CISO Tenure Statistics: 2026 Report

Key Findings

• In S&P 500 10-K filings made from September 2025 to October 2026, 366 of 497 companies (73.6%, our calculation, base n=497) gave cybersecurity to a leader with the CISO title.
• Among the 53 filings that state a start date, the median security chief had been in the seat 3.6 years at filing (our calculation, base 53 filings).
• Of the 201 filings that state a reporting line, 3 (1.5%, our calculation, base n=201) show the security leader reporting to the CEO.
• Nine of the 497 filings (1.8%, our calculation, base n=497), all filed in 2026, describe an interim or vacant security chief seat.

How Long Have S&P 500 CISOs Been in the Seat?

This section measures time in the seat for the S&P 500 security chiefs whose 10-K gives a start date. Fifty-three filings give either the year the current security chief took the role or the year that person joined the company. We measured the time from that date to the filing date.

Source: CyberReviewed CISO Tenure Study (Source 1). Years in seat and shares are our calculation from the filing date. We used the first day of the stated month, or July 1 when the filing gives only a year (our assumption). Bands use exact values to one decimal. Less than 1 year is under 1.0, 1 to 2 years is 1.0 to 2.9, 3 to 4 years is 3.0 to 4.9, 5 to 10 years is 5.0 to 10.0, and More than 10 years is above 10.0.

Data: table1-time-in-seat.csv

• Across the 53 of 497 filings that give a start date, the median time in the seat was 3.6 years, about 43 months, and the mean was 4.6 years (both our calculation, base 53 filings). The five seats held for more than 10 years pull the mean up, and without them it falls to 3.9 years (our calculation, base 48 filings).
• Filings dated by the year the person joined the company show a median of 2.0 years (our calculation, 22 filings). Filings dated by the year the person took the role show a median of 4.6 years (our calculation, 31 filings).
• The 53 companies chose to give a date, so the median describes those companies and may not hold for the rest of the index. The other 444 filings give no start date for a current security chief (our calculation, base n=497).

The longest-serving security chiefs in the sample are at Progressive, where the chief security officer took the role in 2012, and American Express, where the CISO was promoted to the role in 2013. Chubb, eBay and Intel follow with security chiefs who started in 2015. Boeing's filing says its chief security officer joined in 2025 from the CISO role at Merck, and Merck's own 10-K, filed in February 2026, describes an interim CISO. Table 2 lists every company in the sample.

Source: CyberReviewed CISO Tenure Study (Source 1). Years in seat are our calculation, using the first day of the stated month, or July 1 when only a year is given (our assumption). Lululemon's filing describes a CISO who joined in March 2026, within days of the filing, and we count that seat as 0.0 years.

Data: table2-start-year-records.csv

• Of the 40 filings that make clear whether the security chief came from inside or outside the company, 31 describe an outside hire. That includes ten of the eleven security chiefs who started in 2025 or 2026.
• Nine filings describe a security chief promoted from inside. Tyson Foods says its CISO has been with the company since 1997, and The Hartford describes a 27-year tenure with the company before the current role.
• Recent seats in this sample went mostly to outside hires, so an internal successor was the exception. The most recent promotion from inside is News Corp's, dated December 2024.

How Many S&P 500 CISO Seats Are in Transition?

This section counts the S&P 500 filings that describe the security chief role as vacant or held on an interim basis on the day the 10-K was filed. Item 1C asks companies to describe who manages cybersecurity risk.

Source: CyberReviewed CISO Tenure Study (Source 1). Base: 497 filings.

Data: table3-seats-in-transition.csv

• Nine of the 497 filings (1.8%, our calculation) describe a security chief seat in transition. All nine were filed in 2026.
• Three of the nine gave the role to the CIO or CTO for the time being, and five had an interim CISO or co-CISOs in place. Marriott's filing says it intends to appoint an interim.
• The count sets a floor for how often an S&P 500 company files its annual report while it is still looking for a security chief. Seven of the nine came out in February 2026, the month in which 356 of the 497 companies filed (our calculation, base n=497).

A count at a single point in time cannot be converted into an annual turnover rate, because a search can close within weeks and many changes happen between filings. Marriott's filing says its CISO would leave in late February 2026 "for a position in another industry," and CME Group's says its former CISO moved to another company.

Who Leads Cybersecurity at S&P 500 Companies?

This section records the title of the person each of the 497 companies puts in charge of cybersecurity in its 10-K.

Source: CyberReviewed CISO Tenure Study (Source 1). Shares are our calculation. The coding rule is in Data Collection and Methodology. The dataset gives each leader's title as written.

