How Long Do CISOs Stay? Average CISO Tenure and What the Record Shows

TL;DR: A chief information security officer (CISO) typically holds the top security role at one company for 2 to 3 years, according to IANS. Career length is a different number: CISOs at large enterprises average 10 years in the role across employers. IANS links low attrition in 2023 and 2024 to economic conditions and says the trend is unlikely to persist in 2025, so we think the seat figure is a snapshot, not a fixed baseline.

What is the average CISO tenure?

The short answer: a chief information security officer (CISO) typically holds the top security role at one company for 2 to 3 years. IANS reports "2 to 3 years" as the typical CISO tenure in the top role at the same company.

The figure rests on a sizable sample. IANS and Artico Search surveyed more than 800 CISOs for their 2024 CISO Compensation and Budget Survey (IANS). Every respondent was the most senior leader in their cybersecurity organization, though not all held the CISO title (IANS).

Seat tenure and role tenure are different numbers

Tenure figures get mixed up because they measure different things. The 2-to-3-year figure counts time in one seat.

A separate IANS benchmark covers large enterprises, which it defines as businesses with annual revenues above $1 billion. That benchmark counts years as a CISO across all employers, and those leaders average 10 years (IANS).

In our reading, the two kinds of figure fit together. A CISO career usually spans several seats, so a short stay at one company does not mean a short career in the role.

Read the number against its timing

IANS links low attrition in 2023 and 2024 to the economic conditions of those years. It says the trend is unlikely to persist in 2025 (IANS). We think that makes the 2-to-3-year figure a snapshot of a quieter hiring period, not a fixed baseline.

Three things to check before you use any tenure figure in a board paper or a succession plan:

• What it counts. It may cover one seat or a whole career. Our CISO tenure glossary entry sets out the terms.
• Who answered. Survey respondents report their own tenure. Recorded moves show when a seat actually changed hands, and you can follow those on /moves.
• When it was measured. A figure from a low-attrition year may run long once hiring picks up again. Our Time in Seat report tracks this from the record.

Why the tenure figures in different surveys do not match

Three IANS publications draw on the same yearly survey with Artico Search, and their tenure figures look like they disagree. They mostly measure different things. Two of them do not say exactly what they measure.

Why we leave them unreconciled

The seat figure and the large enterprise figure can both be true at once. A leader who has run security at several companies, a few years at each, has a long career total and a short current seat.

The snapshot gives one hint about time in the current job. It says that for some large enterprise CISOs, "more than half is with their current employer". It also says the largest-company CISOs stay with current employers longer than peers at smaller companies. It publishes no average for time in seat. Subtracting one figure from another would produce a number neither source reported, so we do not do it.

The 2026 report places its average next to a note that most respondents served as CISO at multiple organizations. In our reading, that points to career length. The press release does not define the measure, so treat that reading as unconfirmed.

What to check before quoting a figure

• One seat or a whole career. This is the single biggest source of mismatch.
• Who answered. Respondents were the most senior security leaders, not always titled CISO.
• Company size. Large enterprise figures describe a narrower group than all-size surveys.
• Fieldwork year. Market conditions shift attrition from one year to the next, as the previous section noted.

Our own measure of time in the current seat is in Time in Seat, and the definitions we use are in the glossary entry on CISO tenure.

What the CISO Tribune record shows about time in seat and departures

Over the last 12 months, the CISO Tribune record logged 158 appointments of chief information security officers (CISOs) and 22 departures. Both figures come from the moves on the Wire, which held 440 entries as of October 23, 2026. Appointments outnumber departures by roughly seven to one.

The chart sets the 158 CISO appointments in the CISO Tribune record against the 22 departures logged over the same period.

Source: CISO Tribune record: 440 moves on the Wire, as of 2026-10-23

Appointments and departures on the record, last 12 months

Label	records
Appointments	158
Departures	22

Why the gap is so wide

The ratio says less about tenure than it seems to. In our reading, it mostly reflects how each kind of move becomes public.

An appointment is news. The hiring company, the new CISO or a recruiter usually announces it, and a press release or a profile update follows. A departure is often quiet. A CISO leaves, the profile changes weeks later, and the company says nothing until a successor is named. Many exits enter the record only as the other half of an appointment, or not at all.

That pattern matters because interest in moving is common. The 2026 IANS and Artico Search benchmark report found that "Nearly seven in ten CISOs are open to making a career move within the next year." Openness is not the same as leaving. Still, we think the departure count should be read as a floor, not an estimate.

What the record can and cannot tell you

A single year of moves cannot produce an average tenure figure. Tenure needs a start date and an end date for each seat, tracked over several years. The record holds both for some people, but not enough of them to state a market average. The earlier sections cover the survey figures. This record does not replace them.

The appointment and departure counts also do not add up to the full 440 moves. The Wire logs other kinds of change as well, so the two categories in the chart are a subset.

