Rethinking the CISO role: A structural fix

The cybersecurity industry has spent years telling chief information security officers (CISOs) to get closer to the business—understand strategy, speak the language of the board, build relationships with executives, translate cyber risk into business risk. But one analyst now argues that this advice misses the point entirely. The problem isn't communication; it's the design of the role itself.

According to a recent CSO article, the CISO is being asked to solve a problem that the role was never designed to solve. Business alignment, the piece contends, is not primarily a communication problem but a leadership and organizational design problem. If organizations are serious about fixing it, they should stop trying to turn every CISO into a "chief everything officer."

The CISO has become too many things

The article paints a picture of the modern CISO as an overburdened hybrid: technologist, strategist, risk executive, regulator-facing leader, board adviser, crisis manager, transformation executive, and business partner—sometimes all at once. That is an extraordinary range of responsibilities for one role.

The issue is not that all CISOs are incapable of developing broader skills. Many have done exactly that, and the best ones have become highly credible business leaders. But many have also struggled, and many are still struggling. The problem, the article argues, is structural.

The CISO role remains fundamentally anchored in the technology and information-security domain, while increasingly being asked to influence decisions across the entire enterprise. The organization wants the CISO to be accountable for cybersecurity but also expects the CISO to influence business decisions over which they have no direct authority. That creates an inherent tension.

The CSO is a different proposition

The proposed solution is a more elevated chief security officer (CSO) role—not simply a new title for the CISO, not another layer of management, and certainly not an attempt to diminish the CISO's importance. Quite the opposite, the analysis states.

The CSO should sit above the traditional cybersecurity construct and take responsibility for the organization's broader protection. Cybersecurity would be a major component of that business protection portfolio, but it would sit alongside areas such as data protection, business continuity, resilience, and, where appropriate, regulatory protection.

The crucial distinction is that the CSO must be a business leader first. The role is about protecting the organization's ability to operate, compete, and fulfil its obligations toward shareholders, customers, employees, and—in the case of national critical operators—society at large. That requires a very different profile from the traditional security technologist.

Give the CSO the mandate to connect

Consider a typical cybersecurity problem, as the article lays out: Security identifies a significant exposure. Technology must remediate it. Operations do not want disruption. The business wants to protect revenue. Legal is concerned about regulatory consequences. Risk wants the exposure documented. Finance wants to understand the cost. Everyone is involved, but nobody necessarily has the mandate to reconcile all these perspectives.

The CISO can explain the security problem. The CIO can explain the technology implications. The business executive can explain the operational consequences. But who owns the overall protection decision? This is precisely where the CSO can add value.

The CSO should have the mandate to bring those perspectives together and drive a decision that reflects the interests of the whole organization. That is fundamentally different from asking the CISO to persuade everyone to adopt the security team's position.

Not another security silo

The obvious objection is that introducing a CSO above the CISO simply creates another organizational layer, and if designed badly, it could. That is why the distinction between the two roles matters. The CSO should not become the new head of cybersecurity.

The CISO should retain responsibility for the technical cybersecurity capability: architecture, engineering, security operations, identity, vulnerability management, and the other disciplines required to protect the technology estate. The CSO's role is different: to provide the enterprise-level leadership required to make all those capabilities work together in the context of business priorities.

In the model advocated in the article, the CISO can report to the CSO, with an appropriate relationship to the CIO where necessary. That creates a powerful combination: the CSO provides the top-down, cross-functional influence; the CISO provides the technical depth and delivery capability. Neither role has to pretend to be the other.

The 'how' and the 'who'

For more than two decades, the cybersecurity industry has become increasingly sophisticated at explaining what organizations should do. There are frameworks, standards, controls, architectures, technologies, and regulatory requirements. No shortage of advice about what needs to be done in terms of cyber protection.

Yet organizations continue to struggle with the how and the who. Who is going to make the decision? Who owns the risk? Who has to change? Who will resolve the conflict between security and business operational priorities when they emerge? Who ensures that transformation survives the next change in business strategy? Who keeps the organization moving when resistance inevitably appears?

These are leadership questions—and they are precisely the questions a properly constituted CSO role should be equipped to answer.

The board has a role, too

There is an important consequence to this model for boards. Boards should stop treating cybersecurity as an issue that can simply be delegated to a CISO hidden in the organization. The board's responsibility is to hold the leadership team accountable for protecting the business.

That means demanding clarity around roles, responsibilities, and outcomes. It means asking who ultimately owns business protection. And it means ensuring that the executive structure gives that individual sufficient authority to act. The CSO should become the executive through whom the organization's protection strategy is coordinated and executed.

Freeing the CISO to succeed

There is an additional benefit rarely discussed: creating a genuine CSO role could make the CISO more effective. Today, many CISOs spend enormous amounts of time trying to operate outside their natural area of expertise—navigating board politics, negotiating business priorities, managing regulatory expectations, arguing over organizational ownership, and trying to build executive consensus.

All these activities matter, but they can come at the expense of the technical and operational discipline that cybersecurity still fundamentally requires. A CSO could absorb much of the enterprise-level responsibility while allowing the CISO to regain clarity of purpose. That does not mean returning the CISO to a narrow technical silo; it means giving the role a coherent remit.

The CISO becomes accountable for making cybersecurity work. The CSO becomes accountable for ensuring that cybersecurity—and the wider protection agenda—works for the business. That is a much healthier division of responsibility.

A shift in focus

The cybersecurity industry has become overly focused on the evolution of the CISO role, debating reporting lines, budgets, board access, compensation, independence, and technical versus strategic skills. All these debates have value, but perhaps the wrong question is being asked.

Maybe the question is not, "How do we turn the CISO into a better business executive?" but rather, "What executive structure does the business actually need to protect itself?" That leads naturally toward the CSO. You can call it Chief Trust Officer or Chief Resilience Officer if you want, but it quickly boils down to the same thing: a trusted senior executive, visibly part of the leadership team, with responsibility for bringing together cybersecurity and the other dimensions of business protection.

The article concludes that alignment is not a skill; it is a structure. You do not engineer cybersecurity and business alignment by asking the CISO to communicate better. You engineer it by creating the right leadership structure: establish clear ownership, give that ownership sufficient authority, separate enterprise protection from technical delivery without separating the two organizationally, make the CISO responsible for the technical execution of cybersecurity, and give the CSO the mandate to connect that execution to the needs of the business.

Why this matters

For CISOs, boards, and the executives who hire them, this argument reframes a long-running debate. If cybersecurity does not exist to protect technology but to protect the business, as the article asserts, then organizational structures may need to reflect that. The current model, which piles enterprise-level expectations onto a role anchored in technical delivery, may be setting CISOs up to fail—and leaving businesses without clear ownership of protection decisions.

The proposal to elevate a CSO above the CISO is not without practical hurdles—cost, reporting lines, and the risk of creating new silos. But the underlying critique carries weight: no amount of communication training will fix a structural mismatch between responsibility and authority. For businesses wrestling with how to make security a core part of decision-making, this suggests the answer may lie less in developing the individual and more in redesigning the leadership architecture around them.