A CTO or CIO is hired by the chief executive, who is the direct manager of most CIOs and CTOs in the surveys below, and the search is usually opened to outside candidates. The two titles describe different jobs when a company has both: the CIO runs the internal technology the business operates on, the CTO owns technology strategy and the technology in what customers buy. The published data show a market that hires from outside often, mostly people who already hold a top technology title, so the job search is a mapping exercise by remit and reporting line, not by title.
Who sponsors and decides the hire
The reporting line tells you who runs the search. The 2025 Tech Exec Survey from the Deloitte CIO Program, a poll of 622 US senior technology leaders in March and April 2025, found that 65% of CIOs report directly to the CEO, up from 41% a decade earlier. For CTOs the picture is split. The 2024 State of the CIO survey from Foundry, as reported by CIO.com, has 56% of CTOs reporting to the CEO and 35% reporting to the CIO or another top IT executive. Deloitte points the same way: among CIOs who report to the CEO, 34% have a CTO as a direct report.
So a CTO job in a company with a CIO is often a job inside the CIO's organisation, and the CIO is the person to reach, with the CEO behind (an inference from the reporting data). Where the top technology executive does not report to the CEO, the sources opened do not say who the manager is, so establish it company by company.
Private equity ownership is a separate case. Spencer Stuart lists CTO and CIO among the portfolio-company roles it recruits for, and reports more than 3,000 assignments for private equity firms and their portfolio companies over the past decade, but the page does not say who decides those hires. Where the role owns security risk, board oversight is now disclosed (see the SEC rule below), so a candidate should expect to meet the responsible committee chair. That is an inference, not a hiring statistic.
How the search is run
No source opened gives the share of CTO or CIO hires run by retained search firms versus internal recruiters. What is published is the split between internal promotion and outside hiring, and it leans outside.
Russell Reynolds Associates (May 2025) found that 53% of the top technology officers in the Fortune 500 were hired externally. Measured against all top technology officers, 39% were outside hires who had already served as a CIO, CTO or chief digital officer, and 14% were outside hires in a first-time appointment. The Spencer Stuart S&P 500 C-Suite Snapshot (December 2025) puts the top information technology job among the most external of any C-suite role, with 54% hired from outside against 59% of all C-suite leaders promoted from within. It adds that 52% of externally hired CIOs came from another industry.
Together these describe a market where an outside search mostly goes after someone who already holds the title, and where sector is a weaker filter than for most functions. Russell Reynolds also reports that interest in a move among technology leaders rose from 50% in 2022 to 74% in the second half of 2024, so each search draws on a wider pool.
CTO, CIO, CISO and the rest: the real differences
The titles are not stable, so the remit matters more than the label. Russell Reynolds found that the CIO title among top Fortune 500 technology leaders fell from 68% five years earlier to 49% in 2024, and that 54% of appointments since the start of 2024 carry hybrid titles. Deloitte's 2026 Global Technology Leadership Study, which surveyed 662 executives, found that 71% of organisations have five or more C-suite technology leaders.
| Role | Remit as the sources describe it | Reporting line | What it is measured on (Deloitte 2026, second and third ranked) |
|---|---|---|---|
| CIO | Oversees IT staff and infrastructure that support everyday operations | 65% to the CEO (Deloitte 2025) | Cyber resilience and risk reduction, 30%; platform reliability and scalability, 25% |
| CTO | Overall technology strategy, including technology in products and services for external customers | 56% to the CEO, 35% to the CIO or other top IT executive (Foundry 2024) | Secure, resilient engineering, 26%; speed of product delivery, 25% |
| CISO | Security risk; Item 106(c) of the 10-K asks companies to address whether and which management positions or committees are responsible for cyber risk | 82% to the CEO (Splunk and Oxford Economics, 2025) | Security culture, 29%; business value through secure innovation, 24% |
The Splunk and Oxford Economics CISO Report 2025 surveyed 500 security leaders and 100 board members in June and July 2024 and found that 83% of CISOs attend board meetings somewhat often or most of the time. It is vendor-sponsored and the sample is small, so read the 82% as a direction. In Deloitte's 2025 work only 15% of CEO-reporting CIOs had a CISO as a direct report.
What CEOs and boards are asking the role to do
Published evidence on what appointing boards want is thin, and most of it is technology leaders describing their own mandate. Deloitte's 2026 study found these priorities rated to a great or very great extent: measurable business outcomes, 79%; compliance with evolving digital regulations, 77%; cybersecurity and resilience, 77%; retaining top technology talent, 75%; financial and operational discipline, 74%. In the 2025 survey, 36% of CIOs also managed a profit and loss account.
Russell Reynolds found that 69% of Fortune 500 technology officers sit on the executive committee, and 76% of those appointed since the start of 2024; in the FTSE 100 the figure was 59%. Boards are also looking for technology experience in directors: a Russell Reynolds analysis of 398 public company boards (May 2026) found that 47% include at least one director with enterprise technology officer experience, while only 8% of all directors have held such a role.
Public signals that a search is coming
Filings do not announce searches, the 8-K rules are narrower than most executives assume, and they apply only to companies that report to the SEC; companies that do not report to it file neither.
