CISO Strategy

Cybersecurity jobs pay well, especially as professionals move up the managerial ladder. Salaries for CISOs run anywhere between $400,000 to $1 million per year. 

However, as the saying goes, money can’t buy happiness — or job satisfaction. Three in four CISOs considered a job change in 2023, research from IANS and Artico Search found.

CISOs have found acceptance in the C-suite in title but not necessarily with organizational leadership. Security leaders can serve as the scapegoat for cyber incidents and compliance violations, which is contributing to a lack of job satisfaction.

“Regulators and prosecutors are now holding CISOs accountable for transparency, even fraud, on behalf of their organization,” the report found. 

CISOs must contend with personal liability and reputational repercussions, while dealing with leadership teams that fail to grasp the gravity of cybersecurity risks, Pathlock CEO Piyush Pandey said via email.

“Combining these issues with pressure from day-to-day security operations without a commensurate compensation uplift would be a significant disincentive,” said Pandey.

The impact of the declining job satisfaction among CISOs

With increasing regulatory requirements around data protection and privacy, and a growing list of IT general controls, the heavy burden resting on the shoulders of CISOs is leading to burnout. It’s a problem that George Jones, CISO at Critical Start, has witnessed firsthand.

“I am seeing my peers struggle with work-life balance and career development,” Jones said. 

A lack of CISO satisfaction can have significant implications for corporate security, Jones added, including: 

• Decreased effectiveness: A dissatisfied CISO may be less motivated to engage in their role managing and mitigating cybersecurity risks.
• Retention challenges – Highly dissatisfied CISOs will leave roles early, contributing to higher turnover rates and instability in an organization. This can also create potential gaps in leadership and process.
• Cultural impact – CISOs play a crucial role in shaping the security culture of an organization and drive awareness among employees. Dissatisfaction can impact their ability to foster a strong culture of security in an organization.
• Vulnerability increases – A lack of satisfaction can also result in insufficient resources allocated to cybersecurity initiatives, leaving organizations more vulnerable to cyber threats and breaches.

Breaking down the barriers between CISOs and leadership

The lack of a defined leadership role for CISOs is hurting job satisfaction. Those CISOs that have more access to the company’s board of directors report higher satisfaction with their job and handling of security requests.

“Just 28% of those without board engagement are satisfied versus 57% with, at least, infrequent or ad hoc board contact,” the IANS and Artico Search report found.

When CISOs and cybersecurity are overlooked in leadership meetings, organizations will struggle to adopt cybersecurity best-practices and meaningfully integrate cybersecurity within their company’s culture. 

A priority for businesses must be to break down the barriers between security and business leaders. 

This starts with giving CISOs a seat at the table for all board meetings, where cybersecurity initiatives should be proactively and regularly discussed. Organizations must also accept the fact that proactive cybersecurity best-practices and sufficiently funded cybersecurity teams and programs are not cheap. They never will be, either.

“The sooner that board-level decision makers understand that upfront investment is more cost-productive than reactive spending after a breach, notable progress will be made in terms of proper cybersecurity investment and funding,” said Pandey.

The outlook for CISOs is likely to depend on factors such as evolving cybersecurity threats, organizational priorities, regulatory changes, and the effectiveness of measures taken to address the job's challenges.

“This makes it difficult to predict outlook, but the workload and stress levels are not likely to decrease, which means that the stress levels will follow suit,” said Jones.

The U.S. Supreme Court ruling to overturn the Chevron doctrine could have major implications on the cybersecurity regulatory landscape at a time when federal agencies have enacted significant requirements designed to strengthen incident reporting and meet baseline security standards. 

The ruling will likely lead to new legal challenges against recent cybersecurity regulatory measures, including the 2023 cyber incident reporting requirements from the Securities and Exchange Commission, according to the Center for Cybersecurity Policy and Law.

The Supreme Court ruling could impact rulemaking on the Cyber Incident Reporting for Critical Infrastructure Act, too, according to the CCPL. Officials see the potential for the ruling to impact baseline requirements for the healthcare industry or future efforts by the Environmental Protection Agency to mandate cybersecurity rules for drinking and wastewater treatment utilities.  

