The Job of a CISO Is Hell (And It's Only Getting Harder)

Between operational overload, governance responsibilities, and strategic accountability.

It is Friday evening. 9:00 PM. His daughter asks why he is still looking at his phone. He does not really have an answer. Something has come up: an alert, an incident, an anomaly. Maybe it is nothing. Maybe it is the beginning of a sleepless night. He does not know yet. As always, he picks up the call.

This is not a matter of poor work-life balance. It is the nature of the role. Cyberattacks do not respect time zones, public holidays, weekends, or family dinners. The person responsible for protecting an organisation's digital assets understands this better than anyone.

Behind organisational charts and job descriptions lies a reality that many companies still fail to fully appreciate: in 2026, the Chief Information Security Officer (CISO) has become one of the most exposed, cross-functional, and demanding leadership positions in the modern enterprise. Yet despite the pressure, the CISO remains the person holding the line.

Key Takeaways

• The role of the Chief Information Security Officer has evolved from a technical IT function into a strategic leadership position.

• Modern CISOs oversee risk management, cybersecurity strategy, compliance, governance, security operations, and digital resilience.

• Regulations such as NIS2, DORA, GDPR, the Cyber Resilience Act (CRA), and the AI Act have transformed cybersecurity into a board-level governance issue.

• Today's CISOs work closely with the Chief Information Officer (CIO), Chief Technology Officer (CTO), and Chief Executive Officer (CEO).

• The primary challenge is no longer visibility alone, but the ability to prioritise risk across an increasingly complex attack surface.

The story begins in the mid-1980s. Personal computers are gradually entering the workplace, dial-up modems are becoming common, and the internet is still in its infancy. For the first time, organisations begin to realise that digital infrastructure can be attacked—not with physical weapons, but with a keyboard.

The first generation of cybersecurity professionals had no official titles, dedicated budgets, or established methodologies. They improvised, collaborated, and shared discoveries because nobody truly knew how to defend these emerging systems. Early cybersecurity culture was built on pragmatic cooperation: everyone was learning at the same time.

Over the following decades, the profession evolved through several distinct phases.

A major turning point occurred in 1994 when Citigroup suffered one of the first high-profile cyberattacks against a financial institution. For the first time, a company lost significant sums of money without a criminal physically entering one of its branches.

A few years later, the first officially recognised Chief Information Security Officer position was created and entrusted to Steve Katz, who is widely regarded as the world's first CISO. His appointment marked the beginning of cybersecurity as an executive leadership function rather than a purely technical discipline.

In Europe, the evolution followed a slightly different path but was driven by the same realisation: cybersecurity had become a strategic issue. National cybersecurity agencies, industry associations, and executive forums accelerated the professionalisation of the role. What began as a technical discipline gradually became a business function.

Thirty years later, the successors of those pioneers operate in an environment that is infinitely more complex. Yet the biggest transformation is not technological—it is organisational.

The modern Chief Information Security Officer is no longer responsible only for securing systems. They are responsible for protecting a significant portion of the organisation's digital trust.

That trust now exists everywhere: in cloud environments, SaaS applications, APIs, supplier ecosystems, third-party partnerships, critical data repositories, artificial intelligence systems, and virtually every digital transformation initiative undertaken by the business.

As organisations become increasingly digital, the CISO's scope expands alongside them. What was once a specialised technical role has become a strategic leadership function at the centre of business resilience.

This expansion has become one of the profession's most pressing concerns. According to research conducted by Trend Micro, 97% of security leaders report concerns about the size and complexity of their attack surface, while one-third identify the discovery of high-risk exposure areas as one of their most significant operational challenges.

The reality is straightforward: the more an organisation digitises its operations, the larger its exposure becomes. Growth now extends across cloud platforms, SaaS ecosystems, third-party suppliers, subsidiaries, APIs, remote endpoints, hybrid work environments, and sometimes even assets the organisation no longer knows exist.

The modern CISO must therefore oversee a constantly evolving environment where every new project, integration, acquisition, or business initiative introduces potential risk. Security teams are no longer defending a fixed perimeter; they are managing a living ecosystem that changes every day.

This shift has fundamentally changed how CISOs work. Rather than focusing exclusively on prevention, they must balance visibility, prioritisation, governance, and operational resilience. Modern cybersecurity strategy is no longer limited to protecting networks. It involves understanding business risk across the entire digital ecosystem.

