CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows

TL;DR: A chief information security officer (CISO) owns cyber and information security, while a chief security officer (CSO) usually holds a wider brief that can take in physical security, investigations and continuity. Technology companies tend to default to CISO, while banks, energy companies, manufacturers and government agencies still use CSO. Of 417 appointments on our record, 387 carry the CISO title and 16 carry CSO. In our reading, the written scope says more than the title.

What is the difference between a CISO and a CSO?

The short answer: the chief information security officer (CISO) owns cyber and information security. The chief security officer (CSO) usually holds a wider brief that can take in physical security, investigations and continuity. The two titles also come from different places.

The two scopes

Cisco's definition of a CISO describes a senior-level executive who oversees an organization's information, cyber, and technology security. The CSO, in one practitioner's account, owns a broader mandate that typically includes physical security, business continuity, fraud, investigations, and corporate risk, on top of what the CISO covers.

That same source sets out the split by domain:

Where each title came from

The CSO title has physical roots. Cybersecurity Dive notes that long before computers and digital information, companies needed to protect their physical property, and that nobody can say exactly when the term CSO began.

The CISO title arrived later and from the digital side. Steve Katz is credited with pioneering the role after Citicorp suffered a cyberattack in the mid-1990s. The same article says the CISO may at first have sat under the CSO, then came to report to the chief information officer (CIO). The CSO, by contrast, might report to the chief financial officer (CFO) or chief operating officer (COO).

How sector and size shape the choice

According to the same practitioner, technology companies rarely have physical security portfolios large enough to justify a separate CSO scope, so they default to CISO. Banks, energy companies, manufacturers and government agencies still use CSO because the role genuinely spans both domains.

Size pulls in two directions. One field CISO told Cybersecurity Dive that "Larger enterprises with ample physical and digital assets tend to have both a CISO and CSO." At the other end, smaller organizations may only employ a CSO who handles all aspects of security, including information technology.

In our reading, the title on a business card says less than the written scope. Before comparing two roles, ask who owns facilities, fraud and continuity. For how these roles sit beside the CIO and the chief technology officer, see our comparison guide. For the CISO's daily remit, see what a CISO does.

What each security leadership title usually carries

The table below sets five security leadership seats side by side on five dimensions. Reporting lines refer to the chief executive officer (CEO), chief operating officer (COO), chief information officer (CIO) and chief technology officer (CTO).

Read the table as a set of tendencies, not a rulebook. The vCSO.ai scope guide says plainly that an organization may combine or separate these roles differently. The Director row shows how far apart sources can sit. One framework gives the Director the budget. The other says the Director rarely owns all of it.

Two columns carry most of the weight. CISO Prep calls budget ownership and risk-acceptance authority the two rows that define the gap between Director and CISO. vCSO.ai adds that reporting structure determines impact more than title.

In our reading, the Head of Security row is blank for a reason. The title is defined less by a fixed set of powers than by the stage of the company, so its cells are filled company by company. When you compare an offer or a peer's seat, put the actual job description next to this table. Our CISO job description guide and the deputy CISO glossary entry show how those powers are usually written down.

When does a company use VP of security instead of CISO?

On a standard security title ladder, vice president (VP) of security sits above Director and Senior Director and below Senior Vice President (SVP), with the chief information security officer (CISO) at the top. In our reading, the VP is the first rung written as a fully executive role. The Security Titles taxonomy describes a VP who leads multiple directors and senior directors and sits on the executive leadership team. Its list of VP duties includes presenting security strategy and risk to the board of directors.

That overlaps heavily with the CISO entry. The same taxonomy calls the CISO the top security executive and a C-suite member, accountable to the board for security posture and risk. As the previous section noted, a VP can be either the CISO's deputy or the top security executive at a mid-sized company.

How the NICE Framework treats the ladder

According to the taxonomy, NICE collapses the Director, VP and SVP ladder into a single executive role. In our reading, a VP who runs the whole program maps to the same NICE role as a CISO. The title on the org chart does not change what the framework counts.

Why some companies keep the VP title for the top seat

CISO Prep says a Director at a smaller company often does the CISO job without the C-level title, usually because the company reserves chief titles or has not formalized the seat. The same guide says this ambiguity also applies to the VP of Security title. It also lists CISO officer status as sometimes, decided by legal. In our reading, that gives a company three reasons to stop at VP: chief titles are rationed, the seat is still being defined, or the board and counsel have not settled officer designation.

In our reading, the VP title also reads as a step toward CISO. KORE1 lists VP of InfoSec among typical CISO backgrounds. At the other end of the ladder, the taxonomy reserves SVP for the largest and most complex organizations, with a budget it describes as multi-hundred million dollars.

When you assess a VP role, check three things: who signs off on accepting risk, who owns the full budget, and who is in the board room. For how the reporting line changes the answer, see the reporting structure guide.

Company size and sector shape which title gets used

Sector and headcount often settle the title before anyone writes a job description. Technology companies, as vcso.ai puts it, rarely have physical security portfolios large enough to justify a separate CSO scope, so they default to CISO, meaning the chief information security officer title. Banks, energy companies, manufacturers and government agencies still use CSO because the role genuinely spans both domains. At those organizations, the chief security officer covers physical and digital risk together.

Technology accounts for 100 of the 417 appointments on the record, followed by cybersecurity vendors at 93 and financial services at 85.

Where the record sits

We have not split this table by title. In our reading, though, it explains why CISO reads as the default on the Wire. Technology companies and vendors make up close to half the appointments, and those are the sectors that default to CISO. Of the sectors that keep CSO, only finance is large on the record.

