Business leaders understand two things very well: business and people. This article takes a different perspective on the topic of managing one’s cybersecurity posture by focusing on the CISO’s leadership traits instead of the flurry of security-related policies, controls and programs that the business is likely implementing.

As cyber risks have risen in importance, becoming a topic of regular briefings at executive and board meetings, management and the board of directors are being asked to ensure that the security posture of the organization is adequate. While the world is slowly moving away from the awful security-by-audit-checklist mentality, management is increasingly being asked to evaluate the effectiveness of the organization’s security controls.

Business leaders, from the C-suite to the board of directors, process the role of the CISO through a lens that is much more familiar to them than cyber risks: the human perspective. The opinions that follow are forged from decades of working with people, many as students who later become professionals in IT and security, as well as from precious professional friendships with various CISOs and other security luminaries.

The future security posture of your business depends heavily on the kind of person your CISO is!

The CISO as a Translator

One of the CISO’s key roles is as translator of tech-related terms and threats into a language appropriate for his or her audience. When conversing with business leaders, the CISO needs to be able to communicate clearly and effectively, in the language of the business, through explanations, metaphors or visual aids.

The CISO as a Diplomat

The CISO must understand his or her role as a diplomat since very often security ends up stepping on other departments’ toes. Thus, CISOs must have a keen emotional intelligence to allow them to quickly detect whether their audience is closed to suggestions or possibly even hostile to the suggested or required changes.

This type of interaction is likely to increase as the CISOs communicate ways to reduce cyber risks to other groups. For example, they must converse with HR regarding SETA programs, with the IT department about IT controls such as privileged identity management and change control boards and with the finance department regarding multilayered processes around bank accounts and payroll.

The CISO as a Trust Builder

Ultimately, the CISO’s currency is trust. CISOs must earn the trust of the rest of the executive team and maintain that trust. In turn, executives and boards have to trust that the CISO will be an accurate vessel through which their wishes will be communicated and executed. Just as importantly, they have to trust that the CISO will be honest and transparent in reporting the true security posture of the organization.

The CISO as a Strategic Thinker

In line with the CISO as a trust builder, CISOs must also show themselves to be strategic thinkers and an ally of the business. They must be able to embrace the greater good, generate solid ideas and implement them. A great CISO should also be someone with the business wherewithal to include the big picture in all decisions or, conversely, to relate the connectedness of all security decisions to the big picture in all communications.

The CISO as a Leader

As the CISO’s role continues to evolve toward the top of the executive sphere, the CISO is increasingly being asked to serve in a leadership role. Gallup’s “Strengths Based Leadership,” the follow-up to its StrengthsFinder personality assessment, has mapped leaders’ strengths along four main themes: executing, influencing, relationship and strategic thinking. Each theme contains eight to nine strengths.

Effective leaders should know their strengths and their weaknesses. The same is true of CISOs. Here is the breakdown, as explained by StrengthsFinder:





  • Achiever

  • Arranger

  • Belief

  • Consistency

  • Deliberative

  • Discipline

  • Focus

  • Responsibility

  • Restorative

  • Activator

  • Command

  • Communication

  • Competition

  • Maximizer

  • Self-Assurance

  • Significance

  • Woo

  • Adaptability

  • Developer

  • Connectedness

  • Empathy

  • Harmony

  • Includer

  • Individualization

  • Positivity

  • Relater

  • Analytical

  • Context

  • Futuristic

  • Ideation

  • Input

  • Intellection

  • Learner

  • Strategic

Scroll to view full table

To assess the leadership potential of candidates, Spencer Stuart, an executive search and leadership consulting firm, looked at the individual’s performance along the following lines:

  • Exceptional business judgment;
  • The ability to recognize interpersonal dynamics and apply them in decision-making;
  • Highly effective people management and team building skills;
  • Humility and substance;
  • Effective people development skills;
  • The ability to drive change.

As the CISO role matures into that of a risk executive, organizations would do well to review the people side of their security posture, starting with the traits of their CISO to determine the extent to which their CISO is able to make the leap to this new, more challenging senior role.

Read the IBM Report: Cybersecurity perspectives from the boardroom and C-suite

More from CISO

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…