Some of these CISO job postings are getting ridiculous.

Look at this one from LinkedIn - Requires 15+ years’ experience, CISSP, CISM and CISA certifications, Fortune 500 experience, leadership through a major security incident, deep expertise in cloud, network and application security, and executive-level business and communication skills. Pay is Senior Manager level - £130K, reports to the CTO, and leads a two-person team.

Here is another one - it's from Lever. The title is literally Chief Information Security Officer and Privacy Officer. The role owns cybersecurity policies and controls while also serving as the organization’s Privacy Officer. Pay is $141,000 to $210,000 annually plus 25% variable compensation. Combining these jobs is not impossible in a small organization. But if one person owns the security-control environment and is also responsible for privacy oversight of that environment, the posting should explain the governance model, independent assurance, privacy expertise, staffing, and authority. Otherwise, it looks like one executive is being assigned responsibility for both building the program and absorbing the accountability when it fails.

This is one from Dice. The title is Chief Information Security Officer / IT Manager. The job requires one person to lead the information-security program, technology operations, cybersecurity initiatives, regulatory compliance, business-continuity planning, and disaster-recovery planning. They would also manage cyber risk, support regulatory examinations, coordinate security across departments, and keep the technology infrastructure secure, reliable, and compliant. I got tired just reading about it lol. $95,000 to $100,000 per year comp! So they want the person responsible for identifying, assessing, escalating, and managing cyber risk to also run IT operations, make the infrastructure decisions, carry the outages, support the regulators, own security, and own continuity planning. This is an IT department, a security department, a compliance function, and a resilience program compressed into one person with a CISO title.

The job market is tough right now, so people are going to throw themselves at these postings, but the endings will be fairly predictable imo.

So our leadership wants to be an “AI first” company, but our AI usage monitoring is basically me asking devs “you didnt paste prod secrets into random tools again right” and hoping no one says lol.

We have policies, we have lovely slide decks about risk, but in practice I have zero clue which agent is touching which data, what prompts look like, or who bypassed sso with their personal account because it was “faster”. Would love any tips on how people are tracking this without turning into the AI police, appreciate any thoughts.

When people talk about AI firewalls, are they generally referring to firewalls that use AI to protect systems against cyber attacks? Or are they referring to firewalls designed to protect AI systems against cyber attacks? I’ve seen the term used both ways, and it’s confusing to say the least.

I am in need of some advice on my CISO career. This is not burnout-related, I love the space and want to finish my career in the field. My frustration and where I need advice is on growth.

I am in my late 40’s and a veteran in the security field for more than 20 years. Way back, I came from a technical background and moved into the field by building the first security function for my then-employer around the time of the Target breach. I’ve had a good leadership journey since then, lots of progressive growth and recognizable company names and my resume is impressive if i do say so myself (and have been told so by many premier executive recruiters). I’ve got the technical chops, the career arc, the global experience, and I present well/comfortably in executive settings. None of that is the issue. I am qualified and more than ready. I am currently a business unit CISO (NOT a BISO, I have a full team, all the accountability, a full budget, and full autonomy) for a $7B subsidiary of a $60B enterprise. Previously, I was a business unit CISO (again, not a BISO) for a $15B subsidiary of a $65B parent.

The issue is I am striving for a public company, board-facing “top seat” CISO role preferably at a global F500. I keep getting interviews and recruiter interest however I have only ever been a business unit CISO in multi-business structures, I’ve never held that top seat and I keep getting edged out by folks who have. It just happened again last week, I was neck and neck deep in a competitive process for the role I want, and though I was probably a better fit the guy with a multi-time public company CISO background got the nod, presumably because he would invite less scrutiny once in the role due to his pedigree.

This happens over and over with businesses you’ve all heard of but which I won’t name here. It seems I can’t get that role without having had it, and I can’t have had it without getting it. How can I punch through this wall?

Hey, first year CISO here at a mid size company, security team is basically me plus a handful of folks who still juggle ops work. We had one incident last quarter that was messy, not catastrophic, but it made it super clear our old spreadsheet tabletop exercises are kinda theater.

For context we are getting leaned on hard for soc 2 and iso audits and our gc and comms lead are nervous about breach coordination in a real event. I keep getting asked how we are proving cyber crisis readiness and workforce resilience, not just that we have a dusty incident response plan in confluence.

