Not too long ago, the Chief Information Security Officer (CISO) was the person you called when something went wrong… data breach, phishing attack, weird login from another country. Their world was largely technical, reactive, and sometimes siloed from the rest of the business.

But that’s changing. Fast.

Today’s CISOs are stepping into a very different kind of role, one that’s way more strategic. According to Deloitte’s latest Global Future of Cyber survey, nearly 3 out of 4 organizations say their CISO is now actively involved in shaping the company’s technology strategy. They’re weighing in on big-picture investments, helping manage risk at the leadership level, and playing a real part in how the business grows and innovates.

Cyber has become central to how modern companies operate and compete.

Why It Matters: When CISOs are brought into strategy from the start, businesses can move faster, innovate more safely, and build real trust with their customers. These leaders bring a unique lens to the table, ensuring that innovation doesn’t come at the cost of security or trust.

• CISOs Are No Longer Just the “Tech Risk” People: The days of the CISO being tucked away in the IT department are fading. Deloitte’s data shows that 73% of organizations are now bringing their CISOs into the room for high-level discussions around technology strategy. That means these leaders are helping decide what tools to use, how to deploy them safely, and when it’s worth taking a calculated risk. Instead of being the person who says “no,” the modern CISO is helping the business figure out how to say “yes”, securely and confidently.

• AI and Emerging Tech Are Driving the Change: One of the biggest accelerators of this shift is GenAI. It’s showing up in nearly every industry and every department, and it’s forcing companies to rethink their entire risk posture. CISOs are being asked to weigh in on everything from data governance to algorithmic bias to intellectual property protection. The pace of AI innovation means security teams can’t afford to play catch-up anymore, they need a seat at the strategy table from day one.

• The CISO Path Isn’t One-Size-Fits-All Anymore: Traditionally, CISOs came up through the IT or infosec ranks, but that’s changing. As the role becomes more strategic and business-facing, companies are starting to prioritize skills like communication, leadership, and risk management alongside technical know-how. That’s opening the door for professionals from broader backgrounds like finance, operations, and even marketing to move into cybersecurity leadership roles. The CISO is becoming more of a “business translator” for complex cyber issues than a pure technologist.

• Cyber-Mature Companies Are Outperforming Their Peers: Deloitte draws a clear line between cyber maturity and overall business success. Organizations that have well-defined security plans, regularly test scenarios, and actively involve their boards in cyber discussions are twice as likely to report better outcomes, not just in security, but in areas like innovation, customer trust, and operational resilience.

• Security Is About Trust: In a world where customers are more privacy-conscious than ever and one breach can dominate headlines, trust is a business differentiator. The CISO’s role is expanding to include not just risk management, but reputation management. They’re working closely with legal, PR, and executive teams to ensure the brand stays credible, compliant, and trusted. And when done well, security becomes a brand asset.

Go Deeper -> Has the CISO finally been accepted as a key strategic player? – Deloitte