[{"data":1,"prerenderedAt":914},["ShallowReactive",2],{"navigation_docs":3,"-design-personas-01-ciso-simon":369,"-design-personas-01-ciso-simon-surround":909},[4,8,72,102,220,266,280,301,365],{"title":5,"path":6,"stem":7},"Introduction","\u002Fintroduction","0.introduction",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":67},"Company","i-lucide-building-2","\u002Fcompany","1.company",[14,18,22,26,30,34,38,42,46,50,54,68],{"title":15,"path":16,"stem":17},"About","\u002Fcompany\u002Fabout","1.company\u002F0.about",{"title":19,"path":20,"stem":21},"Values","\u002Fcompany\u002Fvalues","1.company\u002F1.values",{"title":23,"path":24,"stem":25},"Communication","\u002Fcompany\u002Fcommunication","1.company\u002Fcommunication",{"title":27,"path":28,"stem":29},"Competition","\u002Fcompany\u002Fcompetition","1.company\u002Fcompetition",{"title":31,"path":32,"stem":33},"Hybrid Working","\u002Fcompany\u002Fhybrid-working","1.company\u002Fhybrid-working",{"title":35,"path":36,"stem":37},"Manchester Office","\u002Fcompany\u002Foffice","1.company\u002Foffice",{"title":39,"path":40,"stem":41},"Operations","\u002Fcompany\u002Foperations","1.company\u002Foperations",{"title":43,"path":44,"stem":45},"Policies","\u002Fcompany\u002Fpolicies","1.company\u002Fpolicies",{"title":47,"path":48,"stem":49},"Problem Statement","\u002Fcompany\u002Fproblem-statement","1.company\u002Fproblem-statement",{"title":51,"path":52,"stem":53},"Product Strategy","\u002Fcompany\u002Fproduct-strategy","1.company\u002Fproduct-strategy",{"title":55,"path":56,"stem":57,"children":58,"page":67},"Products","\u002Fcompany\u002Fproducts","1.company\u002Fproducts",[59,63],{"title":60,"path":61,"stem":62},"Capability Exchange","\u002Fcompany\u002Fproducts\u002Fcapability-exchange","1.company\u002Fproducts\u002Fcapability-exchange",{"title":64,"path":65,"stem":66},"ESProfiler Platform","\u002Fcompany\u002Fproducts\u002Fesprofiler","1.company\u002Fproducts\u002Fesprofiler",false,{"title":69,"path":70,"stem":71},"Security","\u002Fcompany\u002Fsecurity","1.company\u002Fsecurity",{"title":73,"icon":74,"path":75,"stem":76,"children":77,"page":67},"People Ops","i-lucide-users","\u002Fpeople-ops","2.people-ops",[78,82,86,90,94,98],{"title":79,"path":80,"stem":81},"Compensation","\u002Fpeople-ops\u002Fcompensation","2.people-ops\u002Fcompensation",{"title":83,"path":84,"stem":85},"Education","\u002Fpeople-ops\u002Feducation","2.people-ops\u002Feducation",{"title":87,"path":88,"stem":89},"Expenses","\u002Fpeople-ops\u002Fexpenses","2.people-ops\u002Fexpenses",{"title":91,"path":92,"stem":93},"Holiday & Leave","\u002Fpeople-ops\u002Fleave","2.people-ops\u002Fleave",{"title":95,"path":96,"stem":97},"Onboarding","\u002Fpeople-ops\u002Fonboarding","2.people-ops\u002Fonboarding",{"title":99,"path":100,"stem":101},"Recruitment","\u002Fpeople-ops\u002Frecruitment","2.people-ops\u002Frecruitment",{"title":103,"icon":104,"path":105,"stem":106,"children":107,"page":67},"Engineering","i-lucide-rocket","\u002Fengineering","3.engineering",[108,151,155,175,196,200,208,212,216],{"title":109,"path":110,"stem":111,"children":112,"page":67},"Contributing","\u002Fengineering\u002Fcontributing","3.engineering\u002Fcontributing",[113,117,121,125,129,142],{"title":114,"path":115,"stem":116},"Development Setup","\u002Fengineering\u002Fcontributing\u002Fdevelopment-setup","3.engineering\u002Fcontributing\u002F1.development-setup",{"title":118,"path":119,"stem":120},"Engineering