CISOs

The cybersecurity talent shortage is well-analyzed but less discussed is the search for CISOs with the right expertise and skills to lead a company's cybersecurity programs and team. 

It's not just finding and hiring CISOs but also retaining them that poses a challenge. Two-thirds of current CISOs were hired from outside the company, while a little more than half of them have been on the job for two years or less, according to research by Marlin Hawk.

The high turnover means that organizations are always on the lookout to bring in new cybersecurity leadership, but what exactly are companies looking for in a CISO? 

Executives want a CISO who has leadership skills, technical skills and an aptitude in security, according to Stel Valavanis, founder and CEO for onShore Security. Their first option on this search is to look inside the company — within their own infosec team, if they have one, or from the IT department. 

Those who have cybersecurity certifications, such as CISSP or CISM, or are on the path to earning them, will rise higher within the applicant pool, as these help to fill the security knowledge-base gaps that might otherwise be missing in those who have a stronger IT than security background, Valavanis said. 

If there aren't any qualified applicants on the inside, then the search will go external.

Why is it so hard to find a CISO?

A CISO with the right technical skills is the most difficult to find. "They need a technical background in networks and systems which are already in high demand. Companies are often compromising on technical capabilities in favor of leadership skills," said Valavanis. 

Weak technical skills make it more difficult for a CISO to do one of their most important duties — converting security threats to business risks. Security executives must be able to understand how those threats attack the organization, and then be able to translate that information across multiple departments and business functions. 

Finding a candidate with this level of communication skills — to explain issues plainly to groups as diverse as IT, C-suite, and staff assistants — combined with technical skills can seem like a search for a unicorn. 

Location is always a consideration when looking for new talent. Some organizations focus their CISO search in specific cities or companies, though some CISO candidates don't want to relocate. 

"However, in today's new working environment, organizations are becoming more flexible and finding strong CISOs working remotely," said Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify.

Another concern is the organization's overall cybersecurity reputation, such as a company that experienced a major data breach and fired its CISO. Not every new CISO wants to be the one to clean up the mess, but there are CISO candidates who thrive in turbulent situations.

It is up to the organization to find that CISO who grows stronger in a post-breach scenario — or is otherwise the right person to keep business operations running smoothly in this cyber-tenuous world.

The CISO search

Large enterprises have an advantage in the CISO search.

"Bigger companies use recruiters to poach from others but hiring from within, even grooming over years, is just as common," said Valavanis. 

Many organizations need to do more recruiting from the wider cybersecurity community, not just among people already in leadership roles. A lot of potentially great CISOs are left undiscovered. 

"No one will admittedly say they're against diversity. Yet systemic racism, sexism, or just boys' clubism in general continues to exist," David Spark, producer, managing editor and co-host of the CISO Series, said in a CISO Series post. 

An unwillingness to move outside the organization's comfort bubble limits the number of candidates — so will the pay.

"Salaries are going up for CISOs globally, however, not all CISOs are equal and you will find strong CISOs when you match the salary based on the quality of the skills and experience," said Carson.

The median cash compensation for CISOs rose from $473,000 in 2020 to $509,00 in 2021, according to a 2021 global CISO survey from Heidrick & Struggles. Pay and benefits packages are dependent on factors such as geographical region, IT skills and size of the cybersecurity team. 

Each job is unique

Just like the mantra in cybersecurity is "there is no one-size-fits-all solution," the same can be said for the CISO. It isn't a cookie cutter position.

Not all CISOs are equal and not all businesses are the same. To find the right CISO, it is important to search for a CISO who understands the industry that the organizations operate in.

"CISOs are suffering, and we need them to be successful. In order for a CISO to succeed, we must change our path, and this means potentially rethinking our approach to cybersecurity," said Carson. 

The CISO's role within cybersecurity is not to simply put technology in place for sake of security but to put technology in place that contributes to business success while ensuring cyber risks are either reduced or eliminated.