Data: table4-security-leader-title.csv

• Of the 497 filings, 366 (73.6%, our calculation) give cybersecurity to someone with the CISO title, and 459 (92.4%, our calculation) give it to a dedicated security leader of some kind. The other 38 (7.6%, our calculation, base n=497) give the program to an executive without a security title, a committee or an outside firm, or state no leader.
• At Dell the chief security officer reports to the general counsel and the CISO reports to the chief security officer. At VeriSign the Executive Vice President of Technology and Chief Security Officer oversees the CISO, CIO and CTO.
• A search of 10-K filings for the CISO title alone misses the chief security officers, vice presidents and directors who lead the program at other companies. Together they account for 93 filings, or 18.7% (our calculation, base n=497).

Several of the largest companies use titles other than CISO. Apple's filing puts management of cybersecurity risk under its Head of Corporate Information Security, Alphabet's under a Vice President of Privacy, Safety, and Security, and Netflix's under a Senior Director, Security, Privacy & Assurance. Caterpillar, Lennox and Bunge give the program to the CIO or CTO, and Quanta Services gives it to a senior vice president of technology who leads both IT and cybersecurity and reports to the CFO.

In Financials, 88.2% of the 76 filings use the CISO title, against 45.2% of 31 in Utilities and 40.0% of 20 in Energy (our calculation). Table 6 gives the split for every sector.

Who Do S&P 500 CISOs Report To?

This section sorts the executives that dedicated security leaders report to, for the 201 of 497 filings (40.4%, our calculation) that state a line. Reports to the board or its committees are not counted. The 38 filings without a dedicated security leader are also left out, including Quanta Services, where the senior vice president of technology who leads cybersecurity reports to the CFO.

Source: CyberReviewed CISO Tenure Study (Source 1). Shares are our calculation. Covers dedicated security leaders only. Where a chief security officer leads the program, the line is that officer's own.

Data: table5-reporting-line.csv

• Technology executives account for 157 of the 201 lines (78.1%, our calculation), and the CIO or chief digital officer alone for 111 (55.2%, our calculation). The CTO or a combined technology and operations head accounts for another 31 (15.4%, our calculation, base n=201).
• Three filings place the security leader directly under the CEO. At VeriSign that leader is a chief security officer who is also Executive Vice President of Technology, and Amazon's chief security officer and AEP's Senior Vice President of Enterprise Security, Resilience, and National Security Policy also report to the CEO.
• The usual manager in these filings is the CIO, and a direct line to the CEO is rare. Lines to the general counsel, the CFO or the COO outnumber CEO lines about nine to one (our calculation, base n=201).

Lines to the general counsel or chief legal officer include Accenture, Dell, DoorDash and KLA, and the other executives include general managers and chief administrative officers. At Disney the CISO reports to both the Chief Information and Data Officer and the Chief Security Officer, so we coded the chief security officer, who reports to the CFO.

Source: CyberReviewed CISO Tenure Study (Source 1). Shares and medians are our calculation. The CISO share uses all filings in the sector. Reporting-line and experience columns cover dedicated security leaders. Shares and medians are omitted where fewer than five filings in the sector report the item.

Data: table6-by-sector.csv

• In Information Technology, 18 of the 38 filings that state a line place the security leader under an executive outside technology. Adobe, HP, Microchip Technology and Zebra Technologies report to the CFO, and Cisco, Marvell and ServiceNow to the COO.
• All 19 Consumer Staples filings that state a line place the security leader under a technology executive, as do 29 of 31 in Industrials. The two Industrials exceptions, Pentair and TransDigm, placed the security leader under the CFO when they filed, and Pentair's filing says its CIO/CISO moves to a CEO line from March 1, 2026.
• A comparison of reporting lines between two companies is most useful within one sector, because the split between technology and other executives differs widely across sectors. Sector medians of stated experience stay between 20 and 25 years (our calculation, base n=307).

What Backgrounds Do S&P 500 CISOs Bring?

This section summarizes the experience and credentials that S&P 500 filings describe for the dedicated security leader. Companies choose what to include, so the shares in Tables 7 and 8 count what filings mention.

Source: CyberReviewed CISO Tenure Study (Source 1). Shares are our calculation. Base: 307 of the 459 filings with a dedicated security leader. Filings usually state a floor ("over 20 years"), and we recorded the number given.

