As Global Head of Research & Leadership Advisory at JRG Partners, I have prepared this CISO salary guide for 2026 as a calibration tool for compensation committees and hiring executives. Benchmarks answer where the market is; your mandate answers what you should pay within it. Treat every figure below as a directional input to be adjusted for company size, ownership structure, sector, and geography.
Key Takeaways: CISO Compensation in 2026
- Company scale is the strongest single driver of CISO pay: total compensation rises steeply with revenue, complexity, and public-company status.
- Every regulated enterprise, every technology company, and increasingly every industrial operator competes for the same thin bench, and pricing has risen accordingly for a decade.
- Base salary is only part of the architecture: incentive design and long-term instruments determine who the package actually attracts.
- Target bonuses typically run 25-45% of base at mid-market and 40-70% at large regulated enterprises, tied to program-maturity and audit measures rather than incident counts.
- Benchmarks are calibration points, not answers: the specific mandate should shape structure as much as market data does.
What Drives CISO Compensation in 2026
CISO compensation reflects the economy’s most acute leadership shortage relative to demand. Every regulated enterprise, every technology company, and increasingly every industrial operator competes for the same thin bench, and pricing has risen accordingly for a decade. The variables that move packages: enterprise threat surface and regulatory exposure, reporting line, board-facing peer officers price above CIO-subordinate roles, incident-leadership history, and in 2026, personal-liability considerations, which have made indemnification terms, D&O coverage, and legal-support provisions standard package components rather than negotiating afterthoughts.
CISO Salary Benchmarks by Company Size
The table below presents directional 2026 benchmarks for United States CISO compensation by revenue tier. Base ranges reflect typical market practice; total direct compensation adds the annualized value of long-term incentives, which vary widely by ownership structure.
| Company Revenue | Base Salary Range | Target Total Cash | Typical Total Direct Compensation |
|---|---|---|---|
| Under $25M (venture / early stage) | $175,000 – $250,000 | $225,000 – $375,000 | Cash plus meaningful early-stage equity |
| $25M – $100M | $225,000 – $300,000 | $300,000 – $450,000 | $325,000 – $550,000 |
| $100M – $500M | $275,000 – $375,000 | $350,000 – $550,000 | $475,000 – $950,000 |
| $500M – $1B | $350,000 – $450,000 | $450,000 – $675,000 | $725,000 – $1.6M |
| $1B – $5B (often public) | $400,000 – $550,000 | $525,000 – $825,000 | $1.4M – $3.6M |
| Over $5B (large-cap public) | $525,000 – $725,000 | $675,000 – $1,100,000 | $3.2M – $8M |
Treat these ranges as calibration points. A first-time executive stepping up typically lands in the lower half of a band, while a proven operator with directly relevant experience commands the top of the band or above it.
Benchmarks by Ownership Structure
Financial services and healthcare enterprises pay the top of the CISO market with equity-weighted packages. Technology companies compete at similar levels with heavier options. PE portfolios increasingly appoint platform-level CISOs with 0.3-0.8% equity. Mid-market companies unable to match these levels increasingly buy fractional or virtual CISO coverage instead, a legitimate model at the right scale.
Industry Differentials That Persist in 2026
Financial services, healthcare, and technology set the market ceiling; critical infrastructure, energy, utilities, industrials, has closed much of the gap post-regulation; retail and services trail but face identical candidate scarcity.
Geographic Differentials: Narrower, Not Gone
Expect a 30-40 point spread between the most and least expensive American markets for the same scope: apex coastal metros at 15-25% above national medians, major regional hubs near parity, and smaller markets 10-15% beneath, with hybrid arrangements muting but not erasing these differentials.
Structuring the Package: Beyond the Benchmarks
Strong 2026 packages share several design features beyond the headline numbers. Annual bonuses tie to a small set of auditable metrics rather than diffuse scorecards. Long-term incentives vest over three to four years with genuine performance conditions, aligning the executive’s horizon with value creation rather than tenure. And the offer is presented as a coherent thesis, here is how you build wealth by succeeding in this mandate, rather than as a stack of disconnected components. CISO incentives should reward posture and program maturity, control coverage, response readiness, audit outcomes, never the absence of incidents, which is partly luck, and packages must address liability explicitly: indemnification, insurance, and independent-counsel provisions are now market standard. Severance and change-of-control terms belong at offer stage, and sign-on instruments should solve a candidate’s specific transition math rather than serving as blunt sweeteners.