Non-security business leaders perceive cybersecurity as a technical issue that does not drive business outcomes, said Sam Olyaei, director analyst at Gartner, while speaking during the virtual Gartner Security & Risk Management Summit. But security discussions are an opportunity for collaboration. 

CISOs tell Gartner they don't trust their business counterparts with making decisions. A finance CISO told the advisory firm, "my board of directors just want to sign off on a piece of paper that says they talked to me." Other CISOs believe their value to the business is only viewed through regulatory compliance. 

"We also know that this is not just a one-sided challenge," Olyaei said.

CISOs are operating under unfortunate status quos, with an "always on" mindset, poor time allocation, misaligned expectations, and difficulty keeping pace with the speed of the business, Gartner found. "These are some of the status quos that we really need to begin to change in order to evolve as leaders," Olyaei said. 

The disconnect between non-technical and security leaders has existed for years. In the last four years, companies have addressed the disconnect, albeit slowly. As CISOs evolve and make their contributions to overall business goals clear, companies will understand the CISO is not a catch-all for all security-related areas. The evolution of the CISO is as empowering for the individual as it is for the business. 

"The challenges of remaining in this cultural disconnect or an environment with cultural disconnect means that you're going to be encouraging some of the status quos," Olyaei said. Misaligned expectations can damage a CISO, especially as blame can fall on security in the event of an incident.

Provided in Gartner feedback, one insurance business unit said as much as they engage with security, "I don't feel like they really understand my business." 

Another multifirm board member told Gartner "we know we should care about cybersecurity, but when the CISO leaves the board meeting, I don't feel like I know anything new. I don't feel it." 

What evolution will do

Miscommunication exists because CISOs are currently over-investing their time and resources, which can hurt the true purpose of the role. CISOs are too focused on security operations, writing policies or vendor management, and less involved in business strategy, where their time is better spent. 

The pandemic has contributed to the evolution of the CISO and security leader. "The executive shift has been it's not about investment, it's not about protection levels, it's not about technology. It's about value, what is the value that you bring," Olyaei said. 

"You need to be the right type of leader for the organization that you work in," he said. If a CISO were to transfer from financial services to manufacturing, "they would really need to act more like a controls manager or risk-decision owner rather than a trusted facilitator or value creator." 

"It is up to the leader to be able to pull out these cards and be able to showcase these profiles," Olyaei said, as they transition from an organization or industry. "We cannot force different profiles of leaders on different types of organizations — this is where we see a lot of issues sort of fire back and come back and haunt people."  

Half of CISOs expect their responsibilities to increase compared to today, Gartner found. And Gartner warns that if a CISO does not embrace changes to their role, their company is more likely to have security incidents. 

"That'll add to the perception that cybersecurity is a roadblock to the organization," and perpetuate the perception security doesn't facilitate agility, Olyaei said. For "stagnant" CISOs in operations, security alerts will become fatiguing — another outcome Gartner has witnessed in "ineffective CISOs."  

Four in 10 CISOs expect their control to expand outside of information security, but existing CISOs face a similar dilemma: being responsible for tasks that don't belong anywhere else, including IT mismanagement, business continuity or privacy. 

"Today, the role of the CIO is becoming sort of more of a title for everything," Olyaei said. 

Nearly one-third of security programs began adding at least two additional roles to help with some of this this year. Digital or technology risk officer, CSO, cybersecurity-proficient board members, and product security officer are among the roles alleviating CISOs of some of their odd-job security responsibilities.

"We think that many organizations already have a variety of cybersecurity roles," Olyaei said. "Continue to evolve based on your organizational needs and cultural requirements." 

