CISO Conversations: Are Microsoft’s Deputy CISOs a Signpost to the Future?

According to SecurityWeek, Microsoft’s Deputy CISO (dCISO) strategy was unveiled in 2024 as part of its broader Secure Future Initiative, with 14 dCISOs handling risk across the company and reporting to corporate CISO Igor Tsyganskiy. The programme assigns product-aligned dCISOs to specific domains, such as Azure, where Mark Russinovich serves as dCISO, while also covering horizontal areas like engineering systems to provide clear, integrated security governance.

Ann Johnson, corporate vice president and deputy CISO, describes her remit as front door for customer relations with Microsoft’s Office of the CISO, benchmarking and sharing threat intelligence across product groups. The piece notes that the concept aims to scale governance and accountability across Microsoft’s vast scope, acknowledging that a single CISO cannot be expert in all areas.

Both Johnson and Russinovich frame the model as potentially signposting the future for CISOs, while emphasising the need for agility, collaboration and effective communication to succeed at scale. The article also highlights rising threat concerns, including nation-state activity and the growing role of artificial intelligence in both attacks and defence. 14 October 2025.