# C-Suite, Careers, CIO, CSO and CISO, Network Security, Roles, Security Published articles for C-Suite, Careers, CIO, CSO and CISO, Network Security, Roles, Security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The moat is dry - Part 2: A roadmap for rebuilding DevFeed: [The moat is dry - Part 2: A roadmap for rebuilding]() Original publisher: [Read original article]() Author: Steven Goodman Published: 2026-10-29T09:05:00Z Content type: opinion Language: en Sources: [CIO]() Topics: [ai-governance](), [trust](), [Zero Trust]() Tags: [2017](), [agents](), [ai](), [ai-risk](), [attacks](), [board](), [breach](), [c-suite](), [c-suite-careers-cio-cso-and-ciso-network-security-roles-security](), [careers](), [cio](), [contributor](), [cso-and-ciso](), [cyber-risk](), [edition-us](), [governance](), [language-en](), [network-security](), [roadmap](), [security](), [storytype-opinion](), [technology](), [trust]() ### AI overview The article argues that AI-enabled attacks exploit trust and that CISOs often lack the authority and budget influence to manage that risk. It recommends giving security independent reporting access to the CEO and board, assigning the CISO accountability for AI governance, and involving business, research, legal, finance, and technology leaders through a standing risk council. It also proposes board tests for a CISO's technical ability and judgment; accountable owners, least privilege, monitoring, and a kill switch for each AI agent identity; and reporting tested detection, containment, and recovery times. Technology teams should implement basics such as encryption, multifactor authentication, asset inventories, and network segmentation, with the CISO verifying progress and reporting gaps. The article frames board time as a budget and trade-off discussion, while presenting CIO-CISO independence and collaboration as complementary. ### Source excerpt In Part 1, I argued that the moat is dry. When NotPetya hit Merck in 2017, it didn't climb a wall. It came in through trusted vendor software, the routine traffic every perimeter is built to admit, and Merck put the damage at more than $1.4 billion. Its insurers then tried not to pay, and after that fight, underwriters started asking much harder questions. AI has since made attacks like that cheaper and faster. In IBM's 2026 Cost of a Data Breach report, one in four malicious breaches was AI-enabled, and breaches that took more than 200 days to find and contain cost about $1.3 million more than those that didn't. Deepfaked executives, software that can be talked into things and AI agents holding credentials are attacks on trust first and technology second. Yet the people we hold responsible are set up to lose. Some 64% of CISOs still report into IT leadership, only 10% influence financial decisions, and only a quarter say board discussions of cyber risk run longer than 30 minutes. They are accountable for the breach without budget authority, and they check the work of the people they report to. The organizations that feel safest about the next two years are not the ones with the most tools. They are the ones where leadership understands AI risk, someone clearly owns it, and the security team has the authority to act. That is a governance problem, and it has a governance fix. A roadmap for reconstruction 1. Take security out of IT, and do it before the breach No company lets the finance department audit its own books. That is why internal audit reports to the board's audit committee rather than to the CFO. Security deserves the same independence for the same reason: the people who build and run the systems should not vouch for them. The CISO's job is not to run technology. It is to govern how people, partners and machines behave around the things the organization cannot afford to lose, and to tell leadership the truth about that risk. That does not make the job less ## The moat is dry - Part 1: Why the old security model failed DevFeed: [The moat is dry - Part 1: Why the old security model failed]() Original publisher: [Read original article]() Author: Steven Goodman Published: 2026-10-29T09:00:00Z Content type: opinion Language: en Sources: [CIO]() Topics: [Security](), [ai security](), [prompt injection](), [ai-governance](), [shadow AI](), [trust]() Tags: [accounting-software](), [ai](), [backdoor](), [c-suite](), [c-suite-careers-cio-cso-and-ciso-network-security-roles-security](), [careers](), [cio](), [contributor](), [cso-and-ciso](), [data-breach](), [deepfake](), [edition-us](), [ibm](), [impersonation](), [it](), [language-en](), [malware](), [network-security](), [risk](), [roles](), [scam](), [security](), [storytype-opinion]() ### AI overview The article argues that AI has made cybersecurity a business risk centered on trust and governance, while many organizations still rely on perimeter defenses and leave CISOs accountable without budget authority. It cites IBM's 2026 breach report: one in four malicious breaches was AI-enabled, averaging $6 million; shadow AI appeared in 43% of breached organizations, and AI-system breaches often entered through compromised APIs, plug-ins or misconfigured cloud workloads. Its examples include NotPetya's entry through trusted vendor software and ransomware spreading from Johnson Controls' Asia offices. For research settings, it recommends pre-approved sandboxes and tools, monitoring data movement, classifying research by value, and targeted controls modeled on Science DMZs. It says fixed requirements such as export controls and federal research-security rules still apply. The supplied text frames these findings as a diagnosis and previews a separate eight-step roadmap in Part 2. ### Source excerpt In June 2017, a piece of malware called NotPetya got into Merck & Co. without climbing a single wall. It arrived through a backdoor in accounting software supplied by a Ukrainian vendor, the kind of trusted, routine traffic every perimeter is built to let through. It spread to some 40,000 of the drugmaker's computers, and Merck put the damage at more than $1.4 billion. Then several of Merck's insurers argued they owed nothing, because the attack was attributed to Russian military intelligence and their policies excluded acts of war. The fight ended in a confidential settlement in January 2024. Two lessons sit in that story. The moat didn't matter, because the threat came in with the traffic the moat was designed to admit. And the people who price risk for a living were the first to notice and the first to send the bill. That was 2017, when attackers still needed humans at the keyboard. Increasingly, they don't. Here is the argument of this two-part series in two sentences. Security stopped being a technology problem with business consequences; it is now a business risk with a technology component. Most organizations are still organized the other way around, and the person they hold responsible for that risk sits inside the IT department, reporting to the people whose work they are supposed to check. What AI actually changed IBM's 2026 Cost of a Data Breach Report, based on 602 breached organizations, found that one in four malicious breaches was AI-enabled, a 56% jump in a single year. Those breaches averaged $6 million, about $1 million above the global average of $4.99 million. In the U.S., the average breach now costs $11.5 million. You don't need a computer science degree to understand what changed. Three things matter: The con got a better voice. Deepfake impersonation was the most common AI-driven attack in IBM's data, at 45%. The oldest scam in business, the urgent wire transfer, now arrives in the CFO's actual voice on a video call. Your software can be talk