Dive Brief:

• Trust is becoming one of the most important aspects of the chief information security officer role and the success of a modern company, according to Jeff Pollard, vice president and principal analyst at Forrester. Trusted brands will gain market share and develop stronger, lasting relationships with customers and partners.
• Online adults are three times more likely to forgive brands they trust for product or service mistakes than those they don't trust, according to Pollard. Customers are more likely to forgive a particular brand for putting data at risk if they trust the company. Forrester surveyed 1,851 online adults during its 2021 Global Trust Imperative Survey in March. 
• CISOs are starting to become the most senior executive leader responsible for trust inside an enterprise, a trend that began in 2020, but took off this year, according to Pollard. At a number of companies, including Reddit, Red Canary, Cisco, DocuSign and Atlassian, CISO's are either adding the title of trust officer to their portfolio or ascending to that position within the company. 

Dive Insight:

The trust relationship has taken on an unprecedented level of importance inside modern companies as the COVID-19 pandemic and the current political climate has opened a dystopian debate over the meaning of truth and what people are willing to believe. 

For millions of people, the willingness to accept an agreed upon set of facts has become a moving target. For the CISO at a modern enterprise, the need to establish trust with customers, partners and even senior management within the same organization has become even more important. 

About 80% of online adults in the U.S. are willing to buy new products from a company they trust, even if the purchase is unrelated to products they have bought before, Pollard said.

"Imagine being able to guarantee launch window success because you are a trusted organization? That's coming — that's going to happen," Pollard said.

Trust in an organization can extend to partner relationships. The research also showed 72% of online adults in the U.S. that trust a brand were willing to trust affiliates of that brand. 

"Think about the fact that trust now becomes leverage for partnerships," he said.

All a CISO needs is buy-in, but it's not guaranteed when presenting security strategies to the C-suite, board or other employees.

"We forget we do run businesses, right? So you have to make those tradeoffs and decisions," said Sara Andrews, SVP and global CISO of PepsiCo, during the Mandiant Cyber Defense Summit. "What I want is, whoever's in the room, whether it's the CISO, CIO or a board member, [to think] about cybersecurity and the decisions you make." 

Boards are recognizing that their entire business is dependent on technology. Even in industries lagging in digital transformation, businesses are still reliant on technology. It took years for the CIO to have a loud enough voice at the C-suite table, and CISOs are only now becoming more understood. 

"The key is not to bring the day jobs into the boardroom meeting," said David Baumgartner, EVP, CIO, and managed solutions leader at Mandiant, during the panel. He recommends CISOs provide context that illustrates what security wants and portrays clear intention when presenting to the board. CISOs should ask themselves: 

• What are you asking for? 
• What do you need from the board? 

It is the board's job to ask questions, not directly tell CISOs what to do. CISOs who can operate and speak at a board level, and seek agreement from their board, can transcend whatever industry they perform security in. The broad principles of cybersecurity are evident in most businesses and industries, especially in the last year and a half. 

"Try and be as simple as possible in terms of the explanation," Baumgartner said. "Put things in business terms, use benchmarks, use comparative analysis, to give them perspective" around how the business fares against its competition. Having this data will cushion the questions boards often ask their CISOs, including: 

• How at risk is the business? 
• What areas are lacking appropriate protection? 

In addition to stats, Teresa Tonthat, VP of IT and CISO of Texas Children's Hospital, uses the newscycle to educate her board. Tonthat brings "relevant highlights of what's going on in the media" to tie it back to the risk posture of Texas Children's, she said during the panel. "They really like to hear what's happening around the other healthcare institutions." 

Is the board cyber savvy?

While using necessary tools to translate risk or folding security into overall business outcomes are tactics CISOs use, they still need transparency. 

"There hasn't been one time where I've left a board meeting where they hadn't asked me 'Do you need anything Theresa?' So I think they're at that point where they're very well versed," Tonthat said. And the CISO should readily know what areas need more attention and resources. 

While the last year challenged the perception that security is a back-office cost function, and brought CISOs to a more prominent position, executives still struggle with effective communication. It's a balancing act to know which of the board's questions are reasonable to answer now versus deciding to only tell them what they need to know. The tradeoff between the two decisions is neverending, especially during an incident when details slowly reveal themselves. 

