Does replacing the CISO actually make the system more secure? Counterintuitively, probably yes. Tone flows from the top down, and if you want to change the ton

Does replacing the CISO actually make the system more secure? Counterintuitively, probably yes. Tone flows from the top down, and if you want to change the tone you need to start at the top. It's very difficult to try and build a coalition to change the system from underneath. Presumably he had a lot of tribal knowledge built-up and who is going to know the system better than him? Likely he has a lot of political influence and knowledge of the system and for lasting change all of that has to go. If it has gotten that bad it's no good and needs to be swept away.