Repeat CISOs and vendor-side paths lead October 2026's 12 profiled appointments

Ten of the 12 profiled appointments in October 2026 carry the repeat CISO tag, meaning the person had held a top security seat before, and eight carry the vendor-side tag.

This study is computed from profiles on CISO Spotlights, which now holds 322 profiles. Each profile carries verbatim passages from the sources it cites, and every quotation below is one of those passages. October 2026 has 12 profiled appointments, against 37 for September 2026.

How the paths are counted

Each profile is tagged with one or more career paths. A person can carry several tags, so the counts below add up to more than 12. None of the 12 profiles lacks a path tag.

Career path	Profiles
Repeat CISO (held the top seat before)	10
Vendor side (came from or works at a security vendor)	8
Hands-on engineering	5
Government service	4
Internal promotion	3
Financial services	3
Military service	2
Consulting	2
Deputy to CISO	1

Repeat CISOs

The repeat CISO tag is on 10 of the 12 profiles, more than any other path. It sits alongside other tags in most cases, which is why the later sections return to the same names.

Craig Davies is the CISO of Gathid and carries the repeat CISO, vendor-side and government service tags. A source on his profile lists his earlier roles:

Daniel Langley, CISO of the State of Oklahoma, carries four tags: military service, government service, deputy to CISO and repeat CISO. His profile cites a source on his earlier years:

Jim Desmond at HireRight carries the repeat CISO and financial services tags. The company's announcement describes the remit of his role:

The vendor side

Eight profiles carry the vendor-side tag, meaning the person came from a security vendor or works at one. Four of the 12 appointments are in the cybersecurity vendor sector itself, covered in the sector section below.

Kim Larsen, Group CISO at Keepit, carries the government service and vendor-side tags. His profile cites Keepit's own description of his background:

Drew McCombs carries the repeat CISO, hands-on engineering and vendor-side tags. His profile records a combined title at Cylerity:

Lea Kissner at LinkedIn carries four tags: repeat CISO, vendor side, hands-on engineering and consulting. A news report on her profile describes the appointment:

Engineering, promotion and finance

Five profiles carry the hands-on engineering tag. Three of them are McCombs, Kissner and Donna Hart, who also appear above or below under other tags. Three profiles carry internal promotion and three carry financial services. One profile carries the deputy to CISO tag, which is Langley's.

Donna Hart is CISO for the Americas at SMBC and carries four tags: internal promotion, repeat CISO, financial services and hands-on engineering. A conference speaker biography on her profile traces her early work:

Hart and Desmond are the two people on this page tagged financial services. Hart's seat is in the financial services sector. Desmond's seat, at HireRight, is in professional services.

Government, military and consulting

Four profiles carry government service. Davies, Langley and Larsen are three of them, and each now sits in a different sector: cybersecurity vendor for Davies and Larsen, and government and public sector for Langley. Two profiles carry military service. Langley's is the one described in the Army passage above. Two carry consulting, of which Kissner's is the one named in this study.

Taken together, the government, military and consulting tags describe smaller groups than the repeat CISO and vendor-side tags. Where they appear, they usually sit next to one of the two larger tags: Davies, Larsen and Kissner each carry vendor-side along with one of them.

Sectors and titles

The sector counts across the 12 appointments are as follows:

• Cybersecurity vendor: 4. Craig Davies at Gathid and Kim Larsen at Keepit are two of them.
• Financial services: 2. Donna Hart at SMBC is one of them.
• Healthcare and life sciences: 2. Drew McCombs at Cylerity is one of them.
• Technology: 2. Lea Kissner at LinkedIn is one of them.
• Government and public sector: 1. Daniel Langley at the State of Oklahoma is the profile in this sector.
• Professional services: 1. Jim Desmond at HireRight is the profile in this sector.

These six counts add up to the 12 appointments, since each profile has one sector.

Role titles are also counted. Seven of the 12 are plain Chief Information Security Officer. The other five titles each appear once: Chief Information Security Officer for the Americas, Chief Technology Officer and Chief Information Security Officer, Group Chief Information Security Officer, Chief Information Security Officer and Vice President, and a title that joins Group Chief Information Officer, Group Chief Digital Officer and Group Chief Information Security Officer. Hart holds the Americas title, McCombs the combined technology and security title, Larsen the group title, and Kissner the vice president title.

What the counts show for October 2026

Across October 2026's 12 profiled appointments, the profiles most often record a previous top security seat (10) and a vendor-side background (8). Hands-on engineering follows with 5, and government service with 4. Four of the 12 seats are at cybersecurity vendors, and the other eight are spread across five sectors. Each count comes from the path and sector tags on profiles that carry their own sourced passages.