Cybersecurity is a leadership problem: Why the management model needs to catch up
A CSO Online essay argues cybersecurity failures persist because governance and CISO authority lag technical progress.
A CSO Online opinion piece argues that cybersecurity's persistent failures are management problems rather than a lack of frameworks or technology. It says detection, cloud security, identity, and automation have matured since 2015, but organizations still struggle with CISO authority, silos, short-termism, and weak governance. The author contends that moving the CISO's reporting line cannot resolve ambiguity about the role, and that CIO-CISO tension requires a decision model rather than structural separation. Increased spending, the piece says, does not automatically create priorities or accountability.
- The essay says known controls still fail because of governance and accountability gaps.
- CISO reporting-line debates cannot fix an undefined role and authority.
- CIO-CISO tension is described as manageable through leadership, not org-chart moves.
- Higher security spending has not by itself produced clear priorities or execution.
From the original article
7 min read at csoonline.com
When I started writing regularly about cybersecurity management in 2015, the environment looked very different. Cloud computing was still reshaping enterprise technology. Ransomware had not become the industrialised threat it is today.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.