A CISO can become a CIO, and Presidio just hired one. Doran Stienike, its new CIO since November 9, had run security at ConAgra Foods and later held the CIO and CISO titles together at CSG. He’s one of several in the past year.
On November 5, the day Presidio announced his appointment, Checkmarx gave Kobi Sivilya both the CIO and CISO titles. Sivilya came from Outbrain, where he was CISO and VP of IT. The Department of War also appointed a former CISO nearly a year ago, when it named Kirsten Davies, previously CISO at Unilever and Estée Lauder, as its chief information officer.
The harder decision for a board is what happens to security once its former head runs IT. The organizations behind these moves answered that differently, and Euroclear took another approach: it made its group CISO, Claus Norup, deputy CIO with a reporting line to both the new CIO and the CEO.
I’d hire a former CISO as CIO when the fit is right. At a large company, I’d also keep a separate CISO whose reporting line doesn’t run only through the CIO.
Quick Read
- Several CIO appointments in the past year went to former CISOs.
- The board’s first decision is who owns security after the hire.
- In the appointments examined here, the security setup followed each organization’s exposure: the security vendor combined the roles, and the defense and federal organizations kept a separate CISO.
- A second reporting line for the security lead, as at Euroclear and the FDIC, gives risk concerns a way around the CIO.
- A former CISO’s brief needs business results, and only 13% of CIOs in Gartner’s latest survey report major value from AI.
Why Are Boards Putting Security Leaders in Charge of IT?
AI agents may be one reason, since they need access to company systems. Deciding what each one can reach has been CISO work for years.
In July 2026, the Harris Poll surveyed 685 CIOs for Dataiku. 81% said they don’t have complete oversight of agents built outside approved systems, and 84% agreed that employees create agents and apps faster than IT can govern them. Gartner’s 2027 CIO survey, which covered 2,002 CIOs and technology executives from May to July 2026, found that 37% have already deployed AI agents. Another 34% plan to within a year.
Dataiku also asked who is responsible when an agent goes wrong. The answers were spread out: 23% said shared teams, 21% central IT, 20% the data or AI team and 18% security. A CIO with a security background is one way to give that question an owner.
Who Has Moved From CISO to CIO, and What Happened to Security?
The New CIO Keeps a Separate CISO
In February 2026, the Department of War named Aaron Bishop its CISO. He also serves as acting deputy CIO for cybersecurity, inside Davies’s office. Federal law sets how the department appoints people, so the part a company board can use is the reporting design.
In January, IonQ hired Katie Arrington as CIO. She had been CISO in the Pentagon’s acquisition and sustainment office and later its deputy CIO for cybersecurity. She started on January 19 and reports to COO and CFO Inder Singh. Leslie Kershaw, from IonQ’s Capella subsidiary, became CISO and reports to her.
Kershaw’s job is meeting federal and commercial cybersecurity requirements and running enterprise cyber and physical security. For a company that sells to the military, passing security audits is a condition of its contracts, and that work needs its own owner even when the CIO came from security.
The FDIC has made this move twice. Zachary Brown, its longtime CISO, now leads the agency’s IT organization. The CISO seat is listed as vacant, and Rami Dillon is deputy director of the security office. The agency did the same in 2017, when Howard Whyte went from CISO to CIO within ten months. A board promoting its CISO needs a security succession plan before the promotion.
One Executive Holds Both Titles
Pentair gave Heather Hausmann both titles. She joined in 2022 to lead cybersecurity and IT infrastructure, after CISO roles at SPS Commerce and SUPERVALU. On March 1, 2026, she became executive vice president and now reports to the CEO. She had previously reported to the CFO.
CEO John Stauch tied the change to how much digital transformation and cybersecurity matter to Pentair’s long-term success. The new reporting line says more than the titles do: a combined CIO and CISO under the CFO is often managed on cost, while under the CEO the same role gets weighed on growth and risk.
Sivilya’s role at Checkmarx covers security as well as IT and business applications. Checkmarx sells application security, and its announcement said AI is changing how software gets built and attacked. A security failure inside Checkmarx could also damage customers’ confidence in its security expertise, which makes one owner for both jobs easier to defend. The board then needs a check outside the executive team, such as internal audit or an outside assessor.
