Risk, Resilience, and the Right Leader
Hiring the right CISO isn’t a want, it’s a need. A study shows that nearly 50% of CISOs leave within two years due to role mismatch, unrealistic expectations or burnout, making careful hiring critical for organisational resilience.
The right leader changes the game. A CISO doesn’t just protect, they translate technical risk into business decisions, enable calculated growth, and ensure the company can recover when incidents happen.
What a Modern CISO Does
A great CISO is a business enabler. They don’t block innovation they make it safer. They help companies:
- Take calculated risks.
- Prioritise resources based on real business impact.
- Recover quickly when things inevitably go wrong.
“A CISO’s job isn’t to be the department of ‘no.’ It’s to help your company take risks and survive them.”
They’re advisors, not owners of every control. The board and CEO still make the decisions, the CISO ensures those decisions are informed, deliberate, and resilient.
When to Hire a CISO (and When Not To)
Timing matters. The type of company you run dictates what kind of leader you need:
- AI companies / high-risk startups:
Every AI company I see is hiring a CISO or more accurately, a digital risk executive from day one. They don’t need a traditional CISO. They need someone who understands AI risks, can talk to customers and investors, and helps build security coherently while enabling the business.
- Tech vendors:
A CISO here is part security expert, part marketer, part sales enabler. They’re generating pipeline, speaking at events, and building credibility with customers. They also need to scale programs efficiently, fast, cheap, but effective.
- Traditional Enterprises
Bring in a CISO when your security team has outgrown being managed under IT or CTO leadership. They need someone who can unify the team, set governance, and drive strategy forward.
Quick tip: if you hire a CISO before you know what you want them to achieve, you’re setting yourself up for short tenure and frustration. Wait until the pain points are clear, then hire deliberately.
The Skills That Matter
Here’s where most companies get it wrong: they focus on the resume, certificates, or technical depth alone. A modern CISO needs:
- Executive presence and networking:
Can they influence a board? Build trust with peers? Represent the company externally?
- Resilience and crisis leadership:
Can they lead a team through a breach or incident? Do they recover quickly and decisively?
- Vision and foresight:
Can they see risks before they happen, embrace change, and guide the company to adopt new technologies safely?
If a CISO promises they can stop breaches, they’re lying. The reality is about resilience, not protection.
Common Hiring Mistakes
- Hiring the brand, not the skills: Just because someone came from a big-name company doesn’t mean they can thrive in your environment. Tech experience matters more than a logo.
- Promoting the wrong internal person: Brilliant engineers often fail as CISOs because leadership, vision, and executive influence are different skills than technical execution.
- Treating the role as a checkbox: Compliance alone does not make a CISO valuable. If they’re only ticking boxes, the business loses both risk management and growth potential.
Other pitfalls include underestimating the importance of a hands-on, technically fluent CISO who can also leverage modern tools and AI to get work done.
Measuring Success
The worst CISO quote ever? A board asking for ROI based on hypothetical breaches. That’s BS. You can’t measure security by saying, “If we get breached, it’ll cost us X.” It’s a scenario that may never happen and capital shouldn’t be spent on hypotheticals.
Learnt from Maui Jim. Every spend, every hire, no matter the department, should answer one question: How does this help us sell more sunglasses or, more generally, drive the business forward?
A strong CISO:
- Shows how every action and resource directly affects business objectives.
- Uses risk registers wisely, each entry should be specific, tailored, and tied to real business impact, not a laundry list of generic risks.
- Focuses on enabling growth and resilience, not just avoiding breaches.
If all a CISO can say is “we avoided a breach,” they’re failing the business. Measure them on how they help the company move forward, even when things inevitably go wrong.
Founders vs. Enterprises CISOs
For founders: Look for charisma, commercial awareness, and someone who can build programs quickly, cheaply, and scale them effectively. Technical fluency matters your first CISO has to do actual work.
For large enterprises: Consider risk appetite. Do you want someone who fits the existing mold, or someone who challenges the status quo and pushes innovation? Look for executive leadership, resilience, and technical insight and a track record of building and scaling teams.
The Bottom Line
Hiring a CISO is a strategic business decision, not an IT hire. Get it wrong, and you’ll churn through execs, stall growth, and waste capital. Get it right, and you’ll have a leader who:
- Protects and enables the business.
- Drives resilience, not fear.
- Translates risk into opportunity.
- Helps the company move fast, safely, and strategically.
If you’re thinking about a CISO, ask yourself: do you want someone who ticks boxes or someone who changes the way your company thinks about risk? Because only the latter will make a lasting impact.