A review of websites of the global top 100 companies by market value finds only 5% have listed a CISO or a CSO in their executive leadership pages
Virtually all companies like to say they take their customers' privacy and security seriously, make it a top priority, blah blah. Tweets: @briankrebs and @harshilshah1910 Tweets: @briankrebs : Companies like to say they take their customers' privacy/security seriously, blah blah. But very few of the world's biggest companies list any security executives among their executive leaders http://krebsonsecurity.com/... http://twitter.com/... Harshil Shah / @harshilshah1910 : This feels like a weird metric to track. Especially when you see that the title for one of the 5 is “President of Cyber” (MasterCard) http://twitter.com/...
Context & Ripple Effects
Krebs on Security's scan of the global top 100 by market value found only five companies willing to put a security executive — a CISO or CSO — on their leadership pages, with MasterCard's 'President of Cyber' title the most idiosyncratic of the five. Harshil Shah's pushback in the thread captures the real question: whether an org-chart listing measures anything at all.
Five years on, the same visibility gap shows up higher up the hierarchy: 88% of S&P 500 boards still lacked a director with direct cybersecurity experience, and only seven had a current or former CISO seated. What began as a curiosity about websites became the baseline evidence for regulators and investors asking where security actually sits in corporate power structures.
First-order effects
- The 95 companies with no listed security executive are exposed as saying security is a top priority while keeping it off the leadership page — a reputational gap Krebs' readership can now audit company by company.
- MasterCard stands out among the five not just for the title but for backing it with acquisitions like RiskRecon, which assesses third-party vendor risk from public data.
Second-order effects
- Regulators picked up the thread: the SEC's cyber risk reporting rules raised legal exposure for public companies and their CISOs directly, forcing firms that once kept security anonymous to name and own it.
- Boards became the pressure point — with only 14% of new Fortune 500 directors in 2022 bringing cybersecurity experience, down from 17% the year before, investors gained a measurable deficit to push against.
Third-order effects
- If the pattern holds, security accountability migrates from optional titles to hard mechanisms: Microsoft tying security goals to executive compensation after the Cyber Safety Review Board report is the template other large firms would follow under disclosure rules.
- The longer shift is that 'security is a priority' claims become auditable — through leadership pages, board seats, and now compensation and disclosure filings — turning what Shah called a weird metric into a compliance artifact.
The trend: Corporate security leadership is moving from an invisible, unlisted function to a formally disclosed, regulatorily scrutinized and compensation-linked role.