Does your business actually need a full-time CISO?

It's a question I suspect more organisations should be asking, preferably before advertising the vacancy.

Cybersecurity is important. Nobody needs much convincing of that these days, particularly if they've suffered an incident, received an uncomfortable audit report or had a prospective customer ask awkward questions about their security arrangements.

The next step is often to recruit a Chief Information Security Officer.

Fair enough. But what exactly is this person expected to do?

I've worked in organisations ranging from relatively small technology businesses to large, complex financial services environments. One thing I've learned is that security requirements don't necessarily scale with headcount, turnover or the size of the IT department.

A technology business employing 150 people might handle sensitive personal information, provide critical services to regulated customers and face some fairly demanding contractual obligations.

Another employing several thousand people might have relatively straightforward systems, established controls and a mature security operating model.

So, which needs a full-time CISO?

Possibly both. Possibly neither. It depends on rather more than the organisation's size.

What problem are we actually trying to solve?

I think some businesses approach the appointment backwards.

An audit identifies weaknesses, the board becomes concerned about cyber risk, or enterprise customers start asking difficult questions. Somebody concludes that the business needs a CISO.

Before reaching for the recruitment budget, I'd want to know what's actually missing. Where's the gap?

Is there a problem with strategy, governance or accountability? Are material risks poorly understood? Does the business need someone to challenge technology decisions or provide confidence to customers and regulators?

Or is it an operational problem? Perhaps vulnerabilities aren't being remediated, cloud configurations need reviewing, or nobody has sufficient time to tackle technical debt.

These aren't necessarily the same problem.

If you need a penetration test, employ a competent penetration tester. If you're struggling with cloud security, find somebody who understands the technology and can do something about it.

Recruiting an expensive executive to compensate for a shortage of engineers seems a rather unusual way of going about things.

The reverse is equally problematic. Promoting an excellent technical specialist into the CISO role doesn't automatically equip them with the governance, commercial and management experience needed to advise senior decision-makers.

And while we're on the subject, what happens when you ask your CISO to be the strategist, security architect, compliance manager, incident responder, supplier assessor and the person who answers every customer questionnaire?

You may get rather less than the sum of the parts.

The perfect equilibrium — does it actually exist?

Of course, one person can wear several hats, particularly in a smaller business where the technology is stable, processes work and the workload is manageable.

Perhaps everything is running beautifully. Controls are effective, policies are appropriate, customers are happy and there's no pressing need to change anything.

Perfect equilibrium. Your CISO can double or triple hat. Lovely.

But is the business planning to stay that way?

What happens when it develops another product, enters a new market, acquires a competitor or takes on customers with more demanding security and regulatory requirements?

Responsibilities multiply. The business becomes more complex, but the number of hours in the CISO's working week remains stubbornly the same.

How long does that perfect equilibrium last? Five minutes?

That's before a senior manager leaves, there's a significant incident or a new regulatory obligation lands on the desk.

This isn't an argument against combining responsibilities. It's an argument against assuming that an arrangement which works today will continue working as the business develops.

There's some evidence of this pressure in the 2025 IANS Research and Artico Search survey of small and mid-market CISOs. Based on responses from 363 CISOs in that segment, it describes growing responsibilities, lean teams and leaders increasingly stretched across IT, risk and compliance.

It doesn't mean every growing business needs a full-time CISO. It does suggest that the responsibilities and resources need reviewing as the organisation changes.

There's another aspect to this.

Many senior technology and security leaders began their careers in engineering, support or software development. Over time, they've acquired broader responsibilities, managed teams and budgets, and learned how to communicate with senior executives.

Twenty years later, should we expect them to be as proficient with every current tool as the people using those tools every day?

I'd suggest not.

They should retain sufficient technical understanding to question assumptions, recognise weaknesses and challenge the specialists. But expecting the CISO to develop the strategy and personally implement every technical control rather misses the point.

The fundamentals may be familiar. The minutiae change, sometimes rather quickly.

Fractional CISO — what are we actually buying?

Fractional and virtual CISO services have become increasingly popular, although the terms cover quite different arrangements.

Some provide a few days of advice each month. Others involve an experienced security leader working regularly within the business, participating in management decisions and taking responsibility for agreed leadership activities.

I've worked in an embedded senior information security and privacy leadership role on this basis, with a regular weekly commitment and the flexibility to increase my involvement when necessary.

What made it work particularly well?

I established the ground rules, implemented processes that became embedded in day-to-day operations and ensured that policies and standards were appropriate and stable.

The business understood its responsibilities. Decisions could be made without everything passing through the CISO, and the security function became part of the way the organisation operated.