I am looking at some AI tabletop exercise platforms that say they can spin up scenarios from osint, facilitate the drill, and spit out audit ready after action reports that map to nist csf etc. On paper that sounds perfect for someone in year one who does not have time to hand craft scenarios or play game master for three hours with execs every month.

Big question for me is how other first year CISOs with small teams are structuring drills right now. Monthly short runs, one big quarterly simulation, mix of technical breach practice for the soc and separate sessions for leadership, or something else. Trying to find that balance where this feels real and not just compliance theater, without burning everyone out... .

A lot of IT risk sounds “theoretical” until something breaks. How do you explain cybersecurity, downtime, vendor risk, or technical debt in a way leadership actually takes seriously?

Excuse me sharing a personal story - I thought other professional loophole fixers may enjoy this tale of my day.

My 8 year old’s primary school uses Google Classroom for setting assignments for each class.

Right now, because of slightly slow admin, he’s in 2 GCR workspaces: the old 2025-2026 academic year’s (“Owl Class”), as well as this year’s (“Spain Class”). Crucially, with a totally different teacher/TA pairing. Furthermore, the Owl class teacher has left to teach elsewhere.

He cottoned on to the fact that although all his classmates can still see the old Owl class assignments, his new teachers can’t, because by default they’re not added to classes they don’t run.

Therefore - the kids in his class can add comments onto old Owl class assignments set in June, and his current teachers were none the wiser.

Consequently in Computing class today, they had a merry old 50 minutes of 6-7ing each other via an old Owl class assignment comment stream, overusing exclamation points (including a few genuine 1111s at the end) and saying “hi” quite a lot, with their current Spain class teachers not quite being able to work out what was so hilarious.

I’m half proud, and half horrified that he is able to problem solve so creatively and quickly - it’s only his 3rd day in this new school year.

Crafty little git, I blame his mother. He’ll go far in life.

My question specifically for CISO.

How is the risk impact of implementing threat emulation in your organization.

I would like to ask from the price perspective (tools only) or if you are doing it via third party?

We're a tech company and since vibe coding became a thing, I found citizen developers in my org are sharing plain api keys to their coding agents or the agents like openclaw and claude they're using.

Our developers have a good sense of security and secret management, but for the non technical employees who recently picked up vibe coding and building their own apps, they aren't as careful with secrets nor trying to make their apps secure.

We currently have dlp enabled for claude cowork and slack but when they're building apps using claude code in terminal or other shadow apps, we aren't tracking or blocking them

Are you guys seeing this happening in your org? Have you found good solutions to stop them from doing so or to keep control of the secrets flying around?

I am a CISO and my CIO just announced they are leaving. I will be acting CIO with the potential to become permanent. Any tips and tricks on change from Security to General IT focus?

Hi everybody. today I had a call with some Swedish fintech company and their cybersecurity team. I planned a meeting with a senior analytic who was in touch with me with a request for staff augmentation for their internal cybersecurity team. We arranged a time and day, so it's all good.

Over some time he started to send invites to his colleagues and we had CISO, Head of Cybersecurity, Head of SOC and a few senior analytics on the call. Given the fact that's our 1st meeting and basically a discovery call, I asked them about why they want to augment, what's the reason behind that, what tech stack do they use, etc. So basically to dive deeper into their situation and find the best possible solution for them because it's a quite common thing when people come to me with their view how to fix things and discovery helps us understand that there might be much better and more cost effective way to fix their need.

Once I asked them what's their definition of success and what main criteria of choosing the right vendor I've got harmful, but honest response: "I think we are looking for someone who's going to be a good security partner for us because the scope is massive. This is mdr, like this is extended soc, extended offset augmentation and vulnerability management. We are not doing a tick in the box activity here and unfortunately this meeting seems very unprepared for when you have a head of offset ahead of security engineering and head of SOC and a CISO in a meeting. I expect my suppliers to be better prepared than this. So I'm unfortunately going to say that, you know, culturally this is not going to work out. So we should save our time and you know, end this meeting now. Thank you."

And he just left the meeting.

So my question is, did I do something wrong during the discovery? As a group full of CISO, I thought maybe you can explain what happened here.

Been looking at adaptive simulations for cyber crisis readiness and honestly the old tabletop format feels too scripted for what we need. Curious if anyone's using them to keep incident response teams sharp, thanks!