The Chevron doctrine stems from a 1984 case, Chevron U.S.A. v. Natural Resources Defense Council, which set the precedent for courts to yield to the expertise of federal agencies to interpret ambiguities in a statute. 

The Supreme Court ruling involved Loper Bright Enterprises v. Raimondo and alongside a second case, Relentless v. Department of Commerce.

The U.S. Chamber of Commerce called the Supreme Court ruling an “important course correction” that will help create a more stable and predictable business environment.  

SEC cyber rules in the hot seat

The SEC rule passed in 2023 requires publicly traded companies to report cybersecurity incidents to the agency within four business days of determining their materiality. Companies must file annual updates that outline their strategies for how to mitigate cyber risk.

In October, the SEC also filed suit against SolarWinds alleging the company and its CISO defrauded investors by failing to disclose its true cybersecurity risk leading up to the 2020 supply chain hacks by state-linked hackers. 

The Chamber of Commerce and Business Roundtable filed briefs in the SolarWinds case arguing the SEC had expanded its authority in the case far beyond the original intent of Congress. 

Legal and cybersecurity experts are still evaluating what the impact of the Chevron doctrine ruling will be on future regulations. However, Brandon Pugh, director of cybersecurity and emerging threats at the R Street Institute, said the ruling will force federal officials to rethink how they approach future cyber regulations to make sure they don’t create an overly burdensome environment for critical infrastructure and industry partners. 

“I think it may give agencies more pause to think about their legal justification, and perhaps look to Congress for more authority in the cases of ambiguity,” Pugh said in an interview.

Officials from the SEC and the Office of the National Cyber Director declined to comment for the story.

 

Software defects across MOVEit file-transfer services, Log4Shell and Citrix Bleed are among the highest-profile vulnerabilities that have been exploited in recent years, but they represent just a sliver of the total CVEs causing widespread damage.

The volume of CVEs is steadily increasing each year — SecurityScorecard recorded 29,000 vulnerabilities in 2023 and already this year it tracked nearly 27,500 vulnerabilities.

That number is expected to hit 34,888 in 2024, a 25% increase, according to Coalition’s 2024 Cyber Threat Index report. It underscores the challenge for organizations to continuously manage vulnerabilities and strengthen defenses against potential exploits.

While three-quarters of organizations employ a formal program to manage vulnerabilities, many are struggling with a backlog they cannot fix and a growing number that need vendors or the open-source community to remediate, according to the SANS 2022 Vulnerability Management Survey. 

Organizations need effective CVE management to mitigate the risks posed by these vulnerabilities, but many struggle with the complexity of identifying and prioritizing the most critical threats amid a constant influx of new vulnerabilities. 

“The sheer number of CVEs makes it difficult to keep track of all potential vulnerabilities,” said Amit Bismut, head of product at Backslash Security.

With many vulnerabilities deemed critical, the challenge is deciphering which ones pose the biggest risk. One way is to understand if the CVE can potentially be exploited in your specific environment, Bismut said.

Organizations need to prioritize vulnerabilities that represent a specific risk to the environment and direct resources so that the most dangerous vulnerabilities are mitigated promptly.

“Context helps security teams focus on vulnerabilities with the most significant threat to their unique setup, rather than trying to address every single issue,” he said.

How CVE identifiers help vulnerability ranking

Using the CVE number, which is a common identifier, security teams can rank vulnerabilities according to a range of data sources and use vulnerability scanners or intrusion detection systems to find them.

It wasn’t always this way. Before CVEs identification was formalized, security teams had to piece together vulnerability information, according to TK Keanini, CTO of DNSFilter and founding member of the CVE program.

The CVE program, now in its 25th year, has become foundational to many other security standards including the International Organization for Standardization, the payment card industry and the Healthcare Information Trust Alliance security framework.

It’s used in compliance, risk management and cybersecurity protocols, providing a standardized method for identifying and referencing specific vulnerabilities with a common identifier used by security teams everywhere.

“By incorporating all of these different perspectives, it creates a better, more actionable and more accurate workflow,” said Keanini.

