What 361 leaders said about their biggest security gap
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
In this edition:
Will Lassalle on preparing for the boardroom years before you get there.
Upcoming CIOsurge Dinners
How midmarket companies are leaving known security gaps open for six months or more.
Why bigger security budgets still leave AI and tooling gaps wide open.
Stay sharp. Stay ahead.
Grow the Pie, Protect the Pie: Preparing for the Boardroom Years Ahead
Will Lassalle holds a dual CTO and CISO role, and still has mentors. When I asked him why, he told me about the next phase of his career.
“In 5, 6, seven years, I want to join boards. And there’s no better time to start than now.”
He’s already started. Will recently earned the Digital Directors Qualified Technology Expert (QTE) certification and was the first person out of the roughly 7,000 who hold it to score a perfect 100. He also went back to mentors who already sit on boards: Frank Wander, retired from his role as a global CIO, and Shamla Naidu, former global CISO of IBM, who sits on two or three boards and is also a great friend.
What I found most useful is that Will says this preparation pays off twice. It gets him ready for a board seat, and it makes him better in his current job, because he now understands what boards actually want.
“Boards are looking to grow the pie and protect the pie. That’s the main thing.”
Knowing that changes how he talks to his own board. He has the same training they have, he understands their mandates, and his mentors tell him what’s coming up in their board meetings across different industries.
The bigger point Will made was about what mentors can become over time. If they know, like, and trust you, they also become your sponsors and champions.
“If someone can talk about you because they know you, they know what you know when you’re not in the room, that’s the best compliment you could get.”
He described exactly how that plays out. Someone at dinner mentions they need a new board member, and Frank says, “I got the perfect guy, my mentee... He understands AI adoption, AI governance, and cybersecurity. Those are board’s mandates right now.”
The takeaway for technology leaders: if a board seat is anywhere in your future, start preparing now, and use what you learn to speak the board’s language in your current role. And look for mentors who can grow into lifelong friends and champions who will speak for you when you’re not in the room.
🗓️ CIOsurge Executive Forums
Join me and your peers at our upcoming CIOsurge Executive Forums: closed-door, off-the-record dinners for senior CIOs, CISOs and IT leaders, with no vendor pitches.
Realizing AI ROI: Governing the Ecosystem Behind It
Atlanta · Dec 8, 2026 · 5:30 PM ET
Sunday, 4am: Your AI Agent Has Been Hijacked. How Do You Respond?
New York · Jan 28, 2027 · 5:30 PM ET
CIOsurge Executive Forum, Miami Beach
Feb 11, 2027 · 5:30 PM ET
CIOsurge Executive Forum, San Francisco
Feb 25, 2027 · 5:30 PM PT
CIOsurge Executive Forum, Los Angeles
Mar 4, 2027 · 5:30 PM PT
See all upcoming dinners on the CIOsurge Events page.
Midmarket organizations struggle to plug security gaps
A CyberFox survey of 361 small and midsize business leaders found that nearly half left their most significant known security gap open for six months or more. Nearly two-thirds said limited staffing has left important risks unaddressed, and three-quarters said security responsibilities have grown faster than IT headcount over the past three years.
Among companies with IT teams under 15 people, nearly four in five have bought a security tool they couldn’t fully deploy or manage. Many are leaning on managed service providers to fill the gap, with nearly two-thirds using an MSP or MSSP for at least one IT or security function.
Even if your own shop is well staffed, these companies are your suppliers, distributors, and partners, so their open gaps become part of your attack surface. This week’s news makes the point twice: a hacker used stolen credentials to reach downstream MSP clients, and a French bank lost an estimated €100 million through a third-party platform. I’d add one question to your next vendor risk review: how long has your biggest known security gap been open, and who owns closing it?
— Zack Tembi
Companies spend more on cybersecurity but still struggle with AI oversight
A new DNSFilter survey of 400 IT and security workers found that three-quarters raised their security budgets over the past year, and four in 10 say their next dollar goes to AI security and governance. The spending hasn’t closed the gaps. Nearly half are confident that unapproved AI apps are connected to company systems, and one in five say an unapproved AI integration has already caused a security incident. Thirty-seven percent only learn about those connections after the fact.
The tooling picture is just as uneven. Sixty-two percent of respondents aren’t sure all their security tools are properly configured, and the same share can’t say every tool is actively monitored.
A bigger budget is easy to show a board. Proving that the tools you bought are configured and monitored is harder, and that’s the question a sharp director will eventually ask. Will Lassalle’s framing in this edition sums it up: boards want to grow the pie and protect the pie. Before your next board update, I’d pull a simple inventory of every security tool you own, whether it’s fully configured, and who is watching it. If you can’t fill in that table, you’ve found your next priority.
— Zack Tembi
🗞️ At A Glance
💡 CIO Spotlights
Doran Stienike, CIO, Presidio
Joins Presidio, the global IT services and solutions provider, as CIO effective November 9, 2026.
Previously served as both CIO and CISO at CSG International, then went on to lead its global professional services organization.
Earlier held CISO and technology leadership roles at ConAgra Foods.
Background includes cloud services, SaaS operations, business continuity, and board-level technology strategy and risk oversight.
Steps in as part of a planned transition from interim CIO Mike Reilly, with a mandate that includes strengthening the security and resilience of Presidio’s operations.
Shauna Latshaw, CIO, Johnson Controls
Named Vice President and CIO of Johnson Controls (NYSE: JCI), reporting directly to CEO Joakim Weidemanis.
Joins from Caterpillar, with more than 25 years of enterprise information and data technology leadership at global industrial companies.
Will lead enterprise AI and data technology strategy, including systems, infrastructure, customer-facing digital tools and cybersecurity.
Her appointment was announced alongside a new Chief Legal Officer, as part of a broader rebuild of the executive leadership team.
🤝 Jobs
See every open CIO, CISO and IT leadership role on the CIOsurge Jobs board.
