CISO: The Executive Who Acts as a Business Leader and Crisis Manager, But Thinks Like a Hacker

Winning Bizness Bureau

The world's first recognised Chief Information Security Officer shortly termed as CISO was appointed by Citigroup in 1995, after the internet began transforming global business. Indian companies started creating dedicated CISO roles in the mid-2000s, but the position truly gained prominence over the past decade as digital payments, cloud computing, ransomware attacks and data protection laws reshaped the corporate landscape.

Today, almost every major Indian bank, IT company, telecom operator, financial institution and listed enterprise—and even upcoming start-ups—have a designated CISO or an executive performing the same role. While there is no official count, industry estimates suggest that several thousand medium and large organisations across India now employ CISOs, either directly or through outsourced security leadership.

What has changed most is the job description itself.

A decade ago, the CISO was largely viewed as the company's technology gatekeeper, responsible for passwords, antivirus software, firewalls and access controls.

That perception no longer holds.

Role filled with threats & challenges

Today's CISO not just worries about ransomware gangs, cloud vulnerabilities, supply-chain attacks, insider threats, third-party vendors, privacy regulations, remote working, digital fraud and, increasingly, artificial intelligence.

More on the cyber fraud worries today's CISO faces:

AI-powered social engineering, deepfake financial scams and automated Business Email Compromise (BEC) have become some of the biggest cyber frauds keeping Chief Information Security Officers awake at night. The democratisation of advanced AI has shifted the threat landscape from conventional malware to sophisticated identity-based deception.

According to recent global assessments, including the World Economic Forum's Global Cybersecurity Outlook, cyber-enabled fraud has now emerged as one of the biggest corporate risks worldwide. It can be categorised in a few points like...

i) Deepfake photos & videos making hard to distinguish real from reel

Not only celebrities and politicians, hyper-realistic voice and video clones are increasingly being used to impersonate senior corporate executives and bypass traditional security checks.

AI-generated video calls have already tricked finance teams into authorising multi-million-dollar fund transfers, while synthetic identities combining genuine and fabricated information are targeting digital banking onboarding and Know Your Customer (KYC) systems.

For today's CISO, distinguishing real from reel (fake) has become harder than ever.

ii) Business Email Compromise (BEC) creating more trouble

Generative AI has removed the spelling mistakes and awkward language that once exposed phishing emails, making fraudulent communications convincing.

Cybercriminals are also using AI to scan public records, monitor vendor-client conversations and launch highly targeted invoice fraud. AI-generated lookalike domains further blur the line between genuine and fake corporate identities, making these attacks increasingly difficult to detect.

Traditional phishing is evolving into precision-engineered deception.

iii) Rapid AI-adoption inviting more challenges

The rapid adoption of AI inside organisations has opened fresh attack paths. Autonomous AI agents interacting with enterprise applications can unintentionally create new vulnerabilities, while prompt injection techniques are being used to manipulate internal AI systems into revealing confidential information.

Security leaders are equally concerned about the rise of "Shadow AI", where employees unknowingly upload sensitive source code, customer information or internal documents to public AI platforms without organisational approval.

Innovation is moving faster than governance.

iv) Identity has become another major battleground

Modern attackers increasingly rely on session hijacking tools that steal browser session tokens, allowing them to bypass Multi-Factor Authentication altogether.

At the same time, organisations now manage far more machine identities than human users, creating vast blind spots for security teams. Stolen credentials and corporate access keys are actively traded on underground marketplaces, giving attackers legitimate-looking entry into corporate networks.

The challenge is no longer just protecting people, but also protecting machines.

v) Supply chain fraud turning another headache

Supply-chain fraud has become significantly more complex. Rather than attacking well-defended companies directly, cybercriminals frequently target third-party vendors, software suppliers and service providers to gain indirect access.

Compromised software updates, vulnerable vendor ecosystems and limited visibility across external partners have transformed supply-chain security into one of the CISO's most demanding responsibilities.

A company's security is now only as strong as its weakest vendor.

Cybersecurity moves into the boardroom

Every new business initiative whether launching a mobile app or moving customer records to the cloud now passes through the CISO's risk lens. And therefore, cybersecurity has quietly shifted from the server room to the boardroom.

Perhaps the most unusual part of the job is that a CISO spends as much time speaking to people as speaking about technology. The board of directors rarely wants to hear terms like "attack surface" or "zero-day exploit".

Instead, they ask different questions.

• Will the company lose customers?
• Could production stop?
• What will this cost?
• Will investors lose confidence?

The CISO has to translate complex cyber threats into plain business language, helping the CEO and the board understand how a digital breach can quickly become a financial, legal and reputational disaster.

In many companies, the CISO has become the bridge between engineers who understand technology and executives who make billion-rupee decisions.

The AI balancing act

Artificial intelligence has made that balancing act even harder.

The same AI tools helping businesses improve productivity are also making cybercriminals smarter. Fraudsters now use AI to generate convincing phishing emails, clone voices, write malicious code and automate attacks at a speed that was unimaginable just a few years ago.

At the same time, companies are rushing to adopt AI across departments.

That leaves the CISO walking a tightrope by encouraging innovation while ensuring sensitive information does not leak into AI platforms or create new privacy and compliance risks.

• It is no longer enough to secure computers.
• The challenge now is securing intelligence itself.
• Preventing disasters before they happen
• Ironically, the best CISOs are often those whose biggest achievements never make the headlines.

Their success lies in preventing disasters that never happen.

Much of their work revolves around imagining the unimaginable—running cyberattack simulations, testing disaster recovery plans, identifying hidden weaknesses and preparing response teams long before an actual breach occurs.

Security experts often say cyberattacks are no longer a question of "if" but "when". A capable CISO ensures that when the inevitable happens, panic does not.

People remain the weakest link, yet even the most sophisticated security technology has one stubborn weakness.

A single click can harm in millions

A single careless click on a phishing email, a weak password reused across multiple websites or an employee sharing confidential files through an unauthorised app can undo millions of rupees worth of cybersecurity investment.

That is why modern CISOs spend increasing amounts of time conducting awareness programmes, educating employees and building a culture where security becomes everyone's responsibility.

They know that the strongest firewall cannot compensate for poor judgement.

The growing importance of the CISO is backed by research rather than perception alone. A 2025 academic review of global cybersecurity leadership found that the CISO has evolved from a technical specialist into a strategic executive responsible for organisational resilience, governance and business continuity.

What surveys say

Industry surveys by IANS Research and Heidrick & Struggles echo the same finding: boards now involve CISOs in major business decisions far more often than they did just five years ago, even as their responsibilities continue to expand.

In an era where data has become as valuable as money, the CISO has quietly emerged as one of the most indispensable people in any organisation—not because they stop every cyberattack, but because they prepare companies to survive the ones they cannot.