Glossary
What is CISO tenure? How long a security chief holds the seat, defined
CISO tenure is how long one person holds the chief information security officer seat. How it is measured, why filings rarely state it, and how to read it.
CISO tenure is the length of time one person has held the chief information security officer (CISO) title at one organization, counted from the start date to the present or to the day they left. On cisospotlights.com it is a fact about a person's career, read from a company's own filing or announcement, never an average or a score.
How this site measures it
The CISO tenure record lists companies whose most recent Form 10-K states, in its own words, since when the CISO has held the title. A stated start month and the filing date are enough to place a person in the seat; where a filing is silent, the record says nothing rather than estimating. Each entry links to the filing it came from and carries no view on whether a run is long or short.
Why filings rarely state it
US public companies must name their executive officers and give each one's term and period of service under Item 401 of Regulation S-K. The same item asks for each executive officer's business experience over the past five years, which is where multi-employer security careers often surface. The rule reaches executive officers only, and many CISOs are not designated as such, so their start dates never appear in that list.
The cybersecurity disclosure item, Item 106 of Regulation S-K, asks which management positions are responsible for cyber risk and what expertise those people bring. Its examples of expertise are prior work experience, degrees and certifications. It asks for no start date, so a 10-K can describe a security leader's background in detail without saying how long that person has held the seat.
What a tenure figure is not
A tenure figure is not a survey average. Surveys pool many respondents into one number; this site's guide to the 2026 State of the CISO survey reports one such average and explains why it cannot be set against filing-based figures. Nor is tenure a measure of performance. A run can end in promotion to a wider executive role, in a move to another company, or in a vacancy covered by an interim leader.
For a backdrop, the U.S. Bureau of Labor Statistics (BLS) reported that the median wage and salary worker had been with the current employer for 4.1 years in January 2026. Workers in management occupations had the longest median tenure, at 6.1 years. Those are figures for time with an employer, not time in one title, so they frame a CISO's run without serving as a benchmark for it, as the BLS Employee Tenure release defines them.
Where it appears on cisospotlights.com
- The tenure record, one company and one filing at a time.
- The interim and acting CISO record, for what filings say when a run ends before a successor starts.
- The profiles, each of which opens with who holds the seat and since when.