Boards have a critical control and monitoring function when an incident occurs, but if the board does not understand cybersecurity, their control function is less effective. 

SolarWinds is a case study of the role boards play following a breach and revisiting risk management. The company had its nominating and corporate governance committee oversee cyber risk, instead of a standing risk management committee, its April 2020 proxy statement said. After the breach, SolarWinds established a committee with additional board members in January to oversee IT and cybersecurity, according to its April proxy statement. 

It's an example for other companies to understand whether they are putting enough protection around the product or solution that most represents their business. 

When cybersecurity becomes a natural part of overall business goals, and cyber risk is meshed with systemic risk, it changes how incidents are handled in the future. 

Pepsi has cybersecurity built into crisis management, "a lot of companies don't do that," Andrews said. "People think, 'Oh, it's cybersecurity, we need to do something special for that," when really folding it into overall crisis management sets the tone for the rest of the company. It naturally becomes a discussion about customer impact, revenue and availability. 

Firmly placing cybersecurity into overall crisis management helps set the tone for response operations. "It's really important that we leverage — as CISOs — anyone who can help us," said Andrews. "We don't have to solve all these problems ourselves." 

More boards of directors are willing to take risks in the name of long-term growth, a shift from an era when companies could afford to make conservative decisions or investments. As members recalibrate risk tolerance, cybersecurity is part of their assessment.

Boards "recognize that [remaining conservative] in this period of uncertainty is a mistake and hence they're willing to kind of change the mindset to say that even in the face of incomplete information, we are comfortable [making] decisions," said Partha Iyengar, distinguished research vice president at Gartner. 

Almost three in five boards have increased or expect to increase their risk appetite heading into next year, according to research released at the virtual Gartner IT Symposium/Xpo. The results are based on a survey of 273 members of the board or board directors. 

Boards are shifting focus beyond survival, looking for ways to foster future growth that is faster than pre-pandemic levels, Iyengar said, in an interview ahead of Symposium. 

For 38% of boards of directors, economic uncertainty is the biggest source of risk, according to Gartner data. But more companies are looking at cybersecurity as a business risk, independent from technology. 

Nine in 10 board members consider cybersecurity a business risk, a 35 percentage point increase over views expressed in 2016, Iyengar said. 

While cybersecurity is gaining board-level attention, it has not directly influenced board construction. 

In the U.S., cybersecurity issues are still handled under the risk and audit subcommittee. Only one-quarter of U.S. boards have a technology and digital subcommittee, compared to Asia-Pacific, where they're found in more than three-quarters of boards, Iyengar said. 

"All of the issues that otherwise would have been handled by the board-level committee, in the U.S. context, is actually pushed deep into the risk and audit committee," he said.

What this means is that the function of the risk and audit committee changes, where they don't just look at the breaches of cybersecurity as a technology issue, but look at what it means for the business, assessing changes to investments and governance structure, according to Iyengar. 

"Especially in the U.S., with some industries where the boards have been held personally liable for cybersecurity breaches, I think it's acquired an even more sense of urgency," Iyengar said.

Where digital technology fits

For the majority of boards, digital technology initiatives are the main priority, particularly around efforts to adopt, upgrade and integrate technologies, Gartner research shows. Boards of directors are also prioritizing cybersecurity, automation and AI/ML and digital transformation. 

While CFOs are becoming more comfortable with risk, executive leaders are focused on driving digital business issues amid an internal and external talent crunch. 

Pre-pandemic, the biggest challenges for businesses were enterprise culture, access to capital and access to skills. Now, organizations are trying to accelerate digital transformation plans, Iyengar said. "You're taking a five year window and compressing it into 18 months — the crisis around talent and workforce has not just gone up linearly, it's gone up by orders of magnitude."

Boards are aware of the workforce concerns and the impact they can have on business growth and development. Workforce efforts around retention, training and hiring are the No. 2 priority going into next year, according to Gartner. 

