The scope keeps growing
52% of CISOs say their scope is no longer fully manageable, especially in smaller organizations with lean teams.
662 CISOs. IANS & Artico Search, Jan 15, 2026.
2026Guide for CEOs, CHROs and boards
Hire the CISO your business needs next
Independent research and advice on hiring a chief information security officer: when you need one, what to pay, how to assess candidates and which search partner fits.
How a CISO search runsSeven steps, from mandate to day 90
- Agree the mandate with the CEO and board
- Choose full-time, interim or fractional
- Benchmark pay against current data
- Map leaders across competitors and regions
- Run structured, technical interviews
- Confirm D&O cover and board access
- Plan the first 90 days
CISOs reporting to the CEO42%
Heidrick & Struggles, US & Europe, published Feb 26, 2026About 3× the prior year
Security leadership is a board decision.Under SEC and NIS2 rules, management answers for cyber risk.
Research drawn from
A CISO answers to more people than almost any other executive
The right hire has to earn the trust of the board, translate risk for the CFO, work with legal on disclosure, and lead a security team that is already stretched. Hiring for technical depth alone is no longer enough.
CISOs reporting directly to the CEO, about three times the previous year's share
42%371 CISOs, US & Europe, survey summer 2025. Heidrick & Struggles, Feb 26, 2026.
CISOs who say excessive expectations are placed on them, up from 49% in 2022
77%1,600 CISOs, global. Proofpoint Voice of the CISO 2026, Oct 7, 2026.
The CISO role has changed faster than most job descriptions. Our trends page tracks what the data says about reporting lines, pay, AI and regulation.
See CISO trendsWhy hiring a CISO is harder in 2026
The job has grown in scope, accountability and pay. Each of these shifts changes who you should hire and how you should assess them.
Accountability is personal
SEC rules require public companies to describe management's cyber expertise. NIS2 lets EU management bodies be held liable for security failures.
SEC, Jul 26, 2023; NIS2 Article 20.
AI lands on the CISO's desk
79% of CISOs say they are expected to manage AI-related risk without a matching increase in resources or expertise.
Proofpoint Voice of the CISO 2026, Oct 7, 2026.
Pay and mobility are rising
CISO pay rose 6.7% on average in 2025, and 15% of CISOs changed employers, up from 11% in 2024.
US & Canada. IANS & Artico Search, Nov 13, 2025.
The CISO hiring guide, step by step
Written for CEOs, CHROs, board members and founders. Each chapter answers one decision you will face in a CISO search.
01
Decide the model
Full-time, interim, fractional or deputy CISO, and when each one fits.
Read 02Define the mandate
Scope, reporting line, budget authority and board access.
Read 03Benchmark pay
What current surveys say about CISO compensation and equity.
Read 04Choose a search route
Retained search, specialist boutiques, interim providers or internal succession.
Read 05Assess candidates
Questions for the CEO, CHRO, CFO and board, plus red flags.
Read 06Offer and onboard
Protections to agree in the offer, and a plan for the first 90 days.
ReadCISO trends
What the latest research says about the role.
- Reporting
More CISOs now report to the CEO than to the CIO
- AI
AI risk is now part of the CISO's job, often without extra budget
- Regulation
Disclosure rules and NIS2 put security leadership in front of the board
CISO news
Recent research, rulings and regulation, with what each means for hiring.
Proofpoint: 85% of CISOs say their board sees eye to eye with them
ISACA: 58% of cybersecurity teams are understaffed
EU refers four member states to court over NIS2 delays
CISO hiring questions, answered
Short answers with sources. The hiring guide covers each one in depth.
What does a CISO do?
A chief information security officer (CISO) leads an organization's information and cybersecurity program. The role sets security strategy, manages cyber risk, oversees security operations and incident response, keeps the company compliant with security regulations, and reports cyber risk to executives and the board.
Who should a CISO report to?
There is no single standard. In the IANS Research and Artico Search study published January 15, 2026, 64% of CISOs reported into IT leadership and 36% to business leaders such as the CEO, COO, general counsel or chief risk officer (source).
In Heidrick & Struggles' 2025 survey of 371 CISOs in the US and Europe, published February 26, 2026, 42% reported directly to the CEO (source). The two studies use different samples, so the figures are not directly comparable. Reporting outside IT gives the role more independence.
How much does a CISO earn?
Pay varies widely by industry, company size and region. In the IANS Research and Artico Search report published November 13, 2025, based on 566 CISOs in the US and Canada, average total compensation was $844,000 in tech and $744,000 in financial services. Average compensation rose 6.7% in 2025, 70% of CISOs received equity, and the top 1% earned more than $3.2 million (source).
Should we hire a full-time CISO or a fractional CISO?
A full-time CISO suits organizations with significant regulatory exposure, a large attack surface or a public listing. A fractional or virtual CISO can suit smaller organizations that need strategy, policy and board reporting a few days a month. An interim CISO covers a gap while a permanent search runs. See the comparison in our hiring guide.
Which regulations make CISO hiring a board-level decision?
In the US, SEC rules adopted July 26, 2023 require public companies to disclose material cybersecurity incidents, generally within four business days of determining materiality, and to describe management's cybersecurity expertise and board oversight in annual reports (SEC).
In the EU, Article 20 of the NIS2 Directive requires management bodies to approve and oversee cybersecurity risk measures and allows them to be held liable (NIS2). DORA has applied to financial entities since January 17, 2025 (ESMA).
Not sure which search partner or model fits?
Our consultants help you choose between executive search firms, specialist recruiters and interim or fractional options, based on your size, sector and risk.