CISOs at the Crossroads: A Call for Support and Change

By Harold Rivas · October 23, 2024

As a seasoned CISO, I've seen the role evolve dramatically over the years. What was once a largely technical position has transformed into a strategic leadership role, demanding a broad understanding of business, risk, and compliance. While this evolution is necessary and positive, it's also creating a significant strain on CISOs, leading many to question their future in the role.

Our most recent Mind of the CISO research, a comprehensive study of 500 CISOs globally, sheds light on the challenges and opportunities facing today's security leaders. The findings paint a clear picture of a profession under immense pressure, grappling with a complex landscape of regulatory demands, heightened expectations from the board, and a growing sense of burnout.

Navigating the regulatory storm

One of the most pressing concerns for CISOs is the ever-growing regulatory landscape. Our Mind of the CISO research reveals that 95% of CISOs are facing a significant increase in compliance requirements, with 70% reporting that compliance is a constant challenge alongside their other priorities. For 79% of the respondents, the time and effort it takes to keep pace with regulatory change is not sustainable.

This regulatory storm is a reality for CISOs across all industries. From data privacy frameworks like GDPR and CCPA to cybersecurity frameworks like NIST, organizations are facing a complex web of regulations with varying deadlines and enforcement mechanisms. The pressure to stay compliant is a major source of stress for CISOs, who are often tasked with navigating these complexities while simultaneously managing their core security responsibilities.

Elevating the CISO to strategic leadership

The CISO's role has shifted from a technical expert to a strategic leader, with a direct impact on the organization's overall success. In fact, 85% of CISOs report that cybersecurity is now a top priority for their boards, and 75% say they are actively involved in strategic planning and decision-making.

This increased visibility is a positive development, but it also comes with heightened expectations and scrutiny. CISOs are now expected to provide frequent, detailed reporting on their security posture, risk assessments, and incident response capabilities. The pressure to demonstrate value and justify security investments is immense, leaving many CISOs feeling overwhelmed by the demands of their role. (I touched on this pressure and the personal toll it can take in my last blog post, A CISO’s Perspective on the CrowdStrike Outage.)

The combination of regulatory pressure and strategic leadership responsibilities is having an impact on CISOs. Of those surveyed, 60% report feeling burned out, and 40% are questioning their future in the role. This comes on the heels of our previous research, Decoding the GenAI Impact, where 92% of CISOs surveyed reported that GenAI has made them contemplate their future as a CISO.

What CISOs need to feel successful

I hope this research serves as a wake-up call that spurs organizations to recognize the growing pressures on their CISOs and take proactive steps to support them. CISOs are becoming more critical to the success of their organizations just at the moment when many feel they’ve reached a breaking point.

Fortunately, the research points to ways that CISOs can find more support, including:

• Sharing the regulatory workload in organizations and providing executive support, staff, or technology to offload some of the burden
• Better guidance on regulations and clarity on the CISO role itself (which 59% said was lacking) as a way to reduce complexity and overlaps
• More collaboration and communication with other CISOs: 87% of respondents said that discussing cybersecurity regulation with their peers was more valuable than doing their own research.
• Splitting the role in two: I found it interesting that 84% of respondents supported the idea of splitting the CISO role into separate technical- and business-focused roles.

If you’re feeling under pressure, our own Trellix CISO Council and CISO2CISO community can be great resources. The future of cybersecurity depends on the success of our CISOs. Let's work together to ensure that they have the support they need.

Read CISO Crossroads: Regulation, pressures, and the future of cybersecurity leadership. And join me at Trellix’s GenAI Powered Responsible Security Virtual Summit on October 23 in the Americas and October 24 in EMEA and APJ.