The cost to hire and retain a CISO is a major stumbling block for some organizations. Even promoting someone from within to a newly created CISO post can be expensive: total compensation for a full-time CISO in the US now averages $565,000 per year, not including other costs that often come with filling the position.

“If it’s a larger business then they’ll need to hire a team behind the (CISO). They’ll need architects, they’ll need a SOC, they’ll need engineers. So, then the cost of resources kind of expands,” says Sistla Vaishnavi, a UK-based principal at Riviera Partners, an executive search firm headquartered in San Francisco.

The Navisite survey suggests companies face another barrier to hiring a CISO: the never-ending talent gap. “(The) cybersecurity skills shortage … extends to the highest levels. Companies value and want cybersecurity leadership, but it is increasingly difficult to find and retain these individuals,” the Navisite study declared. In a nutshell, the global dearth of cyber talent discourages many firms from embarking on a lengthy, expensive CISO search that could ultimately prove fruitless.