There is a version of the security leader's job that fits on a slide: frameworks, maturity scores, a roadmap in tidy quarters. And there is the version no one describes in the job posting: the phone at two in the morning, and the half-second before you look. The second version is not a matter of temperament. It is a structural feature of the role, the industry's own data shows it clearly, and it can be designed around.
What the Data Says About the Role
The strain is measurable. Surveys summarized by Cybersecurity Ventures report that nearly all CISOs work extra hours every week, one in five works an additional 25 hours, and almost a third say stress is harming their performance. Tenure reflects it: estimates of average CISO tenure have long hovered between 18 and 26 months, well short of the rest of the C-suite, although the 2025 Hitch Partners survey found a more encouraging average of 39 months.
The strain extends to the teams underneath. The 2025 ISC2 Cybersecurity Workforce Study, based on more than 16,000 professionals, found that 95 percent report at least one skills gap on their team, that a third say their organization cannot afford to staff security adequately, and that 72 percent believe cutting security staff directly increases the risk of a breach.
Where the Weight Comes From
| Source of Weight | Why It Lands on One Person | What Relieves It |
|---|---|---|
| Unbounded accountability | Risk is owned by the business, but blame often lands on the security leader | Explicit risk acceptance by business owners, recorded |
| Always on | Incidents do not keep office hours, and many programs depend on one person's judgment | Documented playbooks and a second person who can decide |
| Incomplete information | The picture lives across many technologies, and the leader must assemble it | A single, current view of the program |
| Personal exposure | Regulatory and legal scrutiny of individual security officers has risen | Clear governance, honest disclosure and board oversight |
The Myth of the Single Pair of Shoulders
The industry has spent years treating the CISO as the person who absorbs risk on the organization's behalf. The personal exposure that comes with that became concrete in 2023, when the U.S. Securities and Exchange Commission brought its first cybersecurity enforcement action against an individual CISO, in the SolarWinds case. A federal court dismissed most of the claims in 2024, and in November 2025 the SEC agreed to dismiss the remaining claims against the company and its CISO with prejudice.
The outcome was a relief to many in the profession, but the lesson of the case outlasts its result. Accountability for cyber risk belongs to the organization and its leadership. When it is quietly transferred to one person, that person carries a weight the organization should be carrying itself. The healthiest programs I have seen make risk acceptance an explicit business decision, signed by the people who own the business process at stake.
What Thirty Years Teaches
The work never becomes weightless. What changes is how the weight is distributed. Three practices matter most.
Make Risk Decisions Visible
Every accepted risk should have an owner outside security and a date for review. A leader who carries undocumented risk decisions carries them alone.
Replace Memory with Structure
When the program depends on what one person remembers, every vacation and every night is a risk. Written playbooks, a shared view of the program and a deputy who can decide turn a person into a function.
Spend the Hours on Decisions
The most tiring part of the role is often not the decisions but the assembly: gathering findings from separate technologies, reconciling them and translating them upward. Every hour saved there is an hour returned to the judgment the organization actually needs.
A Note to Anyone in the Role Tonight
If you are the one watching your phone, the weight you feel is real, and it is not a personal failing. It is the predictable result of a role that has too often been designed as a single point of failure. Share the decisions with the people who own the business. Build the structure that lets someone else decide when you cannot. And find the people and the tools that help you carry it, so the organization is carrying its own risk and you are leading it.
Sources
- Cybersecurity Ventures, The Numbers Behind CISO Burnout and Turnover
- CSO Online, on CISO tenure and job dissatisfaction
- Hitch Partners, 2025 CISO Security Leadership Survey
- Security Info Watch, on the 2025 ISC2 Cybersecurity Workforce Study
- ISC2, 2025 Cybersecurity Workforce Study release
- Harvard Law School Forum on Corporate Governance, SolarWinds Dismissed