4 MIN READ
Picture the same letter, different signature, posted to a private LinkedIn update every few weeks. The CISO resignation letter has stopped being a story and started being a genre. The reasons are depressingly consistent across them. Not enough authority. Not enough budget. Not enough board attention. Then a breach, then a quiet exit, then a polite short note about family and opportunity.
The pattern repeats because the role has not been fixed. The resignation is the symptom, not the cause. Boards that treat the exit as a hiring problem onboard the next CISO into the same trap. Boards that treat it as a structural problem have a fighting chance of keeping them.
What the letters actually say
Most letters lead with the personal reasons. Family, health, a better opportunity. The framing lets the CISO leave without burning the bridge, and the language protects the relationship with the rest of the executive team. The personal reasons are usually real. They are also the safest version of the truth.
The strategic misalignment sits underneath. The letter talks about the gap between the security vision and the appetite of the executive floor, the language about wanting a different kind of organisation, the polite framing that says they are too ambitious for the company without saying the company is not serious about security. The polite read is that the role outgrew the person. The honest read is usually the other way around.
Then the breach exhaustion. The weight of the last incident, the postmortem cycle, the regulatory follow up, the insurance claim, the burnout from running the marathon on no sleep. This is what the letters write around most, because it is what the CISO carries personally. No resignation letter has ever opened with it, and the absence tells you everything.
What the letters do not say
The letters are also careful about what they leave out, and the omissions are usually the part that decides whether the next hire survives.
Start with the budget refusal. The letter does not say the board approved a security budget that ran a third of the peer benchmark. The letter does not name the initiative the CFO blocked. The letter does not list the headcount HR denied. The next CISO walks into the same budget, the same block, the same denial, and the same impossible targets that came out of the last round of cuts.
Then the peer pressure. The letter does not mention the CEO comparing the security spend to marketing at every quarterly review. It does not name the board member who asked why security was bigger than sales. It does not describe the conversation where the outgoing CISO was told to “just say no to the auditors.” That meeting is still happening. The next hire gets the same conversation in their first month.
Last, the breach blame. The letter does not mention that the CISO signed off on the configuration the breach later exploited. It does not mention that the executive team had rejected the proposed fix eighteen months before the incident. It does not mention that the outgoing leader was asked to take the fall for an executive decision. The next hire walks into the same breach risk, the same executive decision, the same fall waiting to happen.
How to stay
Three moves if you want the job to last past the second year. Each has a name and a cost, and skipping any of them is the most common way the cycle restarts.
Negotiate the authority before you sign. No direct line to the CEO, no veto on the security budget, no authority to hire your own team, and the job has already failed. The conversation at the offer table is the one with the most use. The conversation after the breach arrives too late to matter.
Build the executive sponsorship that does not depend on you. Being the only person in the building who cares about security burns out in eighteen months. Having the CEO, the CFO, and the general counsel as active allies gets you through the next breach. Sponsorship is something you build before you need it, not after.
Document the refused risk. If you proposed the fix and were told no, the documentation is what protects you when the fix becomes the breach. It lives in the email archive, the board deck, the audit log. CISO with the documentation has a career after the breach. CISO without it does not.
The bottom line
The resignation letter is a symptom. The role, not the resume, is what the executive team has to fix. Authority at the offer, sponsorship before the breach, documentation in the email archive. Miss one, and the next letter writes itself.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