Operations","\u002Fengineering\u002Fcontributing\u002Fengineering-operations","3.engineering\u002Fcontributing\u002F2.engineering-operations",{"title":122,"path":123,"stem":124},"Documentation","\u002Fengineering\u002Fcontributing\u002Fdocumentation","3.engineering\u002Fcontributing\u002F3.documentation",{"title":126,"path":127,"stem":128},"Agentic Coding","\u002Fengineering\u002Fcontributing\u002Fagentic-coding","3.engineering\u002Fcontributing\u002Fagentic-coding",{"title":130,"path":131,"stem":132,"children":133,"page":67},"Back End","\u002Fengineering\u002Fcontributing\u002Fback-end","3.engineering\u002Fcontributing\u002Fback-end",[134,138],{"title":135,"path":136,"stem":137},"API Guidelines","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines","3.engineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines",{"title":139,"path":140,"stem":141},"LLM Prompts & Langfuse Integration","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts","3.engineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts",{"title":143,"path":144,"stem":145,"children":146,"page":67},"Front End","\u002Fengineering\u002Fcontributing\u002Ffront-end","3.engineering\u002Fcontributing\u002Ffront-end",[147],{"title":148,"path":149,"stem":150},"Testing","\u002Fengineering\u002Fcontributing\u002Ffront-end\u002Ftesting","3.engineering\u002Fcontributing\u002Ffront-end\u002Ftesting",{"title":152,"path":153,"stem":154},"Production Database","\u002Fengineering\u002Fdatabase-connection","3.engineering\u002Fdatabase-connection",{"title":156,"path":157,"stem":158,"children":159},"Deployment","\u002Fengineering\u002Fdeployment","3.engineering\u002Fdeployment",[160,163,167,171],{"title":60,"path":161,"stem":162},"\u002Fengineering\u002Fdeployment\u002Fcapability-exchange","3.engineering\u002Fdeployment\u002Fcapability-exchange",{"title":164,"path":165,"stem":166},"Langfuse Deployment","\u002Fengineering\u002Fdeployment\u002Fecs-langfuse-deployment","3.engineering\u002Fdeployment\u002Fecs-langfuse-deployment",{"title":168,"path":169,"stem":170},"ESP Platform Configuration","\u002Fengineering\u002Fdeployment\u002Fesp-platform-configuration","3.engineering\u002Fdeployment\u002Fesp-platform-configuration",{"title":172,"path":173,"stem":174},"Platform","\u002Fengineering\u002Fdeployment\u002Fplatform","3.engineering\u002Fdeployment\u002Fplatform",{"title":176,"path":177,"stem":178,"children":179,"page":67},"Github","\u002Fengineering\u002Fgithub","3.engineering\u002Fgithub",[180,184,188,192],{"title":181,"path":182,"stem":183},"Packages","\u002Fengineering\u002Fgithub\u002Fpackages","3.engineering\u002Fgithub\u002Fpackages",{"title":185,"path":186,"stem":187},"Personal Access Token","\u002Fengineering\u002Fgithub\u002Fpersonal-access-token","3.engineering\u002Fgithub\u002Fpersonal-access-token",{"title":189,"path":190,"stem":191},"Troubleshooting","\u002Fengineering\u002Fgithub\u002Ftroubleshooting","3.engineering\u002Fgithub\u002Ftroubleshooting",{"title":193,"path":194,"stem":195},"Workflows","\u002Fengineering\u002Fgithub\u002Fworkflows","3.engineering\u002Fgithub\u002Fworkflows",{"title":197,"path":198,"stem":199},"Platform Ops","\u002Fengineering\u002Fplatform-ops","3.engineering\u002Fplatform-ops",{"title":172,"path":201,"stem":202,"children":203,"page":67},"\u002Fengineering\u002Fplatform","3.engineering\u002Fplatform",[204],{"title":205,"path":206,"stem":207},"useAPI","\u002Fengineering\u002Fplatform\u002Fuse-api","3.engineering\u002Fplatform\u002Fuse-api",{"title":209,"path":210,"stem":211},"Project