This argument may have had some relevance 20 years ago, when security functions were primarily responsible for auditing IT operations.
But today, it increasingly reflects an outdated understanding of both roles.
Modern cybersecurity is deeply intertwined with technology architecture, cloud platforms, DevOps pipelines, digital transformation programs and operational resilience initiatives. Security cannot be treated as an external oversight function policing IT from a distance.
It must be embedded within technology strategy itself. Any modern CIO should see it that way.
In that environment, close collaboration between the CIO and the CISO is not only desirable — it is essential.
Framing the relationship as a structural budgetary conflict and a source of friction is counterproductive and outdated. The real objective should not be to avoid friction but to engineer alignment: Ensuring that technology leadership and security leadership work together to support the organization’s strategic goals.
Moving beyond the debate
Ultimately, the continuing debate about the CISO reporting line distracts the security industry from more important questions.
What matters far more is whether cybersecurity is integrated into corporate governance, supported by executive leadership and aligned with business strategy.
If organizations are still arguing about where the CISO should sit in 2026, it may simply indicate that they have not yet fully accepted the strategic nature of cyber risk.
And until that changes, the debate will likely continue.
Not because the answer is difficult — but because the underlying governance challenge remains unresolved.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?