Who should the CISO report to?
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
Two CIOsurge dinners are coming up, in Atlanta on Dec 8 and New York on Jan 28. Seats are limited, and you’ll find the details and how to request an invite in our Events section below.
In this edition:
Steven Singer on how a photo of a restaurant menu became a proprietary product
Why a CISO who reports to the CIO ends up grading the boss’s homework
Our upcoming Executive Forums in Atlanta and New York, and how to request a seat
PHP flaws confirmed exploited, with 263,000 unpatchable instances in the U.S.
Stay sharp. Stay ahead.
Stop Being Dr. No: Why One CTO Says Holding Both Hats Makes It Easier
This was the most counterintuitive answer I’ve gotten in an executive interview in a while.
I asked Will Lassalle, who holds a dual CTO and CISO role, how he handles the tension between building fast and locking things down. I expected him to talk about juggling two jobs. He told me holding both titles makes it easier.
“Most people think it makes things harder, right? Most people think you’re wearing multiple hats.”
Will compared it to Two-Face from Batman, flipping a coin between building fast and securing things. In reality, he said, it’s a meld of the two. He owns both sides, so the argument between the team that wants to ship and the team that wants to stop it happens in his own head, and he can settle it there.
“The conflict is within myself, I can resolve it and I can still deliver the value to the business.”
What I liked most is what this does to his conversations with the rest of the C-suite. As Will put it, a lot of cybersecurity people want to say no. When a peer comes to him worried the company isn’t keeping up with the Joneses, he says “yes, but.” They run a proof of concept, then a proof of value, and deploy it securely, because his company is in a highly regulated industry with contractual obligations to clients and vendors.
“I’m never telling somebody, no, I’m still building, you know, pardon my French here, cool [stuff]... But doing it in that secure manner.”
That mindset goes back to how Will sees every company he’s worked for, from banking to casinos to health and wellness.
“Technology company that happens to run a casino, technology company that happens to have health and wellness... Technology company that happens to have banking, financial products.”
When you see every company that way, every technology conversation turns into a business conversation.
The takeaway: You don’t need both titles to use Will’s approach. If you lead with “yes, here’s how we do it safely” and frame each project around the business problem it solves, you get brought into decisions earlier.
Should Your CISO Report to You?
In the second part of a cio.com series, Steven Goodman, senior director of technology at Marquette University’s Klingler College of Arts and Sciences, argues that security has outgrown its place on the IT org chart. He points to data showing 64% of CISOs still report into IT leadership, only 10% influence financial decisions, and only a quarter say board discussions of cyber risk run longer than 30 minutes. His comparison is internal audit, which reports to the board’s audit committee instead of the CFO, because the people who build and run the systems shouldn’t be the ones vouching for them.
His eight-step roadmap includes a direct line from the CISO to the CEO and a board committee, one accountable owner for every AI tool decision, a standing risk council with business leaders, and board reporting built on tested time-to-detect, contain, and recover numbers. He closes with a note to CIOs: elevating the CISO frees the CIO to build without also serving as the auditor of what they built.
A lot of CIOs will read this as losing a direct report. I’d read it as getting a peer who tells the board about the unpatched server before an attacker does, and that protects you too. Before your next budget cycle, check two things: who your CISO actually reports to, and whether they can sign off on a risk decision without routing it through you. If the answer to the second question is no, start that conversation yourself, before the board starts it for you after an incident.
— Zack Tembi
🗓️ CIOsurge Executive Forums
Our closed-door dinners for CIOs, CISOs, and senior IT leaders. Off the record, with no vendor pitches. Seats are limited, and every registration is approved by our team.
Atlanta | Tuesday, December 8 | 5:30 to 7:30 PM
Proving ROI on AI Beyond the Pilot
At Chops Lobster Bar, with panelists Sundari Parekh (TrendAI), Shanief Webb (CISO, Headspace), and Jason James (CIO, Acumatica). I’ll be moderating. We’ll get into the frameworks, metrics, and hard lessons from AI programs that had to prove their worth to the CFO and the board.
Request an invite
New York | Thursday, January 28, 2027 | 5:30 to 7:30 PM
Sunday, 4am: Your AI Agent Has Been Hijacked. How Do You Respond?
A private dinner built around one live scenario. It’s 4am on a Sunday, client data is leaving, and the source is an agent your business built that IT never reviewed. The room works the response stage by stage, from containing the attack back to how the agent got that access in the first place.
Request an invite
PHP Flaws Confirmed Exploited, With 263,000 End-of-Life Instances in the U.S.
Security researchers and CISA have confirmed the first successful exploitation of two critical PHP vulnerabilities, a memory-corruption flaw (CVE-2026-109618) and a stale request-state flaw (CVE-2026-109619). Researchers at Perplexity detected remote code execution through honeypot sensors, and Expel’s Marcus Hutchins called it the strongest confirmation he had seen since the crisis began. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Monday.
The confirmation followed a week of skepticism, with VulnCheck criticizing the quality of circulating proofs of concept and Shadowserver declining to publish exposure data. Shadowserver did publish end-of-life counts, showing about 263,000 instances in the U.S. that no longer receive security patches. PHP powers roughly 70% of websites worldwide.
The number I’d circle is 263,000. Those servers run software that will never get another patch, and plenty of them likely belong to teams that lost track of them years ago. This is the unglamorous work Goodman lists at step seven of his roadmap: inventory, segmentation, and patching that someone verifies. Ask your team for two lists this week: every internet-facing PHP instance you run, and an owner’s name next to each one. Anything without a name gets an owner by Friday or gets shut down.
— Zack Tembi
🗞️ At A Glance
💡 CIO Spotlights
Mikey Santiago, Chief Information Officer, Avantor
Named CIO of Avantor (NYSE: AVTR), the life science tools company, on Oct 26
Will lead Avantor’s global IT strategy and its digital transformation agenda
Four-time CIO with more than two decades in technology leadership, including senior roles at Danaher Corporation and its operating companies
Has led enterprise-wide transformations, major acquisitions and integrations, cloud modernization and cybersecurity initiatives
MBA from USC, graduate studies in computer science and cognitive science at UC San Diego
Rajesh Shriyan, Chief Information Officer, NiCE
Named CIO of NiCE, the customer experience software company, reporting to COO Arun Chandra
Joins from NetApp, where he spent 15 years, most recently as VP of AI, Data, Enterprise Architecture & Applications, and earlier as Chief Architect
Spent more than a decade as an IT architect at Cisco Systems
Will oversee enterprise applications, data, infrastructure and IT services, starting with modernizing quote-to-cash
Based in the Raleigh-Durham area
