NewsCSO Online

    Cybersecurity is a leadership problem: Why the management model needs to catch up

    When I started writing regularly about cybersecurity management in 2015 , the environment looked very different. Cloud computing was still reshaping enterprise technology. Ransomware had not become the industrialised threat it is today. Artificial intelligence was not driving boardroom discussions. Zero Trust had yet to enter mainstream technical vocabulary and quantum computing barely registered on the corporate risk horizon. Cybersecurity itself also occupied a different position. The CISO role was less established, board engagement was inconsistent, regulation was less extensive and security budgets were generally smaller. Much has changed since then. But looking back at the management challenges we were discussing more than a decade ago raises an uncomfortable question: Why are we still discussing so many of them? Technology has advanced enormously. Investment has increased. Regulation has expanded. Cybersecurity has achieved unprecedented executive and board visibility. Yet organisations still struggle with governance, accountability, organisational silos, short-termism and execution. Those were management problems in 2015. They remain management problems today. The ‘what’ was never the hardest part One of the central observations behind my early work was that the what of cybersecurity was already reasonably well understood. Standards, control frameworks and good practices had existed for years. Organisations could identify weaknesses, define controls and produce remediation plans. They knew what good cybersecurity looked like. The difficult questions were always the how and the who. How do you implement those controls across complex organisations with conflicting priorities? How do you sustain transformation over several years? Who owns the changes? Who has the authority to make them happen? And who remains accountable when progress stalls? Those questions cannot be answered by a security framework or product. They are governance, management and leadership questions. More than a decade later, that distinction matters even more. Cybersecurity has progressed — but management has lagged There is no question that cybersecurity capabilities have improved. Detection and response have matured. Cloud security has developed rapidly. Identity management has become a central protection discipline. Security operations are increasingly automated, and AI is transforming both attack and defence. Large organisations now operate substantial security functions supported by extensive technology portfolios, specialist providers and advisers. But increased sophistication has not eliminated fundamental management weaknesses. CISOs can remain accountable for issues they lack the authority to resolve. Technology and security strategies can develop on separate tracks. Business executives can still treat cybersecurity as a service delivered by the CISO rather than a dimension of the processes, applications and activities they own themselves. Governance can produce extensive reporting without effective decision-making. Transformation programmes can identify the right problems without necessarily resolving them. The language has evolved. The underlying management dynamics often have not. The CISO reporting-line debate misses the point The persistent debate around where the CISO should report illustrates the problem. For decades, organisations have debated whether the CISO should report to the CIO, CEO, COO, CRO or another senior executive. The CIO reporting line has attracted particular criticism because of a perceived conflict between technology delivery and cybersecurity protection. But if decades of discussion have failed to produce a universally satisfactory answer, perhaps the real problem lies elsewhere. Maybe the more fundamental question is: What does the organisation expect the CISO to be? Some organisations see the CISO primarily as a technology security leader. Others position the role as an independent control function. Some expect the CISO to coordinate resilience, while others increasingly view the position as a strategic business protection role. Those are very different jobs. Until organisations clarify the purpose, authority and accountability of the CISO, debates about reporting lines will continue because organisational structure is being asked to compensate for ambiguity around the role itself. Moving the CISO around the organisation chart cannot resolve that ambiguity. CIO-CISO tension is not necessarily conflict The supposed conflict between CIO and CISO needs a proper reality check. The two executives inevitably face different pressures. CIOs balance cost, delivery, availability, innovation and transformation. CISOs must challenge weaknesses and ensure protection and resilience remain adequate. That creates tension. But tension can be constructive and does not have to become conflict. Nor does moving the CISO outside the CIO organisation eliminate those competing priorities. Any modern CIO should acknowledge that cybersecurity is inseparable from architecture, cloud, identity, DevOps, digital transformation, AI and resilience. CIOs and CISOs must collaborate regardless of the formal reporting structure. What organisations really need is a governance model capable of resolving disagreements when legitimate priorities compete. That is a leadership and management requirement, not something structural separation can solve on its own. Cybersecurity may be undermanaged, not just underfunded Security spending tells a similar story. Cybersecurity investment has risen substantially over the past decade, and some organisations undoubtedly still require more resources. But persistent weaknesses after years of increasing expenditure should lead executives to ask whether funding is always the central issue. Money can buy technology, people and expertise. It