Promoted from within: how internal CISO appointments happen

What the documents cover

This explainer rests on four public announcements. Two come from MicroAge, one from PNC Financial Services Group and one from EigenQ. They are company press materials, not studies, so they show how three employers described their choices. They do not measure how internal and external CISO hires compare. The last section lists what the documents leave out.

MicroAge: from VP of cybersecurity strategy to CISO

MicroAge's announcement is dated January 8, 2025. The company said it was promoting Alex Ryals to CISO.

The announcement describes his prior job at the company. The release says the appointments reflect a company approach to staffing.

MicroAge's CEO, Rob Zack, framed the promotions as a statement about the people already in the company.

The release also describes what the new CISO will do. MicroAge sells cybersecurity services to clients, and the release says nothing about how the CISO role relates to the earlier VP role beyond the title change.

How Ryals first came to MicroAge

MicroAge's earlier announcement, dated August 5, 2024, shows that Ryals was not a long-tenured employee when he was promoted. The company said he joined as Vice President of Cybersecurity Solutions and Strategy.

That announcement lists his earlier employers. It also says he would succeed a retiring executive.

The August 2024 role was defined around building the security business. The company said Ryals would and would .

Read together, the two MicroAge documents show one person's sequence. He was brought in from outside the company for a senior cybersecurity role on August 5, 2024. MicroAge named him CISO on January 8, 2025. The documents give no reason for the timing and do not say whether other candidates were considered.

EigenQ: a new CISO role filled by an existing executive

EigenQ's release is dated July 28, 2026. It describes a different route. The company did not replace a CISO. It created the position and filled it from inside.

The release names his prior role. The promotion followed . The company tied the announcement to its corporate situation. The appointments came

The scope of the job is stated in the release. The release also says the role keeps a link to his earlier work.

EigenQ gave its reason for the choice. The release does not say whether EigenQ ran a search or considered outside candidates.

PNC: a long-serving CIO from an acquired bank

PNC's release is dated July 27, 2026. It says Christian Winward has been named chief information security officer. It does not use the word "promotion." It describes him as coming from another institution.

The release stresses tenure and a path that began outside technology.

PNC's head of Technology, Debbie Guild, gave the company's reasons. She pointed to the integration work and to business knowledge.

The release also states the reporting line and the scope of the team.

This case sits between a clean internal promotion and an outside hire. He had spent his career at FirstBank, and the release describes him as joining PNC. The release does not say whether PNC searched externally.

How these paths compare with an outside hire

The documents contain no announcement of an outside CISO hire. A direct comparison is therefore not possible from this material. They do show how each company described the basis for its choice.

• MicroAge pointed to the person's existing security leadership role in the company and to its stated approach of developing leaders from within.
• EigenQ pointed to a technical executive's record in cryptography and product security, and created the CISO title for him.
• PNC pointed to three things: a career of more than 30 years at the acquired bank, a CIO role, and work on integrating that bank into PNC.

The August 5, 2024 MicroAge release shows what an announcement for an outside hire in a senior security role looks like in these documents. It leads with years of experience and a list of prior employers at other companies. The three CISO announcements lead instead with the executive's current or most recent role at the company and what that executive did there. That is a difference in how the announcements are written. It does not show a difference in how the hiring decisions were made.

Another pattern in the documents is where the new CISO's previous job sat. At MicroAge it was cybersecurity solutions and strategy. At EigenQ it was cryptography. At PNC it was the CIO seat. None of the three releases describes a prior title of deputy CISO or security operations lead. The documents do not say whether that is typical.

What the documents do not say

Several things a reader might want are absent from all four documents:

• No document describes a hiring process, a board role in the decision, or whether outside candidates were considered.
• The MicroAge releases do not give the CISO's reporting line. The EigenQ release does not either. Only PNC states one, to the head of Technology.
• None of the documents gives data on how many CISOs are promoted internally versus hired externally, or on how long each group stays in the seat.
• None of them compares results between internal and external hires.
• The EigenQ and MicroAge releases are company announcements. Their statements about the new CISOs' qualities are the companies' own descriptions.

For a profile on CISO Spotlights, these three cases offer a documented set of starting points: a security strategy role, a cryptography leadership role and a CIO role. A claim that internal promotions outperform, outlast or differ in kind from external hires would need other sources.