Skip to content
CISO Spotlights

Path study: September 2026

Vendor-side and repeat CISO paths tie at 14 of 27 profiled in September 2026

September 2026 path study: 27 profiled CISO appointments, with vendor-side and repeat-CISO paths each at 14, plus sector and title counts, from sourced profiles.

By the CISO Spotlights Desk · Published · Built from 6 profiles

Of the 27 appointments profiled for September 2026, 14 involve a career path through a security vendor and 14 involve a CISO who has held the top seat before.

This study is computed from profiles on CISO Spotlights, a site of 236 sourced profiles. Each profile carries its own verbatim passages from the sources it cites, and the examples below quote those passages without changes. A profile can carry more than one path tag, so the path counts overlap and do not add up to the number of appointments. Some example profiles below sit elsewhere in the site's dataset rather than in the September 2026 count; they are used to show what each path tag looks like, not to date anyone's appointment.

The September 2026 count

The site profiled 27 appointments for September 2026, up from 15 in August 2026. The study reads only the tags and fields that those profiles carry: path tags, sector, and role title. It does not infer why a company chose a person, and it does not rank the paths. It counts them.

Path counts

Here are the path tags across the September 2026 profiles:

PathProfiles
Vendor side (came from or works at a security vendor)14
Repeat CISO (held the top seat before)14
Consulting8
Government service7
Financial services7
Internal promotion4
Deputy to CISO3
Hands-on engineering2

Three profiles carry no path tag, so those three appear nowhere in the table.

Vendor side and repeat CISOs

The two largest groups are the vendor-side path and the repeat-CISO path, at 14 profiles each. The tags often appear together. Edwin Ng carries both: his profile lists a prior CISO seat and a vendor-side background, and he holds the CISO role at LogicGate, which is itself in the cybersecurity vendor sector. The source says:

Frank Krieger is tagged as a repeat CISO, vendor side, and financial services. His profile describes earlier work at Mambu, Miro and iland Cloud:

Amit Spitzer carries four tags: government service, vendor side, repeat CISO and internal promotion. His profile lists a long run of earlier employers:

Consulting, government, finance and internal routes

Consulting appears on 8 profiles. Government service and financial services each appear on 7. Christie Terrill carries the consulting tag alongside internal promotion and vendor side. Her profile at Bishop Fox describes the start of her career:

Government service shows up in several forms. Chris Jones is tagged deputy to CISO, government service and vendor side. His profile describes federal work before his current role at Axonius:

Chad Holmes carries the vendor-side, consulting and government tags. The profile records a move into a public-sector seat:

Internal promotion appears on 4 profiles, deputy to CISO on 3, and hands-on engineering on 2. These are the smallest groups in the September 2026 table. Terrill's and Spitzer's profiles are two of the places where the internal-promotion tag appears alongside other paths.

Sector counts

Appointments by sector, as the September 2026 profiles record them:

  • Technology: 7
  • Cybersecurity vendor: 6
  • Financial services: 4
  • Government and public sector: 3

Seven further sectors have one profile each: Professional services, Telecommunications, Higher education, Digital assets, Artificial intelligence, Energy and utilities, and Industrial and manufacturing.

The sector field and the path field measure different things. Sector records where the person now works, while path records where they have been. A person in the Technology sector can carry a financial services path tag, and a person in Financial services can carry a vendor-side tag. Frank Krieger is an example of the second case: his profile sits in Financial services and carries a vendor-side tag. Ed Moyle is an example of the first: his profile sits in Technology and carries repeat CISO, financial services and consulting tags.

The cybersecurity vendor sector, with 6 profiles, is a different group from the vendor-side path, with 14. The sector counts where the employer sits. The path counts where the career has run. Edwin Ng and Chris Jones are in both groups, since they hold se

Sources

  1. 1.
    securityweek.comsecurityweek.com · undated page · tier B
  2. 2.
    securityweek.comsecurityweek.com · undated page · tier B
  3. 3.
    securityweek.comsecurityweek.com · undated page · tier B
  4. 4.
    bishopfox.combishopfox.com · undated page · tier B
  5. 5.
    axonius.comaxonius.com · undated page · tier B
  6. 6.
    csoonline.comcsoonline.com · undated page · tier B

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

See an error? Request a correction.

The people behind the pattern