The Evolving Role of the CISO - Security Intelligence

During the last year, we did a lot of thinking about the role of the CISO, including a major survey we posted. As we embark on our next round of research I wanted to share a summary of how we see the Chief Security Officer role evolving. See below:

	CISO Role Today	CISO+ Role in Future
CISO’s Background	CISOs come from varied backgrounds Often inherited the role Moved up through the IT or business ranks Some are hired from outside to create public perception	Proven track record to lead during a crisis Knows how to take risks Ability to manage & communicate clearly and concisely to upper management / Board Heavy on business skills / Lighter on technical skills
Reporting Line	CISOs typically reports to CIO; typically a layer in between CISO and CIO Some CISOs report to COO	CISO+ reports directly to CIO Have responsibility for; Strategy, Policy, Ops, Compliance, Crisis Management
Level of Authority	Not always viewed as a key decision maker Seldom an actual executive role Often tactical and reactive	Transformational leader Sr. level executive Combined role of IT Risk Officer & CISO Responsible for Initiatives & Ops Strategic & pro-active
Areas of spend / Budget responsibility	Majority of budget directed at maintenance projects to keep current initiatives running Other spending on pro-active initiatives and reactive projects	Majority of budget spending will be on transformational initiatives Budgets should be a percent of the Enterprise budget since all functional groups have security requirements

Scroll to view full table

What do you think? Do you agree with the role today and how it will evolve to a strategic role in the future?

As I mentioned, the IBM Client Insights team will be completing our second CISO survey soon. We’ll incorporate your comments in to that work!

Chief Information Security Officer (CISO) | CSO

Marc van Zadelhoff

General Manager, IBM Security

Marc van Zadelhoff is the General Manager for IBM Security, the fastest-growing enterprise security company in the world. Before taking over as head of th...

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

Do You Really Need a CISO?

2 min read - Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer. A CISO is a senior executive in charge of an organization’s information, cyber and technology security. CISOs need a complete understanding of cybersecurity as well as the business, the board, the C-suite and how to speak in the language of senior leadership. It’s a changing role in a changing world. But…

What “Beginner” Skills do Security Leaders Need to Refresh?

4 min read - The chief information security officer (CISO) was once a highly technical role primarily focused on security. But now, the role is evolving. Modern security leaders must work across divisions to secure technology and help meet business objectives. To stay relevant, the CISO must have a broad range of skills to maintain adequate security and collaborate with teams of varying technical expertise. Learning is essential to simply keep pace in security. In a CISO Series podcast, Skillsoft CISO Okey Obudulu recently said,…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

More from CISO

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

Do You Really Need a CISO?

What “Beginner” Skills do Security Leaders Need to Refresh?