At the C‑level, you don’t need to be a hands‑on technologist, but you absolutely need technical literacy.
Not “how to configure a firewall,” but “how firewalls fit into risk, architecture, and business impact.”

Cybersecurity leadership is not like Jack Ma’s¹ world of general entrepreneurship. Cybersecurity is a domain where technology, risk, law, and business are tightly intertwined. You can delegate execution, but you cannot delegate understanding.

¹Jack Ma says he does not need to understand technology, he just needs to find someone who does.

Why pure “good management” is not enough in cybersecurity

A CISO/CSO who lacks technical literacy faces three existential problems:

1. You can’t evaluate risk without understanding the underlying technology

If you don’t understand:

how identity systems work,
what cloud misconfigurations mean,
how ransomware spreads,
what “zero trust” actually implies,

…then you can’t judge whether your experts are giving you good advice or selling you comfort.

2. You can’t challenge your team

A non‑technical leader becomes a hostage to their experts.
A technically literate leader can ask:

“Why is this the only solution?”
“What’s the blast radius if this fails?”
“What assumptions are we making?”

This is where real leadership happens.

3. You can’t communicate risk to the board

Boards don’t want packet captures.
They want:

business impact,
likelihood,
cost-benefit,
regulatory exposure.

To translate tech → business, you must understand both languages.

But do you need deep technical expertise?

No.
A CISO is not a senior engineer.
They don’t configure SIEMs or write detection rules.

What they do need is:

Technical literacy

Enough to:

understand architectures,
spot nonsense,
evaluate trade-offs,
see systemic weaknesses,
understand how attackers think.

Strategic and managerial strength

Enough to:

build teams,
influence executives,
manage budgets,
shape culture,
drive governance.

Risk and compliance fluency

Enough to:

align with regulations,
manage audits,
prioritize investments.

Why Jack Ma’s model doesn’t apply to cybersecurity

Jack Ma succeeded in a domain where:

innovation,
market timing,
and business strategy

were the primary levers.

Cybersecurity is different.
It’s not optional.
It’s not a “nice to have.”
It’s not a domain where you can simply “hire good experts” and stay hands‑off.

Cybersecurity leaders are accountable for:

breaches,
regulatory fines,
operational outages,
reputational damage.

If something goes wrong, the CISO cannot say:

“I didn’t understand the technology; my experts handled that.”

Boards expect CISOs to be bilingual:

fluent in business,
fluent in technology.

A CISO is like a ship captain.

They don’t need to:

build the engine,
repair the hull,
or navigate by the stars.

But they must understand:

how the ship works,
what can go wrong,
how weather affects navigation,
and how to make decisions under uncertainty.

A captain who says “I don’t need to understand the ship, I just hire good sailors” is a disaster waiting to happen.

So what’s the ideal profile?

Here’s the sweet spot for a modern CISO/CSO:

Skill Area	Required Level
Technical literacy	High (conceptual, architectural, risk-based)
Hands-on technical skill	Low to medium (not required daily)
Risk management	Very high
Leadership & communication	Very high
Regulatory & governance knowledge	High
Business strategy alignment	Very high

This is why many CISOs come from:

technical backgrounds who grew into leadership, or
risk/governance backgrounds who invested heavily in technical literacy.

Pure “people managers” rarely succeed in cybersecurity leadership.