[Table 1]
Across these examples, the security setup appears to follow each organization’s exposure more than its size. Checkmarx, a security vendor, combined the roles. Pentair combined them too but moved the job under the CEO. The defense supplier and the federal agencies kept the CISO separate. For a board hiring in 2026, that exposure should be one of the first things it examines.
Does a CISO Reporting to the CIO Create a Conflict?
In April 2026, a CSO Online column called the CIO-CISO conflict a myth and argued that the CIO is still the natural reporting line where technology change is a top priority. CSO Online had earlier quoted Brian Levine, a former federal prosecutor who runs FormerGov, on the other side: “when the CISO sits under the CIO, cost containment may outrank risk reduction.” He would have the CISO report to the CEO or the general counsel.
Neither piece covers a CIO who used to be the CISO. That CIO knows the security program well and can overrule it on technical grounds, and the CISO under them may not push back.
Euroclear handles this with a second reporting line, since Norup reports to the CEO as well as the CIO. Security has drawn regulator attention there before. In 2023, the IMF’s assessment of Euroclear Bank credited the current CISO with improvements but still found critical gaps in operational risk. Whatever the reasons behind this year’s change, Norup’s line to the CEO keeps the security program in front of the executive regulators hold accountable. The FDIC uses a dual line as well. Its August 2025 IT strategic plan has the CISO reporting to both the CIO and the FDIC chairman.
At a small company where IT and security are one team, two executives may cost more than the extra oversight is worth. If one person holds both titles, the audit committee should hear about the security program from internal audit or an outside assessor.
What Should the Brief Say When the Candidate Is a Former CISO?
Much of a CISO’s record is incidents that didn’t happen, which tells a board little about how the same person will deliver systems and returns as CIO. The brief should name those results and put numbers on them.
In Gartner’s survey this year, only 13% of CIOs said their enterprise had realized significant or transformational value from AI.
Before a CIO search starts, the board should answer five questions:
- Who will run security day to day, and can that person go directly to the CEO or a board committee?
- Which security decisions will the new CIO hand off?
- Which business results will the CIO own in year one, and how will they be measured?
- Who owns AI agents built outside IT, and who can shut one down?
- If one person holds both titles, who reviews the security program?
I’d also ask every former CISO on the slate two questions.
“Tell us about a project where business priorities conflicted with security concerns. How did you resolve the disagreement, and who accepted the remaining risk?” A strong candidate understands what each option would have cost the business and can explain why the final decision was justified.
“Your CISO plans to tell the audit committee something you disagree with. What do you do?” The answer you want leaves the CISO’s access to the committee alone. Be careful with a candidate who wants to review the report first.
Frequently Asked Questions About CISOs Becoming CIOs
Can a CISO Become a CIO?
Yes. Kirsten Davies at the Department of War and Katie Arrington at IonQ both did. The gaps worth probing are business applications and delivery budgets, since security roles don’t always include either.
Should the CISO Report to the CIO?
It depends on the company. Euroclear and the FDIC both have the security lead report to the CIO with a second line to the CEO or chairman, which gives security a way to escalate.
Can One Person Hold Both the CIO and CISO Titles?
Pentair and Checkmarx both do it. The setup works best where IT and security are already one team, with internal audit or an outside firm reviewing security.
Why Are Companies Hiring Former CISOs as CIOs in 2026?
AI agents have made access control a bigger part of IT. In Dataiku’s survey, 84% of CIOs said employees build agents faster than IT can govern them.
What Should a Former CISO Show in a CIO Search?
A record of delivery, such as a platform migration or an ERP program where they owned the budget and the deadline.
About Christian & Timbers
Christian & Timbers is an AI and technology executive search firm that recruits CIOs, CISOs, CTOs, VPs of IT, VPs of Information Security, Heads of AI and board directors, with global reach into passive candidates who aren’t looking for a new role. Boards weighing a former CISO for the CIO seat, or deciding how security should report after the hire, can contact Christian & Timbers to discuss the search.
