Hired to Build, Judged on the Breach That Never Happened

Key points

• Chief Information Security Officers (CISOs) are typically hired for technical skills but evaluated on business and communication abilities they were never asked about.
• The disconnect between the job described in an interview and the job that actually exists is a defining problem in security leadership right now.
• Closing that gap is increasingly what separates a CISO who lasts from one who doesn't.

What does a CISO actually do?

On paper, a Chief Information Security Officer (CISO, pronounced "SEE-so") is the executive responsible for keeping a company's data and systems safe. In practice, the role has quietly split into two jobs that don't always share the same skill set.

The first job is the one candidates are screened for: technical depth. Can they design a security programme? Do they understand how attackers get in? Boards and CEOs ask these questions because they feel reassuring. A candidate who can rattle off threat models and audit frameworks sounds like someone who knows what they're doing.

The second job is the one they're measured on once they have the title. That job is political. Convincing a CFO to fund something invisible. Telling a CEO, calmly, that a product launch needs to slip because the authentication layer, the part of a system that checks whether you are who you say you are, has a flaw that could expose customer data. Translating a genuinely complex technical risk into a few points a board will remember. Those tasks require a very different person than the one the interview tested.

Why does this gap keep opening up?

It opens because the people doing the hiring and the people doing the evaluating are rarely the same group. A CISO candidate is often screened by a head of technology or a specialist recruiter who knows what good security architecture looks like. A year later, the same CISO is judged by a board audit committee that can't tell a firewall from a spreadsheet and doesn't need to. What the board can tell is whether the security leader speaks their language, whether they learned about a breach from the news before their own CISO told them, and whether the quarterly risk report makes any sense.

We covered the structural side of this shift on 27 July, when three experienced practitioners described CISOs quietly absorbing responsibility for keeping companies alive after a disaster, not just preventing one. The communication burden only grows with the scope.

Technical excellence is the entry ticket. It was never the scorecard.

What does this mean for ordinary employees and customers?

When a CISO is too absorbed in the internal technical world to communicate outward, risks can sit unspoken until they become incidents. A breach flagged internally months before it went public, but never escalated clearly enough for leadership to act on, is a failure of communication as much as a failure of security.

A company whose CISO briefs the board clearly and regularly is likely one that makes faster decisions when something goes wrong. For customers, security risk understood at the top means a problem is more likely caught before your data leaves the building.

If you're considering a CISO role, the honest advice is simple: build your technical credibility first, then spend equally serious time learning to explain risk to people whose expertise lies elsewhere. The gap doesn't close itself.

Common questions

Is the CISO role getting harder to succeed in?

Yes, measurably. Boards now expect security leaders to speak fluently in business risk terms, regulatory language and technical detail, sometimes in the same meeting. Most career paths in security train people in only one of those areas.

Should employees care who their company's CISO is?

It's worth knowing whether your organisation has one and whether that person has direct access to senior leadership. A CISO buried three layers below the CEO is structurally unable to get urgent problems heard fast enough to matter.