SolarWinds became the poster child for novel nation-state cyberattacks last December. The company was used as a tool in a supply chain compromise in a way no one had seen before. 

When FireEye, now Mandiant, disclosed its breach, the incident raised eyebrows across the security community — a security company is not supposed to get hacked. And then the downstream victim list began to grow beyond FireEye, launching a collective effort to understand how and why hackers leveraged SolarWinds Orion. 

Cybersecurity Dive spoke with SolarWinds CISO Tim Brown about his experience as a security and business leader during an unprecedented cyberattack amid an already unprecedented year. 

This interview has been edited for clarity and brevity.

CYBERSECURITY DIVE: What do you find people get wrong about the SolarWinds hack most often?  

TIM BROWN: Just a number of things, right? So I guess most often, they're not understanding who the attacker was and what the attackers' capabilities were. And that's a big one. 

When you're attacked by a nation state, that's [being] attacked by an army. And who do you expect to be able to defend against an army? You expect the private company to be able to defend it against an army? Probably not.

The amount of thought that they put into it was absolutely a military mission. … The sophistication of the actor is one thing that everybody needs to be prepared for. And they need to be prepared for that level of sophistication to start doing ransomware attacks, organized crime attacks. That's one of the other things that people don't quite, you know, understand.

I just kind of want to hear about your "oh, crap" moment. When you got the call and the minutes after. 

BROWN: It was crazy. So our CEO got a call in the morning from [Mandiant CEO] Kevin Mandia. And then he called me, and then the CTO for FireEye called me. That's our nightmare moment. 

So we were in the office for a couple of weeks straight, we didn't get out until two or three in the morning. So much goes on — you can test and test and test — but the level of intensity, the level of things that need to happen, the level of things that need to happen immediately, is just extremely hard to anticipate until you live with it. 

We were spending time with customers all day long, and with the researchers. We were in here at night reviewing docs and making sure everything was right before we published. ... You've got to go through every word. It's got to be correct. It's got to be well-phrased. 

The first few weeks were just crazy from everything that you had to do. Support lines were going mad, as you would expect, so we had pulled people across the company to answer support calls, and try to get our queues down. 

One of the things that we did well was we split ourselves up into different war rooms. We had people focused on the internal investigation, we had people focused on the development investigation, we had people focused on marketing communication, people focused on business escalation, we had people focused on legal. But each one of them had a leader and we came together every afternoon to talk about where we were on each one of those streams. If you tried to do this with one stream, you would fail. 

And then you can't forget your people, the employees themselves. [Using] the analogy of somebody breaking into your house — they're all going through emotional roller coasters here too. Communicating to the employees about what's going on also is really, really important.

How did you get started in cybersecurity? I ask because I want to know, at any point from your start up to now did you anticipate getting attacked by a nation-state actor?

BROWN: I ran development teams, I ran engineering teams, I built cybersecurity programs. I was one of six Dell fellows. So I really built up a lot of focus, both internally and externally for people. 

A lot of advice I've given to governments, I've given to the world on how to head forward. So did we think about nation states? Yeah, we thought, hey, this could be possible. But possibly, theoretically, is very different than possibly, practically. 

I talked to a number of large companies or entities that would be [susceptible] to a nation state. They'll tell me, "Yes, it happened to us. Yes, we know these threat actors, but it just didn't go public. We didn't talk about it, but they're there." So by us coming out and talking about it, I think we make it real for people making it so it's not theoretical anymore. 

We're humble, but we're trying to be accurate and truthful around what we do. Most CISOs start from a technical perspective, and don't necessarily have that same level of model or skill set. So it's something that we have to develop as CISOs — being both internal and externally focused. 

Is there anything you feel like non-technical or non-security business leaders didn't understand until the last 11-12 months?

BROWN: One thing is that they didn't understand that this can happen.