Data: table7-stated-experience.csv

• The median stated figure across the 307 filings is 22 years, and 281 of them (91.5%) say 20 years or more (both our calculation). Only 26 filings (8.5%, our calculation, base n=307) state less than 20 years.
• Round figures dominate. Filings state 20 years 125 times, 25 years 76 times and 30 years 52 times, and filings often phrase experience as "more than" a round number.
• Because filings state a floor, these figures show the least experience a company claims for its security leader, and the leader may have more. The highest figure in the dataset is Emcor's, which gives its CISO more than 40 years of experience.

Source: CyberReviewed CISO Tenure Study (Source 1). Shares are our calculation. Base: 459 filings with a dedicated security leader.

Data: table8-background-markers.csv

• Of the 459 filings, 81 cite the CISSP for the security leader, about three times as many as cite the CISM (25), our calculation. Sixteen filings cite both certifications (our calculation, base n=459).
• Of the 459 filings, 52 describe a security leader who held a CISO or chief security officer role at another organization first. Uber's CISO, for example, was CISO and deputy CTO at a Fortune 500 company, and Intel's was chief security officer at McAfee.
• A filing that leaves out a credential does not show that the leader lacks it, so these counts work as a lower bound for the index. Of the 459 filings, 271 (59.0%) mention none of the five details (our calculation, base n=459).

Filings that mention military or government service include Merck's, for its interim CISO (US Army and National Security Agency), and Kenvue's, for its CISO (US Air Force Reserve).

IANS Research reported an average tenure of nine years among the CISOs in its 2026 survey, and 70% of them had held the job at more than one company. We read the nine years as time in the CISO job across employers, which would make it a different measure from time in one seat.

How Do CISO Tenure Surveys Compare?

This section sets the published tenure figures beside our 10-K median and shows what each one measures. A Korn Ferry article on CISO retention also repeats the 18-to-26-month range.

Sources: Cybersecurity Ventures, Heidrick & Struggles, Hitch Partners, CyberReviewed CISO Tenure Study (Source 1). Our figure uses July 1 as the start when a filing gives only a year (our assumption).

Data: table9-tenure-by-source.csv

• The 18-to-26-month range has no survey behind it in the sources that repeat it. Cybersecurity Ventures presented it in 2020 as an estimate "by various sources," and its 2023 headcount report repeated it as "only estimated at 18 to 26 months."
• The survey averages of time in the current role run from 36 to 48 months, counting Heidrick's 4 years as 48 months (our conversion). The small-company figures in Table 11 are lower.
• Our figure is a median from filings whose companies chose to give a date, and the survey figures are averages from people who chose to respond. The two kinds of figure describe different groups of security chiefs.

Heidrick & Struggles reports time in the current role in five bands (less than 1 year, 1 to 2 years, 3 to 4 years, 5 to 10 years and more than 10 years), which allows a direct comparison with our 10-K sample.

Sources: CyberReviewed CISO Tenure Study (Source 1), 53 filings; Heidrick & Struggles 2024 Global CISO Organization and Compensation Survey, 396 respondents. Our bands are our calculation on exact values to one decimal (under 1.0, 1.0 to 2.9, 3.0 to 4.9, 5.0 to 10.0, above 10.0), with July 1 as the start when a filing gives only a year (our assumption).

Data: table10-tenure-bands-10k-vs-heidrick-2024.csv

• Our sample has a larger share of security chiefs under one year than Heidrick's respondents (18.9% of 53 filings against 13%, our calculation). That may reflect a selection effect, if filings tend to describe new outside hires.
• Our sample also has a larger share above 10 years (9.4% of 53 filings against 3%, our calculation). Four of those five seats are dated by the start of the role, and Chubb's by the year its CISO joined the company.
• With more seats at both ends of the bands, a single average or median for these filings says little about how many seats are new and how many are long held. Our filings spread more evenly across the five bands than Heidrick's responses do.

Heidrick reported that 63% of its 2024 respondents had been in the role at least three years, up from just over half the year before but down from 77% in 2022. The S&P 500 filings are a different population, and among them 32 of 53 (60.4%, our calculation) had reached three years. Heidrick also found that slightly less than half of respondents had no internal successor in place.

Hitch Partners breaks out average current tenure by company size, and its figures are shortest at the smallest companies.

Source: Hitch Partners 2026 Global CISO Benchmark.

