CISOs sound off

Getty Images

Since 2023, the SEC has required public companies to explain how their boards oversee cybersecurity risk.

That means CISOs are getting some minutes in the boardroom to explain their company’s security posture to stakeholders. But standing in front of the class doesn’t mean everyone’s ready to pass the test: a recent report suggested those stakeholders aren’t understanding the cyber threat impact.

The 2026 Benchmark Report, released on Mar. 3 by cybersecurity insights group IANS Research and exec-recruitment firm Artico Search, reviewed responses from 17 board directors.

They are getting together. An additional survey by the organization found that 95% of CISOs (out of 653 polled) provide regular updates to the board, with 60% engaging with the full group and just over one-third interacting with a board committee. About three in four (72%) of CISOs meet a committee quarterly.
But the time is short. Just over half (51%) of CISOs meeting quarterly reported having between 15 to 30 minutes to speak. One in four of those meeting quarterly said they had fewer than 15 minutes.
And something’s off. Only 30% of boards described the relationship with their CISO as “strong and collaborative.” Slightly more than half of the board respondents (53%) said reporting on the impact of evolving threats needs improvement.

How CISOs can speak up when it matters.—BH

Presented By Level Access

Confidence isn’t compliance

92% of professionals say they're at least somewhat confident in the accessibility of their digital experiences. But 6 in 10 still feel exposed to legal or regulatory action.

That’s the accessibility risk gap for you. It’s the space between what teams *think* is compliant and what actually *is* compliant. Want to close that gap at your org? Level Access can show you how in their Accessibility Risk Reduction Playbook.

Get your copy of the playbook to learn how you can:

Spot warning signs in your program.
Understand what’s really at stake when you catch accessibility issues too late.
Implement practical strategies to reduce exposure.

Don’t let accessibility issues sneak up on you. Dive into the playbook and turn uncertainty into control.

CYBERSECURITY

Runtime

Morning Brew Design, Photo: Universal Pictures

At one point in the 2015 cyber thriller Blackhat, hacker Nicholas Hathaway (Chris Hemsworth) examines the malware on a USB drive. The camera lingers on Hathaway’s screen for a few extra seconds to let us know he is typing real commands like cat and autorun.inf.

The movie follows Hathaway as he tries to find the cyber-villain responsible for melting down a Hong Kong nuclear plant and disrupting the Chicago Mercantile Exchange.

In an interview with Variety eight years after the movie’s release, director Michael Mann said: “The subject may have been ahead of the curve, because there were a number of people who thought this was all fantasy. Wrong. Everything is stone-cold accurate.”

To that end, Blackhat features its share of autoruns, remote access Trojans (RATs), IP addresses, malicious payloads, and other only-in-IT terms that a cyber defense pro like Paul Taylor, associate director at cybersecurity company NCC Group, deals with day to day. Taylor currently conducts cyberattack simulations for banks.

What does Michael Mann’s thriller get right?—BH

CYBERSECURITY

Hack attack

Getty Images

What are they thinking?

When it comes to ransomware criminals, the answers can vary. Some organizations are sophisticated businesses where hackers are treated as employees with HR departments and paid time-off, while others are more ramshackle.

But they’re all dangerous—and after your data. Mike Puglia, general manager of cybersecurity labs at Kaseya, told IT Brew that financial motivation has been the constant motive of ransomware attackers. The tactics are much the same between groups: gaining access, exploiting vulnerabilities, escalating privileges, and deploying an encrypter to hold the data for payment.

“It’s Whac-a-Mole, or a game of cat and mouse, between defenders and attackers, and as soon as one hole is closed, suddenly the next wave comes,” Puglia said.

Here’s how the game is played.—EH, CN

Together With Tines

Patch faster, stress less. Ditch manual patching. Today, teams automate updates across operating systems and apps with intelligent workflows, reclaiming time and trust to focus on bigger and better wins. See how Reddit, MyFitnessPal, and Turo streamline patch management—no complex scripts required. Get the practical guide now.

PATCH NOTES

Francis Scialabba

Today’s top IT reads.

Stat: $1 billion. That’s the size of the now-cancelled licensing partnership between OpenAI and Disney. (Ars Technica)

Quote: “The downturn in Fortnite engagement that started in 2025 means we’re spending significantly more than we’re making, and we have to make major cuts to keep the company funded.”—Epic Games CEO Tim Sweeney on why his company, which produces the Fortnite video game, is laying off 1,000 workers (TechCrunch)

Read: Shishir Mehrotra, CEO of Superhuman (formerly known as Grammarly), sat down with The Verge’s Nilay Patel to discuss how the company used Patel’s name in an AI product without permission. (The Verge)

JOBS

CollabWORK connects you to the hidden job market through IT Brew and other trusted channels. Browse roles curated specifically for this community by clicking through to the job board.

SHARE THE BREW

Share the Brew, watch your referral count climb, and unlock brag-worthy swag.

Your friends get smarter. You get rewarded. Win-win.

Your referral count: 0

Click to Share

Or copy & paste your referral link to others:
itbrew.com/r/?kid=71df84e8

ADVERTISE // CAREERS // SHOP // FAQ

Update your email preferences or unsubscribe .
View our privacy policy .

Copyright © 2026 Morning Brew Inc. All rights reserved.
22 W 19th St, 4th Floor, New York, NY 10011

Speak up!