Management","\u002Fengineering\u002Fproject-management","3.engineering\u002Fproject-management",{"title":213,"path":214,"stem":215},"Releases","\u002Fengineering\u002Frelease","3.engineering\u002Frelease",{"title":217,"path":218,"stem":219},"Tools","\u002Fengineering\u002Ftools","3.engineering\u002Ftools",{"title":221,"icon":222,"path":223,"stem":224,"children":225,"page":67},"Design","i-lucide-palette","\u002Fdesign","4.design",[226,247,251,255,259,262],{"title":227,"path":228,"stem":229,"children":230,"page":67},"Personas","\u002Fdesign\u002Fpersonas","4.design\u002F0.personas",[231,235,239,243],{"title":232,"path":233,"stem":234},"CISO - Simon","\u002Fdesign\u002Fpersonas\u002F01-ciso-simon","4.design\u002F0.personas\u002F01-ciso-simon",{"title":236,"path":237,"stem":238},"Head of Cyber - Harry","\u002Fdesign\u002Fpersonas\u002F02-head-of-cyber-harry","4.design\u002F0.personas\u002F02-head-of-cyber-harry",{"title":240,"path":241,"stem":242},"Security Architect - Sasha","\u002Fdesign\u002Fpersonas\u002F03-security-architect-sasha","4.design\u002F0.personas\u002F03-security-architect-sasha",{"title":244,"path":245,"stem":246},"Procurement Officer - Paige","\u002Fdesign\u002Fpersonas\u002F04-procurement-officer-paige","4.design\u002F0.personas\u002F04-procurement-officer-paige",{"title":248,"path":249,"stem":250},"Design Thinking","\u002Fdesign\u002Fdesign-thinking","4.design\u002F1.design-thinking",{"title":252,"path":253,"stem":254},"Design & Development","\u002Fdesign\u002Fdesign-and-development","4.design\u002F3.design-and-development",{"title":256,"path":257,"stem":258},"Branding","\u002Fdesign\u002Fbranding","4.design\u002F4.branding",{"title":217,"path":260,"stem":261},"\u002Fdesign\u002Ftools","4.design\u002F5.tools",{"title":263,"path":264,"stem":265},"Customer Success","\u002Fdesign\u002Fworking-with-customers","4.design\u002F6.working-with-customers",{"title":267,"icon":268,"path":269,"stem":270,"children":271,"page":67},"Sales","i-lucide-dollar-sign","\u002Fsales","4.sales",[272,276],{"title":273,"path":274,"stem":275},"Customer Onboarding","\u002Fsales\u002Fonboarding","4.sales\u002Fonboarding",{"title":277,"path":278,"stem":279},"Sales Tools","\u002Fsales\u002Ftools","4.sales\u002Ftools",{"title":281,"icon":282,"path":283,"stem":284,"children":285,"page":67},"Marketing","i-lucide-book-image","\u002Fmarketing","5.marketing",[286,290,294,297],{"title":287,"path":288,"stem":289},"Content","\u002Fmarketing\u002Fcontent","5.marketing\u002Fcontent",{"title":291,"path":292,"stem":293},"Messaging","\u002Fmarketing\u002Fmessaging","5.marketing\u002Fmessaging",{"title":217,"path":295,"stem":296},"\u002Fmarketing\u002Ftools","5.marketing\u002Ftools",{"title":298,"path":299,"stem":300},"Website","\u002Fmarketing\u002Fwebsite","5.marketing\u002Fwebsite",{"title":302,"icon":303,"path":304,"stem":305,"children":306,"page":67},"AI & Data Ops","i-lucide-database","\u002Fdata-ops","6.data-ops",[307,315,319,344,361],{"title":60,"path":308,"stem":309,"children":310,"page":67},"\u002Fdata-ops\u002Fcapability-exchange","6.data-ops\u002FCapability Exchange",[311],{"title":312,"path":313,"stem":314},"Leaderboard Calculation","\u002Fdata-ops\u002Fcapability-exchange\u002Fleaderboard-calculation","6.data-ops\u002FCapability Exchange\u002Fleaderboard-calculation",{"title":316,"path":317,"stem":318},"Account Portal (CAS)","\u002Fdata-ops\u002Faccount-portal","6.data-ops\u002Faccount-portal",{"title":320,"path":321,"stem":322,"children":323,"page":67},"Data Management","\u002Fdata-ops\u002Fdata-management","6.data-ops\u002Fdata-management",[324,328,332,336,340],{"title":325,"path":326,"stem":327},"Adding Products","\u002Fdata-ops\u002Fdata-management\u002Fadding-products","6.data-ops\u002Fdata-management\u002Fadding-products",{"title":329,"path":330,"stem":331},"Adding