Cybersecurity Is a Leadership Problem: Why the Management Model Needs to Catch Up
CSO, Wednesday, October 14th, 2026
A decade on, security still struggles with governance, authority and accountability rather than knowing which controls to use.
The author, who has written on cybersecurity management since 2015, notes that technology, budgets, regulation and board visibility have all grown, yet organizations still struggle with governance, silos, short-termism and execution.
The what of security is well understood, but the hard questions remain how controls get implemented and who owns and has authority over change.
CISOs are often accountable for issues they cannot resolve, while executives treat security as a service rather than part of the processes they own.
The piece argues that endless debate over CISO reporting lines reflects unclear expectations of the role, which organizations must define first.