Hiring Security Leaders: What Boards Get Wrong

Two in five CISO hires leave inside eighteen months. That is not a market problem. It is a hiring problem, and it starts with what boards think they are buying.

The pattern of the failed hire

The job spec is written by a technical team. It lists certifications, tool experience, and framework knowledge. The shortlist is built against it. The winning candidate is the deepest technologist on the list. They walk into a role where 80% of their actual job is commercial, political, and regulatory, and they leave before the second board cycle.

What boards should actually be hiring for

• Commercial judgement. Can they make a trade-off between risk reduction and revenue velocity without flinching?
• Regulatory fluency. Can they hold a conversation with a regulator, an auditor, and a GC, separately, and with the same credibility?
• Organisational craft. Can they build a team, carry a budget, and survive a difficult board meeting?
• Strategic narrative. Can they explain what security is for in this specific business, in ninety seconds, without jargon?

Where the process fails

The interview loop almost always over-indexes on technical validation and under-indexes on commercial simulation. The fix is to run at least one interview as a board simulation, whether a budget defence, a breach communication or a regulator conversation, and score against it.

The cost of getting this wrong

A failed senior security hire is rarely booked as a £150K cost. It is booked as "we need to restart the programme." The total carry is typically a year of lost ground, a demoralised team, and a board conversation that is harder the second time around.

The organisations that get this right treat the CISO search with the same executive rigour they apply to a CFO or COO hire. That shift alone eliminates most of the eighteen-month failures.