Vendors","\u002Fdata-ops\u002Fdata-management\u002Fadding-vendors","6.data-ops\u002Fdata-management\u002Fadding-vendors",{"title":333,"path":334,"stem":335},"Framework Mapping","\u002Fdata-ops\u002Fdata-management\u002Fframework-mapping","6.data-ops\u002Fdata-management\u002Fframework-mapping",{"title":337,"path":338,"stem":339},"Refreshing Vendors","\u002Fdata-ops\u002Fdata-management\u002Frefreshing-vendors","6.data-ops\u002Fdata-management\u002Frefreshing-vendors",{"title":341,"path":342,"stem":343},"Reviewing Draft Vendors","\u002Fdata-ops\u002Fdata-management\u002Freviewing-draft-vendors","6.data-ops\u002Fdata-management\u002Freviewing-draft-vendors",{"title":345,"path":346,"stem":347,"children":348,"page":67},"LLM Ops","\u002Fdata-ops\u002Fllm-ops","6.data-ops\u002Fllm-ops",[349,353,357],{"title":350,"path":351,"stem":352},"Agents","\u002Fdata-ops\u002Fllm-ops\u002Fagents","6.data-ops\u002Fllm-ops\u002F1.agents",{"title":354,"path":355,"stem":356},"ESPi Architecture & Query Flow","\u002Fdata-ops\u002Fllm-ops\u002Fespi-architecture","6.data-ops\u002Fllm-ops\u002F2.espi-architecture",{"title":358,"path":359,"stem":360},"Evaluating Agents","\u002Fdata-ops\u002Fllm-ops\u002Fevaluations","6.data-ops\u002Fllm-ops\u002F3.evaluations",{"title":362,"path":363,"stem":364},"Message Queues","\u002Fdata-ops\u002Fmessage-queues","6.data-ops\u002Fmessage-queues",{"title":366,"path":367,"stem":368},"Glossary","\u002Fglossary","glossary",{"id":370,"title":232,"body":371,"description":902,"extension":903,"links":904,"meta":905,"navigation":906,"path":233,"seo":907,"stem":234,"__hash__":908},"docs\u002F4.design\u002F0.personas\u002F01-ciso-simon.md",{"type":372,"value":373,"toc":881},"minimark",[374,379,386,390,484,488,491,539,543,546,550,569,573,588,592,655,659,687,691,696,726,730,760,764,794,798,828,832,838,847,851],[375,376,378],"h2",{"id":377},"the-accountable-one","The Accountable One",[380,381,382],"blockquote",{},[383,384,385],"p",{},"\"Can you get me this on one page. I need something defensible, not a guess.\"",[375,387,389],{"id":388},"quick-facts","Quick facts",[391,392,393,404],"table",{},[394,395,396],"thead",{},[397,398,399,402],"tr",{},[400,401],"th",{},[400,403],{},[405,406,407,419,429,444,454,464,474],"tbody",{},[397,408,409,416],{},[410,411,412],"td",{},[413,414,415],"strong",{},"Title",[410,417,418],{},"CISO \u002F Group CISO \u002F VP Information Security",[397,420,421,426],{},[410,422,423],{},[413,424,425],{},"Company profile",[410,427,428],{},"10,000+ employees, $1bn+ revenue",[397,430,431,436],{},[410,432,433],{},[413,434,435],{},"Budget authority",[410,437,438,439,443],{},"Ultimate — but rarely the ",[440,441,442],"em",{},"sole"," named owner. See \"Where the money actually sits\" below.",[397,445,446,451],{},[410,447,448],{},[413,449,450],{},"Reports to",[410,452,453],{},"Varies widely — CIO (most common), CEO, CFO, COO, or CRO",[397,455,456,461],{},[410,457,458],{},[413,459,460],{},"Direct report",[410,462,463],{},"Harry the Head of Cyber \u002F Chief Security Architect",[397,465,466,471],{},[410,467,468],{},[413,469,470],{},"Time in role",[410,472,473],{},"Shorter than most C-suite peers — see note on tenure below",[397,475,476,481],{},[410,477,478],{},[413,479,480],{},"Primary motivation",[410,482,483],{},"Walk into the board unable to be unpicked in the room",[375,485,487],{"id":486},"where-the-money-actually-sits","Where the money actually sits",[383,489,490],{},"Cyber budget ownership is genuinely inconsistent across enterprises, and it's worth resisting