The CISO Test
One phone call. One policy. One disqualifying signal.
The job description said it was a remote role.
Two minutes into the first call, the framing shifted.
Their new CISO had made RTO a requirement. A couple months back. Company-wide.
I told them RTO was a dealbreaker. I told them I’ve written about it, researched it, and have strong opinions backed by evidence. I said, half-joking, that if the new CISO doesn’t work out after making this particular call, to keep me in mind. Then I ended the interview.
I’m not writing this to burn a bridge. I’m writing this because that call told me something specific: when a CISO walks into a new role and their first major policy contribution is a return-to-office mandate, I’ve just seen their decision-making process in action. Before they shipped a single security architecture. Before they responded to a single incident. Before they earned the credibility to override a standing policy that their workforce built their lives around.
This is what their first move looked like.
The First Decision Test
A leader’s first visible policy initiative is diagnostic. Not because of what the policy does, but because of what it reveals.
Did they look at the data before deciding? Did they weigh the cost? Did they ask whether this solved a problem that actually existed?
RTO mandates, in 2026, are one of the most thoroughly studied management policies in modern corporate history. There’s no ambiguity in the research. There’s no “it depends.” There’s a consistent, multi-institution, multi-year body of evidence pointing in one direction, and it has been public, peer-reviewed, and widely available for years.
A leader who implements an RTO mandate in 2026 either hasn’t looked at that evidence, has looked at it and doesn’t believe it, or has a different agenda entirely.
None of those options make me want to work for them.
What the Research Actually Shows
“Studies show” isn’t an argument. Here’s what the studies actually say.
Nicholas Bloom’s research at Stanford is the most comprehensive study of remote and hybrid work ever conducted: over 16,000 respondents across 40 countries. Even at the weakest version of flexibility (hybrid, two days a week at home), workers are just as productive as their fully office-based peers and equally likely to be promoted. Companies with that minimum flexibility see 33% lower attrition. Not a rounding error. A third fewer people walking out the door, with no productivity loss.
That’s the floor. Hybrid is the baseline. Fully remote outperforms it further. And RTO mandates perform worse than either.
The Flex Index, in collaboration with Boston Consulting Group, tracked revenue growth across thousands of companies from 2019 to 2024. Fully flexible companies grew revenue 1.7 times faster than companies with RTO mandates. This held after controlling for industry and size. You’re not trading productivity for flexibility. You’re trading measurable growth for the ability to see your employees sitting in chairs.
Researchers at the Katz Graduate School of Business at the University of Pittsburgh studied RTO mandates specifically and found they don’t boost company performance. The actual driver of RTO adoption, the paper found, was managerial control, not output. Their exact framing: “managers use RTO for power grabbing.”
Baylor University researchers released the first large-sample empirical study of RTO’s talent effects. The headline: RTO mandates accelerate the loss of high-performing and diverse talent. Not all talent equally. Your best people. The ones who have options.
The picture is clean. No productivity gain. Significant attrition cost. Slower revenue growth. Loss of your most capable employees. This is the body of evidence a CISO chose to override.
This Isn’t the 1950s
Let’s talk about what “hybrid” actually means. Because “hybrid” is often presented as the compromise position, the reasonable middle ground between full remote and full RTO. And in 2026, that framing is just as broken as the mandate it’s softening.
Hybrid doesn’t mean flexibility. Hybrid means you still need to live within commuting distance of an office.
Which means relocation. Which is RTO with extra steps and a better press release.
This matters because of what remote work actually changed over the last five years. It wasn’t just where people opened their laptops. It was where they chose to live. Research from Harvard’s Bloomberg Center for Cities is direct on this: “Work from anywhere is not the same as work from home. It’s about giving people the freedom to choose where to live: which city, which town, which country.”
People took that seriously. They moved closer to aging parents. They moved to cities they actually wanted to live in, not cities where corporate headquarters happened to be built in the 1980s. They bought homes. They put kids in schools. They built community in places they chose rather than places they were assigned.