- Form 8-K Item 5.02. The Form 8-K instructions require a filing within four business days when the registrant's principal executive officer, president, principal financial officer, principal accounting officer, principal operating officer, or any person performing similar functions, or any named executive officer, retires, resigns or is terminated from that position. An appointment is reported for the same positions, without the named executive officer category. The rule lists no CTO or CIO by position, so a departure appears only if that person is a named executive officer, which under Item 402 means the CEO, the CFO and the three other most highly compensated executive officers, with additions for officers who left during the year and a shorter list for smaller reporting companies. Without that status, the absence of an 8-K tells you nothing.
- Form 10-K, executive officers. Item 401(b) lists executive officers by name, age and position, often in Part I of the 10-K, and Rule 3b-7 includes a vice president in charge of a principal function. Whether the technology head is listed, and under what title, shows how the company ranks the role.
- Form 10-K, cybersecurity. The SEC's 2023 cybersecurity disclosure rules added Item 1C to the 10-K. Under Item 106(c), companies describe the board's oversight of cyber risk, whether and which management positions or committees are responsible, and their relevant expertise. A change in who is named from one year to the next is a signal.
- Context, not filings. Spencer Stuart counted 168 new S&P 1500 CEOs in 2025, the most since 2010. A new CEO is a reason to look again at the technology function; that is a heuristic, not a measured pattern.
Paths into and out of the role
Paths into the role are short: every externally hired Fortune 500 technology officer in the Russell Reynolds data was either an existing CIO, CTO or chief digital officer (39%) or a first-time appointment (14%). Spencer Stuart reports that more than 40% of S&P 500 CIOs had served in the role before.
Out of the role, the evidence is about intent. In Deloitte's 2025 survey, 67% of CIOs, 55% of CISOs, 42% of chief data and analytics officers and 41% of CTOs said they aspire to the CEO role. The sources opened here do not report how many actually get there, so none is claimed.
Positioning for the role
Describe the remit, not the title, which may be a hybrid. Three lines carry most of it: who you reported to, what you owned in money and headcount, and which board or committee you presented to. Add one business-outcome result in the company's own measure. If you ran security, state your expertise in the terms Item 106 uses, because that is the vocabulary company filings now use for the role. The executive recruiter guide covers how this reads to a search firm; the evidence review covers why many senior roles are filled without a public posting.
How to build a target map for a technology role
- Choose the buyer. Product technology, enterprise technology or security: each has its own companies and hiring manager.
- Choose the sector band. Outside hiring crosses industries often here, so a second sector is reasonable if chosen on purpose.
- Pull the filings. For each target, read the executive officer list, the Item 1C text and the proxy's committee descriptions. Record the title, the reporting line and the date each last changed.
- Name the decision-maker. The CEO for most CIOs; the CIO for a CTO who reports to one; for private equity portfolio companies, ask who decides, since no source opened says; the committee chair for security roles.
- Mark triggers. A new CEO, a reorganised technology function, a new hybrid title, an acquisition, a security incident filing. A trigger moves a company up the list; it proves nothing.
- Pair companies with search firms. Retained firms publish their sector and function practices; list who covers each target.
The handbook covers how Reverse Recruiting works, how it differs from a headhunter's model and a confidential search while employed.
The first 30 days of a technology search
- Write the three-line remit statement and the one business result you will lead with.
- Settle exit or notice terms with an employment lawyer before anything is announced; the layoff guide sets out the order if a layoff is involved.
- Decide the buyer: product, enterprise or security.
- Build a list of 15 to 25 companies from the filings (for illustration, a working size, not a benchmark), with the decision-maker and your closest contact for each.
- Have the quiet conversations: former CEOs and CFOs you reported to, board members, investors, peers at target companies. If you are over 50, read the age-specific guidance first.
- Then approach the search firms that cover your sector.
The sibling guides cover the COO search and the general counsel search.
Frequently Asked Questions
What is the difference between a CIO and a CTO?
The CIO oversees IT staff and infrastructure that support everyday operations, while the CTO is responsible for overall technology strategy and for technology in products and services sold to customers. When both exist the CTO often reports to the CIO: Foundry's 2024 survey, as reported by CIO.com, has 35% of CTOs reporting to the CIO or another top IT executive, and 56% reporting to the CEO.
Who hires a CTO or CIO?
The CEO in most cases, since 65% of CIOs report directly to the CEO in Deloitte's 2025 survey. Where the CTO reports to the CIO, the CIO is likely the hiring manager, an inference from the reporting data.
How do I find out a CIO or CTO role is opening?
Often not from an 8-K, because Item 5.02 covers departures of the principal officers, the president and named executive officers, and appointments of the principal officers and the president, a list that does not name a CIO or CTO by position. Better signals are the executive officer list and cybersecurity section of the 10-K, a new CEO, and a reorganised technology function.
Can a CIO or CTO become a CEO?
Many want to: in Deloitte's 2025 survey 67% of CIOs, 55% of CISOs and 41% of CTOs said they aspire to the CEO role. The sources opened for this essay do not report how many actually get there, so aspiration should not be read as a path.
Is a CISO the same as a CIO?
No. In Deloitte's 2025 data only 15% of CEO-reporting CIOs had a CISO as a direct report, and the Splunk and Oxford Economics 2025 report has 82% of CISOs reporting to the CEO directly. A CISO search is mapped through boards and risk committees as well as through the CIO's organisation.
