Past, Present, Future: How the CISO Role Can Develop for the Better

It’s been nearly 3 decades since the world’s first CISO was appointed. In that time, the role has fast become an established title within senior management.

And rightly so! As tech has become an ubiquitous and an inseparable part of business, confident, strategic leadership is essential to keeping an organisation’s IT safe, secure, and strategically aligned.

But looking at the entire history of business as a whole, 30 years is a drop in the ocean. The role of CISO is a relative newcomer, and one in a field that is vastly subject to change. As business assets go, IT and data is now just as crucial as its employees and its physical property – so what might the future hold for the top security role?

Well, let’s start with a bit of a history lesson.

The History of the CISO Role

As the latter half of the 20th Century rumbled on, IT became more and more of a common sight in workplaces around the world. Technology went from punch card number crunching to word processing to the world wide web in less than 50 years. Though the concept of computer viruses as we know them had been present since the 1970s, it was the 1990s when they truly reached the public zeitgeist.

The Michelangelo virus, Microsoft Word Macro viruses, the Melissa worm, and more all led to panicked news reporting throughout the ‘90s. So it’s perhaps unsurprising that the first ever Chief Information Security Officer was appointed during the ‘90s too.

Following a withering hack at Citicorp in 1994, a recruiter reached out to experienced technologist and tech communicator Steve Katz, asking if he was interested in a job in information security. And the rest is history as Steve went on to become the world’s first CISO at Citicorp the following year.

As the ubiquity of IT exploded into the new millennium, so did the scale of digital threats. Though network and internet security was previously largely nestled under the “IT department” umbrella, we’re now in a world where cybersecurity is a discipline of its own. IT security is no longer limited to one off attacks, vulnerabilities, and incidents. It requires a constant state of defensive alert, which requires cool heads and consistent oversight.

But modern cybersecurity isn’t just technical IT security. Cyber leaders have to handle significant business risk, corporate strategy, and legislative responsibilities. They need to champion secure behaviours and foster a secure culture throughout the organisation. And there’s the stresses of liaising with the board – though not always being in the room to influence their decision-making.

According to Cybersecurity Ventures, there are 32,000 CISOs employed globally (as of 2023).

The Future of the CISO: What Needs to Change?

The world of infosec is an interesting, dynamic, and lucrative world to work in. Yet it can sometimes be far from sunshine and rainbows.

The role of CISO is still in its relative infancy. This lack of maturity is apparent in a handful of ways – not least the following common issues that will need to be ironed out in any future iterations of the role.

B-B-B-Board Is The Word

Despite the “C” in their title, CISOs don’t often sit directly on the board. In fact, they often report to the CTO or CIO.

Personally, I’ve always found this strange. Cybersecurity is essential to any organisation’s continuity – it’s not just “a function under IT.” CISOs should therefore stand shoulder to shoulder beside the CIO/CTO on the board, rather than be dictated to by a board who may not have direct cybersecurity expertise, and who may only have more general GRC oversight from a Chief Legal or Risk Officer.

A Possible Non-Tech “Tech Leader”

The role of CISO is increasingly moving away from day-to-day technical security functions and more towards risk management, organisational continuity, business strategy and Governance, Risk, and Compliance (GRC).

Will this movement away from operational practicalities and towards governance mean that the CISO of the future will have to be more of a GRC specialist rather than a cyber-battle-hardened career technologist?

Whatever lies in the future for this role, this is a particular balancing act which will have to reach equilibrium.

Isn’t the CISO Stressed Enough?

In its current (admittedly sometimes quite vague) iteration, the CISO has a lot of mental plates to spin: risk management, culture change, behaviour change, technical change, legislative governance, tech advancements, the geopolitical landscape, cybercrime trends, cybersecurity trends, department leadership, board liaison, and more.

CISOs are carrying more responsibility on their shoulders than ever, and those responsibilities are mounting. Cyber threats are more ubiquitous than ever. It’s the CISO’s head on the chopping block should the company fall victim to cybercrime. And they’re always looking over their shoulder at the constant threat of cyber-calamity.

This climate can understandably lead to unbearable levels of stress and burnout. And a stressed employee – wherever they are in the org chart – becomes a less effective employee (and often a poorer leader too). No organisation benefits from a previously effective but currently burnt out, overworked CISO – nor do they benefit when a stressed security head suddenly hands in their notice.

The levels of stress currently in play are dangerous for both employee and employer. Any future iterations of the CISO role will need to address this before more CISOs hit their breaking point.

In With the New, But Also the Old

As the CISO’s metaphorical plate becomes stacked ever higher, I feel there is going to become a point where CISOs say “enough is enough,” and start to chop up and divest their responsibilities.

After all, we are all humans with finite time and energy – responsibilities can’t be stacked infinitely high. Plus, as cyber threats become more and more complex, accountability for an entire organisation’s cyber fate should probably not fall on a single person’s shoulders, for the sake of their own wellbeing.

But how might these responsibilities be shared? Could the day-to-day security duties of the “old” CISO and the high-level, strategic duties of the “new” CISO be split between two individuals in future?

The Corporate Quest for Unicorns

As the CISO role becomes more all-encompassing, it also becomes less well-defined. Many employers may take it as read that CISOs now shoulder all of the responsibilities we’ve mentioned here (and maybe more) without asking whether that workload – and mental toll – is realistic for one person to bear.

