CISOs remain in their positions for an average of only 18–26 months as they face personal liability for security incidents while being isolated from strategic decisions in daily operations — shared responsibility and continuous prevention are proposed solutions.