Stop playing with the CISO role. Fix cybersecurity leadership
Op-ed argues the CISO role is overloaded and advocates elevating a business-first Chief Security Officer above it.
The author contends that business-alignment failures in cybersecurity are structural rather than communication problems, with CISOs expected to act simultaneously as technologists, strategists, risk executives, and board advisers. The piece proposes a distinct Chief Security Officer role focused on enterprise protection, business continuity, and cross-functional decision authority, with the CISO retaining technical cybersecurity responsibility and potentially reporting to the CSO. It argues this model would give executive ownership of business protection while preserving technical depth.
- Modern CISO role conflates too many responsibilities, creating structural tension
- Proposed CSO would own cross-functional protection decisions above the CISO
- CISO would keep technical functions like SOC, identity, and vulnerability management
- Alignment failures stem from organizational design, not CISO communication skills
- Vendors
- CSO Online
- Organizations
- CSO Online
From the original article
7 min read at csoonline.com
We have spent years telling chief information security officers (CISOs) that they need to become better aligned with the business. They need to understand strategy. They need to speak the language of the board.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.