That last point is important. If every routine decision needs the CISO's personal intervention, something probably isn't working as intended.

Fractional leadership isn't simply consultancy sold in smaller packets.

Interestingly, Tomoko Yokoi and Amy Bonsall make a similar distinction in their Harvard Business Review discussion on fractional executives. Their argument extends well beyond security: define the work that needs doing before deciding what sort of executive appointment is required. They also examine the difficulties of integrating a part-time leader into the business and avoiding an overly transactional relationship.

That accords with my experience. Continuity, relationships and an understanding of the business are essential. An occasional meeting and a monthly report won't necessarily provide them.

Consider a growing B2B SaaS business with a competent CTO, experienced engineers and reasonably sound technical controls. It may already have ISO 27001 certification or a SOC 2 report, although neither tells you everything about its security posture.

The company is expanding. Enterprise customers want more assurance, supplier risks need managing, privacy obligations are becoming more complicated and the board wants a better understanding of its exposure.

The CTO has quite enough to do developing the product and running the technology operation.

An experienced security leader could make a substantial difference by establishing priorities, governance, risk management and the means to resolve issues that cut across business functions.

Does that require somebody working five days a week?

Maybe not.

But there's a trap.

A few days of advice each month won't magically replace an absent security function. If the business has serious operational weaknesses, insufficient engineering capacity and a growing backlog of remediation, somebody still has to do the work.

Policies, strategies and risk registers won't fix vulnerable systems by themselves.

I've seen enough security programmes to be wary of mistaking the production of documentation for progress.

The bit that matters more than the employment contract

Looking back at my own engagements, the most successful have had something important in common.

Senior leadership understood why it needed security leadership, what it wanted to achieve and, crucially, was prepared to provide the authority and resources to get there.

That last point deserves more attention than it usually receives.

I've also encountered organisations where the risks were reasonably well understood but governance arrangements made addressing them unnecessarily difficult.

Responsibilities were disputed, decisions moved between committees and remediation competed with other priorities. Everybody recognised the problem, but finding somebody prepared and authorised to resolve it was another matter.

Appointing a CISO doesn't make those difficulties disappear.

You can recruit an excellent candidate, give them a respectable title, put them on the organisation chart and ask for a strategy. But if nobody wants to own the risks, pay for remediation or make the difficult decisions, don't expect miracles.

The CISO hasn't suddenly acquired powers that the organisation itself doesn't possess.

This isn't just an observation from my own engagements.

In a 2025 paper, “Perfect is the Enemy of Good”: The CISO's Role in Enterprise Security as a Business Enabler, Kimberly Ruth and colleagues interviewed 16 current and former CISOs about the way they develop and execute security strategies.

The researchers found that security decisions were shaped by business objectives, competing priorities, staffing, budgets and other organisational constraints. Security weaknesses often persisted not because they were technically impossible to address, but because the wider business context limited what could reasonably be done.

It's a relatively small qualitative study, so I wouldn't claim it represents every organisation. Nevertheless, some of the findings are remarkably familiar.

Knowing what needs fixing isn't always the difficult part. Getting the agreement, resources and authority to do something about it can be another matter.

A capable CISO will also identify shortcomings in governance, risk management and compliance that may have become accepted practice.

Sometimes it takes a fresh pair of eyes to recognise what's going wrong. You'd hope the rest of the executive team would welcome that challenge.

In practice, not everybody is enthusiastic about having the apple cart upset.

There's a distinction between providing security leadership and being held responsible for every security problem within the business.

The CISO should identify material risks, challenge assumptions, recommend proportionate responses and help management understand the consequences of its decisions.

But the business still owns its risks. Executives responsible for operations, technology, products and commercial activities cannot simply hand that accountability to the person with 'Security' in their job title.

Phil Venables makes an interesting related argument in his article on CISO reporting lines. He distinguishes the engineering work needed to build security into products and operations from independent enterprise risk management. Which responsibilities belong where should reflect the organisation's needs, rather than simply following a preferred reporting structure.

That seems a more useful starting point than arguing endlessly about whether the CISO should report to the CEO, CIO or somebody else.

Which leads to a question I'd put to a CEO or board before making an appointment:

Do you want somebody to lead security, or somebody to take responsibility for decisions that management is reluctant to make?

The answer may explain why the previous security leader struggled, assuming there was one.

And who's answering the telephone at 2am?

Availability deserves a little scrutiny too.

Imagine a significant security incident in the early hours of a Saturday morning.

Customer-facing systems may be compromised. Someone needs to authorise containment measures, and there may be contractual or regulatory notification obligations.

