The CISO role is too often just a game of roulette. The big question is whether the CISO is actually able to effect changes that have material impact on their own fate, by improving security posture. If not, then the CISO is merely compensated to play the scapegoat when luck is down.
If it doesn't affect stock price, though, then the CEO, board, and shareholders are all incentivized to keep IS costs low, and ignore any costly security recommendations.
