Trellix has published a new survey-based report, Mind of the CISO: CISO Crossroads, which found that most CISOs (84%) believe that the role needs to be split into two functions – one technical and one business-focused, to maximize security and organizational resilience amid an ever-expanding threat landscape.
The research reveals insights from over 500 CISOs around the world on cybersecurity regulation, the CISO role, and their interactions and challenges when reporting to their organization’s board. Insights shed light on the latest changes, responsibilities, and requirements for CISOs, the impacts of navigating them, and recommendations for organizations and policymakers to protect the future of this role.
We’ve entered the CISO duality era. CISOs need both a technical and business-focused lens – and we need to be strategic communicators. The role is no longer only about maintaining cyber hygiene. It’s managing risk, staying on top of and ahead of regulations and compliance, and aligning with leadership and the board, all while defending against advanced threats. CISOs are the conduit between key stakeholders, business objectives, and cyber resilience.
Harold Rivas, CISO, Trellix
Proactively maintaining a cybersecurity posture, prioritizing ransomware prevention and mitigation, defending against state-sponsored attacks, and responding to global IT incidents are all top priorities for CISOs this year. On top of this, CISOs must also navigate complex regulatory requirements and increased stakeholder interest and expectations with limited resources. The impact of these growing responsibilities is being felt by all. Implications include:
Regulation overload: 93% of CISOs agree that cybersecurity regulation has helped their career as a CISO – such as having greater influence in strategic decisions or elevation to board-level discussions, but the majority (79%) believe the time and effort it takes to keep pace with regulatory change is not sustainable.
The boardroom battle: reporting to the board is a skill CISOs need to hone, as nearly half (49%) report to the board on a weekly (or more frequent) basis, adding to their overburdened workload. Many still struggle with board and C-level understanding and alignment, with 66% saying the board lacks the technical knowledge or expertise to fully comprehend cybersecurity issues and 59% of CISOs saying their views don’t align with their CIO or CEO.
CISO role at risk: 91% of CISOs agree that expanding responsibilities will lead to higher turnover in the role, and 49% do not see a future as a CISO. To better manage these growing responsibilities, 84% of CISOs believe the role should be split into technical (CISO) and business-focused (BISO) roles.
