> Peake, a former CISO, said a lot of the skills from his previous role have translated into his current one. However, he said the CTrO role differs from the CISO role because it operates more on the “business level,” as the work done by a CTrO can directly impact revenue generation, contract negotiation, and onboarding new customers.

In my view, it's a role that sits between Sales and Security. A major part of the role is getting customers and prospects information about your business and security controls to validate their own needs (e.g. compliance requirements). It's still a semi-technical role, but isn't necessarily focused on the nut-and-bolts of ground-level security.

> “Effectively, what the role does is offer assurance to the customers or potential customers of that organization that their data, their information, their technology, the infrastructure, the platform itself, can be trusted as those customers adopt it,”

Like, protecting your customer's data should be assumed and the default. That you would need what's effectively another PR executive to communicate that and "offer assurance" just sounds like marketing speak for "We are doing the bare minimum, but we need our customers to think we do more than we actually do to keep theri data safe."

Just sounds like the CISO's personal PR mouthpiece and like you said, someone else to take the fall when they get breached.