the temptation to draw it as one clean line.",[492,493,494,517,532],"ul",{},[495,496,497,498,501,502,505,506,516],"li",{},"In the majority of organizations, security spend sits inside the CIO's IT budget. Ponemon (2017) found ",[413,499,500],{},"50%"," of CISOs reporting to the CIO, versus 4% to the CEO, 9% to the CTO, 9% to the CFO, and 6% to the COO (60% had a ",[440,503,504],{},"channel"," to the CEO without reporting there)",[507,508,509],"sup",{},[510,511,515],"a",{"href":512,"rel":513},"https:\u002F\u002Fwww.researchgate.net\u002Fpublication\u002F335404794_An_Exploration_of_the_Evolving_Reporting_Organizational_Structure_for_the_Chief_Information_Security_Officer_CISO_Function",[514],"nofollow","[1]",". In this structure, the CIO holds effective allocation power and can shape the CISO's agenda.",[495,518,519,520,523,524,531],{},"In a large and growing minority — ",[413,521,522],{},"45%"," in an ECSO CISO community survey",[507,525,526],{},[510,527,530],{"href":528,"rel":529},"https:\u002F\u002Fecs-org.eu\u002Fecso-uploads\u002F2025\u002F01\u002FCybersecurity-Budgets-Ownership-reporting-trends-ECSO-CISO-Community-v1.pdf",[514],"[2]"," — cyber budget is independent of the CIO's budget, usually answering instead to the CFO, CEO, or a joint budget committee (typically CEO + CFO + CIO together, not one named owner).",[495,533,534,535,538],{},"Either way, Simon is rarely the sole signatory. What's constant is that ",[413,536,537],{},"he is accountable for the number regardless of who controls it"," — he has to defend it to the board even when he doesn't fully control its allocation.",[375,540,542],{"id":541},"role","Role",[383,544,545],{},"Accountable for the organization's security posture and the budget that buys it. Sits in front of the board, the audit committee, and the CFO. Increasingly measured on cost discipline as much as risk reduction — asked \"why do we spend $40m on security and still get breached\" in the same meeting as \"why is spend up 12% this year.\"",[375,547,549],{"id":548},"a-dayweek-in-his-calendar","A day\u002Fweek in his calendar",[492,551,552,555,563,566],{},[495,553,554],{},"Back-to-back exec and board-adjacent meetings; almost no unstructured time.",[495,556,557,558,562],{},"Delegates almost all stack-level detail to ",[510,559,561],{"href":560},".\u002F02-head-of-cyber-harry","Harry, the Head of Cyber",".",[495,564,565],{},"Engages personally only at decision points: budget cycle, major renewal, incident, audit, M&A.",[495,567,568],{},"Reads summaries, not source data. If it's not one slide or three bullets, it doesn't get read.",[375,570,572],{"id":571},"objectives","Objectives",[492,574,575,578,585],{},[495,576,577],{},"Defend the budget number to the CFO\u002Fboard without being unpicked in the room.",[495,579,580,581,584],{},"Avoid being the reason for a breach ",[440,582,583],{},"and"," avoid being the reason spend went up with nothing to show for it.",[495,586,587],{},"Convert \"trust me\" into evidence — frameworks, coverage %, dollars mapped to risk — because that's the language the board will actually accept.",[375,589,591],{"id":590},"pain-points","Pain points",[492,593,594,597,600,613,619],{},[495,595,596],{},"Inherits a stack built by other people, over years, across departments — and is personally accountable for a picture he didn't build and can't fully verify.",[495,598,599],{},"Told controls are \"in place\" on paper; has no reliable way to know if that's true on the ground until an incident proves otherwise.",[495,601,602,603,608,562],{},"Budget conversations are adversarial by