3 Key Skills You Need to Succeed as a CISO

By Harold Rivas · January 8, 2025

Over the past year, CISOs have faced unprecedented challenges: the explosive growth of generative AI in cybersecurity, navigating the fallout from the CrowdStrike outage, and increasingly complex threats that demand sharper skills and faster decisions.

The CISO role is changing tremendously. We need a deeper understanding of the pressures and priorities of shaping security leaders and the critical skills every CISO needs to succeed and lead their organizations forward with confidence.

CISOs themselves report that they are feeling intense pressure. Throughout 2024, our research report, Mind of the CISO: Decoding the GenAI Impact, 92% of the more than 500 CISOs surveyed revealed that the advent of GenAI was causing them to rethink their role (I wrote about the impact of GenAI on the CISO role in my last blog post). What’s more, 90% of the CISOs we talked to reported they were feeling more pressure.

This sentiment was echoed in our most recent Mind of the CISO Report, CISO Crossroads: Regulation, pressures, and the future of cybersecurity leadership, 49% of CISOs responded that they do not see a future as a CISO due to the ever-expanding responsibilities.

CISOs are stressed, and they are going through a period of some soul searching. It’s leading some to ask, Is it worth being a CISO in today’s climate? I still believe so. Here is my perspective on how the role evolves and what current and aspiring CISOs need to succeed.

The CISO story is still being written

Twenty years ago, being a CISO was much simpler than it is today. The role was part of IT and focused on security. Now, there are many thousands of sources of information to consume, a complicated regulatory and compliance landscape, and an ever-widening attack surface.

We’ve seen the role change dramatically. What excites me is that the story is still not written. We don’t know precisely what the role will look like in the future. But for me, it’s been gratifying. Over the past two decades, we’ve gone from organizations that didn’t know what a CISO was to realizing it’s essential to have one.

A set of behaviors or personality traits is natural for anyone with staying power in this role. You need to have high interest and curiosity, plus a willingness to solve new problems and get to the root of issues. One of the most rewarding things is objectively seeing your impact on an organization. If you have a deep technical interest and desire to affect organizations significantly, this role could be for you.

Three key skills for the CISO of the future

At RSAC, I discussed how the CISO role is evolving and described three critical skills. Essentially, you need to be an architect, an operator, and a connector. Here’s what I mean by each.

Being an architect means being a domain expert with deep technology skills and an ability to fuse business and technology priorities.

A technical background will help you, but you must also understand how technology enables business objectives. In my case, I started on the technical infrastructure side. I was a Sun Solaris SysAdmin and wanted to be a CCIE (Cisco Certified Internetwork Expert). Understanding technology at that level has served me well.

As important as the technology side is, I advise CISOs and aspiring CISOs to define themselves as something other than technical subject matter experts. Bring that as a skill, but the language you must speak around the boardroom with executives is the language of business. Invest early in your career to understand the business side. It will serve you for decades to come.

That leads to the second skill CISOs need to master, being an operator.

To be an effective operator, you’ll need to speak the language of your business and unite that with an understanding of what’s going on in the world.

The best CISOs can tie what they do to business objectives. You must understand your organization’s business operations, revenue sources, and industry norms to do that. And you need to understand what’s happening worldwide to know what factors affect your business and industry. I read at least five publications every morning. I look at international affairs, global politics, conflicts, elections, and anything that could influence the threat landscape or the business environment we operate in.

I came from the financial services industry. I needed to get to know the salespeople, partner with marketing, and become familiar with all the different departments. That’s how you understand the organization and what it drives to achieve.

Being an operator is a critical skill set for CISOs everywhere. I advise partnering up with your CFO and following methods like FAIR to quantify the potential impacts of cyber incidents in financial terms. As a CISO, you should have board-level conversations about operational availability, business resilience, impact on revenue, and protecting revenue, not necessarily the latest cyber threat actor—although there’s certainly a time and place for that.

This leads to the third—and probably most important—skill essential for CISOs to develop.

You must be a connector—an independent, credible executive team member.

Being a connector means being an agent of change. A connector can effectively communicate the story of risk and use risk to one's advantage. You have to be able to communicate outside the organization, often with regulators, policymakers, and customers. And you have to be an evangelist, in some sense.

For example, when the Biden Administration issued Executive Order 14028 on Improving the Nation’s Cybersecurity, it was essential to communicate and educate leadership across Trellix. As a CISO, I had to start conversations with executives across the organization and say that this affects our industry and many others providing security solutions to the U.S. federal government. In other organizations, I’ve had the opportunity to facilitate a simulated crisis exercise with executive leadership. That led to incredibly valuable dialog, as it helped the general counsel, COO, and others to see their part in managing cyber risk.

The last advice is that you need help doing this job. We should all crowdsource our defense and response strategy. For example, I have a dozen other CISOs on speed dial if I ever have a problem. As threats become more complex, it’s more important than ever to collaborate.

Learn more insights from Harold Rivas at Trellix’s on-demand GenAI virtual summit, and explore more resources for CISOs.