A new global survey from Splunk has found that 82% of CISOs now report directly to the CEO, a large increase from 47% in 2023. In addition, 83% participate in board meetings ‘somewhat often’ or ‘most of the time’.
These results are from The CISO Report 2025, developed by Splunk in collaboration with Oxford Economics.
Despite the rise in influence, only 29% of CISOs say their board includes at least one member with cybersecurity expertise.
“As cybersecurity becomes increasingly central to driving business success, CISOs and their boards have more opportunities to close gaps, gain greater alignment, and better understand each other in order to drive digital resilience,” said Michael Fanning, Chief Information Security Officer, Splunk. “For CISOs, that means understanding the business beyond their IT environments and finding new ways to convey the ROI of security initiatives to their boards. For board members, it means committing to a security-first culture and consulting the CISO as a primary stakeholder in decisions that impact enterprise risk and governance. Bringing these groups together requires educating boards on the details of cybersecurity, and for CISOs to understand the language and needs of the business while also making security a business enabler.”
The impact of CISO-board alignment
Board members with a CISO background report stronger relationships with security teams and feel more confident about the organization’s security posture. They are less likely than other board members to express concern they are not doing enough to protect the organization (37% versus 62% survey average). Board respondents reported excellent or very good working relationships between the CISOs and board in the following areas:
- Setting and aligning on strategic cybersecurity goals (80% for boards with a CISO member versus 27% for boards without a CISO member),
- Communicating progress against milestones, security goal achievement and plan of record (60% for boards with a CISO member versus 16% for boards without a CISO member),
- Budgeting adequately to meet goals (50% for boards with a CISO member versus 24% for boards without a CISO member).
CISOs with healthy board relationships also tend to have better collaboration throughout the organization, reporting particularly strong partnerships with IT operations (82% versus 69% of other CISOs) and engineering (74% versus 63% of other CISOs). CISOs with good board relationships are also more likely to be given the ability to pursue use cases for generative AI, such as creating threat detection rules (43% versus 31% of other CISOs), analyzing data sources (45% versus 28% of other CISOs), incident response and forensic investigations (42% versus 29% of other CISOs), and proactive threat hunting (46% versus 28% of other CISOs).
Bridging the CISO-board divide: priorities, skills, and measuring success
While CISOs and boards indicate closer alignment on security priorities, gaps still persist.
The largest gaps in top priorities between CISOs and boards include:
- Innovating with emerging technologies (52% of CISOs deem it a priority versus 33% for board members)
- Upskilling or reskilling security employees (51% for CISOs versus 27% for boards)
- Contributing to revenue growth initiatives (36% for CISOs versus 24% for boards).
Boards have high expectations around CISOs building new skills to become better business leaders. However, learning new skills makes the CISO’s job more complex, with 53% saying their responsibilities and job expectations have become more difficult since they took the job. When asked what skills CISOs should develop, the biggest gaps in importance include:
- Business acumen (55% for boards versus 40% for CISOs)
- Emotional intelligence (45% for boards versus 35% for CISOs)
- Communication (52% for boards versus 47% for CISOs)
- Regulation and compliance knowledge (44% for boards versus 57% for CISOs).
While boards and CISOs agree on core cybersecurity KPIs, 79% of CISOs say KPIs for their security teams have changed substantially over the recent years. 46 percent of CISOs said attaining security milestones was indicative of their success, compared to only 19% of board respondents.
Maintaining compliance is business critical
Regulatory environments have become more complex, expansive, and punitive, requiring faster incident reporting and placing more liability squarely on CISOs’ shoulders. While maintaining compliance is vital to the business, only 15% of CISOs ranked compliance status as a top performance metric, a significant disconnect compared to 45% of boards.
21 percent of CISOs revealed they had been pressured not to report a compliance issue, however, 59% said they would become a whistleblower if their organization was ignoring compliance requirements.
Budget cuts have serious consequences
Cyber budgets reflect inconsistent support and misalignment, with 29% of CISOs saying they receive the proper budget for cybersecurity initiatives and accomplishing their security goals, compared to 41% of board members who think cybersecurity budgets are adequate. 64% of CISOs reveal that the current threat and regulatory environment make them concerned they’re not doing enough. 18% of CISOs revealed they were unable to support a business initiative because of budget cuts in the last 12 months, and 64% said that lack of support led to a cyberattack. CISOs also reported reduced security solutions and tools (50%), security hiring freezes (40%), and decreased or eliminated security training (36%) as top cost-saving measures. 94% of CISOs report being victims of a disruptive cyberattack, with 55% experiencing them at least a couple of times, and another 27% experiencing them many times.
Methodology
The global survey was conducted in June and July 2024 in partnership with Oxford Economics. The report surveyed 600 respondents (500 CISOs, CSOs, or equivalent security leaders and 100 board members). Respondent categories included CISOs who self-identified as board members. The survey respondents were drawn from 10 countries: Australia, France, Germany, Italy, India, Japan, New Zealand, Singapore, the United Kingdom, and the United States. They also represented 16 industries: agriculture, business services, construction/engineering, education, energy and utilities, financial services, government, healthcare, life sciences, information services, technology, manufacturing, retail, consumer goods, telecom, and media and communications. Oxford Economics also conducted eight in-depth interviews with CISOs and board members for qualitative insight.
