The bottom line: CISOs remain in their positions for an average of only 18–26 months as they face personal liability for security incidents while being isolated from strategic decisions in daily operations — shared responsibility and continuous prevention are proposed solutions.
European security leaders now stay in their positions for an average of only 18 to 26 months — a dramatic decline. The cause lies in a combination of extreme responsibility, lack of genuine strategic input in day-to-day operations, and a narrow definition of success.
The daily reality of CISOs is marked by persistent tension: on one hand, they must be accountable for all aspects of cybersecurity; on the other hand, they often lack real strategic influence in routine planning. During security incidents, CISOs function as invisible crisis managers — they coordinate stakeholders, make critical decisions under time pressure, and must manage boards, legal teams, communications, and external trust partners. After the crisis, however, this influence quickly fades while personal liability remains.
Statistics illustrate the extent: approximately 90 percent of security leaders report moderate to high stress. The average tenure in the role has shortened across Europe to 18 to 26 months. This is often compounded by personal pressures such as health issues or caregiving obligations that coincide in time. This constellation leads to burnout rates that destabilize the industry.
A key driver is how organizations measure CISO performance: success is measured primarily by the absence of incidents. Qualitative factors such as the quality of preventive measures, resilience planning, or the secure integration of new business processes are overlooked. This narrowing isolates the role and makes the position politically more fragile.
Organizations can counter this trend through two structural changes: First, through shared responsibility — cybersecurity should be embedded in all business units, with clear deputies and transparent succession plans. Second, through continuous prevention: regular simulations, tabletop exercises, and crisis plans should not be built only once after an incident, but should be maintained continuously. Third, through integration of security expertise into all strategic core decisions — from digital transformation to M&A projects.
At the same time, requirements for the CISO role itself are evolving: in addition to technical depth, diplomatic skills, strategic judgment, and the ability to translate IT risks into business metrics are required. Executive coaching and mentoring by experienced board members can support this development.
Source: www.it-daily.net · Published 13 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.