December 10, 2015 By Christophe Veltsos 3 min read

Business leaders understand two things very well: business and people. This article takes a different perspective on the topic of managing one’s cybersecurity posture by focusing on the CISO’s leadership traits instead of the flurry of security-related policies, controls and programs that the business is likely implementing.

As cyber risks have risen in importance, becoming a topic of regular briefings at executive and board meetings, management and the board of directors are being asked to ensure that the security posture of the organization is adequate. While the world is slowly moving away from the awful security-by-audit-checklist mentality, management is increasingly being asked to evaluate the effectiveness of the organization’s security controls.

Business leaders, from the C-suite to the board of directors, process the role of the CISO through a lens that is much more familiar to them than cyber risks: the human perspective. The opinions that follow are forged from decades of working with people, many as students who later become professionals in IT and security, as well as from precious professional friendships with various CISOs and other security luminaries.

The future security posture of your business depends heavily on the kind of person your CISO is!

The CISO as a Translator

One of the CISO’s key roles is as translator of tech-related terms and threats into a language appropriate for his or her audience. When conversing with business leaders, the CISO needs to be able to communicate clearly and effectively, in the language of the business, through explanations, metaphors or visual aids.

The CISO as a Diplomat

The CISO must understand his or her role as a diplomat since very often security ends up stepping on other departments’ toes. Thus, CISOs must have a keen emotional intelligence to allow them to quickly detect whether their audience is closed to suggestions or possibly even hostile to the suggested or required changes.

This type of interaction is likely to increase as the CISOs communicate ways to reduce cyber risks to other groups. For example, they must converse with HR regarding SETA programs, with the IT department about IT controls such as privileged identity management and change control boards and with the finance department regarding multilayered processes around bank accounts and payroll.

The CISO as a Trust Builder

Ultimately, the CISO’s currency is trust. CISOs must earn the trust of the rest of the executive team and maintain that trust. In turn, executives and boards have to trust that the CISO will be an accurate vessel through which their wishes will be communicated and executed. Just as importantly, they have to trust that the CISO will be honest and transparent in reporting the true security posture of the organization.

The CISO as a Strategic Thinker

In line with the CISO as a trust builder, CISOs must also show themselves to be strategic thinkers and an ally of the business. They must be able to embrace the greater good, generate solid ideas and implement them. A great CISO should also be someone with the business wherewithal to include the big picture in all decisions or, conversely, to relate the connectedness of all security decisions to the big picture in all communications.

The CISO as a Leader

As the CISO’s role continues to evolve toward the top of the executive sphere, the CISO is increasingly being asked to serve in a leadership role. Gallup’s “Strengths Based Leadership,” the follow-up to its StrengthsFinder personality assessment, has mapped leaders’ strengths along four main themes: executing, influencing, relationship and strategic thinking. Each theme contains eight to nine strengths.

Effective leaders should know their strengths and their weaknesses. The same is true of CISOs. Here is the breakdown, as explained by StrengthsFinder:





  • Achiever

  • Arranger

  • Belief

  • Consistency

  • Deliberative

  • Discipline

  • Focus

  • Responsibility

  • Restorative

  • Activator

  • Command

  • Communication

  • Competition

  • Maximizer

  • Self-Assurance

  • Significance

  • Woo

  • Adaptability

  • Developer

  • Connectedness

  • Empathy

  • Harmony

  • Includer

  • Individualization

  • Positivity

  • Relater

  • Analytical

  • Context

  • Futuristic

  • Ideation

  • Input

  • Intellection

  • Learner

  • Strategic

Scroll to view full table

To assess the leadership potential of candidates, Spencer Stuart, an executive search and leadership consulting firm, looked at the individual’s performance along the following lines:

  • Exceptional business judgment;
  • The ability to recognize interpersonal dynamics and apply them in decision-making;
  • Highly effective people management and team building skills;
  • Humility and substance;
  • Effective people development skills;
  • The ability to drive change.

As the CISO role matures into that of a risk executive, organizations would do well to review the people side of their security posture, starting with the traits of their CISO to determine the extent to which their CISO is able to make the leap to this new, more challenging senior role.

Read the IBM Report: Cybersecurity perspectives from the boardroom and C-suite

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today