Welcome to this week’s edition of CIOsurge!

In this edition:

Stay sharp. Stay ahead.

When I asked Steven Singer how he cut his company’s network, cybersecurity, and IoT spend by 50% without quietly adding risk, his answer started with the obvious stuff. He found spending the company had set and forgotten, like paying thousands for the equivalent of an old T1 line when fiber could deliver the same connectivity for less.

The bigger lever was the relationships. Steven, CIO and COO of a 110-plus-year-old food distributor, brought vendor relationships with him from his enterprise days. A smaller company can’t match that spend, so he offers something else.

“While I can’t give you the same $100 million spend that I had somewhere else, I can guarantee you for three to five years in a contract and then sign that length.”

Consolidation and longer commitments earn broader discounts from most vendors. Steven frames the whole thing as two people doing their jobs.

“The human being on the other side of the conversation is a person just like you. They have a job to do.”

His first non-negotiable is simple: does the vendor pick up the phone when he calls? And when he needs a few more points on a renewal, he has something to offer back. CIOs talk to each other across company sizes, and a strong recommendation can land a much bigger deal.

“It could be completely different size organization where you could work at a $100 million company and talk to the CIO over a $10 billion company.”

He is just as direct with new vendors. Show him the product, know the technology, bring references, and in security, show him your latest audit. He’ll give you the half hour you asked for, and he’ll tell you in the first 10 minutes if it isn’t working. He also expects vendors to know where his budget cycle sits.

“it’s like you’re calling me, it’s, you know, September 1st, and my budget’s already spent for the year.”

The takeaway for technology leaders: treat vendor negotiations as relationship management. Consolidate, commit for longer when the service earns it, and remember that your peer network is leverage you can offer in return.

Our closed-door dinners for CIOs, CISOs, and senior IT leaders. Off the record, with no vendor pitches. Seats are limited, and every registration is approved by our team.

Los Angeles | Thursday, October 22
Realizing AI ROI: Governing the Ecosystem Behind It
At Perch, with panelists including Jeff Blair (CAA), Nick Reva (DoorDash), and former Dell CISO Tim Youngblood. I'll be moderating.
Request an invite

Atlanta | Tuesday, December 8
Proving ROI on AI Beyond the Pilot
At Chops Lobster Bar. Panel to be announced.
Request an invite

Selim Aissi, a veteran CISO whose career includes Visa, Ellie Mae, and Blackhawk, and a 2026 CSO Hall of Fame inductee, argues that boards should watch security debt more closely than security spend. He defines that debt as the risk that builds up when investments add complexity, when automation lags, and when organizations overcompensate with controls they don’t need. Once a reasonable depth of defense and tool integration is in place, he says, additional spending can become overspend that adds risk to the whole organization.

He also says the board conversation needs to change. Telling directors you patched five zero-days will likely get a shrug. Telling them those flaws could have taken a revenue-generating system down for three days gets their attention.

This is the same lesson Steven Singer learned when he went looking for spend his company had set and forgotten. Most security stacks grow one renewal at a time, and nobody goes back to ask which tools overlap, which never got integrated, and which are still running on old contracts. Before your next budget cycle, list every tool, what it protects, and what else covers that same ground. The overlap is where the debt lives. When you take the results to the board, frame them the way Aissi suggests: what goes down, for how long, and what it costs.

— Zack Tembi

Read the full story

Protiviti surveyed 1,330 board members and C-suite executives worldwide and found cyber threats are the top near-term risk to their businesses. More than three-quarters said they lack strong confidence they can modernize, protect enterprise value, and respond quickly to emerging risks all at once. Cybersecurity remains the leading strategic investment priority, named by 45% of executives. Third-party risk ranked eighth among the top 10 concerns, even as 65% of executives see significant opportunity in building out strategic alliances, up from 62% last year.

Cyber is already the top investment priority, so this confidence gap won’t close with budget alone. Every new partner, platform, and supplier widens the perimeter you’re accountable for. I’d start where Steven does with new security vendors: ask for the latest audit before the first meeting, and walk away from anyone who can’t produce one. Then do the same for your existing third parties. The partners you onboarded three years ago deserve the same scrutiny as the ones you’re signing today.

— Zack Tembi

Read the full story

Hackers cook freezers at hundreds of French supermarkets

Cisco confirms a second exploited email gateway flaw in a month

Microsoft seizes phishing marketplace behind 1 billion messages

Ransomware victims report threats against staff and their families

Grant Thornton: most firms manage cyber risk inconsistently

Send us your story

CIO, FFB Bank

CIO, Bosch Building Technologies North America

Division CIO, Caterpillar

CIO, Temple Health

CIO, Dartmouth College