CISO Trainings
,
Leadership & Executive Communication
,
Litigation
Rising Liability Risks Are Reshaping the CISO Role and Cybersecurity Leadership
The era of the technical specialist is fading. In its place stands a legally exposed executive whose concern is no longer just a system breach but potential personal indictment. Twenty years ago, the cybersecurity remit was defined by network integrity and resilience. Today, it is increasingly defined by the fine print of directors and officers, or D&O, insurance policies and the exact wording of board minutes.
See Also: Why HSMs Are Critical to Digital Asset Security
Following high-profile legal actions against security executives at SolarWinds and Uber, the laughter in the industry has largely disappeared. The era of the Fall Guy has arrived, and the implications for the profession are deeply troubling.
The Myth of the Seat at the Table
For years, the industry clamored for a seat at the table. Practitioners wanted cybersecurity treated as a business risk rather than just an IT problem. That wish was eventually granted, but it arrived with a poisoned chalice. The authority practitioners sought to shape strategy and influence the board now comes with a heavy burden of personal liability.
When regulators such as the U.S. Securities and Exchange Commission or the Australian Securities and Investments Commission start looking for a name to place on a charge sheet, they’re no longer focused on the entire board. They look for the person who signed the attestation – the CISO. This shift has fundamentally changed the psychology of the role. The job is no longer only about defending the network. It is also about defending a career and reputation under legal scrutiny.
This is most visible in the cases of Joe Sullivan at Uber and Timothy Brown at SolarWinds. These incidents were framed not simply as technical failures but as failures of transparency and disclosure. The message from the courts is clear. If the ship goes down, the captain is no longer the only one expected to stay aboard. The CISO may be the first person asked to answer for what happened.
The Rise of Defensive Security Leadership
In medicine, defensive medicine refers to doctors ordering unnecessary tests or avoiding high-risk procedures just to protect themselves against malpractice suits. The same pattern is now emerging in cybersecurity, a trend that can be described as “defensive security leadership.”
When a CISO knows personal assets and even freedom could be at risk, the way they report inevitably changes. Transparency, once the gold standard of a healthy security culture, is being stifled by legal caution. Instead of telling the board that a major gap exists in legacy systems that will take two years to fix, a C-level leader may now be advised by legal counsel to say the organization is continuously maturing its risk posture in alignment with industry frameworks.
One is an honest assessment. The other is a shield.
The irony is that this litigation-heavy environment might actually make companies less safe. If leaders are too afraid to document a known risk because that record could later be used against them in court, the risk doesn’t disappear. It simply goes underground. We are creating a culture of security by obfuscation in which the fear of the prosecutor outweighs the fear of the hacker. This creates a dangerous disconnect between the reality of the server room and the narrative in the boardroom.
The Erosion of Security Culture
A healthy security culture relies on the ability to report near misses and failures without the immediate threat of termination or litigation. When this model changes toward personal liability, the culture erodes. Junior analysts see their leaders dragged through the courts and draw a dangerous lesson: Do not put anything in writing that you would not want read aloud by a prosecutor.
In an Australian context, where the Security of Critical Infrastructure Act and a series of privacy reforms are tightening corporate accountability, the pressure is intense. Organizations are asking people to be transparent and collaborative in an environment that is increasingly hostile and litigious. This is not a recipe for better security – but one for burnout and an exodus of talent.
When the primary objective of a security report becomes the mitigation of personal legal risk, the actual protection of the organization becomes secondary. CISOs may spend more time with general counsel than with the head of engineering. This realignment of priorities benefits adversaries who operate without the burden of legal compliance or personal liability.
A New Social Contract
To avoid a mass exodus of talent from the CISO role, a new social contract is required between the security leader and the organization. This contract must be built on three specific pillars that go beyond the standard employment agreement.
First, personal indemnification must be non-negotiable. If a company expects a CISO to carry the weight of the organization’s digital survival, it must provide more than symbolic support, including personal indemnification. Increasingly, CISOs are demanding independent legal counsel during contract negotiations, separate from the company’s general counsel. This is a necessary evolution. The company’s lawyer is there to protect the company, which often involves finding a scapegoat. The CISO needs someone there to protect the CISO.
Secondly, the industry needs to redefine what success looks like. In a world where a breach is eventually inevitable, success cannot be the absence of an incident. It must be the evidence of due diligence and transparency in the response. The industry should move toward a “safe harbor model” in which leaders who follow established frameworks and report honestly are protected from personal litigation.
Finally, CISOs should have direct, unmediated access to the board. When the security leader reports through a CIO or CFO who filters the message through a budget or operational lens, risk communication becomes distorted. It is unreasonable to hold someone accountable for a risk they were not allowed to report accurately.
The Recruitment Crisis
The recruitment market is already feeling the impact of this liability shift. Seasoned practitioners are looking at CISO vacancies and deciding the risk isn’t worth the reward. Why take a role where you are personally liable for decades of legacy technical debt that you did not create and may not have the budget to fix?
If the industry does not address the liability issue, the market may produce two types of CISOs: those too inexperienced to fully understand the risks they are taking and those who approach the role through a transactional lens, staying just long enough to collect a bonus before moving on ahead of the next breach. Neither outcome serves the long-term interests of corporate security.
The Hard Truth
The profession is at a crossroads. One path continues toward making the CISO a designated scapegoat, the person whose head rolls so the CEO and CFO can keep theirs. The other requires acknowledging that cybersecurity is a collective and systemic responsibility.
Personal liability has not made organizations safer. It has made them more litigious, more guarded and more prone to paper security over actual defense. We are spending more on legal fees and D&O premiums than we are on actual threat hunting. This misallocation of resources ultimately benefits attackers.
It’s time to stop looking for a single neck to wring and start building governance structures that actually support the people on the front lines. The era of the “Fall Guy” needs to end. If we continue to treat our security leaders as sacrificial pawns, soon there will be no one left willing to take the role. A company without a security leader is already exposed, even if executives have not yet recognized the risk.
References and Further Reading
- U.S. Department of Justice (2023). Former Uber Chief Security Officer Joe Sullivan Sentenced to Probation for Obstruction of Justice. Regarding the 2016 data breach and the failure to report it to the FTC.
- U.S. Securities and Exchange Commission (2023). SEC Charges SolarWinds Corp. and CSO Timothy Brown for Fraud, Internal Control Failures. Focusing on misleading investors about cybersecurity practices.
- Australian Securities and Investments Commission (2022). ASIC v RI Advice Group Pty Ltd. A landmark Australian case establishing that failure to have adequate cybersecurity systems is a breach of licence obligations.
- Harvard Business Review (2023). The Changing Role of the CISO. An analysis of how legal exposure is shifting executive priorities.
- AICD (Australian Institute of Company Directors). Cyber Security Governance Principles. A guide for boards on shared responsibility and accountability frameworks.