As attack surfaces continue to expand, organisations increasingly recognise that effective security requires more than technology alone. It requires leadership, governance, and a clear security strategy aligned with business objectives.

This is one of the defining realities of cybersecurity leadership in 2026. As organisations continue to expand their digital footprint, the attack surface grows with them, making visibility, risk management, and resilience more critical than ever before.

It is 5:42 PM. A regulatory notification lands in the CISO's inbox. A few years ago, it would likely have been handled by a compliance or legal team. Today, the Chief Information Security Officer is often directly involved in the chain of accountability.

Cybersecurity is no longer solely a technical matter. It has become a governance, regulatory, and business issue that reaches the highest levels of the organisation.

For many years, cyber incidents were treated primarily as IT problems. Security breaches, ransomware attacks, and data leaks were often viewed as operational concerns managed by technical teams. That reality has changed dramatically.

With regulations such as NIS2, DORA, GDPR, the Cyber Resilience Act (CRA), and the AI Act, cybersecurity has become a board-level responsibility. Regulators increasingly expect organisations not only to implement security controls but also to demonstrate how cyber risk is governed, monitored, and reported across the business.

This evolution has transformed the role of the Chief Information Security Officer. Modern CISOs are no longer responsible only for protecting systems. They are expected to help shape governance frameworks, influence strategic decisions, and ensure that cybersecurity remains aligned with business objectives.

As cyber risk becomes business risk, effective CISO reporting has become essential. Boards and executive committees want more than technical updates. They want visibility into risk exposure, business impact, regulatory obligations, and organisational resilience.

The question is no longer:

"Did we deploy the right security tools?"

It has become:

"Did we identify the risk? Did we assess the potential impact? Did we make the right decisions?"

This shift is redefining cybersecurity leadership across every industry.

The responsibilities of a modern Chief Information Security Officer extend far beyond technology.

At 8:12 AM, the working day has barely begun when the first requests arrive. A business unit wants to accelerate the deployment of a SaaS platform. Procurement is waiting for a third-party risk assessment. Legal teams need guidance on NIS2 compliance. A cloud engineer has discovered a critical misconfiguration. Meanwhile, security operations analysts are investigating suspicious activity, and a phishing awareness campaign must be launched before the end of the month.

None of these requests are the same. Yet they all fall within the CISO's sphere of responsibility.

The role now sits at the intersection of governance, risk management, cybersecurity strategy, compliance, cloud security, security operations, software development, artificial intelligence, and business resilience.

In practice, the modern CISO's responsibilities span nine major areas:

• Governing cybersecurity: defining the security strategy, managing cyber risks, building security budgets, prioritising investments, and reporting key metrics to the executive committee and board of directors.

• Ensuring compliance: overseeing compliance with regulations and frameworks such as NIS2, DORA, GDPR, the AI Act, ISO 27001, and SOC 2.

• Managing the attack surface: maintaining continuous visibility across internet-exposed assets, cloud environments, SaaS applications, and sometimes unknown or forgotten assets.

• Protecting critical systems: defining security architecture, managing identities and access, protecting sensitive data, and securing critical infrastructure.

• Securing cloud environments and applications: embedding security into development lifecycles and overseeing multi-cloud environments, APIs, and the software supply chain.

• Detecting threats: leading Security Operations Centres (SOC), threat intelligence activities, and threat hunting programmes.

• Responding to crises: coordinating investigations, managing incident response and crisis teams, and communicating with executives, regulators, customers, and sometimes the media.

• Managing the external ecosystem: assessing suppliers, securing critical partners, and maintaining relationships with authorities, regulators, and CERTs.

• Building a security culture: training employees, raising awareness among executives, and recruiting and retaining cybersecurity talent.

At 2:03 PM, the executive committee meeting is coming to an end. The project being discussed is strategically important. The expected benefits are substantial, the timeline has already been approved, and business teams are eager to move forward. Everything appears ready.

Then someone turns to the Chief Information Security Officer and asks a simple question:

"Can we proceed?"

The question sounds straightforward. In reality, it rarely is.

Within seconds, the CISO must evaluate technical risks, assess potential business consequences, consider regulatory obligations, and provide guidance that supports both security and growth. They must raise concerns without becoming a blocker, encourage innovation without increasing unacceptable risk, and influence decisions without always having direct authority.

