CISO Salary Guide 2026: What Chief Information Security Officers Really Earn

This CISO Salary Guide exists because most security leaders are negotiating blind. You get an offer letter with a base salary, a vague bonus target, and an equity number nobody bothers to explain, and you’re supposed to just say yes.

Here’s the problem. Glassdoor says CISOs average $261,000. Salary.com says $385,000. PayScale says $184,000. Three trusted sources, three wildly different answers, and you’re the one stuck guessing which number applies to you.

It’s not that any of them are lying. They’re measuring different companies, different equity structures, different everything. This guide breaks down exactly why the numbers split, what a real 2026 CISO package looks like by company size and industry, and how to know if your offer is actually competitive before you sign anything.

The Real Number Behind CISO Salary in 2026

I get asked this same question on almost every call I run with security leaders. What does a CISO actually make. Not the number on a job posting, the number that shows up in the offer letter.

CISO salary is not one figure. It moves depending on company size, industry, and how much equity the board decided to put on the table. Glassdoor puts median Chief Information Security Officer compensation at $326,957 a year for that exact title, and $261,566 for the shorter CISO title. Salary.com lands higher at $385,000.

PayScale, which leans on smaller employers and cash only reporting, comes in closer to $184,000. None of these sources are wrong. They are measuring different slices of the same job.

The IANS Research and Artico Search CISO Compensation Benchmark, built from 566 CISOs across the US and Canada, found total compensation rose 6.7% in 2025 alone. Most respondents fell between $250,000 and $700,000, with a handful of outliers past $3.1 million.

At the very top, Fortune 100 security chiefs have reported total packages north of $5 million, though that sits at the extreme edge of the market, not the middle.

Source	Average / Median	Reported Range
Glassdoor (CISO title)	$261,566 avg	$198,436 to $350,369
Glassdoor (Chief Information Security Officer title)	$326,957 avg	$257,332 to $422,982
Salary.com	$385,000 median	Not broken out publicly
PayScale	$184,000 avg	Cash base only, smaller employers
IANS Research and Artico Search Benchmark	Most between $250K to $700K	Top earners past $3.1 million
Large public enterprises (CSO / Cybersecurity Ventures)	$500,000+	Up to $5 million at Fortune 100 level

CISO Salary by Company Size

Company size impact on CISO pay is bigger than almost any other factor in a comp conversation. A 40-person startup with a security team of two is not paying the same rate as a bank running 50,000 employees under a regulator’s watch.

At mid-market companies with $100 million to $500 million in revenue, base salary usually runs $275,000 to $375,000, with total direct compensation climbing well past that once bonus and incentive pay get folded in. At large public enterprises, base pay alone often starts where mid-market total comp ends, and equity stacks another 30 to 50% on top.

If you are earlier in your security career and want to see how pay builds toward this level, our breakdown of cybersecurity salary by experience level in the US walks through what analysts, engineers, and managers earn at each stage before the executive track.

Industry Pushes Pay Higher or Lower

Industry-specific pay is the second lever that moves the number. Heidrick & Struggles found that CISOs in technology and services earn the highest total compensation on average, largely because equity and long-term incentives make up a bigger share of the package there than anywhere else.

Financial services and healthcare pay well too, mostly because regulatory exposure means the board wants a security leader who can hold up under audit scrutiny. Retail and manufacturing tend to sit lower on base pay, though they have closed the gap fast since 2023, when SEC disclosure rules turned cybersecurity into a board-level reporting item almost overnight.

Base Salary vs Total Compensation

Base salary is only the starting line. Total compensation is where CISO pay actually gets interesting, and it is also where most people misread their offer.

A typical package breaks into four pieces. Base salary is the guaranteed cash. Annual bonus is tied to performance, usually 15 to 30% of base at the executive level. The equity package, often RSUs or stock options on a multi-year vesting schedule, is where the real upside sits for CISOs at public or well-funded private companies.

