“Security teams, overwhelmed by daily threats, struggle to fully leverage their software,” Holland says. “These challenges are driving the demand for security services.”

CISOs at a crossroads

In the end, CISOs find themselves at a difficult crossroads.

“Building all of your own capabilities and expertise internally won’t scale for most businesses,” Marshall Erwin, CISO at Fastly, tells CSO. “At the same time, if a CISO relies too much on third parties, they will find they don’t have the security expertise needed to address the most critical incidents or challenges.”

Erwin advises CISOs to consider what expertise they need internally based on their specific risk profiles and appetites, and what capabilities and services they can rely on externally without putting their organizations at greater risk.

All in all, the changes underscore a role evolution for CISOs in which they must align security with business objectives while still keeping a pulse on day-to-day operations.

But they won’t be going it alone. Finding the right partners may be more important than ever.