Articles like this continue to misunderstand why the CISO role exists in the first place.

Splitting the role into 'GRC/Risk' and 'Technical/Defenses' doesn't magically solve the tension between business velocity and security controls. It just dilutes CISO authority, fractures budget control, and creates a perpetual turf war over who actually owns enterprise risk.

When you split the function, you don't reduce executive complexity, you just push the job of arbitrating technical security trade-offs onto a CEO who hired a CISO precisely so they wouldn't have to do it themselves.

https://www.csoonline.com/article/4230243/should-the-ciso-role-be-split-in-two.html