The Evolving Role of the CISO

The Chief Information Security Officer, or CISO, is the senior-level executive responsible for the protection of an organization’s information and data security. This role has seen exceptional growth in the scope and scale of its duties since its inception in the late 1990s. Once narrowly defined as the head of IT security, the CISO role has grown into a business leader, engaging with executives, and demonstrating a positive impact on organizations.

Security programs under today’s CISOs include, but are certainly not limited to: risk management, security operations, identity and access management, privacy, governance, business enablement, legal, and architecture. That is to say, the importance of this role cannot be overlooked or overstated. Attacks are only getting more sophisticated, and the global annual cost of cybercrime is expected to reach US $9.5 trillion in 2024, according to Esentire’s 2023 Official Cybercrime Report. Additionally, CISOs are taking initiative to ensure cybersecurity is baked into wider business operations, and this requires a deep understanding of an organization’s business objectives.

Reporting Structure and Executive Impact

As the CISO role has grown, their position, authority, and impact within an organization has significantly evolved. Most CISOs have removed the stigma of being a cost center by demonstrating how their programs are driving innovation, protecting valuable company assets, and influencing business transformation. 

It is becoming increasingly common for CISOs to interact more frequently with the CEO, CFO, and other C-suite executives, and there is also movement of CISOs reporting directly to CEOs. CISOs also communicate and present to the Board of Directors on a regular basis. Participation in the business side of the organization grows the influence of the CISO in ways this position has never seen before, and this gives this role a platform to ensure security posture is given the attention it requires.

Managing Vulnerabilities Due to Remote Work

Following the COVID-19 pandemic, remote work is a trend that is here to stay for many organizations. According to Forbes, 12.7% of full-time employees currently work from home, and this percentage will grow to 22% by 2025. CISOs are now responsible for assets and employees spread across the country or across the globe, and this also includes duties such as acquiring and deploying laptops, upgrading VPN infrastructure, being proactive against exploitative cybercriminals who want to exploit this trend, and introducing new security measures to keep employees safe while working remotely.

This trend places more responsibilities on the shoulders of CISOs and drives more interaction across all business departments. In order to efficiently and effectively implement necessary changes, CISOs must create strong lines of communication with executives to provide updates on progress and establish that all parties understand the importance of new measures taken.

The Rise of AI

To be a CISO is to be mindful of rapidly changing technologies within the industry and beyond. This includes AI, or artificial intelligence, and the extensive number of risks and benefits that come with it. The risks come at the hands of bad actors who use this technology to bolster their cyber attacks. Social engineering attacks like phishing scams have become harder to spot, because AI remedies grammatical mistakes or awkward phrasing that used to be a major identifying factor for these malicious messages, and the impact of these attacks is palpable. Direct financial loss from successful phishing attacks increased by 76% in 2022 according to Proofpoint’s 2023 State of the Phish Report. And that is only one example of the way AI can be exploited, among many. 

In order to level the playing field, there are advantages of AI that CISOs are harnessing. This technology is unparalleled in its ability to flag suspicious activity and detect attacks accurately. According to Splunk’s CISO Report, 35% of CISOs report using AI, either extensively or somewhat, for positive cybersecurity functions, another 61% express that they either have plans to use it in the next 12 months, or are interested in doing so.

Not only does AI impact attacks, but across the business, leaders are looking into ways to leverage AI, which may pose increased risk for the organization. CISOs are tasked with reporting and communicating with each department to understand their  departmental goals, to provide a clear plan of where they are looking to invest in technological advancements around AI, and most importantly, to determine where security plays in role in reducing risk without slowing down these efforts. This means CISOs must look to AI internally without their own programs, but also communicate externally across the business. 

Privacy

Regulations such as GDPR and CCPA have made significant impacts on how CISOs operate their security programs, bringing to light the need for strong communication with their privacy and legal counterparts. Not only are country and state regulations changing, but in light of the rising prevalence of AI, CISOs can anticipate a wave of new regulations, especially concerning data privacy protection. In order to combat evolving privacy risks and the concerns of vendors, partners, and consumers, CISOs must be proactive in reaching solutions that prioritize data privacy, restore consumer confidence, and guarantee compliance with regulations. These responsibilities include being able to respond clearly and reassuringly to requests and inquiries about data transparency and being able to focus efforts on monitoring regulatory landscapes.

And as CISOs face growing responsibility and regulatory load, many organizations are adding a new role—Chief Privacy Officer—to their C-Suites. Non-compliance with regulatory measures carries substantial legal risks, particularly around personal data notices and uses. A CPO is responsible for working alongside the CISO to verify and maintain compliance with complex policies, privacy laws, and regulations. With a CISO’s already expansive list of duties, special attention to these areas by a CPO is hugely beneficial to avoid noncompliance with these evolving regulatory measures.

The Future of the CISO

The CISO role has seen significant changes in its responsibilities, and all data indicates that this position will continue to gain authority and influence. The future of this position is deeply entwined with technological shifts, trends, regulations, and advances, and because of this, proactivity is key. CISOs must be able to adapt to these changes, communicate their cause, and even embrace these emerging trends where they can. The future of the CISO is extremely dynamic, just as dynamic as the cybersecurity landscape, but so long as these priorities are actualized, CISOs have the best chance to effectively safeguard their organizations and keep their assets secure.

Sources:
Splunk, “The CISO Report”
Esentire, “2023 Official Cybercrime Report”
Tripwire, “The Changing Role of the CISO”
Information Age, “The Changing Role of the CISO”
Forbes, “Remote Work Statistics And Trends In 2024”
Proofpoint, “2023 State of the Phish Report”
CSO Online, “How the CISO Role is Evolving”
KBI Media, “The Future of CISOs: Navigating Trends and Evolving Roles”
Cyber Defense Magazine, “3 New Risks that CISOs will Face in 2024”
Avertium, “Why Enterprises are adding Chief Privacy Officer to C-Level Leadership”