There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem. It’s what the 2026 CISO Report from Cybersecurity Ventures and Sophos calls a market failure.
Most companies under $50 million in revenue never close that gap with a full-time hire; the math doesn’t work at that scale. Instead, security decisions get made informally: an IT director carrying a second job, a compliance program built to pass audits rather than manage risk, or no one at all. Host David Shaw (CISSP, GLEG) walks through what actually fills the gap: a full-time CISO, an internal promotion, or a fractional vCISO, what each one costs, where each one works, and where each one fails.
In this episode:
- The 10,000-to-1 CISO-to-business ratio, and why the 2026 CISO Report calls it a market failure
- The three informal models that fill the gap when there’s no security leader, and why each one breaks down under pressure
- Full-time CISO vs. internal promotion vs. fractional vCISO: honest costs and tradeoffs for each
- The revenue thresholds where each option actually makes sense
- An illustrative example of what an unaddressed gap costs when a known, escalated risk goes unfixed
The Security Leadership Readiness Check, five questions:
- Who is accountable to the CEO or board for security risk, by name, as a primary responsibility?
- When was security last on the board agenda as a standalone item, not folded into an IT update?
- Do you have a documented security roadmap with budget attached, reviewed at least annually?
- In the last 12 months, has an executive overridden an IT security recommendation, and do you know why?
- If you had a material security incident tomorrow, who makes the notification and response decisions, and have you rehearsed it?
Sources referenced:
- Cybersecurity Ventures — 35,000 Chief Information Security Officers Employed Globally in 2026
- Sophos — 2026 CISO Report (with Cybersecurity Ventures)
- Cybersecurity Ventures — 2026 CISO Salary and Compensation Data
Note: the healthcare-acquisition scenario referenced in this episode is an anonymized composite illustration, not a specific named case.
The Rook is board-ready security intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk without a dedicated security function. New episodes every other Tuesday.
Work with David: corvus-cyber.com
Now, it’s your move.