An interview with global cybersecurity thought leader and Corix Partners founder JC Gaillard
Why Traditional Cybersecurity Roles Aren’t Enough — and How to Transform Them for the Digital Age
Cybersecurity is at a crossroads, and for many organizations, it’s not just a technical issue — it’s a leadership and cultural challenge.
To effectively address the growing threat of cyberattacks, businesses must rethink their cybersecurity strategy by elevating the CISO role and creating a more integrated, business-focused leadership structure. Without this transformation, companies risk remaining stuck in a cycle of reactive responses and missed opportunities.
In this interview with JC Gaillard, Founder and CEO of Corix Partners, we explore why the traditional CISO role has struggled to evolve and what needs to change.
Cybersecurity has been a significant challenge for many businesses. In your opinion, why is the current CISO role facing so many difficulties?
That’s a great question. For the past two decades, cybersecurity has predominantly been treated as a purely technical discipline. The current generation of CISOs is largely made up of technologists, and for them, it’s been about pushing a technology-driven agenda. But that’s created a disconnect. We’ve seen CISOs try to fix the problem from the bottom up — through tools and technology — but this has largely failed, leaving them stuck in a reactive mode, fighting cyberattacks instead of developing long-term strategies.
It sounds like the problem isn’t just about the technology, but about a deeper cultural and structural issue. Could you explain that more?
Exactly. It’s a cultural transformation, not just the implementation of new tools. Many business leaders have now recognized the inevitability of cyber-attacks and their devastating impact. But they expect cybersecurity to be executed effectively and efficiently across the business — not just in IT. The problem is that most CISOs are still stuck focusing on the “what” needs to be done, but they rarely focus on the “how” — the execution. That’s a big mistake. Cybersecurity has to be integrated into every part of the organization: business functions, support teams, and the growing digital supply chain.
So, it sounds like what’s missing is a broader vision of what cybersecurity should be. What’s your solution to this problem?
To break out of this cycle, you need to change how cybersecurity is governed. The CISO role, as it stands, can’t bridge the gaps between technology and business. What I propose is a split of the role. We need to elevate the cybersecurity leader to a more business-facing role, one that is part of the executive team. This new leader would drive the execution agenda across the business, ensuring compliance, reporting, and continuity. Meanwhile, the traditional CISO role should focus on the technical side — managing the IT aspects of cybersecurity.
That’s an interesting approach. But what do you see as the challenges in implementing this split in many organizations?
The biggest challenge, especially in some regions, is regulatory pressure and personal liabilities that CISOs face. It’s a risky move for many companies to split the role when they’re worried about compliance issues. But I truly believe this approach could break the current deadlock and stop the cycle of hiring and firing CISOs without achieving meaningful, long-term results. We need to build trust among the executive team and establish governance structures that go beyond just technical expertise.
It sounds like you’re advocating for a much more strategic and leadership-oriented role for cybersecurity, not just one focused on firefighting. What do you think needs to happen for companies to make this shift?
There’s a lot of work to be done, especially when it comes to changing the mindset around cybersecurity. Businesses need to understand that it’s not just an IT issue; it’s a core part of the business’s long-term health and success. Achieving this requires personal gravitas from the CISO and a willingness from executives to trust that person. But that shift can only happen if we stop thinking of cybersecurity as merely technical and start viewing it as a business priority that requires leadership, governance, and collaboration across the entire organization.
You mentioned earlier that many CISOs are dissatisfied with their roles and often switch jobs without making real changes. Why do you think that happens?
It’s all about the role’s limitations. CISOs are trapped in a cycle of failure because the expectations are misaligned. They’re hired to fix the cybersecurity issue, but because they are stuck in a purely technical space, they can’t address the bigger cultural and organizational gaps. They end up hopping from one job to another, but the issues they face are the same across companies. The leadership around cybersecurity needs to be restructured to be more impactful and forward-thinking.
It sounds like a real shift in how companies approach cybersecurity leadership is needed. How optimistic are you that businesses will embrace this change?
I’m cautiously optimistic. The need for transformation is obvious, and many business leaders are starting to see the bigger picture. While it may be difficult in some places due to regulatory constraints, the direction is clear. The cybersecurity landscape needs stronger leadership and more strategic thinking, and that change is necessary for companies to keep up with evolving threats. It’s not just about technology; it’s about governance and business integration. I believe we’re at a turning point, and with the right approach, we can break the current deadlock and make cybersecurity a real business enabler.
Contact Corix Partners to find out more about developing a successful Cyber Security Practice for your business.
Corix Partners is a Boutique Management Consultancy Firm and Thought-Leadership Platform, focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation & Governance challenges.