The "Golden Bullet" Clause: A Financial Shield for CISOs After Data Breaches

A "golden parachute" clause allows departing executives to land smoothly.

Former WeWork CEO Adam Neumann, for instance, onceactivated his "golden parachute" arrangementand walked away with $1.7 billion in stock, cash, and credit.

That was Neumann's personal choice. Security executives, however, may not have such luxury.

A "golden parachute" provides financial security for executives when they leave. But given the reality that data breach risks constantly hang over CISOs, a "golden bullet" clause can offer financial protection to CISOs after an incident, shielding them from subsequent fallout. This view comes from Stuart Mitchell, head of information and cybersecurity recruitment at Stott and May, who shared it in an interview with CIO Dive.

A "golden bullet" cannot fully shield executives from public scrutiny, but it can ease the pressure of blame placed on them. And if fears of termination become reality, the "golden bullet" clause would pay out as a bonus to CISOs who depart due to a breach.

"Whenever there's a high-profile breach, companies need a scapegoat," Mitchell said. If it's a well-known company, "you get fired and dragged through the mud quite publicly."

A "golden bullet" can cushion the impact of that dragging.

Neumann may have damaged his reputation, but his "golden parachute" gave him a "fairly soft landing" financially, Mitchell said, and CISOs don't always enjoy that treatment.

According to a Nominet survey of more than 400 CISOs, nearly one-third of CISOs suspect they will lose their jobs or receive a "formal warning" due to a data breach.

If CISOs have sufficient budgets and fully staffed security organizations, they have all the resources needed for reliable protection. In such cases, blaming the CISO is reasonable.However, this scenarioalmost neveroccurs.

According to Nominet data, only 60% of CISOs believe their CEO or president agrees that a breach is inevitable. Non-IT leadership may be more focused on liability defense than on pursuing security best practices or investments, putting greater pressure on CISOs to deliver results with minimal resources.

Paying the price

After a breach, companiesfind it easy to make the CISO a scapegoat. These executives are responsible for maintaining network security and stability. But everyone in the security field knows that a cyber incident is a matter of when, not if.

In the third quarter of 2019 alone, more than 5,100 reported breaches exposed 7.9 billion records,according to research by Risk Based Security. In contrast, just over 1,300 breaches were reported for all of 2011, affecting approximately 420 million records in total.

Capital One's breach was reported in July, making it one of six incidents between July 1 and September 30 that exposed 100 million or more records.

Even though breaches are inevitable, professionals still step into this "thankless job," Mitchell said. Unlike other C-suite executives—for example, a CTO becomes a "hero" when launching a new product line—a CISO "never really becomes a hero, but people know when you mess up."

"You can definitely become the villain," Mitchell said.

According to Risk Based Security, top leaders worry most about the impact of a breach on the company's reputation.

During and after a breach, standard PR practice is often to single out a scapegoat—namely the CISO—even if that may not reflect reality, Mitchell said.There are aspects of security programs that CISOs cannot directly oversee, yet they will still bear the blame.

“That's why if you can't stand the heat, you should get out of the kitchen, Andy Kim, CISO of Allstate's e-commerce division, told CIO Dive.

Even with a tough exterior, there's a significant mental health component to the CISO role, Mitchell said.

According to Nominet, the majority of CISOs (91%) report experiencing moderate or high stress. About 17% of CISOs rely on medication or alcohol to relieve stress.

"I know many people who like being the number two, like deputy CISO or VP, because sometimes it's more fun to be the prince than the king," Mitchell said. "You can turn off your phone."

What a "golden bullet" includes

A "golden bullet" clause allows CISOs to consider their own future and what best serves the company's interests.

"Golden parachutes" are often used to attract executives,although critics warnthat they provide a moral incentive executives shouldn't need; organizations should act in the company's best interest without additional compensation.

The clause also helps protect the CISO's career.

"Ultimately you have to suck it up and keep a low profile," Mitchell said. "You always carry that skeleton in the closet; you can't hide that information," especially in front of Fortune 500 companies.

If CISOs leave, they will likely need to reinvent themselves and may hire a personal brand manager to assist.They can choose to leave with a substantial payout that supports them while being "dragged through the mud," until another public breach occurs and people forget, Mitchell said.

Companies also benefit from the contractual clause. If a "golden bullet" clause is written into a CISO's contract, it more or less guarantees the CISO focuses on breach recovery rather than job hunting, Mitchell said."It also gives the company an agreement that allows them to make the CISO the scapegoat."

This add-on helps mitigate criticism and concerns from investors and customers.

Today, "golden bullet"-style clauses typically "appear in nominal CISO appointments," Kim said. Some boards don't know what qualities make an effective CISO, so they appoint someone familiar to them rather than a seasoned security expert.

"Many uninformed board members don't know how to select an effective CISO," Kim said. Fortune 100 companies often have such boards that hire "their own friends or [someone] who is a politically well-connected appointee."

But "a lot of responsibility lies in hiring and firing, and whether to trust the right or wrong people," Mitchell said. Trust either exists between executive leadership and their CISO, or between the CISO and the rest of the security organization.

The cybersecurity industry relies on a diverse workforce with unique backgrounds. According toresearch by (ISC)², about 70% of qualified applicants hold titles not specific to security.

CISOs "who know what they're doing crave the moment when a breach happens," Kim said. "CISOs on the fringe will just resign outright."

Resigning in disgrace

Cybersecuritysuccess can only be measured by silence—no breaches, nocyberattacks, no headlines.

According to Greg van der Gaast, head of information security at the University of Salford, in aLinkedIn post, a CISO's performance should be quantified by more than a single incident.

"I think CISOs should be measured on the improvements they bring, not a point in time. Even if you're heading in the right direction, bad things can happen," van der Gaastsaid.

Retaining an executive with a publicly damaged reputation is a potential PR risk. Terminating a CISO is, to some extent, a form of PR damage control, regardless of the executive's tenure or experience.

Although ousted CISOs need to lick their wounds, their career recovery is possible. Former Uber CISO Joe Sullivan—who was criticized for paying hackers in the2016 data breach—is now the CISO of Cloudflare.

If CISOs do their best to fulfill their duties without major mistakes, yet a breach still occurs, companies must ask two questions, Mitchell said:

• Would the business be better off paying the CISO to clean up the mess?
• Or should the company interview new CISOs, thereby diverting attention from recovery efforts?

Companies with very public breaches, including Home Depot, have retained their CISOs or equivalent positions.

Home Depot adopted the CISO title when hiring Jamil Farschi, whowas later hired by Equifax. But Daniel Grider, vice president of information technology responsible for security, remained in his role.

Other companies were less fortunate. Yahoo experiencedthree high-profile data breaches between 2013 and 2016, later disclosing that the breaches affected 3 billion Yahoo accounts. During that period, especially in 2015, the CISO position saw a revolving door, although those departures were voluntary.

Within six months in 2015, Yahoo went through three CISOs: Alex Stamos, Rames Martinez, and Bob Lord. Lord later left in 2018, and now Chris Nims, CISO of parent company Verizon Media,，has taken on Yahoo's troubled past.