Reference
Guides
How GitHub's CISO disclosed the internal-repository breach
What Alexis Wales said in GitHub's May 20 and May 26, 2026 posts on the internal-repository breach, and how it compares with her earlier posts.
What CISOs say on podcasts and webinars
Four sourced CISO appearances show what security leaders discuss in public: vendor risk, AI, zero trust, liability and budget.
How CISOs frame securing AI: Adobe, Atlassian and Synechron in their own words
What Adobe, Atlassian and Synechron security leaders say about securing AI and AI-driven vulnerability work, and what their publications commit them to.
When the CISO also holds the CIO or CTO title: dual-hat security leaders
How combined CISO-CIO and CISO-CTO roles appear in four sourced documents, how the pairings arose, and what the sources do not say.
Fractional, interim and contract CISOs: what the sources do and don't say
The supplied documents never define fractional, interim or contract CISOs. They do document one permanent, internal path to a CISO seat, summarized here.
Promoted from within: how internal CISO appointments happen
Three 2025-2026 CISO announcements show how companies fill the seat internally, and what their own documents say about outside hires.
CISOs at security vendors: how the role changes when your company sells security
Four vendor-side CISO and CSO appointments show customer-facing duties, wider scope and mixed career routes. None compares the role with a buy-side seat.
CISOs at Consulting and Professional-Services Firms: Four Announcements
What four CISO appointment announcements at consulting and professional-services firms say about protecting the firm while serving clients.
CISO job changes in practice: short stints, boomerang returns and lateral moves
Four dated announcements show a long tenure, a move within nine months, a return to a former employer and a first-CISO hire. They give no tenure averages.
Buyer to vendor: what changes when a CISO joins a security vendor
Four dated vendor announcements show what security chiefs at GitLab, Entrust, Cyberhaven and SoSafe own, and what former buyers carry into the job.
Public-sector and university CISOs: how the role and path differ from corporate security
What Howard University, Nevada and Oklahoma announcements show about how CISOs are appointed, what they own, and where the work differs from corporate roles.
CISO vs. CSO vs. chief trust officer: what the title means in practice
Four appointment announcements from 2024 to 2026 show how CSO and chief trust & security officer roles differ in scope, background and reporting line.
CISOs at investment firms and holding companies: how the role is shared across entities
What three public sources show about one CISO covering an investment firm and its portfolio, and what they do not say about fractional CISOs.
What a deputy CISO does and how the role leads to the top security seat
Two sources, an AWS profile of CJ Moses and Pennsylvania's IT leadership page, show what deputy CISOs own and one documented route to CISO.
The 2026 CISO-Board Engagement Report: what boards say works, and what doesn't
IANS, Artico Search and The CAP Group found boards rate CISOs well on regulatory updates, poorly on evolving and AI threats; only 30% call the relationship strong.
The 2026 State of the CISO survey: executive titles, reporting lines and mobility
IANS and Artico Search surveyed 662 CISOs in 2025. Executive titles passed VP and director titles for the first time, and most say they'd move within a year.
CISSP vs. CISM vs. CCISO: how the three certifications actually compare
Experience bars, exam cost, domains and renewal fees for ISC2's CISSP, ISACA's CISM and EC-Council's CCISO, taken from each certifying body's own pages.
What personal legal liability does a CISO actually face?
SEC v. SolarWinds ended in dismissal; Uber's former security chief was convicted. What the two most-cited cases and the SEC's 2023 rules mean for a CISO's own exposure.
What does it take to become a chief information security officer?
The government's closest occupational data, ISC2's CISSP and ISACA's CISM experience rules, and 2025 workforce-study numbers behind today's hiring market.