Remote work broke the 1950s corporate bargain: the one where the company decides where you live.
That bargain made sense when companies were the only path to economic security and workers had limited leverage. It hasn’t made sense for decades. But the pandemic made it impossible to pretend otherwise. Companies that had spent years insisting presence was essential discovered they could operate globally, recruit nationally, and produce more with less friction, all without requiring their workforce to cluster around a downtown headquarters.
Then some of them forgot what they learned.
IBM’s RTO mandate required remote employees who live more than 50 miles from the nearest office to either relocate or lose the job. That’s not a return-to-office policy. That’s a 1950s relocation notice repackaged as a culture initiative. Amazon. AT&T. Dell. JP Morgan. All of them demanding full-time office presence in 2025 and 2026, as if the last five years produced no evidence worth examining.
The people who built lives in places that made sense for them aren’t refusing to work. They’re refusing to pretend it’s still 1955. That’s not entitlement. That’s evidence that the workforce has moved on, even if some leadership hasn’t.
In 2026, the talent pool is national. The idea that you can only hire and retain people within 50 miles of your headquarters is a self-imposed constraint with no business case behind it. You’re not protecting culture. You’re protecting a real estate investment and a management style that the research consistently shows performs worse than the alternative.
Who Actually Leaves
Here’s the part that doesn’t make it into the executive memo.
When you mandate RTO, you don’t lose the people who needed a nudge to come back. You lose the people who can leave.
A 2024-2025 analysis found that 36% of senior-level job seekers cited RTO mandates as a reason for leaving, and 42% of companies reported unexpected attrition after mandating office returns. Companies with RTO mandates took 23% longer to fill the roles left behind.
Think through the compounding cost there. The senior people leave. You spend 23% longer trying to replace them. You’re paying for the attrition twice: once in the talent you lost, once in the time and cost to find someone comparable. And you’re often not finding someone comparable, because 64% of remote workers say they’d quit or start looking if remote options ended.
After Amazon announced its 5-day mandate, a Blind survey of 2,285 Amazon employees found 73% were considering looking for another job. That’s not a dissatisfied fringe. That’s a talent exodus in progress.
It also hits women and underrepresented groups hardest. Research from the Washington Post and peer-reviewed studies found that RTO mandates disproportionately drive out women, particularly those in their 30s and 40s whose career trajectories depend on flexibility. Women in STEM are already underrepresented at 28.2% of the global workforce. RTO mandates compound that. You’re not enforcing a return to the office. You’re enforcing a return to a workforce that looks like 2010.
RTO is not a neutral operations decision. It’s a policy that quietly erases years of hard-won diversity progress while executives describe it as a culture initiative.
The Confession
One statistic that I want you to sit with.
In a survey of executives and HR professionals, 25% of executives and 18% of HR workers admitted they hoped some employees would voluntarily leave because of an RTO mandate.
A quarter of the people implementing these mandates designed them, in part, as a covert exit mechanism.
It’s not just a bad policy. It’s misdirection. You’re being told “this is about collaboration and culture” while someone in the room is measuring headcount reduction against a forced attrition target. If you stayed because you trusted the stated rationale, you stayed for a reason that a quarter of the people enforcing it never believed.
I don’t know which quarter applies to the CISO from that call. And I don’t need to find out.
The Security Team Problem
I want to make this specific to CISOs because it’s directly relevant to the job.
Security requires a particular kind of employee. Not someone who follows orders. Someone who questions them. The work is adversarial by design: you’re modeling how a determined attacker thinks, and you need engineers who will tell you your architecture is wrong, analysts who will escalate when the process says don’t worry about it, and a team that treats institutional consensus as something to be stress-tested, not deferred to.
RTO mandates, by design, select out those people.
The people who stay after a mandate they disagree with are either unable to leave or willing to comply with a decision they know is wrong. Think about what that means for a security org specifically. Security theater exists because people in security orgs comply with bad policies rather than challenge them. Checkbox compliance is how breaches happen. A team of people who stayed because they couldn’t say no is not a team you want responsible for your threat detection.
