With ransomware becoming increasingly commoditized and generative AI tools like ChatGPT broadening hackers’ arsenal, organizations are increasingly under attack in what some are calling a cyber cold war.

This places greater and greater pressure on security leaders dealing with shrinking budgets, skeleton crew staff and a conglomeration of security tools and protocols — so much so that they are increasingly up and quitting.

This so-called Great CISO Resignation is concerning, experts warn — because what happens when there’s nobody guarding the gate and rallying the troops?

“The CISO is the leader of the front line of defense against threat actors,” said Rick Crandall, chairman of the National Cybersecurity Center’s Cyber Committee, which recently made a call to action to reverse what some are calling the Great CISO Resignation.

“Like any organization,” said Crandall, “without a leader, important things don’t get managed, motivated, measured and corrected.”

CISOs face too much firefighting, excessive expectations

Recent research from anti data exfiltration and ransomware prevention company BlackFog revealed that nearly a third (32%) of CISOs or IT cybersecurity leaders in the U.S. and UK were considering leaving their current organization. Nine in 10 CISOs report being “moderately” or “tremendously” stressed, according to another study, and average CISO tenure is just two years and two months.

The top reasons for CISO dissatisfaction, according to BlackFog: A lack of work-life balance and too much time spent “firefighting” rather than focusing on strategic issues. Many are struggling to keep up to date with new frameworks and models (such as multi-factor authentication and zero trust), and others say keeping their team’s skill levels up is a “serious challenge.”

Then there is the general lack of qualified team members to begin with. Over an eight-year period, the number of unfilled cybersecurity jobs grew by 350%, from one million positions in 2013 to 3.5 million in 2021. That number is expected to hold out to 2025. Organizations are increasingly under attack, and with short staffing, their vulnerability only increases — less than one in 10 organizations are equipped to deal with an attack from professional cybercriminals.

In fact, 100% of CISO respondents to one recent survey said they needed additional resources to adequately cope with current IT security challenges.

But even amidst these limitations, many CISOs say they face “excessive expectations,” per Proofpoint research. This is at the same time that organizations are tightening cybersecurity budgets, leaving security leaders with fewer resources to do their jobs.

“CISOs have always had a stressful job, but additional pressures are creating an untenable situation,” Celeste Lowe, group director for IT security at Nine commented in the Proofpoint report. “Finding a better balance may sound impossible, but given the 24/7 nature of the role, it’s absolutely necessary for maintaining resilience in the face of burnout.”

Increasing scrutiny, lack of authority and collaboration

Additional frustrations come from lack of collaboration with higher ups who expect CISOs to do more — and more quickly — with less, lack of authority to make changes and challenges in influencing management to top challenges and needs.

“Most CISOs would say that the cyberthreat cold war (or some might call it a hot war) is just part of the job that they are paid to do,” said Crandall.

But that is not where stress comes from, he said, adding, “I originally thought it was budget pressures, but that’s not it either.”

Instead, he sees it as coming from “the lack of authority to implement best practices across the company and the lack of visibility at the top on some of the issues that keep them up at night.”

And increasingly, the duty to report can get murky, with regulations at state and federal levels increasing and expectations changing about what and when cyber incidents need to be reported. Then there are high-profile cases placing overall scrutiny on CISOs. Case in point: The high-profile conviction of former Uber chief security officer for his cover-up of a 2016 hack.

“The increased responsibility of the CISO has brought increased scrutiny from regulators,” Proofpoint writes in its 2023 State of the CISO Report. “CISOs are well aware of what this verdict and others like it could mean for them, and they are seeking reassurance.”

Still, they don’t often get it, and some instead turn to experts offering advice on when they should quit their jobs — including when the CISO role is not an executive one, the security team lacks financial support or they feel unsupported during security incidents — and how to go about exiting.

Unfiltered communication with CISOs critical

But how to reverse this trend?

Crandall advised executive sessions where the CISO meets with the boards or board committees charged with the oversight of cyberthreats without any superiors present. Board members then ask penetrating questions of the CISO with the expectation that the respondent will respond openly. These questions can include the following:

• “What practices or lack of practices anywhere in the company keep you up at night?”
• “If you had unlimited authority, what would you have some area of the company do that is not being done today to protect against the top risks?”
• In cases where a penetration is detected: “Have we disclosed the hack and its implications to meet regulatory, customer, and partner expectations?”

This should be done at least annually, he advised, to give board members unfiltered information on cybersecurity matters.

“Companies and states now believe that cyberthreats are the top risk they face,” Crandall said.

And while company boards and state leaders might groan at the thought of having one more demand on their time, he said, “but we are talking about the top risk,” so give up something of lower priority in lieu of such critical meetings.

Leadership must come from the top

To keep CISOs satisfied, experts advise senior managers to foster strong relationships with them to understand challenges facing the business and the overall security industry. Continuous skill development is also critical (for both CISOs and their teams), as is assessment of reporting structures.

In the end, Crandall said, it takes leadership from the top. Since the whole organization doesn’t report to the CISO, their authority must come from CEOs and other C-suite members that are asking questions and making decisions on how to move forward.

Of course, the CEO could decide that the CISO is asking for too much, he said, which is fine so long as they understand the concern and make an informed judgment based on the risk versus cost of implementing or not implementing a CISO’s recommendation.

“In final analysis,” he said, “the buck stops at the CEO — not the CISO.”