The split inside regulated sectors is moving. vcso.ai says the convergence is most advanced in financial services and critical infrastructure, while the industries in between (healthcare, retail, manufacturing) are still working out the structure.

Small companies: one leader, several hats

Below a certain size, titles describe a person more than a function. KORE1 describes a 200-person company where one VP of IT has been wearing all three hats for a decade: the information, technology and security chiefs in one seat. SecComply puts it more bluntly: In a startup, the CISO is the department.

The title can run ahead of the authority. SecComply names a common startup mistake: Giving your IT manager the title of CISO without the mandate, budget, or authority to act as one. In our reading, search firms read the titles as signals of scope. Riviera Partners writes that Head of Security signals a builder. CISO signals board-facing scope. It adds that many companies hire a Head of Security first and grow the role into a CISO seat as they scale.

Three checks before reading a title

1. List the domains the seat owns. Physical security, fraud and continuity point toward a CSO-style scope, whatever the business card says.
2. Ask whether the title signals a builder or a board-facing executive, and whether the company's stage matches that signal.
3. At a small company, check that the person with the security title also holds the mandate and budget to act on it.

For company-level detail, see /companies and the current /open-seats. The /glossary/ciso entry covers the base definition.

Which titles appear most on the record

Across the 417 appointments on our record, the top security seat carries the chief information security officer (CISO) title in 387 cases. The chart groups each appointment by the title used when the move was announced.

Of 417 appointments on the Wire, 387 carried the CISO title, 16 CSO, 11 another top security title, 2 a combined CIO and security title, and 1 VP of security.

How we count title forms

We count the seat, not the wording. Each appointment on the Wire is filed under one of five groups:

• CISO: any form of the chief information security officer title, written out or abbreviated, with or without a geographic or business-unit qualifier.
• CSO: the chief security officer title, used where the announcement presents it as the top security role.
• Combined CIO and security title: a single executive who holds the chief information officer (CIO) title and the security title together.
• Vice president (VP) of security: a VP-level title used for the top security seat, not for a deputy under a CISO.
• Other top security title: everything else that names the senior security leader, such as a head-of-security form.

An appointment is counted once, under the title it carried on day one. A later retitle shows up as a new record only if it is announced as a move.

What the mix suggests, in our reading

The record leans heavily toward CISO: 387 appointments against 16 for CSO. Coverage explains part of that, in our reading. The announcements we track come mostly from companies large enough to name a security executive in public, and CISO is the default label for that seat.

The CSO count needs care. Trade coverage notes that the two titles "are seen as largely interchangeable titles" (Cybersecurity Dive). Because of that, we think some of our 16 CSO appointments describe a seat much like a CISO's. The same article quotes a practitioner who says "Larger enterprises with ample physical and digital assets tend to have both a CISO and CSO" (Cybersecurity Dive). When both seats exist, our count picks up whichever one the announcement presents as the top security role.

The small tail matters more than its size. There are 2 combined CIO and security titles and 1 VP of security as the top seat. One career guide notes that "smaller organizations may only employ a CSO who handles all aspects of security, including information technology" (University of San Diego). We think combined and VP titles appear in public announcements less often than they exist in practice, because smaller firms announce fewer security hires.

For a sitting leader, our reading is that the title on an offer letter says little about scope by itself. Check reporting line, budget and board access, as the earlier sections set out, and see the CISO glossary entry for the baseline role.

Does the title change the legal exposure?

In our reading, the short answer is no. The disclosure rules turn on what a person does and what they know, not on the words on their business card.

What the two rules ask about, in our reading

In our reading, regulation S-K Item 106 governs the yearly description a public company gives of how it manages cyber risk. As we read it, the governance part asks three things: which management positions or committees are responsible for assessing and managing that risk, what relevant expertise those people have, and how they keep the board informed.

The rule speaks of positions and expertise. In our reading, it does not require a company to have a chief information security officer (CISO), and it does not say what the responsible person must be called. Our glossary entry is at /glossary/regulation-s-k-item-106.

Form 8-K Item 1.05 deals with incidents. In our reading, it asks a company to disclose a cybersecurity incident it judges material and to describe the incident and its effect on the business. In our reading, it says very little about people. See /glossary/form-8-k-item-1-05.

Why the title still matters on paper

We think the title shapes how a filing reads, even though it does not set the obligation. A company that names a Head of Security makes the same kind of statement as one that names a CISO. Both statements say who manages the risk and why that person is qualified.

That description of expertise is the part a reader can test against reality. A filing that claims deep experience for a seat that was empty for months, or for a person with a thin background, deserves a second look.

Personal exposure is a separate question. The cases that shaped it are covered in /guides/ciso-personal-liability-solarwinds-uber, and the wider question of who answers for what is in /guides/ciso-accountability. This section is not legal advice. A security leader with questions about their own position should take them to counsel.

What a reader can check in filings

• Who is named. Find the cybersecurity section of the annual report and note the title of the person or committee described as responsible.
• Whether that title matches the company's leadership page and the person's own public profile.
• How the expertise is described: prior roles, certifications, domain experience, and whether the wording is specific or generic.
• The reporting route: who the person reports to, and how the board or a board committee hears from them.
• Changes from one year to the next: a renamed role, a new name, or a reporting line that moved.
• Any Item 1.05 filings, and whether later filings amend or update them.

Our /disclosures pages collect these filings by company. /moves and /people show when the named person changed, which helps when a filing and a departure land close together.

What this guide does not cover

This guide does not cover the cases that shaped personal exposure for security leaders, which sit in a separate guide, and it does not break our appointment record down by sector and title together. It is not legal advice: a security leader with questions about their own position should take them to counsel. For the rules and the record behind it, see What Does a CISO Do? Responsibilities, Reporting Lines and Required Skills.