CISO Salary and Compensation in 2026: What the Public Surveys Show

TL;DR: Average total compensation for a US chief information security officer (CISO) is $1,447,000, according to the Heidrick & Struggles 2025 survey, a figure that blends salary, bonus and equity. That average fell 12% year over year, mostly on lower equity awards, while the 95th percentile for total cash rose to $1.6 million. The Bureau of Labor Statistics (BLS) has no CISO category, and its closest series shows a $175,140 median wage for computer and information systems managers.

How much does a CISO make

The short answer: the Heidrick & Struggles 2025 survey puts average total compensation for a US chief information security officer (CISO) at $1,447,000. That number blends salary, bonus and equity. It sits far above anything the Bureau of Labor Statistics (BLS) publishes for nearby roles.

What the survey measured

Heidrick & Struggles compiled compensation data from a survey fielded in summer 2025 of 371 CISOs around the world. The methodology note says all data was self-reported. Treat the figures as a picture of who answered, not a census of every security chief.

The headline average fell. The report says it represents a 12% year-over-year decline, driven largely by lower equity awards. The top end moved the other way: the 95th percentile for total cash compensation rose from $1.4 million to $1.6 million.

Joining packages are large too. Respondents reported an average cash sign-on bonus of $256,000 and an equity sign-on bonus of $1,211,000.

Where the government figures sit

The BLS does not track CISOs as a separate occupation. The closest series are below.

The BLS manager series is relevant because some of these managers are responsible for a particular area of IT, including cybersecurity. For information security analysts, the median annual wage was $120,360.

In our reading, the gap reflects two different measures as much as two different jobs. The BLS reports wages across hundreds of thousands of workers. The survey reports executive packages from a few hundred respondents, many at public companies, where equity can outweigh salary. A sitting CISO benchmarking an offer should compare cash to cash and equity to equity, and should check which series a recruiter or board member is quoting.

For what the role covers day to day, see what a CISO does and our CISO glossary entry.

Which salary surveys publish their methods

Two kinds of source carry most public pay data for the chief information security officer (CISO), and they answer different questions. An executive search firm's survey asks sitting security leaders what they earn. A government wage series counts jobs by occupation, and it was not built to isolate the top security role.

Heidrick & Struggles: what the survey asks

The Heidrick & Struggles report prints its method. Its online survey asked for current base salary, the most recent fiscal year's bonus, annualized equity or long-term incentive pay, and joining bonuses, and the answers have been aggregated. The sample is wider than the title: respondents also included chief security officers and other senior information security executives.

Three limits matter when you quote the figures:

• Geography: the report covers respondents in the United States and Europe. More than half were based in the United States, and 42% in Europe.
• Company mix: about half worked for publicly traded companies and about one-quarter for private equity or venture capital backed firms. The firm points to a higher share of respondents from family offices and VC-backed companies than in prior years as one possible cause of the decline covered earlier. A change in who answers can move an average with no change in what employers pay.
• Outliers: for some private ownership types, the firm says the higher average is driven by a small number of outliers. We think a printed median is the safer number to quote.

The sample also shifts between editions. The 2023 report drew on 262 CISOs surveyed in early 2023 and published compensation data for the United States, Europe, and Australia. Comparing years means comparing different groups of people.

Bureau of Labor Statistics: benchmarks, not CISO pay

In our reading, the Bureau of Labor Statistics (BLS) has no CISO occupation, so its nearest categories serve only as reference points. The information security analyst page now shows a median annual wage of $129,180 in May 2025, across about 192,900 jobs. These are people who plan and carry out security measures, not executives who own the program. The manager category mentioned earlier sits closer in seniority but mixes security leaders with other technology managers.

Before a figure goes into a board paper or an offer discussion, check who answered, which year the data covers and whether it is an average or a median. Reporting line also shapes scope and pay; see our entry on the CISO reporting line.

How CISO pay varies by company size and sector

Heidrick & Struggles reports that U.S. chief information security officer (CISO) pay tracks two structural factors: reporting line and company size. In our reading, sector shapes the mix of cash and equity more than the headline number. Our own record shows where new CISO seats have been filled, which tells you which pay structures most candidates will actually meet.

Of 416 CISO appointments at classified companies in our record, technology accounts for 100, cybersecurity vendors for 93 and financial services for 84, with telecom and media lowest at 7.

Source: CISO Tribune record: 416 appointments at classified companies on the Wire, as of 2026-10-23

CISO appointments on the record by sector

Label	appointments
Technology	100
Cybersecurity Vendors	93
Financial Services	84
Government & Public Sector	41
Education & Nonprofit	25
Healthcare	22
Professional Services	17
Industrial & Energy	16
Retail & Consumer	11
Telecom & Media	7

What the survey says by sector and ownership

The survey separates total compensation from cash. It finds that CISOs in the technology and services sector "earned the highest total compensation on average, largely driven by equity and long-term incentives" (Heidrick & Struggles). Financial services CISOs received the highest average cash compensation. On ownership, publicly traded companies had the highest median total cash compensation. The earlier caveat about private-company outliers applies here.

