Proofpoint's 2025 survey of 1,600 CISOs found that 63% experienced or witnessed burnout in the past year, and 66% reported excessive expectations. Pressure like that feeds turnover.
This article is for boards, audit and risk committees, and executive teams. It covers why CISOs leave, how a leadership change amplifies risk, and how to keep security continuity intact through a structured transition.
Key Takeaways
- Treat a CISO departure as a security continuity event, not an open requisition.
- Document decision rights, control ownership, and escalation thresholds before anyone resigns.
- Name an interim leader fast enough to keep accountability intact during the search.
- Give the board trend data and open decisions, not just hiring updates.
Why CISO Turnover Happens
Role overload and accountability without authority
Modern CISOs run technical operations, enterprise risk, compliance, incident response, budgets, and board reporting at once. Expectations keep rising. Splunk's 2025 research found that 53% of security leaders say the job got harder after they took it.
Resources rarely keep pace. IANS and Artico reported average security budget growth of 4% in 2025, down from 8% in 2024, and only 11% of respondents reported adequate staffing.
Responsibility also outruns authority when the CISO:
- Lacks direct access to the CEO or board
- Can only advise on risk, not accept or reject it
- Has little influence over business decisions that create exposure
- Has to filter escalations through operational management
Risk acceptance belongs to the accountable business leader. That's reasonable. But if nobody will make those calls, the CISO carries accountability for decisions they never controlled.
Governance, liability, and incentive problems
Legal exposure shapes how CISOs view the job, so it helps to keep the boundaries straight:
- Issuers: SEC rules require Form 8-K disclosure four business days after determining an incident is material, plus annual disclosure of board oversight and management's role.
- Individuals: The SolarWinds CISO case was dismissed with prejudice in November 2025. Uber's Joseph Sullivan was convicted of obstruction and misprision of a felony for concealing a breach.
- Directors: Delaware's Caremark doctrine concerns board oversight failures, not CISO liability.
A breach alone doesn't create personal liability. Concealment can. Still, CISOs notice whether the organization will back them when a hard risk has to be escalated. Written indemnification, D&O coverage, and personal counsel review all matter, and IANS guidance covers each.
Weak succession depth and key-person dependency
Many programs depend on one person. Without a deputy, cross-trained leaders, documented contacts, or organized program records, the departure becomes a crisis. M&A, modernization, major incidents, and rapid growth expose the missing bench quickly.
Heidrick's 2024 survey found 53% of organizations report an internal successor as good as or better than external candidates. That measures readiness, not whether a deputy exists.
How Leadership Change Amplifies Security Risk
No credible data shows that a departure raises breach probability by some fixed multiple. The mechanisms are still clear, and they compound.
Decision latency creates control and escalation gaps
Picture the chain. The CISO leaves. Nobody is clearly authorized to approve a risk exception. A remediation priority waits. A vendor security term goes unreviewed. A concern that should reach the CEO sits in someone's inbox. None of that guarantees a breach, but exposure sits open longer.
NIST SP 800-61 Rev. 3 expects documented responsibilities and the authority to act, including decisions like shutting down critical services.
Institutional knowledge leaves with the executive
Some of the most valuable knowledge never makes it into policy:
- Which legacy exception was granted, and why
- Which third party has unusually broad access
- Which system can't be patched without breaking a customer commitment
- What the company promised a regulator after the last audit
- Which business owner will actually pick up the phone at 2 a.m.
The Sullivan case shows the extreme version. He misrepresented key breach details to Uber's incoming CEO. A CEO who learns the truth later, from outside, is the cost of information discontinuity.
Security programs lose momentum
New or interim leaders often re-litigate priorities. Remediation pauses, control owners drift, and modernization projects wait for a decision-maker. Watch for these indicators:
- Aging remediation items
- Missed milestones
- Unresolved audit findings
- Risk acceptances that quietly expire or multiply
Verizon's 2025 DBIR found only about 54% of studied edge-device vulnerabilities were fully remediated during the year, with a median of 32 days. Unclear ownership makes that worse.
Incident response becomes less decisive
Response depends on predefined authority. Review the plan during any transition and confirm a named alternate for every critical decision:
- Who declares an incident
- Who can isolate systems
- Who briefs the board
- Who calls legal, insurers, law enforcement, and regulators
People, vendors, and board confidence can deteriorate
Repeated changes drain teams, unsettle business partners, and make board reporting inconsistent. Visible turnover is only the surface. The deeper risk is unstable priorities, shifting metrics, and declining confidence in the program.