But for a CISO’s responsibilities to split out into two or more distinct infosec leadership roles, companies need to become laser-focused on their own security priorities, and hire more granularly based on those requirements.

How We See the CISO Role Developing Into the Future

These issues all highlight a need for change. But what might this course-correction mean for the CISO of the near future? Well here’s my take.

Bring on the BISO!

No, that’s not a misspelt gravy brand. A BISO is a business information security officer – a senior role that bridges and blends the responsibilities of business and security.

Out “in the wild,” BISOs often act as a CISO’s deputies, overseeing more granular aspects of security management and implementation. Smaller organisations may only need 1 or 2 BISOs, but larger ones could have one BISO per department, ensuring the CISO’s guidance is executed.

Having these practical “deputies” throughout the organisation can benefit a CISO greatly. Sharing the problem of security oversight, accountability, and implementation can help to alleviate some of the CISO’s stress. Having more boots on the ground can leave the CISO freer to ponder the essential high-level strategy now demanded of the role. BISOs can also bring multiple skill sets and talents into the mix that the organisation wouldn’t have had access to beforehand.

Hey, it may not be a unicorn candidate, but at least it’s two or more additional regular horses to help pull the cart!

Put the CISO on the Board

This is a move we’ve raved about in the past. Any organisation which takes infosec seriously needs to consider this option rather than simply having the CISO report to a member of the board.

Not having direct access to the board can be a source of CISO stress and frustration in and of itself. It means that they aren’t in the room when important security-altering decisions are being made. Decisions are made totally over the CISO’s head, which they just have to deal with.

Yet when the CISO is firmly on the board, they can become an active participant in the decision process, chiming in with their infosec and GRC expertise in real time as high-level decisions are happening. This may mean that the board makes more well-informed, cybersecure decisions – ultimately to everyone’s benefit.

Having a board-dwelling CISO also solves another issue: accountability. CISOs are often considered the chiefly accountable party when a cyberattack rears its ugly head. However, the board holds the ultimate decision-making control – including over infosec investment and implementation. If a sub-board CISO’s sound security decisions have been undermined by the board, who is truly accountable when a cyber incident occurs? I’d argue, not the CISO!

With this in mind, what’s the point of having a CISO – and more, giving them ultimate security accountability – if their advice and expertise can be overridden? For CISOs to truly take full accountability and responsibility, they need to be on the board. Simple as.

Decouple the CISO from IT Functions Altogether

This might sound strange, but hear me out. It could be the future of the role! Though IT and information security have made ideal bedfellows up to now, could it be time for change?

The modern CISO’s responsibilities are becoming increasingly oriented towards strategy, risk, and legislation. So could their ilk possibly be overtaken by those from established governance, risk, and legal backgrounds?

A few years ago, we probably wouldn’t have put this idea forward. However, since the team and I have been working more closely with ethical AI roles and candidates, we’ve noticed something surprising. Successful candidates for these roles aren’t coming from strictly technical backgrounds – they’re usually deep-rooted GRC specialists. Could the future CISO take a similar tack?

Personally, I don’t see this as a universally applicable option like the “board CISO with deputy BISOs” could be. It would depend heavily on the organisation’s own approach to risk, IT, and data. But if the board spends a lot of time worrying about digital risk and business continuity, it might be worth considering.

More CISOs with Non-Standard Career Histories

In a similar vein, we have to consider the possibility of employing CISOs for their cool heads, diverse perspectives, and problem solving prowess rather than their explicit technical background. Don’t get me wrong; a certain level of technical knowledge is required to become a cyber leader; but looking outside of the “career techie” blueprint can often be beneficial.

One route into cybersecurity leadership that creates a lot of buzz is that of military veterans moving into infosec. These are disciplined individuals who are used to operating under persistent pressure, and coming from a sector that is utterly reliant on highly sensitive IT and communications tech. The UK Cyber Security Council also points out that our ex-mil friends often hold useful security clearances ideal for government security roles.

Devo (the SOC software provider, not the New Wave band) shares the benefits that a handful of “unconventional” backgrounds bring to the CISO role, as diverse as law enforcement, customer service, business operations, and – again – the armed forces.

Here at Bestman Solutions, we’ve placed CISOs with less conventional career histories, including a few from the military and even a former teacher.

More Tailored Role, Less Standardised Remuneration

We discussed the prospect of the ideal, “unicorn” CISO candidate above. Thankfully, more and more organisations are waking up and realising that this is unrealistic. No one person can know everything, have every skill, and have every experience needed – in any role, not just CISO.

With this in mind, employers may increasingly start to mould the CISO role – and perhaps their whole cybersecurity function – around their own individual needs and priorities.

And a tailored CISO role requires a tailored approach to compensation. Thankfully, CISOs in the Western world are pretty fairly compensated. However, as the CISO’s responsibilities have expanded, the role itself can differ wildly between organisations.

With this in mind, employers should seek specialist advice on CISO remuneration based on their own priorities and desired skill sets rather than lazily slapping a benchmarked figure on a role.

Conclusion
Nothing stays the same forever – not even the role of CISO. It’s a role in its relative infancy. And just like an infant, there is so much that may lie in store for its future, and the world it’s going to grow up in.

I hope we will start to see widespread changes that will minimise the stress of the role, whilst also maximising the potential for secure operations. Time will have to tell.