CISO

Should the CISO Role Be Split in Two?

/ ,

As the CISO role expands from technical security oversight to encompass business risk management, governance, and strategic leadership, industry experts debate whether it should be split into separate business-focused and technical-focused positions. While some organizations have introduced deputy CISOs to manage operational tasks, the consensus among professionals like Todd Fitzgerald and Tim Brown is that a single CISO with clearly defined responsibilities is preferable, supported by appropriate teams to handle technical and governance functions. The evolving role increasingly requires CISOs to act as business leaders responsible for cyber risk at the enterprise level, raising the importance of executive authority, board engagement, and personal liability considerations.

https://www.csoonline.com/article/4230243/should-the-ciso-role-be-split-in-two.html

September AMA: I’m a CISO Who’s Built Many Security Teams. I Want to Help You Level up Your Career. Ask Me Anything.

/ , ,

CISO Series hosts a September AMA featuring experienced cybersecurity leaders who have built and led multiple security teams, offering advice on career growth, leadership, hiring, and team management within the security field. The panel includes CISOs and security directors from diverse organizations and covers topics such as AI security, cloud security, risk management, and security culture. Participants engage with the community over a week-long event on Reddit to answer questions and share insights relevant to advancing careers in cybersecurity.

https://cisoseries.com/september-ama-im-a-ciso-whos-built-many-security-teams-i-want-to-help-you-level-up-your-career-ask-me-anything/

Is There Really a Fix for CISO Fatigue?

/ ,

CISO fatigue results primarily from a structural issue where security leaders bear accountability without corresponding authority, leading to chronic stress and burnout. The article identifies three key resilience factors to address this: aligning authority with accountability, embedding security decisions earlier in business processes, and consolidating technology tools to improve operational efficiency. Ultimately, fixing CISO fatigue requires redesigning the cybersecurity management model rather than solely increasing resources or compensation.

https://www.darkreading.com/cybersecurity-operations/fix-for-ciso-fatigue

Former Citigroup CISO Blauner on What Makes a Great Leader

/ , ,

Charles Blauner, former CISO at major banks including Citigroup, reflects on the evolution of the CISO role from a technical function to a strategic leadership position requiring resilience, communication, and business acumen. He emphasizes the importance of mentorship and community in cybersecurity, the unique challenge CISOs face from active adversaries, and how AI will automate mundane tasks but not eliminate cybersecurity jobs. Blauner envisions the future of cybersecurity expanding into operational resilience, aligning security more closely with critical business processes to strengthen overall organizational continuity.

https://www.darkreading.com/cybersecurity-operations/former-citigroup-ciso-blauner-great-security-leader

Your CISO Is Becoming a Safety Architect (Whether They Know It or Not)

/ , ,

The traditional role of the CISO is shifting from defending against external human attackers to managing risks posed by autonomous AI agents operating inside organizations. These AI agents act at machine speed with broad permissions, creating new safety challenges as their failures resemble industrial accidents driven by complexity and unpredictability rather than malicious intent. To address this, CISOs must adopt a safety architecture approach focused on observability and pattern-driven monitoring to ensure reliable and accountable AI behavior within enterprise environments.

https://www.scworld.com/perspective/your-ciso-is-becoming-a-safety-architect-whether-they-know-it-or-not

“Boards Love to Hear Jargon,” Says Soon-to-Be-Fired CISO

/ ,

Cybersecurity boards often lack expertise, making meaningful governance challenging as many directors cannot critically evaluate risk reports and rely heavily on CISOs’ presentations. Experts suggest CISOs should engage with board members one-on-one outside formal meetings to build understanding and trust, translating technical risk into business terms, while emphasizing that boards must maintain fiduciary responsibility without needing deep technical knowledge. Additionally, rapid AI adoption in competitive markets pressures organizations to balance speed with security, with the consensus favoring faster innovation despite associated risks.

https://cisoseries.com/boards-love-to-hear-jargon-says-soon-to-be-fired-ciso/

Turning Tension Into Collaboration: How CIOs and CISOs Can Lead Together

/ , , , ,

The article discusses the longstanding tension between CIOs and CISOs, highlighting that while this friction is natural due to their differing priorities—innovation versus security—it can be managed constructively to strengthen organizational resilience. It emphasizes the importance of clear accountability, collaborative risk management processes, and regular communication to turn tension into productive collaboration, enabling organizations to innovate securely without compromising cyber risk management.

https://www.cybersecuritydive.com/news/turning-tension-into-collaboration-how-cios-cisos-can-lead-together/821610/

State CISO Confidence Drops From 48% to 22%, NASCIO-Deloitte 2026 Study Finds

/ , , ,

The 2026 NASCIO-Deloitte Cybersecurity Study reveals a significant drop in state CISO confidence, falling from 48% in 2022 to 22%, due to increased cyber threats, reduced federal support, aging infrastructure, and AI-enabled attacks. The study highlights the need for whole-of-state cybersecurity governance, AI risk frameworks, reassessment of federal program dependencies, and implementation of effectiveness metrics to help rebuild confidence in public-sector cybersecurity programs.

https://www.cybersecurity-insiders.com/state-ciso-confidence-nascio-deloitte-2026-study/

Cybersecurity Professionals Say High-Profile Incidents Boost Execs’ Credibility

/ , , ,

A May ISC2 survey of nearly 800 cybersecurity professionals found that 76% believe leaders gain credibility by having managed real, high-profile security incidents, indicating a shift in attitude toward executives who have experienced breaches. Key traits fostering trust include strong communication of risk to senior leadership, a long-term cybersecurity vision, and the ability to work effectively with boards to secure budgets, emphasizing the importance of experienced and transparent leadership in cybersecurity.

https://www.itbrew.com/stories/cybersecurity-professionals-say-high-profile-incidents-boost-execs-credibility

More Money Is Going to Physical Security, but It’s Often CISOs That Oversee It: EY

/ , , ,

A recent EY survey reveals that organizations are increasing budgets for physical security, with nearly 80% allocating more funds, sometimes up to 50%, amid rising board oversight. However, many place responsibility for physical security with Chief Information Security Officers (CISOs), blending physical and cybersecurity, which can lead to under-resourcing physical protection; EY recommends centralizing security functions, clarifying accountability, and expanding security preparedness through integrated threat intelligence and realistic crisis simulations.

https://www.facilitiesdive.com/news/more-money-is-going-to-physical-security-but-its-often-cisos-that-overse/820077/

Scroll to Top