default: reporting line and budget ownership are split more often than the org chart implies",[507,604,605],{},[510,606,515],{"href":512,"rel":607},[514],[507,609,610],{},[510,611,530],{"href":528,"rel":612},[514],[495,614,615,616,562],{},"External reviews land on his desk with little runway: a PwC\u002FKPMG portfolio-rationalisation or cost-optimisation engagement is built to demand current inventory, overlapping capabilities, unused functions, and total cost of ownership (TCO) — a picture he cannot produce from a spreadsheet. See the ",[510,617,47],{"href":618},"..\u002F..\u002Fcompany\u002Fproblem-statement",[495,620,621,624,625,628,635,636,639,640,643,650,651,654],{},[413,622,623],{},"A note on tenure:"," CISO tenure and turnover pressure are widely cited — commonly ",[413,626,627],{},"18–26 months",[507,629,630],{},[510,631,634],{"href":632,"rel":633},"https:\u002F\u002Fcybersecurityventures.com\u002Fthe-rise-in-ciso-job-dissatisfaction-whats-wrong-and-how-can-it-be-fixed\u002F",[514],"[3]",", well under general C-suite tenure. But the 2026 IANS\u002FArtico survey of 662 CISOs reported an average ",[440,637,638],{},"self-reported total tenure"," of ",[413,641,642],{},"nine years",[507,644,645],{},[510,646,649],{"href":647,"rel":648},"https:\u002F\u002Fwww.iansresearch.com\u002Fresources\u002Fpress-releases\u002Fdetail\u002F2026-report-finds-executive-level-ciso-titles-more-prevalent-than-ever",[514],"[4]"," — a very different number, almost certainly because it measures cumulative time across employers rather than time in the current seat. Use the ",[440,652,653],{},"pressure"," (\"job security is genuinely precarious, burnout is real, turnover is high\") rather than a specific tenure figure — the underlying stat is contested.",[375,656,658],{"id":657},"relationships","Relationships",[492,660,661,669,678],{},[495,662,663,668],{},[510,664,665],{"href":560},[413,666,667],{},"Harry the Head of Cyber",": primary trusted delegate. Simon expects Harry to already know the answer and bring a recommendation, not a question.",[495,670,671,677],{},[510,672,674],{"href":673},".\u002F03-security-architect-sasha",[413,675,676],{},"Sasha the Security Architect",": almost no direct contact. Occasionally sees her name on incident reports or consolidation wins.",[495,679,680,686],{},[510,681,683],{"href":682},".\u002F04-procurement-officer-paige",[413,684,685],{},"Paige the Procurement Officer",": transactional, mediated through Harry — Simon signs off, doesn't negotiate.",[375,688,690],{"id":689},"empathy-mapping","Empathy Mapping",[692,693,695],"h3",{"id":694},"says","Says",[391,697,698,704],{},[394,699,700],{},[397,701,702],{},[400,703],{},[405,705,706,711,716,721],{},[397,707,708],{},[410,709,710],{},"\"Can you get me this on one page.\"",[397,712,713],{},[410,714,715],{},"\"What's our exposure if we cut this?\"",[397,717,718],{},[410,719,720],{},"\"Show me where the dollars map to risk.\"",[397,722,723],{},[410,724,725],{},"\"I need something defensible, not a guess.\"",[692,727,729],{"id":728},"does","Does",[391,731,732,738],{},[394,733,734],{},[397,735,736],{},[400,737],{},[405,739,740,745,750,755],{},[397,741,742],{},[410,743,744],{},"Signs off budget, doesn't build it",[397,746,747],{},[410,748,749],{},"Attends board\u002Faudit committee, rarely the tooling reviews",[397,751,752],{},[410,753,754],{},"Delegates verification entirely to Harry",[397,756,757],{},[410,758,759],{},"Engages only at decision points",[692,761,763],{"id":762},"thinks","Thinks",[391,765,766,772],{},[394,767,768],{},[397,769,770],{},[400,771],{},[405,773,774,779,784,789],{},[397,775,776],{},[410,777,778],{},"\"I don't actually know what's true on the ground, and that scares me a bit.