Should the CISO role be split in two?
Experts argue organizations should keep one strategic CISO rather than splitting the role in two.
CSO Online reports debate over whether the expanding CISO job should be split. IANS finds two-thirds of CISOs still report into IT and 52% say their scope is no longer fully manageable. Splunk’s 2026 CISO Report says 79% see a more complex remit and 96% now handle AI governance. Former CISO Todd Fitzgerald and Team 8’s Tim Brown argue for one strategy-owning CISO, with a deputy covering operations.
- Two-thirds of CISOs still report into IT, IANS finds.
- 52% of CISOs say their scope is no longer fully manageable.
- Splunk: 96% of CISOs now own AI governance and risk.
- Experts favor one strategic CISO plus a deputy, not two CISOs.
- Vendors
- Splunk
From the original article
5 min read at csoonline.com
In its roughly 30-year history, the CISO role has been reshaped by waves of new technology and rising cyber threats. In many organizations, CISOs now own risk reporting, information risk management, threat monitoring, cyber risk accountability and governance, and security strategy. And as AI and digital dependence grow, the CISO’s remit is growing beyond security controls.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.