This section does not reproduce the survey's revenue-band figures. Readers who need a size benchmark can check the U.S. compensation tables in the report itself and match the band to their own company.

Reporting line as a proxy for size

Reporting structure is moving. In the 2025 survey, 42% of respondents report directly to the chief executive officer (CEO), three times the share in the prior year. The share reporting to a chief information officer (CIO) or chief technology officer (CTO) fell from roughly half to 30%. Our glossary entry on the CISO reporting line covers the structural side.

Where the appointments are

Our record counts 416 appointments at classified companies. Technology accounts for 100 of them, cybersecurity vendors for 93 and financial services for 84. Those three sectors together make up most of the total. Healthcare, with 22, and retail and consumer, with 11, are far smaller.

In our reading, this means the two pay structures the survey describes are the ones most new CISOs will face: equity-heavy offers in technology and vendor firms, and cash-heavy offers in financial services. A candidate weighing offers across these sectors should compare the cash component and the equity component separately, not only the total. Current openings by sector are on open seats, and recent moves are tracked on moves.

Does the reporting line change the package

The Heidrick & Struggles survey, covered in the earlier sections, found that U.S. chief information security officer (CISO) pay tracks reporting line and company size. It also found that far more respondents now report to the chief executive officer (CEO). The open question is how large the pay gap between reporting lines actually is. The public summary page does not say. The breakdown sits in the tables of the full report PDF.

Two details in the published text help frame that comparison.

• The shift is not limited to one kind of company. Heidrick writes that "this trend spans all ownership types (public and private)." It adds that more than one-quarter of respondents in every ownership type now work under the CEO's direct oversight.
• The reporting-line chart uses a smaller sample. It carries a note of n=231. The full survey covered 371 CISOs.

Why the line and the package move together

Heidrick reads CEO reporting as a sign that information security "is no longer positioned as a subset of the IT function." In our reading, the pay link follows from that change in scope. A CISO under the CIO is usually benchmarked as a senior IT leader, with a budget and bonus plan set inside IT. A CISO under the CEO tends to be benchmarked against other executive committee members, including their equity plans. We think scope drives both the line and the package, so one does not simply cause the other.

The top of the market fits this pattern. The 95th percentile for total cash rose from $1.4 million to $1.6 million while overall averages fell. Heidrick takes this to mean that "those entrusted with enterprise-level responsibility are being rewarded for their strategic influence." That is the firm's interpretation. The survey does not test it as a measured link.

What to check before using the tables

For definitions and structure options, see the reporting line glossary entry, our reporting lines report and the guide to CISO reporting structure.

What share of CISO pay is base, bonus and equity

The survey splits a CISO package into four parts, and the split matters more than the headline total. Heidrick & Struggles asked respondents for their "current base salary, bonus for the most recent fiscal year, and annualized equity or longterm incentive pay, as well as joining bonuses". Every figure is self-reported, so treat the parts as respondents' own accounts, not audited payroll.

Joining bonuses are mostly equity

In the U.S. data, CISOs reported an average cash sign-on bonus of $256,000 and an equity sign-on bonus of $1,211,000. The report explains the gap: equity sign-on awards "usually make candidates whole on the equity they are leaving behind due to changing jobs". A recruiter who offers a large equity sign-on is usually buying out unvested grants, not adding new money.

The form of equity is fairly standard. Restricted stock units were the most popular form of both annual and sign-on equity.

Equity moves the total

The 2025 U.S. average showed a 12% year-over-year decline, driven largely by lower equity awards. Cash at the top of the market rose over the same period, as noted earlier. In our reading, that means equity is the swing component: it accounts for most of the change in totals from year to year, while cash holds steadier.

The extract we worked from does not break the mix out by pay band, so we cannot give a percentage split at each level. We think the pattern from the sector data points one way: as total pay rises, equity and long-term incentives make up a larger share, and base salary a smaller one. A package heavy in equity also carries more risk, since its value depends on the share price at vesting.

Severance covers less than the full package

Most respondents were also covered by a severance policy. Coverage is uneven across components: "Most of these policies covered cash base, while roughly half included equity and cash bonuses."

For a leader whose package leans on equity, that gap is the part to read closely. Check three things in an offer letter:

• Whether unvested equity accelerates or lapses on termination.
• Whether a bonus earned in the current year is paid pro rata.
• Whether a change of control triggers different terms.

For how reporting structure shapes these terms, see our CISO reporting line entry.

How public-company CISO packages differ

Listed companies are where equity weighting matters most, because their stock has a market price and part of their pay practice sits in public view. In the Heidrick & Struggles 2025 survey, roughly half of respondents worked at publicly traded companies. The public-company view therefore carries real weight in the survey's averages.