can finance transformation and accelerate remediation. What it cannot automatically do is establish strategic priorities, create clear accountability, resolve organisational politics, force collaboration or ensure transformation programmes achieve their objectives. Again, those outcomes depend on leadership and management. Cybersecurity can be underfunded, but quite often it is also undermanaged . The distinction matters because it changes the executive conversation from “How much more do we need to spend?” to “Are we converting the investment we already make into sustainable capability?” Compliance is necessary, but it cannot substitute for management The expansion of regulation and certification schemes has created genuine benefits. It can establish minimum standards, impose accountability and force cybersecurity onto executive agendas. But compliance has inherent limitations. An organisation can satisfy formal requirements while carrying substantial structural weaknesses. An audit finding can be closed without addressing the management problem behind it. Certification can demonstrate that processes exist without proving that an organisation will behave effectively during a serious incident. When showing activity becomes more important than building sustainable capabilities, compliance runs the risk of providing reassurance without necessarily delivering protection. Board awareness was only the first step Over the past decade, cybersecurity has also achieved something the industry demanded for years: It has reached the boardroom. That matters, but board visibility does not automatically produce effective governance. Many organizations are totally technology-dependent and their boards already understand the importance of cyber protection and resilience The old argument that CISOs need to convince boards of the importance of cybersecurity and the need to invest in it, is increasingly outdated. The more important issue is what boards do next. Boards should challenge whether strategic priorities are clear, whether executive accountability is effective, whether transformation is progressing and whether investment is creating sustainable capability. They also need to understand whether assumptions about resilience have been tested. Board awareness was necessary. Board responsibility is the more important issue now. Breaking the cybersecurity spiral of failure These management weaknesses help explain why cybersecurity transformation repeatedly loses momentum. A serious incident creates urgency. Urgency releases funding. Remediation accelerates and visible progress is made. Eventually, the pressure declines. Executive attention moves elsewhere. Longer-term structural problems become harder to prioritise. Transformation slows down. Then another incident restarts the process. I have described this as the Cybersecurity Spiral of Failure . Organisations can spend substantial amounts during every cycle and make genuine technical improvements while leaving intact the management conditions that created the weaknesses in the first place. Poor accountability remains. Governance struggles with difficult decisions. Priorities change. Corporate or geographical silos inhibit execution. Short-term pressures displace long-term transformation. Breaking that cycle requires management discipline and strategic continuity — not simply another security programme. Cybersecurity cannot remain the CISO’s problem Perhaps the most important lesson is that cybersecurity cannot become sustainable while organisations continue treating it primarily as the CISO’s responsibility. The CISO has an essential role in providing expertise, strategic direction, coordination and challenge. But the organisation must execute. The CIO needs to ensure technology architectures and services are secure and resilient. Business executives need to accept accountability for the processes and applications they own. Corporate functions must discharge the security responsibilities attached to their authority. Executive management must resolve competing priorities. The board must provide oversight and strategic continuity. The CISO cannot substitute for those responsibilities. The principle should be straightforward: Accountability must follow authority. The objective is not to turn every executive into a cybersecurity specialist. It is to make cybersecurity part of normal management. The technology will change. The management principles won’t There will always be another technology wave. AI will continue to transform business practices. Quantum computing may force major cryptographic transformation. Cloud architectures will continue evolving. Digital ecosystems will become even more interconnected. The security industry will respond with new products, frameworks and methodologies. But organisations need management principles capable of surviving those technology cycles: Clear priorities. Accountability aligned with authority. Governance capable of turning disagreement into decisions. Strong CIO-CISO collaboration. Genuine business ownership. Sustained board oversight. And disciplined execution. That brings us back to the question we started with: Why do cybersecurity observations from 2015 still sound so contemporary? Because many of the hardest cybersecurity problems were never primarily technological. They concern leadership, accountability, governance, organisational politics, short-termism and execution. They cannot be patched, outsourced or solved simply by moving the CISO to another reporting line. They have to be managed. Cybersecurity has become a core business protection capability. It is fundamentally a management challenge supported by technology — not a technology challenge that management somehow needs to accommodate.

    More on Cybersecurity

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/4234532/cybersecurity-is-a-leadership-problem-why-the-management-model-needs-to-catch-up.html

    ID