Hired to Build, Judged on the Breach That Never Happened
The skills that land someone a CISO job are rarely the ones the board scores them on a year later. That gap is quietly ending careers.
Key points
- Chief Information Security Officers (CISOs) are typically hired for technical skills but evaluated on business and communication abilities they were never asked about.
- The disconnect between the job described in an interview and the job that actually exists is a defining crisis in security leadership today.
- Closing that gap, not patching software or writing policy, is increasingly what separates a CISO who lasts from one who does not.
What does a CISO actually do?
On paper, a Chief Information Security Officer (CISO, pronounced "SEE-so") is the executive responsible for keeping a company's data and systems safe. In practice, the role has quietly split into two jobs that do not always share the same skill set.
The first job is the one candidates are screened for: technical depth. Can you design a security programme? Do you understand how attackers get in? Have you handled an incident before? Boards and CEOs ask these questions because they feel reassuring. A candidate who can rattle off threat models and audit frameworks sounds like someone who knows what they are doing.
The second job is the one they are measured on once they have the title. That job is political. It is about convincing a CFO to fund something invisible. It is about telling a CEO, calmly, that a product launch needs to slip because the authentication layer, the part of a system that checks whether you are who you say you are, has a flaw that could expose customer data. It is about translating a genuinely complex technical risk into three bullet points a board will remember.
Those two jobs require very different people.
Why does this gap keep opening up?
It opens because the people doing the hiring and the people doing the evaluating are rarely the same group. A CISO candidate is often screened by a head of technology or a specialist recruiter who knows what good security architecture looks like. A year later, the same CISO is being judged by a board audit committee that cannot tell a firewall from a spreadsheet and does not need to. What the board can tell is whether the security leader speaks their language, whether they learned about a breach from the news before their own CISO told them, and whether the quarterly risk report makes any sense.
SecurityWeek has covered this tension for years, and the observation holds: technical excellence is the entry ticket, not the scorecard.
What does this mean for ordinary employees and customers?
It matters more than it sounds. When a CISO is too focused on the internal technical world to communicate outward, risks can sit unspoken until they become incidents. A breach that was flagged internally months before it went public, but never escalated clearly enough for leadership to act on, is a failure of communication as much as a failure of security.
For employees, this means that a company whose CISO briefs the board clearly and regularly is likely a company that makes faster decisions when something goes wrong. For customers, it means a company where security risk is understood at the top is one more likely to catch a problem before your data leaves the building.
If you are a professional considering a CISO role, the honest advice is simple: build your technical credibility first, then spend equally serious time learning how to explain risk to people whose expertise lies elsewhere. The gap does not close itself.
Common questions
Is the CISO role getting harder?
Is the CISO role getting harder to succeed in?
Yes, measurably. Boards now expect security leaders to speak fluently in business risk terms, regulatory language, and technical detail, sometimes in the same meeting. Most career paths in security train people in only one of those three areas.
Should employees care who their company's CISO is?
It is worth knowing whether your organisation has one and whether that person has direct access to senior leadership. A CISO buried three layers below the CEO is structurally unable to get urgent problems heard fast enough to matter.