This challenge illustrates how dramatically the role has evolved. Today's Chief Information Security Officer participates in decisions that directly affect revenue, operational resilience, digital transformation, mergers and acquisitions, customer trust, and long-term business strategy.

The modern CISO is no longer simply a cybersecurity leader. They have become a business leader whose decisions influence the future of the organisation.

One of the most important skills a modern Chief Information Security Officer can develop is the ability to communicate effectively with non-technical stakeholders.

Security teams naturally focus on vulnerabilities, attack paths, threat actors, exposure management, and technical controls. Executive leaders focus on growth, profitability, operational continuity, market competitiveness, and shareholder value.

Both perspectives are valid, but they often rely on different languages.

When a board member asks about cybersecurity, they are rarely interested in the number of vulnerabilities patched during the previous month. What they want to understand is whether the organisation faces material business risk and whether leadership has a plan to manage it.

This is why effective CISO reporting has become a critical component of cybersecurity leadership.

Modern reporting frameworks focus on questions such as:

• What are the organisation's most significant cyber risks?

• How could those risks affect business operations?

• Which assets are most critical to the organisation?

• How effective are current mitigation efforts?

• Where should future security investment be prioritised?

By answering these questions, CISOs help executive leadership make informed decisions based on business impact rather than technical complexity.

Despite growing awareness of cyber risk, many organisations still struggle to align executive perceptions with operational reality.

Security teams often evaluate risk through technical indicators such as:

• Vulnerability severity.

• Exposure levels.

• Attack surface visibility.

• Detection coverage.

• Remediation timelines.

Boards and executive committees tend to evaluate risk differently. Their priorities typically include:

• Revenue protection.

• Regulatory exposure.

• Business continuity.

• Customer trust.

• Reputation management.

• Strategic growth.

The challenge for the Chief Information Security Officer is connecting these two perspectives.

A critical vulnerability may appear highly significant to a security analyst, but its true importance depends on the business context surrounding the affected asset. Similarly, a seemingly minor technical weakness may become a major concern if it affects a critical business process or regulatory requirement.

Successful CISOs understand that cybersecurity decisions must be framed within broader organisational objectives. They focus on translating technical findings into measurable business outcomes and ensuring that cybersecurity remains aligned with corporate strategy.

Cybersecurity presents a challenge that few other executive functions experience.

Success is often invisible.

When sales teams exceed targets, results are reflected in revenue. When marketing campaigns perform well, growth metrics improve. When product teams launch successful innovations, customers notice.

When a cybersecurity programme performs exceptionally well, nothing happens.

No major breach occurs. No systems are disrupted. No regulatory investigation takes place. No customers are impacted.

Paradoxically, this absence of events is precisely the desired outcome.

As a result, CISOs often face difficulties demonstrating the value of cybersecurity initiatives. The effectiveness of a security programme is measured by incidents that never happen, risks that never materialise, and crises that are successfully avoided.

This visibility challenge is one reason why security investment discussions can be particularly difficult. Executive leaders naturally seek measurable returns on investment, yet the value of cybersecurity frequently lies in preventing losses rather than generating direct revenue.

The most mature organisations address this challenge by treating cybersecurity as a risk management discipline rather than a purely technical function.

Budget discussions highlight the unique position occupied by the Chief Information Security Officer.

Marketing leaders typically present growth opportunities. Product teams showcase new capabilities. Sales executives discuss revenue projections. Security leaders often present a different type of business case.

Rather than describing what they intend to create, they explain what they are trying to prevent.

This distinction fundamentally changes how security investment is evaluated.

Cybersecurity programmes are designed to reduce the likelihood and impact of future incidents. Their value is reflected in avoided disruptions, reduced regulatory exposure, stronger customer trust, and improved organisational resilience.

As cyber threats become more sophisticated and regulatory requirements continue to expand, security investment is increasingly viewed as a strategic necessity rather than an operational expense.

Leading organisations now assess cybersecurity investments through a business lens, considering factors such as:

• Financial impact reduction.

• Operational resilience.

• Regulatory compliance.

• Customer confidence.

• Reputation protection.

• Long-term business continuity.

This evolution represents a significant shift in how executive leadership views cybersecurity.

The conversation is moving away from technology spending and toward enterprise risk management.

