In nearly half of software-based product companies, security oversight has moved outside the CISO’s office entirely.