With the rising tide of vulnerabilities, it’s not feasible to tackle every risk. Ranking means every CVE has a risk weight, critical to prioritizing patching and vulnerability management, especially as the scope of CVEs is only growing.

Every new line of code that’s introduced provides new opportunities for more CVEs, noted Keanini.

“We're not counting a static space. That’s why the scoring’s important to stack rank and know which ones are on your network,” he said.

Tackling CVEs with a strategic business lens

While the headline number of CVEs is going up, there’s more to it than that, given that a single CVE number can often refer to more than a single piece of code.

“One CVE might affect multiple different versions of software or packages of software, especially if that CVE is embedded in very pervasive code,” said Dustin Kirkland, VP of engineering at Chainguard.

When a vulnerability is discovered, it is enriched with additional information, although this doesn’t automatically mean it will lead to an attack as a vulnerability may be a proof of concept or a theoretical problem. 

“Not every CVE comes with either a fix or even a proof of concept that shows it’s a real problem that could be exploited in the wild,” Kirkland said.

If it warrants it, a fix is issued or the weakness declared so that security teams and scanning tools are aware of it. 

The scoring system helps ensure that the most real, egregious vulnerabilities get a higher priority than the lowest ones, which could be considered just nice to fix.

While the usual practice is responsible disclosure so that it can be identified, some CVEs are sold on the dark web by hackers and cybercriminals. 

“There's certainly an underground market for zero-day [vulnerabilities] and for undisclosed vulnerabilities, where they’re bought and sold on an underground market by some shady organizations,” he said.

In neutralizing CVEs, scanning tools are vital, yet it’s not simply a process of turning a vulnerability dashboard flashing red to green when consulted on a periodic basis.

While vulnerability management is largely driven by adherence to some compliance framework, security chiefs don’t usually have a singular goal of eliminating CVEs. 

“It’s usually tied to a business objective,” said Kirkland.

The majority of CISOs and other IT security leaders, almost 4 in 5, say they have felt pressure from their corporate boards to downplay the severity of cyber risk, according to a study commissioned by Trend Micro.

The study highlights ongoing tension within the upper ranks of corporations between C-suite executives, investors and security operations over how to properly manage and communicate security risk.

“The board is focused on the overall business and typically there is a big effort to ensure the company supports their investors,” Jon Clay, VP of threat intelligence at Trend Micro, said via email. “As such they want to ensure the reputation, revenue and profitability is tantamount.”

Among those security leaders feeling pressure from their boards, the report found 43% say they are seen as nagging or repetitive and 42% say they are seen as being overly negative about cyber risk. The report is based on a worldwide survey of 2,600 IT security leaders conducted by Sapio Research. 

The debate is particularly relevant in the U.S., as the Securities and Exchange Commission requires publicly traded companies to disclose material cybersecurity incidents within four business days of such determination. 

Companies must also annually disclose information about their cyber risk strategies.

The SEC in 2023 filed charges against SolarWinds and its top cyber risk executive, alleging the company misled investors about the company’s cyber resilience.   

Brian Walker, CEO of the CAP Group, which advises corporate boards and executives on cyber risk, disagrees with the findings about board pressure, but agrees communications between CISOs and board directors are often misaligned. 

“Most boards are aggressively trying to understand cyber risks in context of all other enterprise risks,” Walker said via email. 

The findings are somewhat contradicted by a report from Proofpoint, which shows increased alignment between CISOs and their respective companies. The 2024 Voice of the CISO report shows 84% of CISOs say they see eye-to-eye with their boards on cyber risk, a significant improvement from a year ago, when only 62% saw such alignment. 

Despite the improvements, CISOs still feel tremendous pressure to carry the weight of cyber risk on their backs. Proofpoint's study shows 66% of CISOs say they are faced with excessive expectations, compared with 61% in the year-ago study. 

“While CISOs are enjoying closer ties with key executive partners, stakeholders, board members and regulators, this proximity also brings higher stakes, more pressure and heightened expectations,” Patrick Joyce, global resident CISO at Proofpoint, said via email. 

