When the CISO also holds the CIO or CTO title: dual-hat security leaders

What the sources cover

This guide rests on four documents. They are a Prove Identity press release dated January 26, 2023, an Avant Technologies release dated July 25, 2023, a second Avant release dated March 14, 2024, and an undated "About" page from Glilot Capital. All four are published by the companies themselves or by their newswire. None of them defines a combined security and technology role, measures how common it is, or explains reporting lines. The term "dual-hat" does not appear in any of them. What follows describes what each document says about specific people, and where the documents say nothing, the guide says so.

Two titles at the point of hire: Prove and Amanda Fennell

Prove's release, dated January 26, 2023, announces a single appointment that carries both titles. It names Amanda Fennell to the post of .

The release says she held the same pairing at her prior employer. It states that she served as . It describes that work as security-focused. According to the release, .

The release gives no reason for combining the two titles at Prove. Prove's chief executive, Rodger Desai, is quoted on what he expects from her. He says . The release does not split her duties between the security side and the information technology side. It also does not say which title comes first in practice or to whom she reports.

Two titles through a career path: Danny Rittman at Avant

The Avant documents show a different route. The titles appear one after another within the same company, and at an earlier employer they appear together.

Avant's July 25, 2023 release . The same release says he came from another company. It states that he joins Avant from GBT Technologies, . The release does not say whether he left that post when he joined Avant.

The release also describes his security duties while holding the CTO title at GBT. It says his role there . It adds that he was responsible for . As the release tells it, the CTO title at GBT already carried security governance and a link to the CEO.

Avant's March 14, 2024 release adds a third title. The company . That release lists his work at Avant under each title. It says It then says . In the company's account, the CTO and CISO titles attach to the same product. The release does not say whether he gave up the CISO title when he became CIO.

The documents also describe his earlier career at Micrologic Design Automation in two ways. The March 2024 release states that . The July 2023 release says that . Neither release says whether these were different periods or overlapping duties.

A smaller organization: Glilot Capital

The Glilot Capital page is a different kind of source. It is a team listing for a venture firm, with no announcement and no date. Its "Our team" section lists . The page gives no description of his duties and no account of how he came to hold both titles. It does show that the pairing appears in a listing for a small firm, in a single title line, with no other detail.

How the sources describe the work

Only the two Avant releases say much about what the combined work looks like. They describe it in terms of security programs and company risk.

The July 2023 release lists several duties. It says . It also says These are security program duties, and the release attaches technology risk to the same job.

Avant's chief operating officer, Paul Averill, is quoted in that release on what the appointment is meant to do. He says Rittman will be instrumental . The quote ties the security role to the company's products as well as its internal systems.

In the March 2024 release, Avant's chief executive, Timothy Lantz, is quoted on why Rittman fits the CIO post. He says . This is the one place where a source states a reason for choosing a person who spans both domains. It is the company's own statement in its own announcement, so it describes how Avant presents the choice. It is not evidence about how the arrangement performs.

Taken together, the sources describe three patterns. In Prove's account, one person is hired into both titles at once. In Avant's account, one person moves from CTO to CISO to CIO, and the security work is tied to a product he built. In the Glilot listing, one person holds CTO and CISO titles in a small firm's team listing.

What the sources leave out

Several questions that a security leader would ask are not answered by any of the four documents.

• None says why a company chooses one executive for both roles rather than two.
• None says to whom the combined executive reports, or whether the security function has a separate line to the chief executive or the board.
• None says whether the executive's security duties and technology delivery duties conflict, or how any conflict is handled.
• None gives a count of how many companies use the arrangement.
• The Avant releases do not say whether Rittman kept the CISO title after the March 14, 2024 promotion, and the Prove release does not say whether Fennell's two titles are split between teams.

The documents are announcements and a team page. They show that the combined titles exist and how three organizations describe the people who hold them. They do not show how the arrangement works in daily practice, so claims about its strengths or risks would need other sources.