Equity follows ownership

The earlier section on pay mix covered the drop in U.S. pay. Heidrick's explanation for it points at ownership. One contributing factor, the authors suggest, may be a higher share of respondents from family offices and venture capital-backed companies, organizations that "typically offer more limited equity participation" (Heidrick).

In our reading, this is the clearest statement in the public data that equity weighting tracks ownership. A sample that tilts toward private firms pulls the equity line down, even if cash holds steady.

Cash tells a different story. Some private ownership structures, such as employee-owned companies and private subsidiaries, showed the highest average total cash compensation. Heidrick attributes the gap between that average and the public-company median to "a small number of outliers" (Heidrick).

We think the practical point for a candidate is this. A public-company package tends to be more predictable, with more of its value in tradable stock. A private package varies more from one employer to the next.

What a reader can check in public filings

What the SEC's cybersecurity rules say is covered in our guide to the disclosure rules. Here the aim is narrower: using filings to put a package in context. In our reading, do not expect a CISO's own pay to appear there: the disclosure rules describe the role and the program, not the officer's package. The filings can still tell you a good deal about the role and the equity behind an offer.

Our guide to CISO reporting lines in 10-K filings and the disclosures tracker show how individual companies describe the role.

These documents show what a company chose to disclose. They do not replace advice from a qualified adviser on a specific offer.

What new CISOs negotiate beyond pay

Joining bonuses are the part of the offer most new chief information security officers (CISOs) expect to discuss. In the Heidrick & Struggles 2025 survey, "Sign-on incentives were common", and the cash and equity averages appear earlier in this guide, in the section on pay mix.

The survey also offers a reading of the equity buyout. Heidrick takes the make-whole pattern to mean that "CISOs have decent tenure in their roles before moving on to another CISO position." The practical step follows: bring your current vesting schedule to the first serious conversation. A buyout is priced against what you leave behind, so the schedule is your evidence.

The terms we think carry as much weight as the number

The survey does not measure the non-cash terms below. What follows is our view, drawn from how these roles tend to succeed or stall. In our reading, a candidate who settles these before signing has an easier first year than one who settles them after.

The reporting-line point builds on the earlier section on how the line shapes the package. Here the concern is different: a line promised in conversation and missing from the letter is easy to reverse after a reorganization. Our guide to board cybersecurity oversight covers what committees typically ask of a security leader.

Liability coverage is the term candidates most often raise late. We think it belongs early. Ask to see the actual policy and indemnification wording rather than a summary, and have your own lawyer review it. Our piece on CISO personal liability describes the cases that put this on the table.

Work arrangement is a smaller item that still comes up. The survey found that three-quarters of CISOs work from a corporate office at least once per week, though only 36% are in the office every day. If you expect a hybrid pattern, write the expected office days into the offer.

A final check: read the full package against your first 90 days plan. Budget and access you cannot use in the first quarter are worth less than they look on paper.

Which CISO seats are opening, in our reading

This section is our view, not a survey finding. It draws on how our record tracks open seats, time in seat and time to fill. Treat it as a reading of direction, and check the live pages before acting on it.

Where we see demand building

Seats rebuilt around a new reporting line. The earlier section on reporting lines showed the shift toward the chief executive officer. In our reading, that shift does more than change an org chart. When a board moves the role out from under IT, the company often rewrites the job description, and that can open a search even when the current holder stays.

Seats with an artificial intelligence (AI) mandate attached. Heidrick & Struggles found that 57% of respondents chose AI, machine learning and data analytics as a top area of expertise to build. The same survey says 60% are actively hiring for talent where AI and security meet. We think postings that pair the chief information security officer (CISO) title with AI governance will keep growing.

Divisional and deputy seats. We see more searches for a business information security officer (BISO) and for deputy CISOs. These are the seats that feed future CISO hires.

Why the bench matters

The Bureau of Labor Statistics (BLS) does not track CISOs, but it tracks the staff below them. It projects about 14,100 openings a year for information security analysts, and says many will come from replacing workers who change occupations or retire. In our reading, churn at that level makes it harder to build an internal successor, which pushes more top seats to outside searches.

What a reader can do with this

• Track departures in /moves. A peer leaving often means a seat reopening with a changed brief.
• If you lead a team, name a successor early. Our record suggests the seats that sit empty longest are the ones with no internal bench.

For readers aiming at their first top seat, the path to becoming a CISO covers the deputy and BISO routes in more detail.

What this guide does not cover

This guide does not reproduce the survey's revenue-band tables, cover regions outside the United States and Europe, or price virtual or interim CISO services. It describes what public surveys and filings report and is not legal, tax or financial advice on any specific offer. For the rules and the record behind it, see How to Become a CISO: Career Path, Experience and Certifications.