The modern Chief Information Security Officer operates at the centre of an increasingly interconnected organisation.

Cybersecurity decisions now affect every department, from engineering and operations to legal, procurement, finance, and executive leadership. A cloud migration, software deployment, acquisition, or new supplier relationship can all create security implications.

As a result, CISOs work closely with:

• Security teams.

• Information security managers.

• CIOs and CTOs.

• Legal and compliance departments.

• Procurement teams.

• Executive leadership.

• Board members.

Few leadership roles require such a broad understanding of both technical and business considerations.

This cross-functional responsibility is one of the reasons the role has become increasingly strategic. Modern CISOs are expected to understand technology, governance, finance, risk management, and organisational leadership simultaneously.

While the position remains deeply connected to cybersecurity, its influence now extends far beyond security operations.

The Chief Information Security Officer of 2026 is not simply responsible for protecting systems. They are responsible for helping the organisation make smarter decisions about risk, resilience, and long-term growth.

As cybersecurity continues to evolve, this ability to bridge business objectives and security requirements will remain one of the defining characteristics of successful cybersecurity leadership.

At 2:26 AM, the phone rings.

The Security Operations Centre is already investigating suspicious activity. Technical teams are analysing logs and attempting to determine the scope of a potential incident. Legal teams are reviewing regulatory obligations. Executive leadership is waiting for answers.

Nobody has a complete picture of the situation.

And yet decisions cannot wait.

Should critical systems be isolated? Should customers be notified? Does the incident require regulatory disclosure? Should the business continuity plan be activated?

This scenario illustrates a reality that is rarely visible outside the cybersecurity profession: the most difficult aspect of being a Chief Information Security Officer is not necessarily the technology. It is the responsibility of making high-stakes decisions under pressure with incomplete information.

Modern CISOs operate in an environment where uncertainty is constant. Cyber threats evolve continuously, attack surfaces expand daily, and regulatory expectations continue to increase. While technology plays a critical role, leadership under pressure has become one of the most valuable skills a security executive can possess.

The role of the Chief Information Security Officer has become significantly more demanding over the past decade.

Several factors contribute to this growing pressure.

The first is the expectation of constant vigilance. Cyberattacks do not follow business schedules. Critical incidents can emerge during weekends, public holidays, or late at night. Many CISOs remain mentally connected to their responsibilities even when they are not actively working.

The second factor is accountability. As cybersecurity becomes a governance issue, the consequences of a poor decision can extend beyond technical systems. A major security incident may result in operational disruption, regulatory scrutiny, financial losses, reputational damage, or legal consequences.

The third challenge is complexity. Modern CISOs oversee risk management, cybersecurity strategy, security operations, compliance programmes, supply chain security, cloud environments, and executive reporting simultaneously. The breadth of responsibility continues to expand while resources often remain limited.

Another challenge is professional isolation. Few executives operate at the intersection of technology, governance, risk management, compliance, and business strategy. While CISOs collaborate with many stakeholders, relatively few people fully understand the complexity of the role.

Finally, there is uncertainty. No organisation can guarantee complete visibility across every system, asset, supplier, application, or exposure. Every security leader understands that unknown risks may still exist somewhere within the environment.

Research consistently highlights these concerns. Studies conducted across the cybersecurity industry show that many CISOs believe their responsibilities become more challenging every year, with burnout emerging as a growing concern among security professionals and executive leaders alike.

Given the pressure associated with the role, an obvious question emerges:

Why do so many CISOs continue to choose this career path?

The answer extends far beyond technology.

For many security leaders, the role provides an opportunity to create meaningful impact. Every prevented breach, every successfully managed incident, and every improved security programme contributes directly to organisational resilience.

Most successes are invisible to the outside world.

A critical vulnerability is remediated before it can be exploited. A phishing campaign is detected before employees are compromised. A supply chain risk is identified before it affects business operations. An attacker fails because the organisation was prepared.

In many cases, the crisis never becomes visible because it was prevented before it began.

This sense of purpose remains one of the strongest motivations within the profession.

Another factor is intellectual challenge. Few industries evolve as rapidly as cybersecurity. New technologies, new threats, new regulations, and new business models continuously reshape the landscape. CISOs must constantly learn, adapt, and refine their approach to risk management.

