CISO Succession Crisis Highlights How Turnover Amplifies Security Risks

When cybersecurity leadership turns over too quickly, risk does not reset; it compounds, a dynamic highlighted by discussions with Nicole Jiang of Fable Security. The piece notes that average CISO tenure now hovers between 18 and 26 months, with an industry survey showing 66% report excessive expectations and 63% reporting burnout within the past year. A 2024 survey by Heidrick & Struggles found that nearly half (47%) of surveyed CISOs did not have an adequate internal successor in place.

The consequence, according to the article, is not just executive churn but instability that ripples through security programmes, teams and risk posture, including disruptions to 24-hour security operations and the loss of tribal knowledge. Several industry voices argue for building a leadership pipeline and clearly defined ownership within security teams to reduce disruption when turnover occurs, moving away from the notion of a hero hire toward an organisation-wide approach to risk governance.