Dive Brief:

• CISO turnover rates remained soft during the first half of 2024, as economic uncertainty continued to slow demand for new executive hires, according to a compensation study by IANS Research and Artico Search. Annual rotation of CISOs was 11% for the first half of the year, compared with 12% for 2023 and 21% for 2022.
• Average compensation for CISOs — including base salary, bonuses and equity — is $565,000 per year, with median compensation coming in at $403,000. The top 10% of CISOs are earning more than $1 million per year, with about 1% earning more than $3 million per year.
• About 70% of CISOs in the study received merit-based raises, averaging 5.6% base salary increases and 6.3% growth to total compensation. However, CISOs that changed jobs saw compensation rise 31% on average, according to the report. The report is based on a survey of 755 security executives conducted between April and August of this year.

Dive Insight:

The report highlights how lingering concerns about the economy have impacted the job market for CISOs as well as compensation for those roles. 

“There’s been a lack of momentum in the hiring market,” said Nick Kakolowski, senior research director at IANS, in an email. “CISOs are staying at jobs longer and companies are conservative about hiring.”

The market has been relatively stable, as cybersecurity is considered a growing priority at companies, Kakolowski said. In addition, there are signs the hiring market is beginning to pick up. 

Another major change in CISO compensation involves personal liability protection. About 40% of CISOs are receiving an insurance benefit typically reserved for the C-suite.

“More CISOs are pursuing coverage in directors and officers policies or, when that isn’t possible, looking for alternative protection, such as indemnity clauses or personal liability protection,” Kakolowski said. 

CISOs have been under increased scrutiny in recent years as federal regulators crack down on companies to be transparent about cybersecurity risk. 

SolarWinds and its CISO Tim Brown are currently fighting a civil suit by the Securities and Exchange Commission for alleged fraud related to disclosures it made in connection to a massive supply chain attack by state-linked hackers. 

In a separate case, the former CSO at Uber was convicted in federal court after orchestrating a coverup of a ransomware payment and failed to report it to the Federal Trade Commission.