Common Pricing Mistakes to Avoid
The recurring pricing errors are worth naming. Anchoring to the departing incumbent’s package rather than the market for the role as now scoped. Quoting base salary against a candidate’s total compensation, then wondering why the conversation stalled. Leaving long-term incentives undefined until final negotiations, which reads as improvisation. And benchmarking against national medians while recruiting in a premium market, or against premium markets while recruiting outside them. Each error is cheap to prevent and expensive to commit.
How to Use These Benchmarks in a Live Search
Used well, benchmarks are the start of a disciplined sequence: mandate first, then range, then candidates. Anchor to the role as now scoped rather than to history, secure compensation-committee approval before finalists are in play, stress-test the structure against the candidate’s best alternative offer, and let the interview process verify that the experience being priced is real rather than well-narrated. Our companion guide, 25 Interview Questions to Ask When Hiring a CISO, is built for exactly that verification step.
The Bottom Line for Boards and CEOs
Benchmarks inform; architecture decides. Companies that price the role against reality, tie incentives to the mandate, and run decisive processes build leadership teams at sustainable cost, and this CISO salary guide exists to give that discipline its starting point.
Frequently Asked Questions
- Q: What is the average CISO salary in the United States in 2026?
- A: There is no single meaningful average because scale dominates the answer. Mid-market CISOs at $100M-$500M revenue companies typically earn base salaries in the $275,000-$375,000 range, with total direct compensation well above that once incentives and long-term instruments are included.
- Q: What bonus percentage is standard for a CISO?
- A: Target bonuses typically run 25-45% of base at mid-market and 40-70% at large regulated enterprises, tied to program-maturity and audit measures rather than incident counts.
- Q: How much equity should a CISO receive?
- A: Technology-company CISOs commonly receive option packages of 0.2-0.75% at growth stage; public-company grants typically run 1.5-3x base at scale; PE platform CISOs commonly receive 0.3-0.8% of equity.
- Q: Should the CISO be paid as a C-suite officer or a senior director?
- A: The market has answered: enterprises treating the CISO as a true officer, with peer compensation, board access, and liability protection, are winning the talent, while director-level framing increasingly buys a caretaker in a seat that cannot afford one.
- Q: Should we pay a first-time CISO less than the benchmark range?
- A: Modestly, at most: the lower half of the relevant range is appropriate; below-band offers are false economies that convert into premature departures once the executive proves out.
- Q: How often should CISO compensation be re-benchmarked?
- A: Annually for bonus and equity refresh decisions, and immediately upon any material change in scope such as an acquisition, significant revenue growth, or a transaction process. Waiting for the executive to raise the issue is how companies lose leaders they intended to keep.
![](https://www.jrgpartners.com/wp-content/uploads/2025/12/tanya-gallardo.jpeg")
Tanya Gallardo
Managing Director, Executive Search & AI Talent Strategy
Tanya Gallardo is the Managing Director of Executive Search & AI Talent Strategy at JRG Partners, leading C-suite and Board engagements across key growth sectors including Technology, Financial Services, and Manufacturing.
With over 18 years of experience specializing in disruptive technology leadership, Tanya is recognized as a leading authority on talent architecture for future-focused executive roles, such as the Chief AI Officer (CAIO) and Chief Digital Officer (CDO). Her expertise lies in accurately assessing the cultural fit and technical depth required to ensure a high return on investment (ROI) for critical leadership appointments.
Prior to her role at JRG Partners, Tanya held senior roles directing global talent acquisition strategies at a major publicly-traded technology firm, advising on organizational design and succession planning for emerging executive functions. She is a recognized speaker and contributor to industry events, sharing data-driven insights on executive compensation, leadership development, and the measurable business impact of C-suite talent.
