CISOs get more time in the boardroom but struggle with budgets
A new report from Splunk shows 82 percent of CISOs now report directly to the CEO, up from 47 percent in 2023, and 83 percent participate in board meetings somewhat often or most of the time.
However, only 29 percent of CISOs say they receive the proper budget for cybersecurity initiatives and accomplishing their security goals, compared to 41 percent of board members who think their cybersecurity budgets are adequate.
Many CISOs say that they have made cutbacks due to inadequate budgets. Some of the biggest cutbacks have included postponing a security update or refresh (52 percent), reducing the number of security solutions to save on licensing costs (50 percent), and imposing freezes on promotions, raises, and hiring (40 percent).
See also:
- CISOs take on extra responsibilities
- Why CISOs need to keep on top of their cybersecurity investments [Q&A]
- Enterprise CISOs worry about losing their job after a breach
Perceptions between boards and their CISOs differ in other areas too, 61 percent of CISOs say their relationship with the board is very good to excellent, compared to only 43 percent of boards who characterize the relationship in the same positive terms.
Many boards state that they prioritize business growth (44 percent) over security growth (34 percent), which means they're likely to financially support cybersecurity initiatives that provide the most value to shareholders and the organization.
Michael Fanning, CISO of Splunk, writes on the company's blog that CISOs need to learn to 'speak board' in order to justify their budgets, "Boards reported that they prioritize business growth, even over improved cybersecurity posture. That means CISOs need to think beyond risk metrics and dive deeper into how a solution will benefit the broader business. It means articulating the potential or inevitable costs of not implementing a security solution or best practice. Our report details ways CISOs can better champion security budgets and reframe their efforts into ROI that lands well with their boards."
You can read more and get the full report on the Splunk blog.
Image credit: Monkey Business Images/Dreamstime.com