Path study: September 2026
Vendor-side and repeat CISO paths tie at 14 of 27 profiled in September 2026
September 2026 path study: 27 profiled CISO appointments, with vendor-side and repeat-CISO paths each at 14, plus sector and title counts, from sourced profiles.
Of the 27 appointments profiled for September 2026, 14 involve a career path through a security vendor and 14 involve a CISO who has held the top seat before.
This study is computed from profiles on CISO Spotlights, a site of 236 sourced profiles. Each profile carries its own verbatim passages from the sources it cites, and the examples below quote those passages without changes. A profile can carry more than one path tag, so the path counts overlap and do not add up to the number of appointments. Some example profiles below sit elsewhere in the site's dataset rather than in the September 2026 count; they are used to show what each path tag looks like, not to date anyone's appointment.
The September 2026 count
The site profiled 27 appointments for September 2026, up from 15 in August 2026. The study reads only the tags and fields that those profiles carry: path tags, sector, and role title. It does not infer why a company chose a person, and it does not rank the paths. It counts them.
Path counts
Here are the path tags across the September 2026 profiles:
| Path | Profiles |
|---|---|
| Vendor side (came from or works at a security vendor) | 14 |
| Repeat CISO (held the top seat before) | 14 |
| Consulting | 8 |
| Government service | 7 |
| Financial services | 7 |
| Internal promotion | 4 |
| Deputy to CISO | 3 |
| Hands-on engineering | 2 |
Three profiles carry no path tag, so those three appear nowhere in the table.
Vendor side and repeat CISOs
The two largest groups are the vendor-side path and the repeat-CISO path, at 14 profiles each. The tags often appear together. Edwin Ng carries both: his profile lists a prior CISO seat and a vendor-side background, and he holds the CISO role at LogicGate, which is itself in the cybersecurity vendor sector. The source says:
Frank Krieger is tagged as a repeat CISO, vendor side, and financial services. His profile describes earlier work at Mambu, Miro and iland Cloud:
Amit Spitzer carries four tags: government service, vendor side, repeat CISO and internal promotion. His profile lists a long run of earlier employers:
Consulting, government, finance and internal routes
Consulting appears on 8 profiles. Government service and financial services each appear on 7. Christie Terrill carries the consulting tag alongside internal promotion and vendor side. Her profile at Bishop Fox describes the start of her career:
Government service shows up in several forms. Chris Jones is tagged deputy to CISO, government service and vendor side. His profile describes federal work before his current role at Axonius:
Chad Holmes carries the vendor-side, consulting and government tags. The profile records a move into a public-sector seat:
Internal promotion appears on 4 profiles, deputy to CISO on 3, and hands-on engineering on 2. These are the smallest groups in the September 2026 table. Terrill's and Spitzer's profiles are two of the places where the internal-promotion tag appears alongside other paths.
Sector counts
Appointments by sector, as the September 2026 profiles record them:
- Technology: 7
- Cybersecurity vendor: 6
- Financial services: 4
- Government and public sector: 3
Seven further sectors have one profile each: Professional services, Telecommunications, Higher education, Digital assets, Artificial intelligence, Energy and utilities, and Industrial and manufacturing.
The sector field and the path field measure different things. Sector records where the person now works, while path records where they have been. A person in the Technology sector can carry a financial services path tag, and a person in Financial services can carry a vendor-side tag. Frank Krieger is an example of the second case: his profile sits in Financial services and carries a vendor-side tag. Ed Moyle is an example of the first: his profile sits in Technology and carries repeat CISO, financial services and consulting tags.
The cybersecurity vendor sector, with 6 profiles, is a different group from the vendor-side path, with 14. The sector counts where the employer sits. The path counts where the career has run. Edwin Ng and Chris Jones are in both groups, since they hold se
Sources
The people behind the pattern

Amit Spitzer
CTO and CISO
Glilot Capital Partners

Chad Holmes
Chief Information Security Officer
Texas Office of the Attorney General

Chris Jones
Chief Trust & Security Officer
Axonius

Christie Terrill
Chief Information Security Officer (CISO)
Bishop Fox

Edwin Ng
Chief Information Security Officer
LogicGate

Frank Krieger
Chief Information Security Officer
Swap