Executive-level benefits round things out, covering deferred compensation, extended health coverage, and increasingly, personal liability protection tied to the role, since CISOs now carry real legal exposure after a breach.

Here is a scenario I walk people through often. Say an offer shows a $300,000 base and a recruiter quotes total comp around $450,000. That gap is bonus plus equity. If the equity is unvested RSUs on a four year schedule, you are not pocketing $450,000 in year one.

You are getting your base, plus bonus, plus roughly a quarter of the grant if it vests evenly. Read the vesting schedule before comparing two offers side by side, because the headline number rarely tells the whole story.

About 70% of CISOs now receive some form of equity, and for the highest earners it can represent half the total package. That is a real shift from a decade ago, when CISO pay was almost entirely cash.

CISO Salary by Location

Location-based pay still matters even as remote work reshapes how security teams operate. San Francisco leads at roughly $400,000 in average total comp, followed by New York near $375,000, Seattle around $360,000, and Washington DC close to $350,000.

These cities combine large tech employers, heavily regulated industries, and higher cyberattack exposure, all of which push CISO demand and pay upward.

For the full city by city and state by state numbers across the broader cybersecurity field, not just the CISO title, our guides on cybersecurity salary by city and cybersecurity salary by state break down how cost of living and local demand shift pay for every role from analyst to executive.

CISO vs Other Cybersecurity Roles

CISO sits at the top of a career ladder most people climb over 10 to 15 years, and the pay gap between rungs is bigger than most job seekers expect.

A SOC analyst salary in the US typically starts well below six figures for entry roles. Move into offensive security and pay climbs, with penetration tester salary in the US often outpacing a general analyst role because of the specialized skill set involved.

Keep climbing toward architecture and leadership, and the gap widens further, which our comparison of cybersecurity analyst vs engineer vs architect breaks down role by role.

For the complete picture of where every cybersecurity title lands on the pay scale before drilling into any single role, start with our cybersecurity salary in the US guide. It is the anchor reference we build every role-specific breakdown on this site from, CISO included.

If you are just starting out, our page on entry-level cybersecurity salary in the US covers realistic first-job numbers and what to expect before the titles and the pay start climbing.

What Moves the Number

A few things reliably move CISO pay beyond size and industry. Certifications like CISSP and CISM still carry weight in negotiations. Board exposure matters too, meaning CISOs who report directly to the board or sit in on audit committee meetings tend to command more than those buried a few layers under a CIO.

Prior breach experience, oddly enough, can raise your market value, since boards want someone who has already been through a real incident.

Job changes remain the fastest way to grow pay. Several recruiting firms report that CISO transitions average a 31% salary increase, well above the 3 to 5% typical for an annual raise. Turnover in the role itself stays low, around 11% a year, which keeps openings competitive whenever one does appear.

Common Misconceptions About CISO Pay

A few myths keep circulating in security circles that are worth correcting directly.

The first is that CISO pay is mostly base salary. It is not, not once you move past small companies. The second is that every CISO earns seven figures. Most do not. The realistic middle of the market sits in the $250,000 to $700,000 total comp range, and seven-figure packages stay reserved for large public companies and a handful of high-profile hires.

The third is that fractional CISO arrangements pay poorly. On an hourly basis they can actually work out well for experienced leaders splitting time across a few smaller clients. The fourth is that the title alone tells you the pay. A CISO running a 12-person startup security function and a CISO running a 300-person global program are different jobs wearing the same title, and compensation reflects that gap every time.

Frequently Asked Questions

How This Article Was Created

The figures in this guide come from Glassdoor, Salary.com, PayScale, ZipRecruiter, the IANS Research and Artico Search CISO Compensation Benchmark, and reporting from Cybersecurity Ventures and RSAC Conference covering 2026 CISO pay data. No numbers were invented or estimated without a source behind them. This article was written to help job seekers and hiring teams understand realistic CISO pay ranges, not to promote any recruiting service or platform.