The CEO Is Next

The piece argues that U.S. enforcement is increasingly targeting corporate CEOs for cybersecurity failures rather than only security leaders, citing recent actions and investigations (e.g., SolarWinds, Drizly, Uber, and Change Healthcare) as evidence. It explains the rationale—limited CISO authority, the need to assess top-down budget and governance decisions—and notes industry responses such as better documentation of budget refusals and bringing executives into incident response to avoid personal liability.