How long do CISOs stay? Tenure evidence from dated appointment announcements

What the documents contain, and what they leave out

The question has two parts: what the average CISO tenure looks like, and what dated appointment announcements show about how long individuals stay. The four documents supplied for this explainer are all appointment announcements. They are press releases from SandboxAQ (May 1, 2024), Cyberhaven (January 23, 2025), GoTo (July 18, 2023) and Slalom (April 15, 2024). None of them reports a survey, a median or an average for CISO tenure.

So this guide does not give an average. Any number offered here would have to come from outside the documents. What the announcements do provide is a set of dated career facts about individual leaders. Those facts can be read for a sense of how long people stay in security roles, with clear limits, which later sections set out.

Chris Bates: two announcements, May 1, 2024 and January 23, 2025

The first document is a SandboxAQ release dated May 1, 2024. The company's announcement says it appointed Chris Bates as Chief Information Security Officer.

The release also describes the role he held before. It says Bates came from SentinelOne, where he served as Chief Trust and Security Officer. It then gives a length for that time.

That is the one explicit tenure figure in the four documents for a security leader: more than seven years at SentinelOne, in a role the release titles Chief Trust and Security Officer.

The second document is a Cyberhaven release dated January 23, 2025. The company's announcement says it appointed Chris Bates as Chief Security Officer.

This release describes his background differently from the first. It says Bates came from SentinelOne, and it describes his role there as part of the executive team. It does not mention SandboxAQ.

Counting from the two release dates, May 1, 2024 to January 23, 2025 is a span of roughly eight months. That is arithmetic on two dates, not a statement in either document. The documents do not say when, or whether, Bates left SandboxAQ, so they do not support calling that span a tenure. They show that two different companies announced the same person in a security leadership role on two dates about eight months apart. They do not show how long he held the first seat.

Attila Török at GoTo: a return announced July 18, 2023

The GoTo announcement is dated July 18, 2023. The company's announcement says Attila Török was appointed as Chief Information Security Officer and that this was a return to the company.

The announcement gives dates for the earlier stretch. It says he held security leadership positions at the company . That is a five-year span between 2014 and 2019, in "leadership positions" in the security department. The announcement does not say he was CISO during those years, so five years cannot be read as a CISO tenure.

The same announcement carries a length-of-service figure for a different executive. It says Meredith Hawkins succeeded Jo Deal in the Chief People Officer role. That is not a security role. It appears here only because it is the other dated length-of-service figure in the same announcement. It cannot stand in for CISO tenure.

The GoTo document shows a pattern that tenure averages hide: a leader can leave a company, take a security role elsewhere, and come back to the original company in the top security seat.

Christopher Burger at Slalom: an April 15, 2024 first seat

The Slalom release is dated April 15, 2024. The company's announcement says Christopher Burger would take a newly created role.

The release gives career length, not seat length. It also names the employers where he led teams.

Twenty-six years of experience at several named companies says something about a career. It does not say how long Burger held any one title at any one of those companies. A career length like this should not be mistaken for tenure in a single CISO seat.

What dated announcements can and cannot show about tenure

Taken together, the four documents support a few narrow readings.

• They fix a start date for a seat. Each announcement carries a date: May 1, 2024, January 23, 2025, July 18, 2023 and April 15, 2024. A start date is half of a tenure measurement.
• They sometimes describe the previous seat. The SandboxAQ release states a length for the SentinelOne role, more than seven years. The GoTo release states years for an earlier stretch, 2014 to 2019.
• They do not record the end date. No document in this set reports when any leader left the seat named in it. A tenure needs both dates, so an announcement alone cannot supply one.
• They describe the leader the company wants to present. The two Bates releases describe the same SentinelOne period with different job descriptions: Chief Trust and Security Officer in one, executive leadership team member in the other. A reader building a tenure record from releases has to decide which description to use, and the documents do not settle it.
• They mix titles. The documents use CISO in three cases and Chief Security Officer in one. They use "first CISO" for two companies, SandboxAQ and Slalom. Counting a "first CISO" as a seat holder with no predecessor is a fair reading of the wording, but it says nothing about how long that person stays.

Reading tenure claims with these limits in mind

For a profile of a security leader, the supplied documents suggest a method that stays inside what the evidence supports. Record the announcement date. Record any length-of-service figure the announcement states, with the exact role it is attached to. Keep job titles as written, since the same period may be titled differently in different releases. Record departures only from a document that states one.

On the question as asked, the supplied documents give no average CISO tenure. They give one stated multi-year figure for a security leader (more than seven years at SentinelOne), one stated date range for security leadership positions (2014 to 2019 at GoTo), one career length (26 years for Burger), and one pair of announcements about eight months apart for the same person at two companies. Anything beyond that needs a source that measures tenure directly, such as a dataset of start and end dates across many leaders.