\"",[397,780,781],{},[410,782,783],{},"\"If this breaks, it's my name in the post-mortem.\"",[397,785,786],{},[410,787,788],{},"\"Every renewal is a fight I don't have the ammunition for yet.\"",[397,790,791],{},[410,792,793],{},"\"I need my people to make me look right in that room.\"",[692,795,797],{"id":796},"feels","Feels",[391,799,800,806],{},[394,801,802],{},[397,803,804],{},[400,805],{},[405,807,808,813,818,823],{},[397,809,810],{},[410,811,812],{},"Exposed — accountable for things he can't personally verify",[397,814,815],{},[410,816,817],{},"Time-poor and defensive by necessity",[397,819,820],{},[410,821,822],{},"Relief when someone hands him a clean, evidenced answer",[397,824,825],{},[410,826,827],{},"Skeptical of vendor claims, tired of \"trust me\"",[375,829,831],{"id":830},"design-marketing-angle","Design & marketing angle",[383,833,834,835,562],{},"Simon is nearly unreachable directly and doesn't want a demo — he wants a one-pager Harry can hand him before the board meeting ",[413,836,837],{},"or the consultancy readout",[383,839,840,841,844,845,562],{},"Marketing to Simon is really marketing ",[440,842,843],{},"through"," Harry: case studies about defensibility, board-ready framework mapping, and dollar-figure overlap findings that make him look good in the room, not tools he'll personally log into. The purchase is a necessity when he cannot otherwise survive that room; see the ",[510,846,47],{"href":618},[375,848,850],{"id":849},"sources","Sources",[492,852,853,859,869,875],{},[495,854,855,858],{},[510,856,515],{"href":512,"rel":857},[514]," Ponemon Institute (2017) — CISO reporting lines (50% CIO, 4% CEO)",[495,860,861,864,865,868],{},[510,862,530],{"href":528,"rel":863},[514]," ECSO CISO Community, ",[440,866,867],{},"Cybersecurity Budgets: Ownership, Reporting, Trends"," (2025) — 45% independent of the CIO",[495,870,871,874],{},[510,872,634],{"href":632,"rel":873},[514]," Cybersecurity Ventures — CISO tenure commonly 18–26 months",[495,876,877,880],{},[510,878,649],{"href":647,"rel":879},[514]," IANS Research \u002F Artico Search, 2026 State of the CISO — nine-year average self-reported tenure (n=662)",{"title":882,"searchDepth":883,"depth":883,"links":884},"",2,[885,886,887,888,889,890,891,892,893,900,901],{"id":377,"depth":883,"text":378},{"id":388,"depth":883,"text":389},{"id":486,"depth":883,"text":487},{"id":541,"depth":883,"text":542},{"id":548,"depth":883,"text":549},{"id":571,"depth":883,"text":572},{"id":590,"depth":883,"text":591},{"id":657,"depth":883,"text":658},{"id":689,"depth":883,"text":690,"children":894},[895,897,898,899],{"id":694,"depth":896,"text":695},3,{"id":728,"depth":896,"text":729},{"id":762,"depth":896,"text":763},{"id":796,"depth":896,"text":797},{"id":830,"depth":883,"text":831},{"id":849,"depth":883,"text":850},"The CISO is the accountable one of the security team.","md",null,{},true,{"title":232,"description":902},"J04Eg8zhLUGnGHY2jGO7LZzAxFlGKXiDHkf-BnACTqk",[910,912],{"title":217,"path":218,"stem":219,"description":911,"children":-1},"Recommended tooling we use in the Engineering organisation, and if required, how to go about requesting licenses.",{"title":236,"path":237,"stem":238,"description":913,"children":-1},"The head of cyber, or Chief Security Architect, is the head of the security team and the security architects. They are responsible for the security tooling portfolio and often the key decision maker for security investments.",1790076745503]