Many security leaders are also motivated by the broader mission of protecting people, organisations, and critical services. Whether supporting healthcare systems, financial institutions, industrial operations, or technology companies, cybersecurity has become an essential component of modern society.

While attackers continue to evolve, the greatest challenge facing modern CISOs is not necessarily threat sophistication.

It is scale.

Every year organisations deploy more applications, adopt more cloud services, connect more suppliers, and expose more digital assets to the internet. Each initiative creates business value, but it also increases complexity.

The result is a rapidly expanding attack surface.

At the same time, attackers are operating faster than ever before. Vulnerabilities are often exploited within days—or even hours—of public disclosure. Security teams are expected to identify, assess, prioritise, and remediate risks at a pace that would have been unimaginable only a few years ago.

This creates a fundamental problem.

The issue is no longer finding vulnerabilities.

The issue is determining which vulnerabilities matter most.

Most organisations already possess extensive visibility into their environments. Vulnerability scanners, cloud security tools, threat intelligence platforms, and security operations technologies generate enormous volumes of data every day.

The challenge is transforming that data into actionable decisions.

This is why prioritisation has become one of the most important capabilities within modern cybersecurity programmes.approches d'External Attack Surface Management (EASM)et de validation offensive continue.

As organisations continue to expand, maintaining visibility across all internet-facing assets becomes increasingly difficult.

Cloud environments, SaaS applications, acquisitions, third-party integrations, remote work technologies, and digital transformation initiatives all contribute to attack surface growth. Many organisations discover exposed assets they were unaware existed.

This reality has accelerated the adoption of External Attack Surface Management (EASM).

EASM provides organisations with continuous visibility into internet-facing assets, helping security teams identify:

• Unknown assets.

• Forgotten systems.

• Exposed services.

• Vulnerabilities.

• Misconfigurations.

• Third-party exposures.

For modern CISOs, understanding what is exposed has become a prerequisite for effective risk management.

However, visibility alone is no longer sufficient.

Security teams also need to understand which exposures represent genuine business risk.

This is where continuous validation approaches are becoming increasingly valuable. By validating exploitability rather than relying solely on severity scores, organisations can focus resources on the risks most likely to affect business operations.

In a world where attention, resources, and budgets remain limited, prioritisation is rapidly becoming the defining capability of mature cybersecurity programmes.

The future of cybersecurity leadership will not belong to the organisations that identify the most vulnerabilities. It will belong to the organisations that understand which risks matter most and act on them first.

Understanding the role of the Chief Information Security Officer is only the first step. Providing security leaders with the tools and capabilities required to manage an increasingly complex environment is another.

A recurring theme emerges across conversations with CISOs, security teams, and information security managers: the challenge is no longer visibility alone. The challenge is volume.

Organisations face an ever-growing number of digital assets, cloud services, third-party relationships, vulnerabilities, alerts, and attack paths. At the same time, cybersecurity teams continue to operate within familiar constraints: limited budgets, limited resources, and limited attention.

The question is no longer whether risks can be identified.

The real challenge is determining which risks require immediate action.

This is why modern cybersecurity programmes increasingly rely on External Attack Surface Management (EASM), Risk-Based Vulnerability Management (RBVM), and continuous validation methodologies. These approaches help organisations focus on the exposures that present genuine business risk rather than attempting to address every finding equally.

The first challenge facing every Chief Information Security Officer is understanding what is actually exposed.

As organisations expand through cloud adoption, SaaS platforms, acquisitions, supply chain partnerships, and digital transformation initiatives, maintaining a complete inventory of internet-facing assets becomes increasingly difficult. Many organisations discover that their attack surface is significantly larger than they originally believed.

Advanced External Attack Surface Management provides continuous visibility across the external environment, allowing security teams to identify assets, exposures, and potential risks before attackers do.

Key capabilities include:

• Automated discovery of internet-facing assets.

• Continuous mapping of the external attack surface.

• Identification of unknown or unmanaged systems.

• Detection of vulnerabilities and misconfigurations.

• Risk-based prioritisation of exposures.

• Ongoing monitoring of supply chain and third-party risks.

For modern CISOs, visibility is no longer a luxury. It is a fundamental requirement for effective risk management and cybersecurity strategy.

Visibility alone does not solve the problem.

Most organisations already generate more security data than they can effectively process. Vulnerability scanners, security operations tools, cloud platforms, and threat intelligence services produce thousands of findings every day.

