IANS Research & Artico Search
Reports
All Statistics
A functional department leader, such as a head of SecOps, at a Fortune 500-size company earns an average annual cash compensation of $307,000.
More than 40% of Fortune-500 size security organizations have a deputy CISO.
The average annual cash compensation for a functional department leader (such as a head of SecOps) at large security organizations is $247,000.
Software accounts for roughly 30% of security budgets, making it the second-largest line item after staff and compensation.
SecOps solutions represent the largest share of software budgets at 16%.
Nearly 70% of CISOs have consolidated or are consolidating tools into integrated platforms.
90% of CISOs have ownership of their organization’s security operations, architecture, governance, as well as digital risk and compliance.
70% of CISOs indicated any raises they received were annual merit-based increases, which on average were 6%.
Strategic CISOs have an annual cash compensation of around $545,000, compared to $385,000 for functional CISOs and $291,000 for their tactical counterparts.
The average annual cash compensation for a functional department leader (such as a head of SecOps) at a Fortune 500-size company is about 25% higher than for the same role at large security organizations.
15% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to IAM.
11% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to GRC.
6% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to AppSec.
20% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to SecOps.
5% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Threat intel.
6% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Cloud security.
4% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Awareness training.
8% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Incident response.
8% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Leadership & strategic roles.
95% of Fortune 500-size CISOs engage regularly with the full board and/or board subcommittees.
31% of Fortune 500-sized security organizations have a dedicated, full-time deputy CISO.
34% of Fortune 500-size CISOs meet with the full board at least quarterly.
13% of Fortune 500-sized security organizations assign the deputy CISO role to a functional department head as part of a combined role.
Fortune 500-size firms with revenues exceeding $7 billion generally have security teams of more than 50 professionals.
68% of Fortune 500-size CISOs engage with board subcommittees at least quarterly.
8% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Other functions.
9% of the security staff budget for Fortune 500 organizations with 50+ security FTEs is allocated to Network security.
The average annual cash compensation for a functional department leader (such as a head of SecOps) at a Fortune 500-size company is 40% higher than the average for the same role at midsize security organizations.
13% of CISOs have made plans to consolidate tools into integrated platforms.
Two-thirds of security programs use Managed Security Service Providers (MSSPs).
Only 47% of CISOs engage with their boards on a monthly or quarterly basis, and 42% meet with their boards on an ad hoc basis, if at all.
1-25% of CISOs reported that emerging domains including AI, M&A security, change management, IT due diligence, digital transformation, and innovation were being added to their workload.
Between 50% and 90% of CISOs identified other elements of business risk, such as disaster recovery, business risk, and third-party risk management, as well as broader security concerns such as product security, as falling under their remit.
Dual CISOs at large organizations earn an average total compensation (including equity) of $1 million, whereas those who only take on partial IT oversight are closer to the average of traditional CISOs who manage none of the IT functions ($653,000).
3% of CISOs attribute their raise to taking on larger scope, while others see it reflected in merit increases.
7% of CISOs said their growth in compensation was driven by a change in employers, and this group received an average increase of 31%.