The CISO Transition Playbook: Before, During, and After the Change
Before the departure: build continuity into the operating model
Keep a current inventory of:
- Critical services and major risks
- Open exceptions and control owners
- Key vendors and regulatory commitments
- Incident contacts and active transformation projects
Then write down decision rights: what proceeds on its own, what needs executive approval, and what reaches the board or a committee.
The first 30 days: establish ownership and protect the essentials
- Name an interim accountable leader so ownership is clear from day one
- Validate monitoring and incident-response coverage before gaps surface
- Review privileged access tied to the departing leader
- Identify activities that cannot lapse, including audits, filings, and critical controls
Then hold an executive briefing on current risk posture, what changed, decisions needed now, and dependencies that could create surprises. A workable cadence is a 30-minute weekly executive checkpoint and a risk decision meeting every two weeks.
Days 31–60: re-baseline risk and restore execution
Review the roadmap, remediation backlog, risk acceptances, control performance, third-party exposure, staffing, and audit commitments. Then sort work into three piles:
- Urgent: must continue without pause
- Pause or re-sequence: can wait without material risk
- Reassign: needs a new owner before the transition ends
Every top risk gets an executive owner, a technical owner, and a due date.
Days 61–90: align the incoming leader and the board
Give the permanent CISO a documented package:
- Stakeholder map and decision log
- Risk register and metrics history
- Unresolved tradeoffs still on the table
Define success as clear ownership, stable reporting, agreed priorities, credible escalation, and less uncertainty for the board. Don't promise that all risk disappears.
When internal capacity is not enough
A permanent search can take months. An interim or fractional CISO preserves accountability during a search, M&A integration, post-incident recovery, or major modernization. Interim fits short transition and pressure. Fractional fits ongoing direction without a full-time hire.
Tyson Martin provides interim and fractional CISO leadership and board advisory work for organizations that need faster escalation, plain-English risk reporting, clear decision rights, and an executable 90-day plan.
What Boards and Executive Teams Should Inspect
Is the CISO positioned to influence enterprise risk?
Review the reporting line, executive access, budget authority, and ability to escalate without filtering. Heidrick found 42% of CISOs report to the CEO, while 30% report to a top technology executive. Enterprise-wide accountability needs matching authority, resources, and board visibility.
Does the board receive a stable, decision-useful dashboard?
IANS board research shows 95% of CISOs update boards regularly, but only 25% get 30 minutes or more. Access isn't the same as discussion. A good dashboard shows:
- Risk trends and top exposures
- Remediation progress and control ownership
- Incident readiness and accepted risks
- What changed since the last briefing
Tyson Martin's principle is "trend, not trivia." Reporting should support decisions rather than bury directors in activity counts.
Are decision rights and escalation thresholds explicit?
Require written answers: who accepts risk, approves exceptions, isolates systems, declares an incident, speaks externally, and notifies the board. Then test them with a tabletop or transition exercise, and log unresolved ambiguity as a governance issue.
Is there a credible succession bench?
Check whether a deputy can step in, whether critical processes have alternate owners, and whether board context lives beyond one executive. Review succession in regular talent and risk reviews, not after a resignation forces it.
Are retention and legal protections part of the operating model?
Look at realistic objectives, adequate resources, development paths, indemnification, legal support, and a culture where security is a business responsibility. The payoff is continuity: fewer resets, steadier metrics, faster escalation, and sustained execution.
Frequently Asked Questions
What is meant by turnover?
Turnover is employees leaving and being replaced. Repeated CISO turnover disrupts security governance, institutional knowledge, and risk ownership.
Is CISO a good job?
It offers strategic influence and strong career value. It also brings pressure, accountability, a shifting threat environment, and heavy dependence on organizational support.
Is CISO a C-level position?
CISO means Chief Information Security Officer, generally an executive role. Authority, reporting line, and board access vary; IANS found only 20% held a C-level title in its 2023-2024 data.
Is cyber security a 9-5 job?
Routine work often fits business hours. Incidents and urgent decisions can arrive anytime, and BLS notes some analysts are on call outside normal hours.
Is cybersecurity still worth pursuing in 2026?
Yes. BLS projects 21% growth for information security analysts from 2025 to 2035. Success takes technical, communication, governance, and risk-management skills.