The institutional self-preservation instinct and the security instinct point in exactly opposite directions. A CISO who doesn’t see this has told me something specific about how they’ll run security operations: authority over evidence, compliance over rigor, policy over judgment.
That’s not a CISO. That’s a title with a badge.
The Cargo Cult Continues
I wrote about the mechanics of this in The Presence Tax: the “Microsoft Effect,” the acoustic failure of open offices, the caregiving economy that RTO dismantles, the 200,000 years of human history where work and life weren’t geographically separated by executive policy. That piece was about the human cost.
This piece is about something colder: the decision-making failure.
It’s not just that executives are copying bad homework. It’s that the homework has been graded, returned, and marked wrong. And they’re still turning it in. The research has been public for years. Stanford, BCG, Pittsburgh, Baylor, Gallup. The argument has been made, supported, replicated, and distributed. There’s no reasonable version of “I didn’t know.”
So what’s left? Incuriosity. The comfort of doing what the visible giants do, without examining whether what the visible giants are doing actually works. Amazon announces 5-day RTO, a new CISO takes the job, and somewhere in the first 90 days the mandate comes down. Because that’s what serious companies do, apparently, regardless of what serious research says.
That’s the cargo cult. It didn’t end. It just upgraded to 2026 branding.
What I’m Actually Looking For
I didn’t end that call because I was angry.
I ended it because I had the information I needed. The first decision told me the rest. A leader who doesn’t examine the evidence before making a call that affects every person in the organization isn’t going to suddenly start examining evidence when the decisions get harder.
The leaders I want to work with don’t need convincing on this. They’ve already looked at the data. They know what Bloom found, what the Flex Index showed, what the Katz paper concluded. They made a decision based on evidence and communicated it clearly to their teams. Some of them run fully remote orgs. Some run in-person teams and can tell you specifically why the data supports that choice for their context. That’s legitimate. That’s leadership.
What’s not leadership: copying a mandate from a company ten times your size, stripping remote options from a workforce that built their lives around them, and calling it culture.
If you’re in a leadership position and you’re reading this, I’m not asking you to agree with me. I’m asking you to look at the data before your next policy decision, whatever it is. Security decisions. Org decisions. Policy decisions. The habit of examining evidence before acting is either something you do or something you don’t. It doesn’t switch on for the important calls if you turned it off for this one.
That’s the test. And in that phone call, I got my answer.
Resources
Katz Graduate School of Business, University of Pittsburgh — RTO and Managerial Control — First study to identify managerial control (”power grabbing”) rather than productivity as the primary driver of RTO mandates.
Baylor University — Brain Drain and RTO — First large-sample empirical evidence that RTO mandates accelerate the loss of high-performing and diverse talent.
Harvard Bloomberg Center for Cities — The Geography of Work — Research on how remote work gave workers freedom to choose where to live, not just where to work — and what RTO mandates actually reverse.
Founder Reports — Return-to-Office Statistics 2026 — Aggregated RTO data: 64% of remote workers would quit if remote ended; 25% of executives admitted hoping employees would leave due to RTO.
Amazon / Blind Survey — Post-mandate survey of 2,285 Amazon employees: 73% considering looking for another job.
Stanford / Nicholas Bloom — Work From Home Research — The largest study of remote and hybrid work ever conducted (16,000+ respondents, 40 countries). Key finding: hybrid workers are equally productive and equally likely to be promoted as office-based peers, with 33% lower attrition. Fully remote outperforms hybrid.
Flex Index / Boston Consulting Group — Flexibility and Revenue Growth — Analysis of thousands of companies from 2019-2024. Fully flexible firms grew revenue 1.7x faster than RTO-mandate firms after adjusting for industry and size.
Washington Post — RTO and Diversity — Evidence that RTO mandates disproportionately affect women and underrepresented workers, reversing diversity gains.
Inc. — Women and RTO — Data showing RTO mandates helped reverse years of gender pay gap progress and drove up attrition among women and Black employees.