The 2026 State of the CISO survey: executive titles, reporting lines and mobility

This site's /tenure record lists how long a named CISO has held the seat at a specific company, straight from that company's own Form 10-K. This page is different: it's what a survey of the whole field found, not a per-company fact. IANS Research and Artico Search's sixth annual CISO Compensation and Budget Research Study — published as the 2026 State of the CISO report — surveyed 662 CISOs between April and November 2025 and released its findings January 15, 2026. Its headline: for the first time, more of the CISOs it surveyed held executive-level titles than VP- or director-level ones.

How many CISOs now hold an executive-level title?

In large enterprises, IANS's own release states that executive-level representation rose from 33% in 2023 to 47% in 2025, with the sharpest gains at large public companies. IANS's release doesn't give a single overall percentage across all company sizes; two trade outlets that covered the same report do, and they don't quite agree. TechTarget's write-up puts the full sample at 47% EVP/SVP, 27% VP and 27% director; Infosecurity Magazine, describing the same 662 respondents specifically as North American CISOs, gives 46% executive, 27% VP and 27% director. The two-point gap and the unstated-versus-stated geography are both worth naming rather than picking one number silently.

Smaller companies show the same direction: IANS's release says 52% of organizations under $100 million in annual revenue now give their security leader an executive or SVP-level CISO title.

Who do CISOs report to?

Most still report inside IT. IANS's release puts it at 64% reporting to IT leadership (typically a CIO or CTO) and 36% reporting to a business leader such as a CEO, COO, general counsel or chief risk officer. IANS's own research director, Nick Kakolowski, frames the split as structural rather than closing fast: many CISOs, he says, "still work within legacy structures that haven't kept pace with expanded expectations." Executive-level CISOs are reported by TechTarget to be reporting outside IT at a notably higher rate than VP- or director-level peers — twice as likely as VPs, three times as likely as directors.

Is the bigger title matched by a bigger budget to do the job?

Not according to the same respondents. IANS's release states that 52% say their scope is no longer fully manageable, a strain the report says is sharpest at smaller organizations and in industries with leaner security teams. Artico Search's own Steve Martano frames the title shift and the strain as the same trend: "The demand for experienced CISOs remains strong as the role continues to become more complex and more 'executive.'"

How long does a CISO stay, and how open are they to moving?

IANS's release gives an average CISO tenure of nine years, with most CISOs having served at more than one organization and across more than one industry. Despite that average, the release says nearly seven in ten respondents are open to a career move within the next year — to a larger organization, a different industry, or an adjacent executive role.

A nine-year average from a 662-CISO survey is a different kind of number from the per-company figures on /tenure, which are read individually off each company's own 10-K rather than averaged across a sample — the two aren't directly comparable, and this page doesn't try to reconcile them.

Does this mean the CISO job is splitting into two different roles?

That's IANS's own reading, not just an outside interpretation of the numbers. Infosecurity Magazine's coverage paraphrases the firm's argument that security leadership is dividing into two models: large, often publicly listed companies increasingly treat security as a core enterprise-risk function led by an executive CISO who reports to a business or risk executive, while small and midsize organizations more often keep security embedded in IT, with a director-level CISO reporting to a CIO or CTO. The title and reporting-line numbers above are consistent with that split, but this page reports it as the report's own framing rather than independently verified against the underlying respondent-level data, which isn't public.