The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A regular working relationship between the chief information security officer and the chief financial officer is a sound way to connect cyber risk with investment decisions. Survey data shows that senior contact and joint investment planning already happen among CISOs. The evidence does not show, however, that the partnership alone produces better security. Treat it as a governance mechanism that makes better decisions more likely, not as a guaranteed result.
What the evidence supports, and what it does not
The claim that CISO–CFO partnerships “drive” security success is best read as a proposition to test, not a finding. Four recent published sources measure how often CISOs reach senior leaders, how often they plan cyber spending with finance, how hard business alignment is in practice, and which operating practices are associated with stronger programs. None of them isolates the effect of a CFO partnership on breach rates or other security outcomes. The useful conclusion is narrower: executive access and financial alignment are common enough to be practical, and they address problems the surveys identify.
As an Amazon Associate I earn from qualifying purchases.
Joint investment planning is real but uneven
The clearest data on finance involvement comes from the PwC Switzerland Digital Trust and Insights 2026 Switzerland edition. It reports that 36% of Swiss organisations’ CISOs are engaged in strategic planning with the CFO about cyber investments. The same chart lists 45% for the global sample and 46% for Western Europe on that activity.
Two points follow. First, the Swiss figure sits below both comparators, so it should not be read as a typical level for every market. Second, the chart also tracks regular board reporting and reviewing regulatory disclosures with finance and other executives. Those are the other places where security spending and financial reporting meet, and they are worth checking in your own organisation alongside joint planning.
#1 Best Overall
Senior access is common among the surveyed CISOs
Splunk’s CISO Report 2025, produced with Oxford Economics, was based on a global survey conducted in June and July 2024. It drew 600 respondents: 500 CISOs, CSOs or equivalent security leaders, and 100 board members, across 10 countries and 16 industries. Within the CISO group, 82% said they interact directly with the CEO, and 83% said they participate in board meetings somewhat often or most of the time.
The CEO figure measures interaction, not reporting lines. The release was clarified on this point, and it should not be read as a claim that most CISOs report directly to the CEO. The same release describes differences between board and CISO priorities and in how each group defines success. Access, in other words, does not guarantee agreement. That gap is where a CFO partnership has the most practical work to do.
Business alignment is still the hard part
Gartner’s February 11, 2025 press release on its security leader survey found that 14% of surveyed security and risk management leaders could both secure organisational data and enable its use for business objectives. That is a survey result about how difficult the balance is. It does not identify the cause of the gap or a tested cure.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The implication for the CISO–CFO relationship is straightforward. Protecting data and enabling its use involve trade-offs that cost money and affect revenue, so the two executives need a shared way to weigh them. That reasoning is an interpretation of the finding, not something the survey measured.
Rank #3
Measuring security success beyond budget size
Discussions about security spending often stall on budget size. Cisco’s Security Outcomes Study, Volume 2 shifts attention to operating practices. It describes an independent, double-blind survey of more than 5,100 IT professionals in 27 countries and names five practices it associates with program success:
- Proactive technology refreshes, replacing aging tools before they fail or fall behind.
- Well-integrated technologies, so that tools share context rather than working in isolation.
- Quick incident response, measured by how fast the organisation contains a problem.
- Prompt disaster recovery, restoring operations after an incident.
- Early, accurate threat detection, spotting problems soon and with few false alarms.
These are Cisco’s study findings, and they describe associations rather than controlled tests. They are still useful to a CFO conversation because each one can be expressed in business terms. A technology refresh is a planned capital decision with a known schedule. Response and recovery capability is an operating commitment with costs that can be budgeted and outcomes that can be reported.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A working model for the partnership
There is no validated scoring framework for CISO–CFO collaboration in these sources. The following sequence is a practical structure drawn from the findings above, and it can be run in any organisation with a budget cycle.
- Name the business goal or risk. State the outcome the spending supports, such as protecting a revenue process, meeting a regulatory obligation, or keeping a product launch on schedule.
- Describe what the security proposal changes. Explain the control, tool or process in operational terms, including what would be different after it is in place.
- Set out costs and trade-offs together. Show the expected cost, the timing, what is deferred if the money is not approved, and the residual risk that remains.
- Agree on the outcome to monitor. Choose measures that both executives will review, such as detection time, incident response time or recovery time, and record who owns each one.
Compare proposals on three axes: how clearly they serve a business goal, how transparent the risk and financial assumptions are, and whether their outcomes can be measured afterwards. These axes are editorial, inferred from the sources, and not a formal scoring method.
Best Value
Illustrative example (hypothetical): A CISO proposes replacing an aging log platform. Step one ties the request to the finance team’s close process, which depends on access to audit records. Step two describes what the new platform changes in plain language. Step three lists the licence cost, the migration period and the risk of deferring by one budget cycle. Step four agrees that detection time will be reported quarterly. Each part of the discussion is now checkable.
Limits to keep in view
- Each statistic belongs to its own population, date and geography. The PwC figure is for Swiss organisations; the Splunk figures are from a June–July 2024 survey; the Gartner figure is from a February 2025 release.
- Survey responses show what respondents say is happening. They do not confirm that a practice produced a particular result.
- A strong CFO relationship does not replace technical controls, staffing or board oversight. It improves how those are funded and explained.
A CISO and CFO who plan together are better placed to explain cyber risk in the language the business uses, and to decide where money changes outcomes. Whether that partnership delivers security success in a given organisation has to be measured there.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
