Almost all chief information security officers (CISOs) now say they report directly to their CEOs, according to a new report from Splunk, with most now also taking part in regular Board meetings.

According to data published by the cybersecurity firm in its CISO Report 2025, 82% of CISOs are now managed by CEOs, a significant increase from the 47% who reported the same chain of command in 2023.

However, although 83% of the 500 CISOs and CSOs Splunk polled are now participating in Board meetings most of the time, only 29% of CISOs say their Board includes at least one member with cybersecurity expertise.

Splunk’s study also found a disconnect between the priorities of CISOs and their Boards, with 52% of CISOs reporting that they are focusing on innovating with emerging technologies, despite only 33% of Boards agreeing that should be a priority. 

A gap also exists in the perception of the work that CISOs do and the everyday reality, with 52% of Boards thinking that CISOs spend most of their time on business enablement, even though only 34% of CISOs report that’s the case.

That lack of understanding regarding CISOs’ role in the business is leading to more risk. Only 29% reported having the proper budget for cybersecurity initiatives, despite 41% of Board members who think cybersecurity budgets are adequate.  

The lack of financial support for security operations is hitting CISOs hard, with 64% concerned they’re not doing enough to meet the current threat landscape. with 62% of CISOs consequently saying that postponing an upgrade due to budget cuts led to a successful cyber-attack on their firm.

CISOs reported reduced security solutions and tools (50%), security hiring freezes (40%), and decreased or eliminated security training (36%) as some of the top cost-saving measures being enforced, which seems to be having a major impact on resilience, with 64% of CISOs saying that this lack of support has led to a cyber-attack. 

CISOs are taking these failings personally, with more than half (58%) saying the impact of security incidents is indicative of their success, however only 43% of Board members agreed.

Cybersecurity risks are not the only danger to business that CISOs are dealing with, however, as more than a fifth (21%) revealed they had been pressured not to report a compliance issue.

Recommended reading

• Two-thirds of CISOs Have Had Budgets Slashed Due to AI
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• Cyber Leaders Reveal Compliance and Boardroom Struggles

As regulatory environments become more complex, expansive, and punitive, firms are required to be faster at incident reporting, placing more liability on CISOs’ shoulders. Over half (57%) of CISOs now consider developing their regulation and compliance knowledge as essential to their role, however that feeling isn’t shared among Board members with only 44% agreeing.

“As cybersecurity becomes increasingly central to driving business success, CISOs and their Boards have more opportunities to close gaps, gain greater alignment, and better understand each other in order to drive digital resilience,” said Michael Fanning, CISO at Splunk.

“Bringing these groups together requires educating Boards on the details of cybersecurity, and for CISOs to understand the language and needs of the business while also making security a business enabler.

“For CISOs, that means understanding the business beyond their IT environments and finding new ways to convey the ROI of security initiatives to their boards. For board members, it means committing to a security-first culture and consulting the CISO as a primary stakeholder in decisions that impact enterprise risk and governance.”