CISO News: Tracking Every Appointment and Departure in the Top Security Seat

TL;DR: CISO news is coverage of who takes or leaves the top security seat at a named organization. CISO Tribune tracks it as a dated, sourced record rather than a column: 466 moves logged as of this guide's last review, each its own page with a primary source, a company page and a person page. A move is either confirmed, sourced to the organization itself, a filing or an established publication, or clearly labeled "Reported, unconfirmed" until it is.

What counts as CISO news

A CISO news item names a person, an organization, and either an appointment or a departure from the organization's top security seat, titled Chief Information Security Officer or an equivalent combined title such as CIO and CISO. It is distinct from general cybersecurity news, which covers breaches, vulnerabilities, regulation and products rather than who runs the security program. It is also distinct from a promotion or hire below the top seat: a deputy CISO, a BISO or a VP of security operations moving jobs is not a CISO move by this record's own standard, even when a headline calls them one.

Two things make a report usable as news rather than rumor: a named person and organization, and a source that actually states the move, not a headline alone. SecurityWeek's Industry Moves column is a working example of the first bar without the second: it groups CISO appointments with other executive hires into one weekly post, for instance naming that Barracuda has appointed Dan Fletcher as Chief Financial Officer (CFO) in the same post as its security hires, with each entry a brief paragraph rather than a sourced page of its own. National CIO Review's "30 CISOs on the Move" takes the same column format at a larger scale, describing itself as an edition that "highlights 30 new CISO appointments defining 2026".

How CISO Tribune's record differs from a moves column

CISO Tribune gives each move its own page: the person's name, the company, the title, the date the move was announced, the date it was recorded, and the source it was checked against, with a link to the company's page and the person's page. As of this guide's last review the Wire holds 466 such entries. That is a different unit than a weekly roundup: a reader or another publication can link to one appointment directly, see exactly what source backs it, and see whether it is confirmed or still a single-outlet report.

That confirmed-or-reported distinction is the other difference. An appointment whose only support is one smaller outlet publishes with a visible "Reported, unconfirmed" label naming that outlet, never stated as settled fact. It is checked again on a schedule: if an established publication or the organization itself later confirms it, the label comes off and the stronger source replaces it; if a later filing names someone else in the seat, or the report goes unconfirmed past its window, the entry is withdrawn and logged, never silently deleted. Departures carry no such lane: a departure publishes only once an organization itself says so.

Why CISO moves are hard to track consistently

Two recent studies, measuring different things, explain why a simple "average tenure" number is misleading. Cybersecurity Ventures reports that "Dark Reading reports that average CISO tenure now hovers between 18 months and 26 months," and cites research finding "75 percent of security chiefs are interested in a job change." That figure describes time in one seat at one company.

A different angle comes from IANS Research and Artico Search's 2026 State of the CISO survey of 662 CISOs, which found that "CISOs report an average tenure of nine years." That number is a career-long figure, often spanning more than one employer, not time in a single job. The same survey found that "Nearly seven in ten CISOs are open to making a career move within the next year." Read together, the two studies say the same seat turns over every couple of years at a given company, while a given person often stays a CISO, just not always at the same company, for close to a decade. For the fuller breakdown, including what CISO Tribune's own record shows about appointment and departure counts over the last 12 months, see How Long Do CISOs Stay?.

Both facts point to the same practical problem for anyone trying to track the role as news rather than as a once-a-year statistic: a title search on a company's leadership page goes stale within a couple of years on average, and a person's full history of CISO roles across employers is not visible from any single filing or press release. That is also why a single company's own newsroom is not, by itself, a complete CISO-news feed: it announces its own hire, not the person's departure from somewhere else, and rarely announces its own CISO's departure at all unless the successor is named in the same release.

Three recent moves on the record

• Alex Stamos left his role as CISO and advisor to the CEO at SentinelOne by the week of September 28, 2026, when SecurityWeek's Industry Moves column reported he had become CISO at Cognition. The record states only what the source states: no exact exit date, no reason given.
• Australia and New Zealand Banking Group named Sandro Bucchianeri its new CISO, announced around August 2026 per CSO Online's own new-appointments column; he previously held senior cybersecurity roles at Absa Group and the National Bank of Abu Dhabi.
• David Nolan had left his role as Global Chief Information Security Officer at Asurion by June 15, 2026, when Trimont announced it had named him Chief Security Officer; Asurion itself has not separately confirmed the departure date.

Each of those pages links the full source and states plainly what is and is not known, including when a date is approximate.

How to follow CISO news without missing a confirmed move

• Read the Wire directly. /moves lists every tracked appointment and departure, newest first, each with its own source link.
• Check the company and person pages. A company page states who currently holds its CISO seat per the record's most recent confirmed entry; a person's own page gathers every move tied to them.
• Watch the label, not just the headline. A "Reported, unconfirmed" badge means exactly one outlet has said so; treat it as a lead, not a settled fact, until it clears or is withdrawn.
• Track vacant seats, not just filled ones. Open seats and interim coverage explains how CISO Tribune records a seat between a departure and the next confirmed appointment, which a moves column rarely tracks at all.
• Subscribe instead of checking manually. The newsletter and the weekly sector alerts at /new-in-seat both draw only from confirmed, sourced entries on the record, so neither carries a reported-but-unconfirmed move.

Who reads CISO news, and why it matters beyond the headline

A CISO move is a governance signal as much as a career story. A departure can leave a security program briefly without its senior accountable executive; an appointment often resets reporting lines, since who a CISO reports to varies company to company and frequently changes with a new hire. Board members, the incoming CISO's own new team, vendors who sell into the security function, and candidates weighing how to become a CISO all have a direct reason to know a move happened and to know whether it is confirmed, which is why CISO Tribune treats the confirmed-or-reported distinction as a publishing rule rather than a footnote.

What this guide does not cover

This guide does not name a specific person's reason for leaving a role, speculate about fault, or rank which outlet covers moves "best." Methodology and sourcing rules for the record itself are on /about; to report a move we have missed or flag an error in one we have published, see /corrections.