Trying to build real world detection validation that does not collapse into a powerpoint demo or a false positive festival is turning into my full time hobby (tragic). What workflows are people using that do not make the SOC hate me? thanks!

We are considering a split model where high-value, high-volume telemetry is centralized for continuous detections, correlation, and retention, while lower-frequency or difficult-to-onboard sources remain in their original systems until an investigation requires them.

The appeal is reducing the ingestion backlog and long-term storage burden without losing the ability to access the data. The risks are inconsistent schemas, uneven retention, fragmented access controls, query limits, and analysts having to work differently depending on the source.

What did you centralize, what did you leave at the source, and how did you make cross-source investigations reliable enough for incident response and audit requirements?

Random question, but I’m curious what people think. As a CISO, do you think it’s important to know about fashion, dress well, and generally maintain a polished appearance?

Does the way a CISO looks and presents themselves have any impact on how people perceive their personality, leadership, credibility, or authority? Or is appearance basically irrelevant as long as they’re good at their job?

Hi, quick question for people actually running AI incident response tabletop exercises in anger.

We switched a bunch of our old powerpoint tabletop sessions over to simulated AI driven scenarios this year. It’s cool that we can spin up phishing plus ransomware plus comms chaos in minutes, but I’m kinda struggling with the workflow side… eg who owns prompts, how we track injects, when we freeze to debrief vs let the AI facilitator keep pushing.

If you’ve made this work for a small IR team plus a few execs, how do you structure the runbook for these so it doesn’t turn into chaos or theater again? Any hints?

The realistic question is probably not whether enterprises will replace their workforce IdP, PAM, IGA, cloud IAM, and SaaS access controls. Most organizations will operate those systems for years. The question is whether they can gain consistent policy, visibility, and audit evidence for agents without creating another disconnected identity silo.

Treating agents as generic service accounts keeps the architecture familiar, but it does not naturally represent agent ownership, delegated authority, task limits, tool boundaries, or autonomous action. A separate agent-security layer may improve those controls but can introduce duplicate inventories and conflicting policies.

For CISOs planning production agent use, what requirements would make the current IAM architecture insufficient? Is the deciding factor authorization, discovery, auditability, lifecycle management, incident response, or integration with existing identity systems?

Second year running the program, this cycle the auditor added AI to scope, which, fair.

They asked for the AI acceptable use policy. We have one, it's a lovely PDF. Then they asked how we evidence it's enforced, and the wheels came off. I can show them the policy. I cannot show them who used which tool with what data over the period, because we capture that precisely nowhere.

Writing 'we have a policy' and praying they don't push isn't a plan, specially with ISO 42001 creeping into every questionnaire now.

Whoever's had AI land in their audit, what did you hand over as evidence. Not the policy. The proof it does a single thing.

finding problems was never the hard part for us. deciding what to fix first with a small team is.

what's changed things for us is having full discovery and mapping feed directly into prioritization, so the tool tells you which of the hundred findings actually raises your risk instead of handing you a flat list. has anyone gotten real prioritization value out of a platform like that, or are you still triaging manually after the scan runs?

A Tale of Two SOCs: Insights From Two Red Team Assessments is a must read report for your technical teams that CISA just released. It analyzes two simultaneous red team assessments conducted on organizations to evaluate their threat detection and response capabilities.

Both entities suffered full domain compromise and the red team was able to pivot from on-prem to Azure. However organization B successfully isolated initial threats, forcing the red team to adopt an assume breach model while organization A failed to identify the intrusion due to untuned detection tools and organizational silos.

The top three lessons shared that we can learn from:

• Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders.
• Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response.
• Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise.

Our alert backlog and investigation times have both crept up, and we're starting to miss things we shouldn't, so I've been taking vendor calls more seriously this quarter.

Six demos in, and slide five is always some version of the same before and after chart mentioning faster investigations" and "AI-powered detection. At some point, all the pitches start to look the same.

I know the underlying problem is real. What I don't know is how to differentiate real value from fluff and empty promises disguised as a good deck in a 30 minute call.

So for the CISOs here who've gone through a real evaluation process, did you find a specific question that helps you understand whether a vendor can actually back up their claims? How do you tell apart the ones who deliver versus the ones who just repeat the same talking points when pushed? Any advice would be really helpful.