Who's investigating? Who can isolate affected systems? Who decides whether to interrupt a critical business service? Who communicates with customers and regulators?

A fractional CISO working several days a week doesn't automatically provide a round-the-clock incident response capability.

But neither does the mere presence of a permanent CISO guarantee one.

The response might depend on internal engineers, an outsourced SOC, an incident response retainer or some combination of these.

Whatever the arrangement, responsibilities, escalation routes and decision-making authority need to be established beforehand.

The attackers are unlikely to consult your employment contracts or check which days the CISO is working.

And contracting out security activities doesn't absolve management of its own governance and accountability responsibilities.

Permanent, fractional or interim?

There are circumstances where a permanent, full-time CISO is the obvious choice.

A complex or heavily regulated business, substantial security operations or a major transformation programme may require continuous executive leadership.

There are also situations where the need is intensive but temporary. An organisation might have lost its CISO, be navigating an acquisition or need to stabilise a struggling security function.

A full-time interim appointment may be the better answer.

And sometimes fractional leadership is the right starting point. As the business develops, it may need someone full-time.

I'd regard that as a perfectly sensible outcome, not a failure of the fractional model. A good fractional CISO should recognise when the business has outgrown the arrangement, even if that means recommending their own replacement.

There's an interesting counterpoint in Phil Venables' CISO Version 2.0. He describes the evolution of security leaders towards broader technology and digital-risk responsibilities.

That may sound at odds with my earlier concerns about people wearing too many hats, but I don't think it necessarily is.

A capable executive can take on wider responsibilities if the organisational structure, technical teams, delegation and resources support them. The problem arises when additional accountability is simply piled onto the same individual without reconsidering what they need to deliver.

The economics need some thought as well.

A permanent senior executive represents a substantial commitment. But a cheaper arrangement isn't necessarily better value if recommendations aren't implemented, nobody has time to work with the adviser or management keeps changing consultants and starting again.

I'd be more interested in what the engagement actually achieves.

Does management understand its material risks and who owns them? Are important weaknesses being addressed? Can the business explain its security position to customers and regulators? Is the board receiving information that helps it make decisions rather than another colourful dashboard?

And are technical teams being helped to deliver improvements, or merely being given more forms to complete?

Those are rather better indicators than the number of policies written or meetings attended.

So, do you need a full-time CISO?

I don't think there's a universal answer, nor should there be.

A permanent appointment may be exactly what's required. An embedded fractional CISO might provide the right balance of experience, continuity and cost. An interim leader could be more appropriate during a difficult transition.

And if the problem is a shortage of technical expertise or delivery capacity, the right answer might not involve recruiting a CISO at all.

Before advertising the role, I'd want management to explain what's not working today, what decisions aren't being made and what it expects to change when somebody takes up the appointment.

If the answers are clear, you've made a useful start.

If they aren't, there's probably a little more work to do before interviewing candidates.

Further reading

Some interesting research and practitioner perspectives explore the organisational factors that make security leadership effective. Not all reach identical conclusions, which is part of what makes them worth reading.

Ruth et al. (2025) — “Perfect is the Enemy of Good”: The CISO's Role in Enterprise Security as a Business Enabler. Research based on interviews with 16 CISOs, exploring how business objectives, competing priorities and organisational constraints shape security decisions. The paper was published at ACM CHI 2025. https://kcruth.com/papers/2025-CISO.pdf

IANS Research & Artico Search (2025) — Compensation and Budget for CISOs in the Small and Middle Market. A survey-based examination of expanding responsibilities, staffing constraints, governance and the demands placed on CISOs as organisations develop. https://www.ians.com/press/ians-and-artico-search-release-compensation-and-budget-report-for-cisos-in-the-small-and-middle-market

Harvard Business Review (2025) — How to Make Fractional Leadership Work. Tomoko Yokoi and Amy Bonsall explore fractional executive appointments, the importance of defining the work, organisational integration and the limitations of part-time availability. A podcast discussion with transcript. https://hbr.org/podcast/2025/08/how-to-make-fractional-leadership-work

Phil Venables (2019) — The Reporting Line of Security Teams / CISOs. An examination of security engineering, independent risk management and why reporting structures should reflect the responsibilities an organisation needs fulfilled. https://www.philvenables.com/post/the-reporting-line-of-security-teams---cisos

Phil Venables — CISO Version 2.0. A broader, and in places contrasting, perspective on how security leadership is evolving, including the potential combination of CISO, technology and digital-risk responsibilities. https://www.philvenables.com/post/ciso-version-2-0