Data: table11-hitch-2026-tenure-by-company-size.csv

• Hitch describes the 28-month figure for companies under 500 employees as 40% shorter than the 47-month average at companies with 5,000 to 9,999 employees. The gap is 19 months (our calculation, from Hitch's published averages for the two size bands).
• Hitch's 2025 survey reported that tenure at companies with fewer than 250 employees was "significantly less" than at larger ones. Hitch's 2026 bands start at under 500 employees, a wider small-company group than the 2025 cutoff of 250.
• In Hitch's figures, tenure rises with company size up to 9,999 employees and dips at companies with 10,000 or more. An average across all sizes mixes short small-company seats with longer mid-size ones, and a figure for large companies needs a large-company breakout.

How Do Survey Reporting Lines Compare With 10-K Disclosures?

This section compares the reporting lines in our 10-K dataset with the reporting lines CISOs give in surveys, for technology executives and for the CEO.

Sources: CyberReviewed CISO Tenure Study (Source 1); Heidrick & Struggles 2024 and 2025 surveys; IANS Research and Artico Search 2026 State of the CISO. In our row, technology executive covers the CIO or chief digital officer, the CTO or a combined technology and operations head, and other technology heads, and both shares are our calculation. Heidrick's category is the CIO, CDO or CTO, and IANS reports lines into IT. Survey respondents and 10-K filings are different populations.

Data: table12-reporting-lines-10k-vs-surveys.csv

• Heidrick's 2025 survey found 42% of respondents reporting to the CEO, which it called three times the share in its 2024 survey, while reporting to the CIO or CTO fell from roughly half to 30%. Among its publicly traded companies, 21% of respondents reported to a global CISO or chief security officer.
• IANS found that 64% of CISOs report into IT and 36% to business leaders such as the CEO, COO, general counsel or chief risk officer. Executive-level CISOs were twice as likely as VP-level CISOs to report to business roles.
• A survey's CEO-reporting share describes its own respondents, and it cannot stand in for the reporting lines that large public companies disclose. Within Heidrick's 2025 survey, the CEO share is 36% at publicly traded companies against 42% for all respondents.

Survey respondents include divisional and regional CISOs at private and venture-backed companies, where Heidrick found the CEO share at 54% for private equity-backed and 57% for venture-backed companies. Hitch's 2026 benchmark found CEO reporting falls from 32% at companies under 500 employees to 3% at companies with more than 10,000, and 34% of its public-company respondents report to the CIO. Item 1C describes the most senior security leader at a large public company.

What CISO Tenure Data Means

When a security chief leaves, someone still has to own the cybersecurity program and run the search. Deciding both in advance leaves a named person accountable for the program while the seat is open.

A CISO tenure figure means little without its source and a statement of what it measures.

Before relying on a company's security leadership, read the Item 1C section of its latest 10-K to see who holds the role today.

Sources

1. CyberReviewed, CISO Tenure Study: analysis of the cybersecurity sections (Item 1C) of the latest Form 10-K filings of 497 of the 500 S&P 500 companies, retrieved from SEC EDGAR, conducted October 2026. Dataset: sp500-item1c-security-leader-dataset.csv. Table data: table1-time-in-seat.csv, table2-start-year-records.csv, table3-seats-in-transition.csv, table4-security-leader-title.csv, table5-reporting-line.csv, table6-by-sector.csv, table7-stated-experience.csv, table8-background-markers.csv, table9-tenure-by-source.csv, table10-tenure-bands-10k-vs-heidrick-2024.csv, table11-hitch-2026-tenure-by-company-size.csv, table12-reporting-lines-10k-vs-surveys.csv.
2. Heidrick & Struggles, 2024 Global Chief Information Security Officer (CISO) Organization and Compensation Survey. https://www.heidrick.com/-/media/heidrickcom/publications-and-reports/2024-global-ciso-organization-and-compensation-survey.pdf
3. Heidrick & Struggles, 2025 Global Chief Information Security Officer (CISO) Compensation Survey (published February 2026). https://www.heidrick.com/-/media/heidrickcom/publications-and-reports/2025-global-chief-information-security-officer-ciso-comp-survey.pdf
4. Hitch Partners, 2025 CISO and Security Leadership Survey Results. https://www.hitchpartners.com/ciso-security-leadership-survey-results-25
5. Hitch Partners, 2026 Global CISO Benchmark. https://www.hitchpartners.com/ciso-survey-results-26 and https://2026-ciso-survey.vercel.app/
6. IANS Research and Artico Search, 2026 State of the CISO Snapshot Report. https://sf-cdn.iansresearch.com/sitefinity/docs/default-source/reports/2026-state-of-the-ciso-snapshot-report.pdf
7. IANS Research, press release of January 15, 2026. https://www.iansresearch.com/resources/press-releases/detail/2026-report-finds-executive-level-ciso-titles-more-prevalent-than-ever
8. Cybersecurity Ventures, "24 Percent Of Fortune 500 CISOs On The Job For Just One Year" (July 13, 2020). https://cybersecurityventures.com/24-percent-of-fortune-500-cisos-on-the-job-for-just-one-year/
9. Cybersecurity Ventures, CISO Workforce and Headcount 2023 Report. https://www.ciso.inc/wp-content/uploads/2023/08/CISO-Report-2023-.pdf
10. Korn Ferry, "The CISO Dilemma." https://www.kornferry.com/institute/the-ciso-dilemma

