4 MIN READ
The CISO arrives at twice the market rate. The consulting firm arrives at seven figures. A year later the security posture looks the same as it did on the day the press release went out. The single hire, the expensive single engagement, the heroic single intervention. None of them survive the departure of the single interventionist. A senior security leader who joined a Fortune 500 in 2023 and left in 2025 took the entire detection program with them in a box. The board paid twice and got the same posture.
Here amounts to the part the board does not hear. A CISO who joins at the senior level needs 6 to 12 months of learning before becoming operational. A CISO who joins at the junior level needs 12 to 24 months. An executive expected to fix the program in the first year does not yet understand the program well enough to fix it. The CISO who understands the program and the program still does not change lacks the relationships that turn recommendations into budget. The single hire fails for structural reasons, and the structural reasons match the same reasons the diet fails without the lifestyle change.
Why the single hire does not work
Knowledge sits as the first problem. A new CISO knows the security program in general. A new CISO does not know the security program at the new company. The systems, the stakeholders, the culture, the budget, the history, the politics all need to be learned. Senior hires need 6 to 12 months before becoming operational. Junior hires need 12 to 24 months. An executive expected to fix the program in year one simply does not yet understand the program well enough to fix it.
Buy-in sits as the second problem, and the second problem runs as the harder one. Building relationships with the stakeholders who will implement the changes takes time. Stakeholders block changes from someone they do not trust. Stakeholders adopt changes from someone they do. The buy-in work takes the longest and stays the most invisible. The board sees the security program after the buy-in work. The board does not see the buy-in work. The board measures the new executive on the program, and the program runs on the buy-in work, and the buy-in work does not show up in the measurement.
Sustainability rounds out the three problems, and the third problem carries the most weight after the resignation letter. The CISO who joins, fixes the program, and leaves. The company has the fixes for as long as the executive stays. The executive leaves. The fixes erode. The next CISO walks into a program that looks the way the program looked before the previous CISO, plus the cost of the previous CISO salary. The company ends up back where it started, with the additional context of having tried the single hire once.
What actually works
Systemic change sits as the first pattern. An executive who changes the system, the process, the tooling, the policy, the metrics, leaves a system that produces the right outcomes. An executive who changes the people leaves a system that produces the right outcomes only with the right people, and the right people leave. The systemic change amounts to the change that survives the departure. The process stays documented. The tooling stays in the procurement cycle. The policy stays in the policy library. The metrics stay in the board report. The next executive inherits the system, and the system keeps producing the outcomes the previous executive set up.
Team building serves as the second pattern. An executive who builds the security org, the senior engineer, the analyst, the architect, the program manager, leaves an org that continues the work. The org survives the executive departure. The security org amounts to the part the board does not see in the press release, and the security org amounts to the part the program runs on after the press release ends. A LinkedIn profile that says “built a 12 person security team from scratch” reflects an executive whose next company inherits a working system, not a stack of initiatives.
Stakeholder education rounds out the three patterns, and the third pattern runs as the longest lever. An executive who educates the CEO, the board, the engineering leader, the product leader leaves stakeholders who understand the security program and can continue to fund it. The educated stakeholders survive the executive departure. A board that knows the difference between mean time to detect and mean time to contain sits as a board that has been educated, and a board that has been educated amounts to the strongest defence against the next single hire that does not work.
What the company should do
First, hire for the systemic track record. The interview question amounts to one the recruiter will not want to ask and the candidate will not want to answer: what did the candidate change that outlasted the candidate’s tenure? A candidate with no answer does not get the job. A candidate with two or three concrete answers gets the follow up, the references, the offer. The systemic track record serves as the only track record that survives the departure.
Second, fund the program, not the person. The budget that goes to the program, the tooling, the training, the process, the team, produces the outcome. The budget that goes to the person produces the dependency. A CFO who approves the program budget gets a program. A CFO who approves the salary budget gets a person, and the person will leave.
Third, measure the systemic metrics, not the heroic ones. Vulnerabilities patched per month, detection latency, containment latency, recovery latency. The systemic metrics improve with the systemic change, and the systemic change amounts to the change that survives. The heroic metrics, the conference talks, the press coverage, the LinkedIn announcements, improve with the heroic person, and the heroic person will leave.
The bottom line
Hire for the systemic track record. Fund the program, not the person. Measure the systemic metrics. The single hire will not save the company. The systemic change will. The executive willing to make the systemic change amounts to the executive worth hiring.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
