iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A modern chief information security officer (CISO) is expected to do more than defend systems. The role increasingly involves translating cyber risk into business decisions, influencing technology and AI choices, securing resources, and helping organizations build resilience. Recent surveys show that executive access is common in some samples—but meaningful board engagement, adequate budgets, and support are far less consistent.
That tension is central to understanding what keeps a CISO focused: the job’s strategic reach is growing faster than many organizations’ willingness or ability to support it.
How close are CISOs to the CEO and board?
Survey results suggest that many security leaders have access to senior executives, but the measures differ: some ask whether a CISO interacts with the CEO, others whether the CISO reports directly to the CEO, and others measure how often cybersecurity reaches the board agenda. Those are related forms of access, not interchangeable ones.
| Survey and sample | Finding | What it measures |
|---|---|---|
| Splunk and Oxford Economics, 2025 report; 600 respondents—500 CISOs, chief security officers, or equivalent leaders and 100 board members—surveyed in June–July 2024 across 10 countries and 16 industries | 82% of surveyed CISOs said they interacted directly with the CEO; 83% said they participated in board meetings somewhat often or most of the time. | CEO interaction and frequency of board-meeting participation. The 82% figure was clarified in a February 21, 2025 update. |
| World Economic Forum, 2025; poll conducted at the 2024 Annual Meeting on Cybersecurity | 60% of CISOs polled discussed organizational cybersecurity posture with the board three or four times per year; nearly 24% had a direct CEO reporting line. | Board-discussion cadence and formal reporting line. |
| Deloitte Global, 2024 survey | 20% of respondents said their CISO reported directly to the CEO. | Formal reporting line. The survey sample details are not specified here. |
The figures are not contradictory estimates of a single global rate. A CISO can meet with a CEO without reporting to that person, and attending board meetings does not establish how often cybersecurity is discussed or whether the CISO can shape decisions. The surveys also differ in participants, geography, dates, and definitions.
#1 Best Overall
What separates a strategic CISO from a tactical one?
IANS Research and Artico Search classified more than 830 security executives surveyed from April through November 2024 into three profiles. Their distinction is useful because it describes how the security function engages with the organization, not simply how technically capable its leader is.
| Profile | Share of respondents | How to interpret the profile |
|---|---|---|
| Strategic | 28% | Security is closely connected to organizational strategy and executive decision-making. |
| Functional | 50% | Security is managed as an established organizational function, but its strategic influence may be less extensive. |
| Tactical | 22% | The role is more centered on operational security work than broader strategic partnership. |
Board engagement adds a practical measure of that connection: 47% of IANS/Artico respondents met with their boards monthly or quarterly, while 42% met ad hoc or less. The profile labels and meeting cadence are survey categories, not a universal certification or a measure of an individual CISO’s competence. The results do show why a title alone does not tell an organization how influential its security leader is.
Do CISOs have enough budget and organizational support?
In the Splunk/Oxford Economics survey, only 29% of CISOs said they received the proper budget to accomplish security goals. By contrast, 41% of board-member respondents believed security budgets were adequate. That gap points to different views of what security objectives require; it does not by itself establish which budget is objectively sufficient.
Rank #2
In the same survey, 64% of CISOs said a lack of support had led to a cyberattack. The finding reflects respondents’ reported experience and attribution, rather than an independently verified causal estimate. Still, it captures why budget discussions matter to security leaders: funding, staffing, and executive backing affect whether agreed safeguards can be implemented.
There is also a forward-looking contrast. Deloitte Global’s 2024 survey found that 57% of respondents anticipated higher cybersecurity budgets over the next 12–24 months. An expectation of future growth is not proof that the money was allocated or that it matched the work required.
What does a modern CISO actually do?
The role’s center of gravity is shifting from technical protection alone toward translating cyber risk into choices the rest of the organization can make. The World Economic Forum’s 2025 analysis describes effective CISOs as framing cyberthreats as business risks rather than purely technical challenges. Deloitte Global Cyber Leader Emily Mossburg likewise characterized CISOs as participants in strategic decision-making, not only protectors against outside threats.
In practice, that means connecting security recommendations to consequences leaders recognize: business continuity, exposure of sensitive data, regulatory obligations, customer and partner trust, and the ability to keep operating after an incident. The CISO must communicate what a risk could mean, which options are available, and what trade-offs each option creates—without implying that security can eliminate all risk.