How to use it

• Treat a recorded departure as confirmed and a missing one as unknown.
• Check a specific company's history on /companies before drawing conclusions about its turnover.
• Use /open-seats for roles that appear vacant. An open seat is often the first public sign of an exit.
• Follow the time-in-seat report for longer-run tracking, and see the glossary entry on CISO tenure for how we define the term.

For a security leader planning succession, the practical point is that public data undercounts exits. Your own peer network will usually learn of a departure before the record does.

When CISO appointments are announced during the year

The CISO Tribune record logged 158 CISO appointments announced on the Wire between November 2025 and October 2026. The monthly counts are uneven, and the reason for the unevenness matters as much as the shape.

Announced CISO appointments in the CISO Tribune record by month, November 2025 through October 2026, totaling 158 as of October 23, 2026.

Source: CISO Tribune record: 158 appointments announced in these months on the Wire, as of 2026-10-23

CISO appointments announced per month, last 12 months

Label	appointments
Nov 2025	6
Dec 2025	6
Jan 2026	7
Feb 2026	9
Mar 2026	14
Apr 2026	7
May 2026	9
Jun 2026	30
Jul 2026	23
Aug 2026	14
Sep 2026	28
Oct 2026	5

Three months carry most of the year. June shows 30 announcements, September 28 and July 23. The four months from November 2025 through February 2026 add up to 28, which is fewer than June alone.

October 2026 shows 5. The record runs only to October 23, so that month is incomplete and should not be read as a slowdown.

Announcement dates trail start dates

Each point on the chart is the date an appointment became public. It is not the date the person started, and the two often differ.

• A company may confirm a hire weeks after the new CISO began, once onboarding is settled or a quarterly update goes out.
• The executive may post the news on a professional network only after the first month in the seat.
• A press release can also arrive before the start date, timed to a signed offer or a board announcement.

In our reading, the June and September peaks say more about when news is released than about when companies hire. A search that closed in the spring can surface as a summer announcement. We think one year of data is also too short to call the pattern seasonal.

How to use the monthly view

For a security leader, the practical use is benchmarking rather than forecasting.

• Time your own search from your own dates. Count from offer acceptance and start date, not from when peer hires were announced.
• Check the start date on peer moves. When a competitor's appointment appears on the moves feed, look in the release or any filing for a start date before you assume the seat changed that week.
• Wait for the month to close. Partial months understate activity. The monthly report gives the settled count after each month ends.
• Pair arrivals with vacancies. A spike in announcements can follow a stretch of empty seats. The open seats tracker shows roles that are still unfilled.

The earlier section on time in seat covered how long CISOs stay. This view covers only when their arrivals become visible. For the full method behind both, see the time-in-seat report.

Why do CISOs leave?

An earlier section covered the IANS view that the economy kept CISOs (chief information security officers) in their seats through 2023 and 2024. This section looks at what the same research group says pushes them out once that pressure eases. The public summaries say more about dissatisfaction than about exits, so we report what was measured and label our own reading.

High pay, low satisfaction

Pay is not the main complaint at the top of the market. In the IANS large enterprise snapshot, average total compensation for large enterprise CISOs is $700,000, rising to $1.1 million at $20B+ firms. Even so, the report finds that "many CISOs feel stretched too thin, and low job satisfaction keeps them open to new opportunities."

IANS asked CISOs to rate satisfaction across security budget, compensation, board visibility and career development. The segments that scored each area low differ.

IANS suggests the $20 billion-plus group may be comparing its pay with other executive leaders who receive larger packages. The smaller large enterprises, the ones least satisfied with board access, also show the largest share of CISOs considering a job change in the next 12 months.

Scope and structure

The 2026 benchmark points to workload. More than half (52%) of CISOs say their scope is no longer fully manageable, particularly at smaller organizations and in industries with lean teams.

Titles have moved faster than reporting lines. In large enterprises, executive-level titles rose from 33% in 2023 to 47% in 2025. Yet 64% of CISOs still report into IT (information technology) leadership. Nick Kakolowski of IANS said many CISOs are "still operating within legacy structures that haven’t kept pace with the scope and expectations now placed on the role."

What this means for a sitting leader

In our reading, the sources describe a mismatch between title and terms rather than a single cause. A bigger title without matching budget, board access or reporting line is the pattern most tied to restlessness.

We think the useful check is concrete: compare scope added in the last two years with budget and headcount added, and note who you report to. Our reporting line glossary entry explains the common structures. For departure patterns in our own data, see time in seat and open seats.

How does CISO tenure compare with other executives?

None of the sources behind this guide gives tenure figures for chief executives, finance chiefs or other senior roles measured the same way as CISO tenure. So we do not put a number on the comparison. Any figure placed next to the CISO data here would come from a different survey, a different sample and probably a different definition.

The definition is the part that trips people up. The large enterprise figures earlier in this guide count years as a CISO across employers. The IANS hiring guide reports a different measure: 2 to 3 years as the typical CISO tenure in the top role at the same company. In our reading, only the same-company measure lines up with how executive tenure is usually discussed, which is time in one seat at one employer.

What you can check yourself

Public filings and our record let you build the comparison for the companies you care about, one company at a time.

