Executive summary As organizations confront a rapidly evolving and interconnected threat landscape – especially from organized criminal groups and state-sponsored cyber operations, AI-enabled attacks and supply chain vulnerabilities – the role of the CISO is undergoing a profound transformation. Today’s CISO must act as a business strategist, operational risk leader and trusted adviser to executive leadership and boards. The shift towards positioning cybersecurity as a core business risk has accelerated in recent years. Regulatory frameworks now frequently mandate the appointment of a CISO and define their accountability structures.1 At the same time, the consequences of cyber incidents – such as operational disruption, reputational damage and erosion of customer trust – have become more visible and severe. However, in the Global Cybersecurity Outlook 2025 survey, almost twice as many surveyed CISOs than CEOs identified brand damage and loss of customer trust as their top concerns amid geopolitical tensions. This gap highlights a continued misalignment at the executive level regarding cyber risk prioritization.Drawing on insights and engagements with CISOs in the World Economic Forum’s CISO community, this white paper discusses how the position is expanding in scope and influence amid the growing complexity of the cyber landscape, and outlines the key roles CISOs must fulfil to position themselves as strategic enablers. Boards have a role to play in empowering the CISO to exercise effective leadership and deliver strategic and sustainable impact. The success of the CISO depends on influence rather than hierarchy. To do this, boards must empower CISOs with a clear, enterprise-wide mandate that recognizes cybersecurity as a fundamental enabler of resilience, trust and long-term value. This white paper also addresses boards and provides them with a set of enablers that help elevate cybersecurity within the organization so that the CISO can develop trusted relationships in both internal and external ecosystems – spanning the C-suite, risk and compliance functions, operational units and government bodies. Elevating cybersecurity is also about strengthening the organization’s overall resilience.The chief information security officer has become central to the success of the business. Boards and C-suite executives can actively contribute to making cybersecurity a strategic imperative within the organization. Elevating Cybersecurity: Ensuring Strategic and Sustainable Impact for CISOs 4

Elevating Cybersecurity 2025