Free tools Windows power users keep installed
One-click scans. No signup required.
The surveys also point to a broader organizational remit. In Osterman Research’s 2025 survey of 268 CISOs and CIOs at U.S. organizations with more than 1,000 employees, leading priorities included cloud infrastructure, internal cybersecurity talent, and compliant data processing. These priorities span technology architecture, workforce capacity, and the handling of data under applicable requirements.
How are CISOs using AI, and why does governance matter?
Deloitte Global reported in 2024 that 39% of respondents used AI capabilities in cybersecurity to a large extent. The figure describes reported extent of use, not the share of organizations using any AI at all, and it does not specify which tools or outcomes were included.
Splunk/Oxford Economics found that CISOs with healthier board relationships were more likely to have permission for AI uses such as threat detection, data analysis, incident response, and proactive threat hunting. This is a reported correlation, not evidence that board engagement alone caused adoption. It does illustrate a practical dependency: security teams need clear authority, oversight, and organizational trust to deploy tools that can affect sensitive data or operational decisions.
For a CISO, AI therefore presents both an operating opportunity and a governance responsibility. Decisions about where to use it have to account for data handling, oversight, reliability, and how people remain accountable for consequential security actions. The available survey findings establish adoption and a relationship with board support; they do not establish that any particular AI deployment is effective or safe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What keeps a CISO up at night?
The surveys point to a combination of changing threats, unfinished security work, and limited capacity—not one universal worry shared by every CISO.
Best Value
- Cloud exposure and data obligations: Osterman’s U.S. survey identified cloud infrastructure and compliant data processing among leading priorities.
- Staffing and skills: The same survey named internal cybersecurity talent as a priority. ISACA’s 2024 report highlights skills gaps and rising stress among cybersecurity professionals; its public summary does not provide a numeric stress percentage.
- Threats that affect investment decisions: Osterman respondents cited cyber-insurance prices, AI attacks, software supply-chain compromise, and return-to-office mandates as factors shaping decisions.
- Expanding expectations: In Splunk/Oxford Economics’ survey, 53% of CISOs said their responsibilities and expectations had become more difficult since they took the job.
Together, these pressures help explain the gap between strategic expectations and day-to-day conditions. A CISO may be accountable for resilience across systems, suppliers, data, and people while competing for resources and trying to close skills gaps.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should organizations assess CISO effectiveness?
Board access and budget are enabling conditions, not complete measures of success. A useful assessment connects the CISO’s work to agreed organizational outcomes and makes ownership of decisions explicit.
- Track milestones: Define which risk-reduction actions are due, who owns them, and whether dependencies—such as staffing or business-unit cooperation—are in place.
- Measure compliance work accurately: Distinguish completing a required control or assessment from reducing the underlying operational risk.
- Evaluate resilience: Look at whether the organization can maintain or restore critical services when disruption occurs, rather than treating prevention as the only goal.
- Connect security decisions to business outcomes: For major risks, record the decision-maker, the options considered, the accepted trade-offs, and the operational consequences the organization is prepared to manage.
- Check whether authority matches accountability: If the CISO is responsible for an outcome, identify whether the role has a workable route to executive decisions, sufficient resources, and cooperation from the teams that must carry out the controls.
These are practical management measures, not metrics claimed by the surveys above. They help turn executive conversations into explicit decisions rather than relying on meeting frequency or a CISO’s job title as proxies for influence.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How to read the survey findings
The evidence is best treated as a set of indicators from distinct samples, not combined into one global portrait. Splunk/Oxford Economics surveyed security leaders and board members across 10 countries and 16 industries; IANS/Artico surveyed more than 830 security executives across industries, company sizes, and organizational types; Osterman surveyed CISOs and CIOs at large U.S. organizations; and the World Economic Forum figures came from a poll at its 2024 Annual Meeting on Cybersecurity. Deloitte’s figures are from its 2024 global survey, while the ISACA public summary confirms stress and skills-gap themes without exposing the underlying numeric tables.
Differences in who answered and what each question measured matter as much as the percentages. Direct reporting, CEO interaction, board attendance, and board-discussion frequency describe different kinds of access. Budget adequacy is also a perception reported by CISOs or board members, not a common accounting standard. Read each result within its stated sample and avoid treating one survey’s definition as the industry-wide norm.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