The proxy is also where pay comparisons start. Steve Martano of Artico Search says that at the top end, "CISO comp structures look more akin to executive compensation packages found in a company's proxy statement." If pay is starting to look executive, we think it is fair to ask whether time in seat does too.

Compare against the boss, not the average

We think the most useful comparison is with the executive the CISO reports to. The 2026 IANS benchmark found that 36% of CISOs report to business leaders such as the chief executive officer (CEO), chief operating officer (COO), general counsel or chief risk officer. It also found that executive-level CISOs are significantly more likely to report outside of IT.

A CISO who has outlasted several bosses is in a different position from one who arrived with a new leadership team. A change at the top often reshapes the security reporting line. Checking both dates side by side tells you more than any cross-industry average.

Mind the years you compare

Timing can skew a comparison. The IANS hiring guide says low attrition rates in 2023 and 2024 resulted from the economic conditions of those years. If you compare CISO tenure with another role, use the same window for both. Our time-in-seat report shows the period our own record covers.

What makes a CISO stay longer?

The sources here do not measure tenure against any single factor. In our reading, they describe conditions that remove the usual reasons to leave covered earlier: an unclear mandate, thin resources and no backup.

A charter agreed in the first 30 days

IANS advises that a new chief information security officer (CISO) needs a clear charter within the first 30 days, one that spells out responsibilities and matches what executives expect. The same checklist states plainly: "There should be no disconnect between CISO and executive management expectations."

We think a written charter is the cheapest retention tool available. When scope drifts, both sides have a document to return to. Our first 90 days plan covers the steps that follow.

A risk register with executive backing

The checklist tells a new CISO to check for a risk register, a list of key risks and their owners. If none exists, or it lacks executive backing, the advice is to get one created with executive input. A sound register, per IANS, shows clear lines of risk ownership and accountability.

In our reading, this matters for tenure because named executive owners share the weight when a risk turns into an incident. Without them, the security leader carries it alone.

Structures that match the scope

The National Institute of Standards and Technology (NIST) added a Govern function when it released version 2.0 of its Cybersecurity Framework (CSF) in February 2024. Its outcomes include leadership being accountable for cybersecurity risk and resources being allocated in line with roles and responsibilities. IANS also advises a new CISO to document any gaps between resources and the charter early.

Steve Martano of Artico Search puts the retention link directly: understanding "scope, reporting structure, and leadership access and visibility" is, in his words, critical for companies looking to hire or retain security leaders.

A deputy who gives depth and cover

A deputy CISO typically reports to the CISO or CIO. IANS says the role can run day-to-day operations when resources are stretched thin and acts as a backup that hedges against the impact of a departing security leader. The IANS hiring guide lists steps for CISO succession planning among its topics.

We think the deputy does two jobs for tenure. It makes the top role more sustainable, and it lowers the cost to the company if the CISO does leave.

What a board can do before and after a CISO seat opens

Earlier sections covered why CISO seats turn over. This one covers what a board and its hiring leaders can prepare, using the IANS hiring guide and a separate IANS note on the deputy role. One caveat: the public page of the guide lists its topics, but the detailed steps sit in a gated download. We describe only what the public text says.

IANS treats turnover as a risk to plan for. After the low-attrition years covered earlier, it says "organizations should proactively mitigate the risk of turnover, as this trend is unlikely to persist in 2025" (IANS). The guide also lists "actions to take in the event an unexpected leadership vacancy occurs." It asks how hiring leaders can attract strong replacements "diligently and quickly" (IANS). A separate chapter covers best practices when hiring external candidates (IANS).

Before the seat opens

The deputy chief information security officer (DCISO) is the most concrete backup IANS describes. An earlier section covered the role's reporting line and its value as a hedge. Two further points matter for a board.

IANS says the role "has become more common among security teams at larger enterprises" (IANS). It also says that if the CISO is unavailable for any reason, a deputy "can continue to drive critical security initiatives forward" (IANS).

The same note flags a practical gap: "a certain amount of ambiguity still exists around the DCISO role" (IANS). We think a deputy who has never been prepared for the top seat is a name on an org chart, not a successor.

When the seat opens unexpectedly

Board members who want a sense of how long a gap can last can start with the CISO Tribune record. Time to fill tracks how long seats stay open. Open seats lists current vacancies, and moves shows who has left and where they went.

If no deputy is ready, an interim CISO is the usual stopgap. In our reading, the decisions that slow a search are the ones a board could have made in advance: who signs off on the hire, what the role reports into, and what the charter says. Settling those while the current CISO is still in the seat shortens the gap later. Read alongside time in seat, the record gives a board a working estimate of when to expect the next vacancy.

What this guide does not cover

This guide does not give tenure figures for other executive roles, explain why any specific CISO left a company, or reproduce the detailed steps in the gated IANS hiring guide. It describes what surveys and the CISO Tribune record show. It is not legal, financial or employment advice. For the rules and the record behind it, see CISO Accountability: What the Rules Actually Put on the Role.