Illumio says CISOs need more power in cybersecurity decisions

Illumio argues that CISOs are being held responsible for enterprise cyber risk without the authority, budget or board access to manage it. The article points to direct reporting lines, board oversight and new regulatory pressure in the US and Europe as the fix.

Why it matters: - Cybersecurity failures can leave CISOs accountable for risks they were not empowered or funded to solve. - Illumio argues that the gap between responsibility and authority is now a core enterprise risk, not just a security-team problem. - Public company boards and senior leaders face growing pressure to treat cyber risk as a governance issue, not an operational afterthought.

What happened: - Business Reporter published an article from Illumio on sharing cybersecurity responsibility across the enterprise. - The article says only 5% of CISOs in a global survey report directly to the CEO. - Illumio says CISOs should report directly to the CEO and have a standing seat in board-level risk discussions.

The details: - The article says many security chiefs have seen their role shift from strategic adviser to the person expected to explain failed controls, budgets or organizational decisions. - The SEC requires public companies to disclose how boards oversee cybersecurity risk and how management handles it. - Europe’s NIS2 regime adds duties and potential personal liability for boards and senior management. - Illumio says the goal should be to align liability for cyber risk with the agency to reduce it. - The article frames cybersecurity as a board-level responsibility that needs real decision-making power and investment.

Between the lines: - The message is partly about governance, but it is also about speed. Security leaders cannot manage enterprise-wide risk if they sit too far from budget and strategy decisions. - Regulatory pressure is pushing boards to be more explicit about cyber oversight, which may force tighter links between CISOs, executives and directors. - Illumio’s position reflects a broader shift in security thinking: containment and resilience are becoming as important as prevention.

What's next: - Companies may face more pressure to formalize CISOs’ reporting lines and board access. - Boards are likely to face greater scrutiny over whether cyber risk oversight is active or merely documented. - The article suggests the next step is not blaming CISOs after an incident, but giving them the authority to prevent and contain one before it spreads.

The bottom line: - Cybersecurity accountability is moving up the org chart, and authority will need to move with it.