By Raghu Nandakumara
Every board wants to know whether its cyber security spend is delivering a good return on investment. It is a reasonable question, but too often organizations try to answer it using the wrong metric: whether a breach occurred.
When a breach happens, the immediate assumption is that something must have failed. Boards automatically want to know from the CISO what broke and how it could have been prevented.
But that line of thinking is not how you measure effective risk management; and it is not how boards assess risk in any other part of the business.
Cyber security should not be treated as the black sheep of the family and the expectations set on CISOs should always be based on the risk tolerance and budget they were given.
The secret amendments to the CISO contract
No CISO walks into the job promising to eliminate cyber risk. It is an impossible promise, and any board that expects it is asking for something no security leader can deliver. Instead, what the CISO is expected to do is manage risk within a tolerance that the organization has agreed to, using a finite budget, much the same way that the CFO manages financial risk and the COO manages operational risk.
When CISOs arrive at the job, the typical question boards ask is whether cyber risk is being managed to an acceptable level. When a breach happens, that question gets replaced by a different one entirely: what broke?
Not whether the CISO was operating within the parameters they had been given, but on which specific control failed and why it was not fixed sooner.
In other words, the CISO is judged by two different standards. One asks whether risk was managed responsibly. The other comes down to whether an attacker got lucky that particular week.
Why it is different for CISOs
Cyber risk deserves the same treatment from the board as other departments but rarely gets it. This is because a breach produces a single, often high-profile, publicly visible moment.
With hindsight and in the chaos of a breach, every cyber decision suddenly looks binary. The fact that these decisions were originally made as part of a broader programme of risk management is quickly forgotten.
It is this shift in scrutiny that shapes CISOs’ behaviour, knowing they will ultimately be judged on the control that failed rather than the decisions that preceded it. As a result, there is a natural temptation to prioritise immediate, visible fixes over longer-term improvements.
The danger comes when those temporary measures become permanent. Over time, organizations can build layers of compensating controls that do not address the underlying issues.
While cyber breaches are highly visible, they are analogous to other acute enterprise risk events, and boards should therefore apply the same mature governance metrics to cyber as they do to other operational failures.
Is CISO authority part of the problem?
When those compensating controls stack up instead of fixing the root cause, it can start to look like the CISO is stuck with the accountability for risks they are not always in a position to eliminate.
This is not quite right, because most CISOs do have authority – they decide where the budget goes, which risks get prioritised, and which get accepted for now. What they do not have is the budgetary resource to fix everything they would like to fix, for lack of sufficient funds.
Evidence of that constraint shows up in an uncomfortable trend, with security leaders increasingly building a paper trail of everything they flagged before resigning. It is a rational response to an unfair system – when people in a role feel they need to document their own diligence in case they get blamed for someone else’s decision, the system around them has stopped working the way it should.
Perhaps it is no surprise then that the average CISO tenure is only between 18-26 months; not nearly long enough to build or execute a proper long-term strategy. However, it is long enough to be reactive, to patch whatever gap is loudest, and to respond to whichever technique made headlines last month, but rarely long enough to step back and ask why the same kinds of issues keep reappearing.
What boards should be asking
None of this means boards should hand over blank cheques or stop asking the difficult questions when something goes wrong.
The entire premise needs to change. Instead of asking what broke, ask whether the programme was managing risk to the level that was agreed, with the resources they were given, and treat a breach as one data point in an ongoing conversation about how much risk the organization is willing to carry.
Security programmes are not built around a single security control, but hundreds of interconnected decisions. Judging the entire programme based on one successful attack ignores the reality that no organization has the resources to address every possible weakness simultaneously.
Good risk management starts by understanding which risks matter most to the organization, their likelihood, and the impact they would have if they materialised. That requires honest conversations about what the business is prepared to accept and where investment will deliver the greatest reduction in exposure.
It also means getting the fundamentals right. Foundational controls are rarely the most exciting investment a board will approve, but they are often the ones that have the greatest long-term impact. Strengthening identity, segmenting critical systems, or addressing long-standing architectural weaknesses will make organizations materially harder to compromise.
I accept it is not an easy conversation for any CISO to have, particularly when there is pressure to respond to the latest threat or invest in the latest technology. However, it is a far more honest one than pretending that every cyber risk can be eliminated simply by doing things the way they have always been done.
Ultimately, boards that keep score purely on whether there is a breach or not will keep getting a distorted picture of how well their security programme is run and, as a result, they will keep losing good CISOs for the wrong reasons.
The organizations getting this right are the ones that treat cyber risk exactly like every other risk on the balance sheet. These risks are never eliminated but always managed and should be judged on the quality of the decisions behind them.
The author
Raghu Nandakumara is VP of Industry Strategy at Illumio
