Something has shifted in the last few years, quietly, and it changes how the most exposed job in the business should be thought about. The accountability for a cyber failure is moving onto a person.

In February 2026 ASIC secured a $2.5 million penalty against an Australian financial services licensee over its cyber security failures, the first penalty of its kind in this country. [1] It built on a 2022 case in which the Federal Court found that a financial advice licensee had failed to adequately manage its cyber risk, and ordered it to pay $750,000 towards ASIC’s costs and to bring in an expert to fix it. [2] Those are actions against companies, but the direction they set points at individuals, and overseas it already has. The former chief security officer of a major United States technology company was criminally convicted in 2022 over his handling of a data breach, and the conviction was later upheld on appeal. [3] In 2023 the United States securities regulator took the then unprecedented step of charging a listed company’s chief information security officer personally, by name, over what the company had told the market about its security. A court threw out most of that case in 2024 and it was later dismissed, [4] but the signal had already been sent. The regulator had reached past the company and put a finger on the person in the chair.

Read those together and the trend is unmistakable. The individual responsible for security is, more and more, personally in the frame.

The accountability for a cyber failure is moving onto a person. The role was never designed to hold it.

This is not a hunch. The market is already moving.

You can see it in two places that have nothing to do with us.

The first is what organisations are quietly doing to their own arrangements. In a 2024 survey of 1,800 security decision-makers, the technology firm Fastly found that 93 per cent of organisations had changed policies in the previous year out of concern about personal liability for the CISO. [8] More telling than the headline is what sat underneath it. Nearly half of those surveyed were unclear about who ultimately holds responsibility for a cyber incident, and only around a third had clearly defined roles and responsibilities. The accountability is escalating faster than anyone has settled who actually holds it.

The second is the insurance market, which prices risk for a living and has noticed this one. There is now a recognised gap in cover around the CISO. Directors and officers policies commonly exclude cyber events, and cyber policies carve out securities claims, which can leave the individual exposed in the space between the two. A CISO who is not a formally appointed officer may find a claim falls outside both. Brokers have started writing bespoke endorsements that name the CISO explicitly as an insured person to close that gap. [9] When the insurance industry begins building custom cover for your personal exposure, the exposure is real.

There is a twist worth sitting with. The corporate cost of cyber cover has actually been falling. It is a buyers’ market, with one major broker reporting premiums down around 11 per cent across its book in early 2026 even as incidents rose, though it warned the softness may not survive 2027. [10] So the organisation’s premium is getting cheaper at the very moment the individual’s personal exposure is getting sharper. The two numbers are moving in opposite directions, and the person in the chair is on the wrong side of the gap.

The role was never built to carry it

Here is the problem. The CISO role was never built to carry that kind of personal exposure, and most organisations have not changed a thing about how it is structured to match.

Start with what a CISO actually controls, because it is far less than the accountability now attached to the title.

The CISO is held responsible for the organisation’s security posture. Yet almost none of the controls that posture depends on are hers to operate. IT owns multi-factor authentication, patching and backups. HR owns onboarding, offboarding and awareness. Procurement owns the suppliers. Legal owns the obligations. The executive owns the acceptance of the risk that is left. The CISO coordinates all of it, evidences it and reports on it, but the levers sit with other people who do not report to her and have their own priorities.

Then there is the budget, which she usually does not set, and the board, which she typically sees for about half an hour a quarter. So the person now carrying personal and legal exposure for the whole picture often cannot direct the spending, cannot compel the control owners, and gets one short window every three months to make the case to the people who can.

That is responsibility without authority. It is an uncomfortable position in any role. It is a dangerous one when the courts and the regulators have started looking for a name.

And the chair is a revolving door

Now add turnover. The CISO role changes hands faster than almost any other in the senior team. The tenure figure that gets quoted around the industry is roughly two years, far shorter than the executives around her. [5]

Two years is not an arbitrary number, and it is worth saying why we think it holds. Two things tend to decide it.

The first is a quiet test she is running the whole time. Inside about two years she has learned whether she is genuinely being listened to, and whether her recommendations get acted on or merely noted. If they do, she stays and builds. If they do not, if she is raising real risks into a room that nods and moves on, she leaves. Rarely in anger. She leaves because staying means being accountable for a position she was never given the authority or the budget to improve.

The second is burnout, which we have written about more than once. [6] Look at the arithmetic of the job. She successfully handles the overwhelming majority of what comes at the organisation, very nearly all of it, week after week. Nobody tells her that was a good job, because nothing happened, and nothing happening is invisible. The one attack that gets through is the only one anyone remembers. And she is doing all of it on resources that were not enough for the job two years ago, let alone the job today, where the obligations have multiplied and the attackers have better tools. Thin recognition, short resourcing, and now personal exposure. People do not last long in that, and the good ones have options.

There is a deeper reason sitting underneath the resourcing, and it is the one that actually sets the budget. Cyber tends to be under-resourced because it is not genuinely understood by the people who hold the chequebook. That is not a character flaw in those people. It is a failure of translation, and it is a big enough subject to deserve its own piece, which we will write soon, on the common language a board and a security function have to build before the funding conversation can even be had properly.

And when she does go, the loss compounds. The hard-won context leaves with her. What was actually assessed, what was accepted and by whom, which risks were being watched, where the evidence lived. Much of that is carried in one person’s head, and when the chair empties, the organisation’s real security position empties with it, to be slowly reconstructed by whoever arrives next.

So the picture is this. Escalating personal accountability, landing on a seat that has responsibility without authority, and that turns over every couple of years. That is not an individual failing. It is a structural fault, and no amount of hiring a better or braver person fixes a structure.

What actually has to change

If the accountability has moved, three things have to move with it.