Two-thirds of CISOs are concerned about personal liability, compared with 62% in the year-ago study. More than 70% of those surveyed said they would not join a company unless they had directors and officers coverage, which is personal liability insurance for top executives. 

Earlier this year, UnitedHealth Group CEO Andrew Witty testified in front of Congress over a February cyberattack on its subsidiary Change Healthcare that affected an estimated third of Americans, and disrupted claims processing, payments to providers, prior authorization requests and eligibility checks for months. 

The incident was notable because while cybersecurity breaches have become common, a CEO answering security questions at the highest levels of government is not.

But that’s changing, because the risk of such a breach has changed — especially when personal and health information is compromised, as happened with UnitedHealth. 

“Cyber risk has far outstripped the traditional risk in terms of impact,” said Kevin Dunn, the former SVP and head of professional services at NCC Group who now serves as a senior manager for ProServe Security at AWS.

CEOs can no longer skim over their company cybersecurity plans. When big incidents occur, they risk firing, forced resignation, shareholder lawsuits, or even charges from the Securities and Exchange Commission. 

A decades-long perception shift of who is responsible for risk

The role of the CEO hasn’t exactly changed when it comes to cybersecurity, but the CEO’s perception of risk and level of engagement has, said Trevor Horwitz, CISO and founder of Trustnet. 

Ten years ago, cybersecurity was seen as an IT and compliance issue, Horwitz said. “If there was a breach, the impact wasn’t seen as significant, and the CEO’s role was primarily to make high-level decisions during the incident.”

The difference now is the potential threat to business operations and reputations, he said. “CEOs are tasked with integrating cybersecurity into the overall business strategy and aligning cybersecurity with business goals.”

Old excuses aren’t going to cut it anymore either, Dunn added.

In the case of UnitedHealth, Witty attributed the hack to acquiring a company, Change Healthcare, and that they hadn’t yet brought their security up to snuff. It wasn’t a sophisticated hack that breached the company either: Change Healthcare did not have multifactor authentication turned on, Witty testified.

His responses, including confirmation the company paid a $22 million ransom in Bitcoin, did not go over well with Congress. 

“This hack could have been stopped with cybersecurity 101,” Sen. Ron Wyden, D-Ore., said during a hearing in the Senate Committee on Finance. Sen. John Barrasso, R-Wyo., pointed out that even a small rural hospital in his home state has multifactor authentication.

Beyond it being an embarrassing few days for Witty, such breaches could have potential ramifications beyond Congress compelling company officials to testify. 

CEOs are also beholden to the SEC, said Gartner Distinguished VP Analyst Katell Thielemann, meaning they are responsible to shareholders or, in the case that the company they oversee is part of critical infrastructure, the country. 

“The government is telling me ‘I’m sorry’ is not good enough," Thielemann said. "The national security and economic prosperity implications of critical infrastructure going down is not something we’re willing to take anymore.”

What CEOs need to know

There are also potential legal ramifications to high-profile security incidents, according to Thielemann, through shareholder lawsuits or charges from the SEC, as happened to SolarWinds’ CISO after their massive breach. 

In the SolarWinds case, “they’re not going after the CEO, but they’re signaling that if they find that there was some misinformation or some outright false statements to investors, that they will go after the CEO,” she said. “If they can go after a CISO for those things, they’ll do the same for the CEO.”

CEOs don’t necessarily have to become experts in the technical aspects of cybersecurity in order to be prepared in case of an attack or — hopefully — stop one before it starts.

As such, CEOs should be playing a role in cybersecurity strategy overall, said Horwitz, which includes overseeing the development and implementation of risk mitigation strategies, incident response plans, and disaster recovery plans.

“When there is a breach, CEOs are now much more engaged in the details, activating incident [response] plans, making decisions, communication with key stakeholders and keeping the board informed,” he said. 

That means digging into cybersecurity before there’s a breach.

“I wouldn’t be letting my team off the hook with vague assurances” that the company is safe, said Dunn. Instead, CEOs should be “asking deep and searching questions, not about the technical aspects of it but the coverage and depth and how confident we feel” in the company’s cybersecurity stance. 

