From what I have heard from a CISO, they often get the job but not the power or budget. That turns then into a scapegoat if things go wrong. The day job is pri

From what I have heard from a CISO, they often get the job but not the power or budget. That turns then into a scapegoat if things go wrong. The day job is primarily politics to get some meager resources for security from somewhere and raising awareness.