agencies, defines a Chief Information Officer as the agency official responsible for providing advice so that information technology is acquired and information resources are managed consistently with laws and the priorities set by the head of the agency, for developing and maintaining “a sound and integrated information technology architecture”, and for promoting the effective and efficient design and operation of all major information resources management processes. A virtual CIO, in my reading, is that role bought part-time by the month, and it is rarely what a SaaS founder needs for the product itself.
If you have a working app built with these tools and need it ready for real customers, this is what we do.
Built it with AI. Now it has to hold up for real customers.
The Production Hardening Sprint takes the app you already have and builds the production foundation underneath it. Authentication and access rules, payments that stay consistent, error handling, monitoring, backups, automated tests and a documented handover. Our engineers work inside your existing codebase for ten working days. All 123 deliverables are included, and you get the evidence for each one.
See the Production Hardening Sprint → 
$2,500 fixed price · 10 working days · One codebase