I think that the incident sparked a lot of conversations for many companies on what their security programs were, what their security programs needed. [When I talk to] CISOs around the world, they thank me for helping with their budget.

So in that way, the event itself has spurred more security across the world. Not just for us, not just for our clients. … "Could we get hit in this way?" Is the question the boards are asking, which is a very, very healthy conversation to occur.

One of the interesting parts is when this happened, we got calls from every country of the world — believe it or not, the countries call you. And the countries say, "Can you give me a list of all the customers in my country?" … We found them very great partners, and that their agenda was simply to amplify messages. Their agenda was to help the customers become safe. 

One of the things SolarWinds did almost immediately was create a cyber-specific committee on your board. Did you have any realizations throughout the year of "why didn't we already have that?" Or "why didn't we already use that?" 

BROWN: So the technology committee was there, but it just brought up the fact that we need to specifically have that cyber committee as part of the board. 

Some of the things we should really think about from the industry perspective is, how much thought are you putting into all of these things. A lot of people put technology in place and the technology is there. But in this case, the actor was, again, very, very thoughtful. So activities that we've been doing since the incident had been both technology implementation … and thinking ... That's what they did well.

The message is that we have to out-think the adversaries, out-mission the adversaries, out-prepare from the adversaries. It's not just about putting technology to it. It's not just about processes. It's taking that time and effort to really out-think them. 

Is there anything else that you wish that SolarWinds had communicated more clearly? I know that the investigation was unraveling in real time in December. 

BROWN: We found that we didn't have the right list of people to communicate to. We put information to every email contact that we had, but those email contacts happened to be the sales contact. One of the things we've revamped was to give ourselves a security contact for each one of the companies. Now we have that as part of Salesforce. … 

We tried to amplify messages. We tried to push information out as much as we could. We agreed with a lot of what the [Cybersecurity and Infrastructure Security Agency] folks were amplifying. So that helped. 

Our first message said, "18,000 companies were affected," simply because that was everybody that downloaded [the update]. That was a high number, right? … Everybody was affected, everybody had to do an investigation, so I'm not lessening that. But the ones that went to a stage two attack, the ones that were actually targeted, were under 100. 

So big difference from 18,000, down to 100. So do I wish I knew that was 100 on day one? Yeah. But you can't necessarily know everything when something starts. 

Is there anything this taught you or changed you as a cyber leader, a business leader or as a person? 

BROWN: Yeah, one of the things that was really, really helpful — which is something completely aside that I didn't expect — was the number of people that reached out with support. And that gave me a big lesson. I reached out to the Kaseya guy to say, "It's okay, you'll get over it." 

But the level of support from the community and people coming back and just saying, "Yeah, we've got your back." The level of appreciation that both government entities and corporations gave us for being transparent and helpful goes a long way. It goes an incredible amount of way to just kind of humanize the problem and say, "You're doing the best you can, and we know it's difficult, but you'll get through it." 

That's one of the things I encourage others to do: When you see people that are in a difficult situation, reach out and give them a hand if you can. A kind word goes a long way.

When devising an aligned cybersecurity and business strategy, companies should only identify their individual risks — not those of their industry or competitors, according to Jeffrey Wheatman, VP of advisory at Gartner, while speaking during the virtual Gartner Security & Risk Management Summit.

"How are we going to engage with our business stakeholders to strike the appropriate level of balance between running the business and protecting the business?" Wheatman said. Companies will be able to answer this once they've established overall business goals and identified risks.

The common issue security and business leaders run into is miscommunication, according to Wheatman. Either high-level business strategies are too vague for security leaders, or too much detail fails to resonate with business leaders. 

Companies need their security leaders to connect "what we know with what we feel" for stakeholders, Wheatman said. Oftentimes stakeholders will know cybersecurity is important for the business, but they don't exactly know why. 

Security executives cannot always present risks as negatives, sharing how a company will fail if a risk goes unaddressed. In some cases where risk is present, like IT modernization, taking the risk directly benefits overall business goals and competitiveness. 