The challenge is identifying which findings represent real-world risk.

This is where continuous offensive validation becomes critical.

Rather than relying exclusively on periodic penetration tests, continuous validation assesses whether vulnerabilities and exposures can realistically be exploited by attackers. This approach allows security teams to move beyond theoretical severity scores and focus on practical exploitability.

The objective is simple: prioritise the risks that matter most.

Key benefits include:

• Continuous validation of vulnerabilities.

• Identification of realistic attack paths.

• Reduction of false positives.

• Verification of remediation effectiveness.

• Improved security investment decisions.

• Better alignment between security operations and business priorities.

For CISOs, this approach helps transform large volumes of technical data into actionable business intelligence.

At Patrowl, we believe modern cybersecurity requires more than visibility.

As attack surfaces continue to expand, organisations need two essential capabilities: understanding what is exposed and understanding what is truly exploitable.

Patrowl combines Advanced EASM and Continuous Offensive Validation to help organisations focus on the risks that matter most.

For many CISOs, the challenge is no longer discovering risk.
It is deciding what deserves attention first.

Today, the platform helps organisations monitor more than 2 million assets and analyse over 100 million vulnerabilities, enabling security teams to identify and remediate critical exposures significantly faster.

Patrowl's approach is built on three complementary pillars.

Agentic AI

AI agents continuously analyse, correlate, qualify, and prioritise exposures across the attack surface. Rather than overwhelming security teams with raw data, they help surface the findings that require immediate attention.

Automation

Asset discovery, attack surface monitoring, security assessments, and validation activities are performed continuously. This allows organisations to maintain visibility across rapidly changing environments without relying solely on manual processes.

Human Expertise

Technology alone cannot fully understand business context.

Experienced cybersecurity professionals remain essential for validating findings, assessing real-world risk, and providing the offensive perspective required to understand how attackers operate. Human expertise ensures that technical insights are translated into meaningful business decisions.

Together, these capabilities allow CISOs, information security managers, and security teams to spend less time processing noise and more time managing risk.

The objective is not to identify more vulnerabilities.

The objective is to identify the vulnerabilities that matter most—before attackers do.

If the Chief Information Security Officer of the 1990s was responsible for protecting infrastructure, the Chief Information Security Officer of 2026 is responsible for protecting the organisation's ability to operate.

The role now sits at the intersection of risk management, cybersecurity strategy, governance, compliance, security operations, digital resilience, and executive leadership. Its scope continues to expand as organisations become more connected, more digital, and more dependent on complex ecosystems.

Modern CISOs work alongside Chief Information Officers (CIOs), Chief Technology Officers (CTOs), Chief Executive Officers (CEOs), legal teams, compliance specialists, and board members. They play a critical role in developing and implementing security strategies that support business growth while managing cyber risk.

Artificial intelligence, regulatory pressure, software supply chain risks, and increasingly sophisticated threat actors will continue to shape the future of the profession. As a result, the importance of the Chief Information Security Officer will only continue to grow. The question is no longer whether cybersecurity is a strategic function.That question has already been answered.

The real question is whether organisations will provide security leaders with the resources, influence, and support necessary to meet the responsibilities they now carry.Understanding the reality of the role is an important first step.Equipping those who perform it is the next.

Because behind every prevented breach, every avoided crisis, every successful security investment, and every informed risk management decision lies a reality that often goes unnoticed: Someone is holding the line.

And in 2026, that person is usually the Chief Information Security Officer.

• Unit 42, Global Incident Response Report 2025, Palo Alto Networks, février 2025

• Bugcrowd, Inside the Mind of a CISO — Resilience in an AI-Accelerated World, 2025

• PwC, Global Digital Trust Insights 2025

• Trend Micro, étude sur la surface d'attaque (entreprises françaises)

• Mandiant, données sur le délai d'exploitation des vulnérabilités (2023)

• VulnCheck, données sur les vulnérabilités KEV

• Nick Kirtley, CISO Security Mind Map 2026, Threat-Modeling.com, avril 2026

• FIRST.org, CVE Volume Forecast 2026

• Les Assises de la cybersécurité / EPITA, Évolution du rôle du CISO, 2025

• CISO: Holding the Line, Épisode 1 — « Why the Hell Would Anyone Want to Be a CISO? », YouTube, 2025