What makes this situation especially challenging is that, at the end of the day, CISOs are still held accountable for failures. When a breach occurs or a vulnerability is exposed, it’s the CISO who bears the brunt of the blame. They’re expected to manage and prevent these incidents, but without the authority to enforce necessary measures, they are set up to fail.

It’s a situation that few other leaders in the C-suite experience: a CEO, for example, typically has control over decisions related to the company’s strategic direction and resources, but CISOs are expected to prevent breaches without the same level of control. They have accountability without command, a model that doesn’t set anyone up for success.

This lack of command doesn’t just affect the organization’s security; it also affects the CISO’s relationships, internally and externally. CISOs often need to engage with board members, peers, and stakeholders to explain security initiatives, address potential threats, and discuss risk mitigation strategies.