The tactics and approaches to identifying risks that help move the business toward its goals will vary depending on the situation. "If you're very heavily in the cloud, you're going to need to think differently about how you're going to be implementing your controls," said Wheatman. 

Companies will have to develop metrics to track improvements over time. "These are the things that actually need to come after building this out and communicating," he said. 

Business goals will differ from company to company, and they all have to align with what the C-suite and board expects. Goals can range from growing revenue to creating more jobs or retaining customers. 

Leaders should not take goals unless it's specifically for their business, Wheatman said. "Don't make the mistake that folks make which is just to copy what comes in the toolkit or the template." 

Some stakeholders are concerned that their business goals are too "fluffy and abstract," but that is "actually better," said Wheatman. It's difficult for security and risk executives to connect "anything we do in security that's going to help raise revenue by 6% year over year," he said. "But you can talk about being the best, you can talk about reputation." For a quick win, executives can even refer to their company's website to find value statements, typically in the "about us" dropdown.  

When identifying risks, Wheatman advises leaders to stay away from too much technical jargon. "The phrase that I like to use is technology-related risks. These are risks that your organization faces, as a result of technology," including implementation, updates, the cloud and OT. The areas directly impacted by these technological risks include intellectual property protection, regulatory compliance or resilience. 

Companies can perform risk assessments or use peer support groups to find common risks, even though they should still be unique to an individual company. Companies can use audits, but Wheatman recommends staying aware of the checkbox nature of audits, and adding context. 

"Oftentimes, people have 20 to 30 risks — that is far, far too much," Wheatman said. Aim for between five and seven. 

Half of CIOs are prioritizing security management this year, as CEOs push for IT and data security upgrades to reduce corporate risk, according to IDG's annual CIO survey, which included responses from almost 1,000 heads of IT and 250 line of business participants.

Increasing cybersecurity protections is the top business initiative for 2022, especially for IT leaders in the government, education, manufacturing and healthcare sectors. Respondents cited socioeconomic factors for driving focus on security, the report said.

The majority of IT leaders, 76%, expect to be more involved in cybersecurity this year, while maintaining their role as the primary technology decision maker, the report said. This is particularly for CIOs in government, healthcare and manufacturing. Security and risk management skills are also the top skills CIOs are expected to seek this year. 

Without visibility into a company's tech stack, a CISO's ability to defend a network is weakened. Software complexity is a top challenge for CIOs and CISOs. 

The reporting structure between CIOs and CISOs varies. With IT and security demands sometimes at odds, many CISOs report directly to the CEO. However, a direct CIO to CISO rapport gives leaders insights into the network and what is necessary to defend it. 

The majority of CIOs engage with their CEOs more than other C-suite executives, while engagement is evenly split between CISOs and CTOs, a 2021 IBM report found. The survey was based on 2,500 responses from CIOs and 2,500 responses from CTOs between May and September 2021. 

IBM found that cybersecurity is among the shared responsibilities of the CIO and CTO.  

Nearly three in five respondents (57%) cited security improvements as a driver for their budget increases this year, according to IDG. The top technology investments for 2022 are in security and risk management, followed by data and business analytics, and application and legacy system modernization. Upgrades to IT infrastructure came second to security improvements as reasons for budget increases, IDG found. 

The increased focus on cybersecurity can bridge potential technological gaps between IT and the security organization. SolarWinds, for example, is a tool CIOs were likely familiar with, Chris Krebs, former director of the Cybersecurity and Infrastructure Security Agency (CISA), said during a virtual Gartner conference in October. CISOs "may not have had as deep an understanding of the Orion product and platform," the software's criticality in maintaining network operations, Krebs said.

CIOs and CISOs play equal roles in defensive collaboration — each has a responsibility to demand higher security standards from the vendors they work with. CISOs have the responsibility of shedding light on risk, not necessarily security practices for their C-suite counterparts.