A Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability

This article contrasts an "engineer" CISO—who treats security primarily as an engineering problem focused on preventative technical controls—with a "holistic" CISO who integrates people, process, and technology to build resilience; it warns that engineering-only approaches can simply move risk into less-observed areas (build pipelines, glue code, human workflows) and cites incidents like the Bybit theft and AI supply-chain/prompt-injection risks as illustrations.