What is CISO tenure? Time in the security seat, and how CISO Tribune measures it

CISO tenure is the length of time one person holds the chief information security officer seat at one organization, measured from appointment to departure. On CISO Tribune it is computed only from completed tenures in the verified record, the same person at the same company, and it is never presented as an industry-wide average.

How CISO Tribune measures it

Time in the CISO seat counts completed tenures: an appointment and a later departure, both confirmed on the Wire, for the same person at the same company. A sitting CISO has no completed tenure yet, so the report reflects people who have left. Interim, acting and deputy titles do not count as appointments to the seat, so a period covered by an interim adds to the gap between holders, not to anyone's tenure.

The gap has its own measure. Time to fill the CISO seat counts the days between a confirmed departure and the next confirmed appointment at the same company, and lists every seat still open with its age. That report calls the record partial and young, and neither report offers an industry-wide average.

Why filings rarely settle it

Public filings seldom date a CISO's term. Form 8-K Item 5.02(b) requires a current report when the principal executive, financial, accounting or operating officer, a person in a similar function, or a named executive officer leaves. A CISO outside that list can leave without an 8-K.

The annual report asks about expertise, not time in seat. Regulation S-K Item 106 lists prior work experience, degrees and certifications as examples of relevant expertise, so companies describe careers rather than appointment dates. HubSpot's 10-K for 2023, for example, said its CISO had over seven years of experience running cybersecurity programs, without saying when he took HubSpot's seat.

Some filings do date an exit. GitLab's 10-K, filed on 17 March 2026, states that its CISO left the role on 26 February 2026. CISO Tribune builds tenure from announcements and filings like these, confirmed one by one, with the sources kept on each record.

Why it matters to a board

A short tenure is a signal to read, not a verdict. As Why CISOs leave sets out, the same exit can follow an incident, an acquisition, a lost budget argument or a better offer, and the pattern around it tells which. A board that tracks its own CISO's tenure next to succession depth, a named deputy CISO or a ready internal candidate, knows how exposed the seat is.

What it is not

Tenure is not years of experience, and it is not time at the company. A CISO can bring two decades of security work to a seat held for 18 months, or spend years at a company before taking its top security role.

Where it appears on CISO Tribune

• Time in the CISO seat and time to fill, computed from the record.
• Open seats: every tracked departure without a confirmed successor.
• Named successor or empty chair: what the Wire's exits show about succession.

Related terms

• Interim CISO
• Chief information security officer (CISO)