CISO Responsibilities Are Expanding, and Greg Crowley Says Risk and Resilience Must Guide the Work
Checked out by Franklin Okeke · 810 reads
eSentire CISO Greg Crowley says security leaders need risk based priorities, stronger organizational support and resilience metrics to manage expanding duties.
The modern CISO is expected to connect security decisions to business priorities while overseeing a widening set of risks. Greg Crowley, CISO at eSentire, says the role now reaches into privacy, contract reviews, HR investigations and executive planning, on top of the daily work of detecting, preventing and responding to threats. His advice is to rank work by risk, explain what the team can realistically deliver, and measure whether the organization can withstand and recover from an incident.
That expanding remit has a human cost. “I challenge you to find a CISO who has not been burned out, who is not on the verge of burnout, or who is not currently burning out,” Crowley says. The problem, in his view, is partly a mismatch between the breadth of the job and the expertise or resources available to carry it out. Security leaders can’t be specialists in every domain they’re asked to oversee.
Crowley’s career reflects the mix of technical and organizational experience the job demands. He has spent more than 20 years in IT and cybersecurity, including 17 years at World Wrestling Entertainment, where he held leadership roles in engineering, infrastructure and security and served as vice president of cybersecurity and network infrastructure. He holds a bachelor’s degree from Queens College and the CISM and CISSP certifications.
For Crowley, security leadership depends heavily on communication: setting a strategic direction, then translating it into work teams can carry out. That means understanding technical risks and explaining their business consequences to executives and other stakeholders.
Use risk to decide what comes first
Cloud services, connected devices, privacy and day-to-day incident response can all compete for attention. Crowley says there is no universal priority list: the right focus depends on the organization’s size, industry and level of security maturity. The first questions are which incidents could cause the greatest harm, how likely they are, and how prepared the company is to contain and recover from them.
That assessment can look different from one organization to another. A risk that deserves immediate attention in one industry may be less pressing elsewhere. Crowley recommends considering both potential impact and likelihood, along with the company’s current ability to respond. The goal is to direct limited resources toward the risks that matter most in that specific business.
“We often have to get involved with data privacy, legal contract reviews that have security and data terms, HR investigations, and the daily tasks of ‘detect, protect, and respond.’”
That breadth makes prioritization more than a planning exercise. If everything is treated as equally urgent, teams can lose sight of high-impact threats while stretching their time across too many tasks. Crowley’s approach starts with a clear view of the organization’s exposure and resilience, then uses that view to make choices about effort and staffing.
Burnout points to a support problem
Crowley says the CISO role still lacks consistent boundaries. Boards and CEOs increasingly recognize that security leaders need executive judgment as well as technical understanding, but expectations can continue to grow faster than a team’s capacity. Privacy, compliance and legal work each call for specialized knowledge, and their requirements change across jurisdictions and over time. Crowley points to Europe’s GDPR as one example of the complexity involved.
His argument is not that CISOs should ignore these areas. They need enough visibility to identify security risks and bring the right people into decisions, but they can’t reasonably serve as deep subject matter experts in every field. Organizations need specialists and support staff who can take responsibility for work that falls outside the CISO’s core expertise.
Trying to cover every issue with a small, overloaded team can leave the whole program less effective. Crowley warns that when a CISO attempts to own everything, tasks may be done poorly and important risks can go unmanaged. He says security leaders should tell executives plainly what resources they need and what outcomes are achievable with current staffing. That conversation can also reset assumptions about what the security team can take on.
Agree on risk tolerance before priorities collide
Security priorities often compete with product schedules, customer needs and business plans. Crowley says organizations should establish their risk appetite early: which risks they can accept, which require mitigation, and which are beyond their tolerance. That shared understanding gives teams a way to work through disagreements without treating security as a blanket reason to stop a project.
For example, a software team may want to release features quickly. A CISO can work with engineers to identify the associated risks and find safeguards that let the team proceed within the organization’s agreed limits. If a proposed initiative could exceed those limits, the security leader can explain the exposure and help stakeholders consider ways to reduce it.
This approach also requires security leaders to communicate constraints, not just technical findings. Executives and product teams need to understand the practical choices: what can proceed as planned, what needs additional protection, and what risk would remain. A common framework for discussing risk helps make those trade-offs explicit.
Build relationships before a risk becomes urgent
Strong working relationships help CISOs learn where risks are emerging and where concerns might otherwise go unreported. Crowley recommends building connections across the organization, from executives to teams closer to daily operations. A security leader who understands what people are working on can often spot an issue earlier and find a practical way to address it.
When he joins an organization, Crowley says he arranges one-on-one conversations with key people. He asks about their challenges and obstacles, and looks for ways the security team can help remove them. That effort builds trust and gives the CISO a clearer view of the business. At the executive level, open communication helps leaders raise difficult issues and get support when a risk needs attention.
“You have to prove to them that you’re here as a partner, right?”
For Crowley, partnership is built through repeated, useful conversations. A CISO who is brought into decisions only when a security review is needed may have little time to shape the plan. Earlier involvement gives security teams a chance to identify risks while there is still room to address them.
Report resilience in terms leaders can use
Security teams can track many operational measures, but Crowley says there is no single set of standardized CISO benchmarks comparable to the familiar metrics used in finance. Detailed measures can help teams assess their own programs, yet executives may struggle to understand what those figures mean for the business. He recommends organizing the message around cyber resilience: how well the company can anticipate threats, withstand an attack, recover and adapt.
The National Institute of Standards and Technology describes resilience through those capabilities. Crowley says organizations can use them to group measures and show how security work supports business continuity.
Anticipation: Training effectiveness and vulnerability management can show how well the organization identifies and prepares for threats.
Withstanding: Time to detect, respond, contain and recover can help show whether an incident can be controlled before it spreads.
Recovery: Incident response plans, tabletop exercises and the ability to restore data within Recovery Time Objective and Recovery Point Objective targets help assess recovery readiness.
Adaptation: Teams can use what they learn from threats and incidents to adjust their approach as risks change.
Operational reporting still has a place: teams need detailed measures to understand whether controls and processes are working. For executive discussions, Crowley advises translating those measures into a simpler account of resilience and its business implications. The NIST Cybersecurity Framework can provide a structure for that work, while the reporting itself should focus on outcomes leadership can act on.
Put security into plans early
Crowley’s prescription for organizations is to treat security as a core part of business planning and give CISOs access to the people and resources needed to do the job. A security leader brought into decisions at the start can help identify risks while a new product, market expansion or AI initiative is still being designed.
Waiting until a plan is well underway can make security problems more expensive to address. An organization may have to redesign work or abandon an initiative after investing time and resources in it. Early involvement gives teams more options and lets the CISO help the business meet its goals with security considerations built into the plan.
For organizations facing an expanding CISO remit, Crowley’s guidance comes down to three practical steps: prioritize by likelihood and impact, equip specialized teams to handle complex areas, and bring security into business decisions early. Resilience measures then give leaders a shared way to track whether those choices are improving the organization’s ability to prepare for, contain and recover from threats.
