There are a lot of ways you are flat wrong about this issue. I was a CSO at a large technical company and we were successful in separating the role of Security

There are a lot of ways you are flat wrong about this issue. I was a CSO at a large technical company and we were successful in separating the role of Security Engineer from regular Engineer with HR. With regard to corporate politics, you have hit on an interesting aspect of the problem. Why is it that politics should trump the actions taken to prevent breaches? The CSO/CISOs that I know all have this stress of knowing what the risks are and the difficulty of moving the organization, incrementally, towards a safer posture. Successful ones know how to navigate whatever the culture is and somehow produce a solution. The underlying causes of breaches really come down to 1. the corporate culture, 2. the technical competence of the organization, top to bottom, and 3. the strength of the security team. If the security team up through the CSO is very good and the culture is not so good (recent breaches will give you names), or the technical competence of the company is low (e.g., putting a breach response site on the internet disconnected from your root domain), then the effectiveness of the CSO is not very good. There is a fundamental tension between spewing off features to win market share and producing quality, secure software. A wise company will find a CSO who can help move the culture and influence the technical practices. Those folks are very rare, and as such will have very high pay.