Chris Bates's CISO moves: SandboxAQ in 2024, Cyberhaven in 2025

The two announcements at a glance

Two company announcements, dated May 1, 2024 and January 23, 2025, describe the same executive joining two different security-focused companies. A third document, a SandboxAQ blog post dated June 3, 2024, adds a few details about his first weeks at the first employer. Read together, they show what each company chose to emphasize about a CISO moving into a vendor role.

The SandboxAQ announcement says the company appointed veteran cybersecurity executive Chris Bates as Chief Information Security Officer. The Cyberhaven announcement says the company appointed Bates as its Chief Security Officer.

The title changed between the two releases, from CISO to CSO. The documents do not explain why.

The same previous employer in both releases

Both releases name SentinelOne as the employer Bates came from. The SandboxAQ release says Bates joins from SentinelOne, where he served as Chief Trust and Security Officer.

The Cyberhaven release also says he joins from SentinelOne, and it describes his role there as part of the executive leadership team.

The Cyberhaven text we reviewed does not name SandboxAQ. It leads with SentinelOne, and its subheading calls him a former SentinelOne security leader. The documents do not say why the release is framed this way.

The two releases describe his SentinelOne work with different emphasis. SandboxAQ stresses the length of his tenure and the range of functions he held. Cyberhaven lists the teams he built and the acquisitions he handled.

What each company said the job was

SandboxAQ framed the role around protecting the company and also around its product. The release says Bates, as the company's first CISO, is responsible for protecting its data, communications and intellectual property. The same sentence says he will draw on his sales, product development, messaging and go-to-market experience to help develop the AQtive Guard cryptography management platform.

The CEO, Jack D. Hidary, listed the experience he sees in Bates.

Marc Manzano, General Manager of the Cybersecurity Group, tied the hire to the product's customers. He also described a customer-facing duty.

Cyberhaven's release puts the weight on strategy and scale. The announcement's subheading says Bates will oversee the company's security strategy. CEO Howard Ting said Bates has a record with fast-growing companies.

The release gives Bates's range of experience.

What carries over between the two hires

Several parts of the background appear in both releases. Both name SentinelOne and its IPO. SandboxAQ calls it the largest cybersecurity IPO to date in 2021. Cyberhaven calls it the largest cybersecurity IPO in history and says it raised $1.2 billion.

Both also point to work with government and intelligence bodies. The Cyberhaven release names specific agencies.

Both releases mention Nike and Fidelis among his earlier employers. For both, the employer named in the "joins from" line is the vendor where he ran a large security organization.

The company descriptions differ. SandboxAQ calls itself an enterprise SaaS company working at the nexus of AI and quantum technology. Cyberhaven calls itself the AI-powered data security company. In both cases the hire is described through the lens of that company's own product area, cryptography management at one and data security at the other.

Company stage in each announcement

The two announcements also place Bates at different points in a company's history. SandboxAQ says its core team formed at Alphabet Inc. and that it emerged as an independent, growth capital-backed company in 2022. It describes Bates as its first CISO, so the hire created the seat.

Cyberhaven's release gives its funding history and growth. It says that year included 200 percent growth in new bookings. The release does not say whether a security leader held the seat before Bates.

Both announcements carry quotes from Bates about AI. At SandboxAQ he spoke of defending against increasingly sophisticated AI-driven attacks. At Cyberhaven he said the rise of AI has created opportunities in data security and also introduced significant challenges.

What the SandboxAQ blog adds

The June 3, 2024 SandboxAQ blog post, written by James Howe and David Joseph, covers the Cybersecurity Group's events, including the RSA Conference in San Francisco. It reports that the team met Bates in person there.

It then gives a reason his network matters to the product. That fits the SandboxAQ release, which describes a peer-facing role with customer CISOs. The post's section on SandboxAQ's cybersecurity group also mentions an AQ CISO Council.

The post is also a reminder that the appointment announcement is not the whole account. Within about five weeks of the May 1, 2024 release, the company's own blog was describing how his CISO relationships would be used.

What the documents leave open

The documents say nothing about why Bates left SandboxAQ or how long he served there. The Cyberhaven release does not mention SandboxAQ, and the SandboxAQ material does not mention Cyberhaven. They give no start dates beyond the announcement dates.

They do not compare the two roles in scope, reporting line or team size. The only structured information is the title, the stated responsibilities and each company's description of its own business.

One further detail appears in the SandboxAQ release, which says Bates is currently a member of the advisory boards of several organizations. That is the one outside-role detail in the set, and the Cyberhaven release does not repeat it.

What the announcements show is how each employer chose to describe him. SandboxAQ stressed product, go-to-market work and customer CISO relationships. Cyberhaven stressed security strategy and scale. Both named SentinelOne as the place he came from.