Data Collection and Methodology

Company list. We used the S&P 500 constituent list as published on October 24, 2026 (503 share classes, 500 companies). Three companies had no Form 10-K on EDGAR. For the remaining 497, we took the most recent 10-K from each company's SEC submissions record. Filing dates run from September 26, 2025 to October 2026, and 459 of the 497 were filed in 2026.

Extraction. We extracted the text of Item 1C (Cybersecurity) from each filing, ending at Item 2 (Properties). Where a filing placed its cybersecurity disclosure elsewhere, as some banks do inside risk management sections, we used the sentences describing the security leader or the "risk management and strategy" passage. Where Item 1C incorporates the disclosure by reference from the annual report filed as an exhibit to the 10-K, as at BNY and Wells Fargo, we used that exhibit. All 497 filings are coded, and Tables 1 to 8 use them.

Title coding. A filing has a dedicated security leader when it identifies a current CISO, whatever part the filing gives that CISO in the program, or describes a person whose title includes security, cybersecurity or information security, alone or combined with other duties, as leading or managing the cybersecurity program or its day-to-day work. We coded the most senior security title in that role. A chief security officer or similar chief security title (including global chief security officer, chief trust officer, chief security and privacy officer, chief security and information security officer, and chief information risk officer) that leads or oversees cybersecurity, or to whom the CISO reports, is coded as a chief security officer or similar. A chief security officer with a physical security remit only is ignored. Seats in transition are coded by the seat. A leader described as acting as CISO under a non-CISO security title is coded as other security title. A leader whose title has no security term (such as a CIO, CTO or vice president of IT), or an outside firm retained to act as CISO, means no dedicated security leader. The dataset gives each leader's title as written (original_title), left blank for the 38 filings without a dedicated security leader. Its recode_flag column marks the filings coded under the combined-title rule (a security title other than CISO or a chief security title, alone or combined with other duties), and recode_note states the rule each of those rows meets.

Reporting lines. Lines were taken from sentences in which the dedicated security leader reports to, or works within the organization of, a specific executive role. Where a chief security officer is coded as the leader, we used that officer's own line. Reports to the board or its committees were excluded. Where a security leader reports through a technology chief who reports to the CEO, we coded the technology chief.

Experience. We recorded the first total figure of years stated for the coded leader as an individual, including statements that give one figure for both the leader and another executive ("each of whom"). We excluded team, collective, average and combined figures for several people, durations at one prior employer, company tenure, and "decades" with no number. "Nearly 20 years" was recorded as 20, and "two decades" as 20.

Start dates. Start dates come from sentences stating when the current security chief took the role (role start) or joined the company (company join), coded for every filing with a dedicated security leader and excluding seats in transition. Years in seat are our calculation from the filing date, using the first day of the stated month, or July 1 when only a year is given (our assumption). Bands use exact values to one decimal, as set out under Table 1. Interim and vacant seats were found by searching for interim, co-CISO, departure and search language and reading each match.

Credentials and background. CISSP, CISM, degrees, military or government service and prior security chief roles were matched on keywords in sentences about the coded security leader, including statements that cover the leader together with the team, and checked by hand. Statements about the team alone, or about another executive, were excluded. These counts are a lower bound, because filings vary in how much they describe.

Checks. Reporting lines, start dates and every experience value outside the automated pass were checked by hand against the evidence sentence, which the dataset records for each reporting line, experience figure and start date. Conversions from years to months are our calculation.

Item 5.02 filings on Form 8-K. Companies report the departure or appointment of certain officers on Form 8-K under Item 5.02, but the rule covers principal officers and the executives whose roles the proxy statement covers, which seldom include the CISO. A full-text EDGAR search for "chief information security officer" in 8-K filings during 2025 returned 47 filings, seven of them under Item 5.02, too few to measure turnover.

Survey figures. Survey figures are reported as published. The Hitch Partners 2026 tenure-by-size figures come from the report's chart values and the text that describes them.