A position you can prove, not one you assessed last year. When a person is personally accountable, “we assessed that at the annual review” is not a defence and never feels like one at two in the morning. What protects the organisation, and the individual, is a current, evidenced position: what is true today, what is being done about it, and the trail to show it. A point-in-time assessment is stale the moment it is filed, and staleness is exactly what the enforcement cases turned on. The question a regulator asks is not whether you had a policy. It is what you knew, when you knew it, and what you can show.

Authority, or board air-cover, matched to the accountability. If a board is going to hold the function accountable, it has to fund and empower it, and it has to own the residual risk it chooses to accept. This is not a radical idea. It is already what the law says. APRA’s CPS 230 and CPS 234 place responsibility for operational and information security risk at board level, and the Security of Critical Infrastructure regime puts obligations directly on directors. [7] The Fastly research made the same point from the industry side: accountability should start with senior leadership, in particular aligning budgets to the risks the CISO is actually reporting. [8] The accountability and the authority are meant to sit together, at the top. Where they have drifted apart, and landed on a mid-level person with a quarterly audience, that is the gap the enforcement trend is walking into.

Continuity that survives the person. The security position cannot live only in one head. It has to be held in a way that persists when the chair empties, so a resignation is a handover rather than a reset. That is the difference between a function and a single point of failure wearing a job title.

Where the risk should actually sit

Pull those together and you arrive at a cleaner division than most organisations run today.

The CISO, or the function, runs the controls, the evidence and the reporting. The board owns the risk and the decisions. That is not a dodge, it is where the law already puts both, and keeping them clearly separate does two useful things at once. It gives the board the honest, current position it is accountable for. And it stops a single individual from quietly carrying personal exposure for risks that the organisation, not the person, actually chose to accept.

Several of the cases that reached the courts share a shape. An individual ended up holding, alone, what should have been an organisational position, owned and evidenced at the top. The lesson is not that CISOs should be more careful about what they sign. It is that organisations should stop asking one accountable-but-unempowered person to be the whole function, and the memory of it, and the liability for it.

Stop asking one person to be the whole function, its memory, and its liability.

Where this leaves BayRisk

I will be straight that this is what we do, so weigh it accordingly.

RiskOps is the security and risk function run as a continuous operation. We keep the position current and evidenced rather than reconstructed before each board meeting, so what goes in front of the board is what is true today, with the trail to prove it. Because we run it as an operation rather than a person, the position survives turnover: it does not walk out the door when someone resigns. And the division stays clean. The risk and the decisions stay with the board, where the law puts them. The work of holding the position and proving it is the part we take on.

For the person in the CISO chair, that means walking into the room with a position she can stand behind, not one she is personally exposed on. For an organisation that cannot fill the chair at all, and many cannot, it means the function still runs, properly, without betting everything on finding and keeping one scarce individual.

The accountability has moved onto people. The sensible response is to stop running the function as if it were one.

If any of this sounds like the seat in your organisation, it is worth a conversation: hello@bayrisk.com.au.

References

  1. Australian Securities and Investments Commission, enforcement action resulting in a $2.5 million penalty against a financial services licensee for cyber security failures, February 2026 (media release 26-021MR). https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-021mr-asic-action-sees-fiig-securities-ordered-to-pay-25-million-over-cyber-security-failures
  2. Australian Securities and Investments Commission, Federal Court finding that a financial advice licensee failed to adequately manage cybersecurity risks, with a $750,000 costs order, 5 May 2022 (media release 22-104MR). https://asic.gov.au/about-asic/news-centre/find-a-media-release/2022-releases/22-104mr-court-finds-ri-advice-failed-to-adequately-manage-cybersecurity-risks/
  3. United States Department of Justice, conviction of a former chief security officer over the cover-up of a data breach, 2022; conviction and sentence later upheld on appeal. https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach
  4. United States Securities and Exchange Commission action against a listed software company and its chief information security officer, 2023; most claims dismissed by the court in 2024 and the matter later dismissed. Background: Hunton Andrews Kurth, “Judge dismisses most of SEC case”. https://www.hunton.com/privacy-and-information-security-law/judge-dismisses-most-of-sec-case-against-solarwinds-and-its-ciso
  5. Commonly cited industry figure for average CISO tenure of roughly two years; see for example Cybersecurity Ventures on CISO turnover. https://cybersecurityventures.com/is-the-ciso-chair-becoming-a-revolving-door/
  6. BayRisk, “Do your work in the hallways: a CISO, the board, and the burnout nobody reports”, 12 September 2026. https://bayrisk.com.au/blog/2026/09/12/do-your-work-in-the-hallways-a-ciso-the-board-and-the-burnout-nobody-reports/
  7. Australian Prudential Regulation Authority, CPS 230 Operational Risk Management and CPS 234 Information Security, for board-level accountability; and the Security of Critical Infrastructure Act for obligations on directors. https://www.apra.gov.au/
  8. Fastly / Sapio Research, survey of 1,800 security decision-makers conducted 2024, including that 93 per cent of organisations changed policies in response to concern about CISO personal liability; reported by SecurityBrief Australia, 2025. https://securitybrief.com.au/story/change-in-ciso-liability-policies-at-93-of-businesses
  9. Business Insurance, “CISOs face D&O cover risks as hacks spread”, 1 October 2024, on the gap between directors and officers and cyber policies around the CISO, and endorsements naming the CISO as an insured person. https://www.businessinsurance.com/cisos-face-do-cover-risks-as-hacks-spread/
  10. Lockton cyber market update reporting an approximately 11 per cent fall in premiums across its book in early 2026, with incidents still rising and a warning of possible pricing volatility in 2027; reported by SecurityBrief Australia, 13 February 2026. https://securitybrief.com.au/story/cyber-premiums-fall-as-lockton-flags-2027-volatility-risk