We Gave Cyber Risk to the CISO and Walked Away

Institutions tend to believe persistent problems will, over time, settle into place. A risk emerges. It creates friction. Eventually responsibility is assigned, processes form around it, and the problem becomes manageable, if not resolved. Cyber risk has never quite followed that pattern. Instead of being absorbed into general management, it was professionalized. Organizations hired specialists, built security teams, invested heavily in tools, and elevated a role meant to sit at the center of digital uncertainty. Over time, the presence of this role came to function as reassurance. Someone was responsible. Someone was paying attention. What remained less clear was whether…