Welcome to this week’s edition of CIOsurge!

This week, we’re focusing more on vulnerabilities and security:

Let’s make this week a game-changer.

Stay sharp. Stay ahead.

One of the sharpest moments from our DC Executive Forum came later in the evening, and it reframed everything that followed: the CISO role is no longer just about defending. It is about building. Engineering teams are now reporting directly into Security at some organizations, and if you are a security leader who has not picked up a builder's mindset, the job has already moved past you. I have felt this shift firsthand. The leaders who are winning right now are the ones who stopped thinking of security as a gate and started thinking of it as a capability they can design and deploy.

That conviction set the tone for June 25th at Tysons Corner. We brought together senior technology and security executives for a closed-door conversation on crisis communication, boardroom dynamics, and what it actually means to lead through a breach. The panelists have been in that room. The moderator has sat at the highest levels of institutional leadership. 

The relationship question came up early and stayed central throughout the evening. You cannot introduce yourself to the board during a crisis. The relationships with your CEO, CFO, General Counsel, and board members have to exist before anything goes wrong. If the first time a board director hears your name is in a breach notification, you have already lost the narrative. Trust is not something you manufacture under pressure. It is something you deposit in advance, in normal times, in quiet conversations, in the boardroom updates nobody thinks matter until they suddenly do.

That connects directly to a distinction that does not get enough attention: the difference between a technical incident response plan and a board incident response plan. Most security organizations have detailed playbooks for the technical side — isolation, forensics, recovery. Far fewer have an equally detailed plan for the board level: who calls whom, what gets said, how the organization controls the narrative externally while managing the response internally. These are not the same plan. A breach that is handled cleanly on the technical side can still destroy shareholder confidence, regulatory standing, or patient trust if the communication layer is not thought through in advance. The organizations that weather crises best are the ones that rehearsed the conversation before they needed to have it.

What I kept coming back to throughout the evening was how much of this comes down to proximity. Security leaders who are embedded in the business, who have built real relationships across the C-suite, who treat the board as an audience that deserves context rather than just compliance updates — those are the ones who get the benefit of the doubt when things go sideways. And things go sideways. That is not a question of if. It is a question of whether the foundation was laid.

None of this conversation happens without the right people in the room. I am genuinely grateful to our panelists Brad Christmas and David Reese for bringing real operational depth to this topic — not theory, but experience earned the hard way. And Mercy Tembon held the whole evening together with a level of precision and warmth that made every voice in the room feel heard. Thank you as well to our sponsors Zaun and AegisAI for making the evening possible. Events like this only work when the right partners believe in what you are building.

If you want to continue this conversation: Book time with Zack Tembi — 30 minutes

As CIOs and CISOs evaluate their security stack for the back half of the year, I asked Woo An, CEO of Zaun, the question I think matters most: what should our peers be asking their vendors as those vendors start bolting AI into everything?

His answer cut straight past the usual checklist. "The big thing these folks need to ask is, what is the security that you're applying to your own company? Who is your security leadership, and what does your security actually look like?" The reason, Woo explained, is that the old proof points no longer carry weight. "People understand these SOC 2 check marks are not really cutting it anymore." He pointed to the drama in San Francisco around SOC 2 compliance companies faking reports, and argued it is now more important to understand what a vendor is doing with its own AI systems, how it builds controls, and whether it lets customers apply their own controls on top.

So the sharper question is: what are you doing outside of SOC 2 and ISO? That is a hard one to answer, and Woo noted it is exactly why buyers build their security questionnaires and run real due diligence. The catch is that the whole process is about to change and speed up, because leadership is telling teams to procure in two weeks rather than twelve months.

I told Woo I think security is going to become a genuine revenue differentiator, not just a cost center. For a lot of enterprises, the moat they build around their data is going to be part of how they win business, and they need their third-party partners doing the same. Many are not today. When I evaluate a vendor now, the tell is whether they eat their own dog food. On every demo, do I see a new feature shipped? When a customer asks for something on a call, does it show up in the product days later? The companies that pair that customer obsession with the speed of modern AI tooling are the ones that will lead. As Woo put it, you have to use it yourself before you can sell it.

The takeaway for CIOs and CISOs: add one question to every vendor evaluation this quarter. Ask what they do for their own security beyond SOC 2 and ISO, and whether you can enforce your own controls inside their product. The answer separates the partners worth your data from the ones that just passed an audit.

Verizon's Data Breach Investigations Report found that third-party involvement in breaches doubled from 15% to 30% in a single year, the largest single-year shift the report has ever recorded. The exposure model has widened well beyond the classic vendor questionnaire: SaaS providers, managed service providers, cloud integrations, APIs, software dependencies, identity providers, and privileged vendor access all now create real attack paths. A supply chain compromise costs $4.91 million on average and takes 267 days to identify and contain, the longest lifecycle of any breach vector tracked. On the developer side, more than 454,600 new malicious open source packages were counted in a single year, a 75% jump.

This is the number that should reset how you think about your attack surface. When a third party is involved in nearly one in three breaches, your security posture is no longer defined only by what you control. It is defined by every vendor you have handed data or access to. A point-in-time questionnaire describes a supplier on the day they filled it out, not the day they get compromised. Move the critical vendors to continuous monitoring, tier them by the access they hold, and treat the supplier ecosystem as your default initial-access path, because attackers already do.

- Zack Tembi

Read the original article

ServiceNow confirmed unauthorized access to customer data, a fresh reminder that even core enterprise platforms sit inside your third-party risk surface.

Microsoft's June Patch Tuesday addressed a record 206 vulnerabilities, including 39 critical flaws and an actively exploited Defender zero-day.

A self-replicating worm called Miasma hit numerous GitHub repos, prompting Microsoft to add a two-hour delay on automatic VS Code extension updates.

npm is now the highest-yield malware registry on the internet, with malicious-package detections up more than 100% year over year.

Europe's DORA and the SEC's incident-disclosure rules are converging on one demand: prove how you are monitoring your suppliers.

IBM's 2026 research found that 56% of tracked vulnerabilities can be exploited without any authentication, a basic hygiene gap at enterprise scale.

Send us your story

CIO, Vaco by Highspring

CIO, Lutz

CIO, Smith & Wilkinson

CIO, Tarkett