The CISO Pay Gap: Inside Cybersecurity's Massive Compensation Divide
The 2025 CISO Compensation Benchmark Snapshot Report reveals a striking reality: total compensation for the top 1% of CISOs starts at $3.2 million, roughly 10 times the median and 20 times what the bottom 10% earn. This isn't just a modest pay gap—it's a chasm that reflects fundamentally different roles operating under the same title.
DOWNLOAD NOW: 2025 Cisco Compensation Benchmark Snapshot Report
The distribution of total compensation shows that most CISOs earn between $250,000 and $700,000 annually. But the upper end stretches beyond, with the highest earners exceeding $3.1 million in compensation. This skewed distribution means that averages often fail to represent the experience of CISOs at either end of the spectrum. (See Figure 6.)
IANS and Artico Search conducted their sixth annual CISO Compensation and Budget Research Study. Data collection for this research took place from April to October 2025. To date, we have gathered data on compensation from 566 CISOs based in U.S. and Canada.
What Drives the CISO Compensation Differences?
Our data analysis points to four primary factors that create this compensation divide:
- Equity compensation changes everything. Seventy percent of CISOs receive equity as part of their package, and for top earners, it can represent up to 50% of total compensation. But equity availability varies by sector—nearly universal for tech CISOs, present for about 70% of financial services, retail, and healthcare CISOs, yet only one in five CISOs in education receive equity-based compensation packages.
- Industry matters. Tech and financial services industries lead the pack, with CISOs who receive equity earning average total compensation of $844,000 and $744,000, respectively. The heightened threat exposure of these sectors, regulatory requirements, and data sensitivity drive higher compensation for these vertical industries.
- Scale and complexity command higher pay. CISOs overseeing teams of more than 100 employees and budgets exceeding $50 million typically land in the top percentile of earners. In these cases, the scope and complexity of the mandate directly impacts compensation potential.
- Experience and diversification increase earning power. CISOs with at least eight years of role experience, particularly those who've worked across multiple companies or industries, often earn 100% more than peers with shorter, less varied backgrounds.
READ MORE: 2025 Large Enterprise CISO Snapshot: Higher Compensation—Lower Satisfaction
Guidance for CISO Career Planning
Understanding these drivers matters whether you're negotiating your current package or evaluating new opportunities. The data shows that CISO compensation grew 6.7% in 2025, outpacing security budget growth of just 4%. CISOs who stayed with their employers and expanded their scope saw the highest compensation increases at 8.1%—higher than the 5.0% average increase for those who switched jobs.
The lesson? Strategic career moves that increase your scope, deepen your industry expertise, and position you in sectors that offer equity can dramatically impact your earning trajectory over time.
READ MORE: CISO Compensation Negotiation Checklist
Get the Latest Analysis on the CISO Talent Landscape
Cybersecurity faces a persistent talent shortage. With CISOs struggling to staff critical security roles and retain existing employees, understaffed teams are left to execute critical security initiatives. Download the 2025 Cisco Compensation Benchmark Snapshot Report and use benchmark data to refine staffing, negotiate pay bands, and secure budgets for top talent. To request the full 36-page report contact us.
You can also download our 2025 Security Organizational Design Benchmark Report—and gain access to valuable insights on team design, leadership positions, and pay ranges broken out by three distinct revenue and staffing clusters: contact us to request the full report.
Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.