Cybersecurity & CISO Leadership

Three regulatory developments - occurring simultaneously across three jurisdictions - have elevated cybersecurity leadership from a technical function to a board-level accountability. The CISO who reports to the board is a fundamentally different hire from the CISO who managed a SOC. SEC cyber disclosure rules, NIS2 personal liability provisions, and MAS TRM oversight expectations have rewritten the search brief entirely.

Simultaneously, the EU AI Act is creating an entirely new category of leadership. The AI Safety Officer - a role that didn't exist until regulation wrote the job description - must navigate mandatory risk classifications, conformity assessments, and human oversight requirements for high-risk AI systems. The career path that produces qualified candidates does not yet exist in any established form.

Meanwhile, the VP Security Engineering who can deliver zero trust at enterprise scale - dismantling perimeter-based security while maintaining operational continuity across multiple regulatory jurisdictions - remains among the rarest hires in technology. Fewer than 15% of enterprises have implemented zero trust architecture at scale. The bottleneck is leadership, not technology.

The IMPACT Framework's seven diagnostic questions apply to every search. For cybersecurity and AI risk mandates, three dimensions carry disproportionate weight - because the failure modes are regulation-specific and the cost of misalignment is measured in personal liability, not just organisational risk.

Pattern Recognition Under Novelty - The regulatory landscape is evolving faster than published guidance. EU AI Act implementation is still emerging. NIS2 national transpositions vary. MAS expectations shift with supervisory focus areas. We assess whether candidates can reason from regulatory principles when specific rules haven't been written yet - a capability that distinguishes leaders who anticipate from those who react.

Conviction Depth - Will this CISO tell the board something it doesn't want to hear? The most dangerous failure mode in cybersecurity governance is a leader who calibrates their message to the audience's comfort level rather than the organisation's actual risk posture. We assess whether candidates have a documented history of escalating uncomfortable findings.

Accountability Architecture - Under NIS2, board members face personal liability for cybersecurity failures. Under MAS TRM, CISOs are expected to maintain direct board reporting. Under SEC rules, materiality determinations have securities law implications. We assess whether candidates understand - and accept - this expanded personal accountability radius.