Security budgets have grown about 8% in 2024, marking a modest increase from the 6% growth in 2023, according to a report from IANS Research and Artico Search. The average growth rates are down considerably from prior years, when security budgets rose 16% in 2021 and 17% in 2022. 

Security budgets as a percentage of IT spending is up considerably compared to prior years, according to the survey of 750 CISOs, 681 of which responded to budget questions. The report found security represents 13.2% of overall IT spending in 2024, compared with 8.6% of overall IT spending in 2020. 

Hiring has slowed considerably in recent years. Security staffs grew 12% in 2024, a big drop off when compared to the 31% growth in 2022 and 16% increase in 2023.

Companies are up against competing priorities as security teams are leading the charge to protect organizations from malicious attacks with sophisticated tools and improved cyber hygiene. At the same time, companies have been struggling to manage overall expenses due to ongoing concerns about the economy. 

Security is often one of those areas where leaders are asked to deliver better protection from outside threats, however they aren’t always provided enough tools or expertise to make that happen. 

As more corporate functions depend on digital technology, the need for strong security is directly tied to business growth strategies, Nick Kakolowski, senior research director at IANS, said via email. 

“However, as security normalizes as a cost of doing business, we expect budget growth to continue, largely at an incremental pace,” Kakolowski said.

A report from Gartner last month shows security spending is expected to reach $212 billion by 2025, an increase of 15% from 2024 levels.

While 2 in 5 cybersecurity leaders reported their security operations center was hit by a recent cyberattack that led to a security breach, the vast majority, 85%, were still confident in their security operations center’s ability to prevent “increasingly sophisticated” attacks, according to the results of a cybersecurity survey conducted in April and released by Big Four accounting and consulting firm KPMG.

The respondents — comprised of about 200 CISOs, CSOs and AI security officers at firms with at least $1 billion in revenue — also expect more resources to bolster their defense going forward.

Nearly 9 in 10 anticipate their company’s SOC budgets and headcount will increase by under 20% over the next two years, according to the findings. Currently, the average annual SOC budget stands at $14.6 million, according to KPMG.  

The anticipated boost in security budgets comes amid a growing number of cyberattacks against large organizations, according to Ryan Budnik, director of cyber threat management at KPMG.

CISOs are “acknowledging that there is an expanding footprint of devices and technologies and business that they need to cover and protect,” he said in an interview.

SOCs are front and center in handling cyber threats, acting as a kind of “one-stop shop” to help organizations mitigate, prevent, contain, respond to and recover from cyberattacks, Budnik said.

While organizational structures differ, Budnik said SOCs typically reports to the CISO, who is often a peer of the CFO. The finance chief allocates the budget to the CISO, who would oversees the SOC operations, he said. 

Some of the SOC plans are likely to be more robust than others. More than two-thirds of respondents expect their SOC budget to increase over the next two years, but for most it’s a small uptick.

Of those, almost half expect a SOC budget increase of less than 10% and 2 in 5 expect their budgets to rise between 10-20%, KPMG found. Just 13% expect their budgets to increase by at least 20%.  

Only 1% of respondents anticipate their SOC budgets will decrease.

Cybersecurity has risen as a C-suite level priority in recent years, amid a rise in sophisticated and costly cyberattacks as well as growing regulatory pressures, including the Securities and Exchange Commission’s rules that require public companies disclose cybersecurity incidents within four business days of determining if they are material. 

“The SEC requirement is forcing a conversation … really forcing the CISO to frame it within the organization as a business risk,” Budnik said, noting that putting a price tag on the value of the security is not easy. “That dollar saved coming out of security is hard to quantify.” 

The study’s findings regarding how the security leaders spend SOC money show that the allocations of the SOC budget are spread fairly evenly across different aspects of the center’s activities, with 19% spread on prevention expenses to 16% spent on response and remediation. 

While companies have been talking about “shifting left,” Budnik said it was understandable that spending on response remains a focus. 

“When those incidents happen, everybody drops their pencils and everyone focuses on that,” Budnik said. “So typically that’s where the budget, I suspect, is being focused because when a breach is occurring everyone needs to focus on that, worrying about prevention at that point is less important.”