The IBM report offers up some excellent data and provides some useful findings, some examples of which I found particularly interesting and included:

The Focus is Shifting Towards Risk Management: "In two years, security leaders expect to be spending more of their time on reduction of potential future risk, and less on mitigation of current threats and management of regulatory and compliance issues."
The Archetypes are Real: CISOs and security leaders can be grouped into archetypes which include Responders, Protectors and Influencers, and each persona has a very distinct modus operandi in regards to working with and through their organizations. The report does a great job of not only fleshing out these different archetypes; it also provides keen insight into how one can morph from one archetype to the others.
A Shift in Focus from the Local to the Global: "In general, the role of information security will be moving away from specific risks to global risks. The role will be much larger than it used to be," the authors noted.
Measures Really Matter: Think of this as gaining insight from the process of obtaining metrics, and not just from the numbers themselves. "Although metrics can be a challenge to define and capture, that should not deter organizations from implementing them. Measurement may be imprecise at first but will improve over time – and the process itself can drive valuable insight," the report states.

I saw a lot of reports last year on the evolution that is defining the role of the new CISO, but this report is by far the best in show.

Instant Insights /

The CISO as the Man-in-the-Middle