By: Sarah Summer

When major cyberattacks make headlines, executives scramble to understand what went wrong. The uncomfortable truth is that many CEOs still view cybersecurity as a technical challenge, rather than a core leadership issue. Jerry Sanchez, Co-Founder and Managing Partner of Framework Security, has spent more than 25 years at the intersection of technology, security, and business growth. His message to CEOs is straightforward: if you’re not treating cybersecurity as a priority in the boardroom, you may be lagging behind.

Sanchez was named Chief Information Security Officer of the Year by the Cybersecurity Excellence Awards and recognized among The Consulting Report’s Top 50 Global Cybersecurity Leaders. His career spans roles at Electronic Arts, Charles Schwab’s CyberTrader division, and Planview, where he contributed to the development of a SaaS delivery model that helped drive enterprise expansion. In 2018, he co-founded Framework Security, now acknowledged by Clutch, G2, and The Manifest as one of the leading cybersecurity consultancies in the United States.

The track record matters—not only because it adds credibility to his message but because it highlights a significant shift in the risk landscape.

“A breach isn’t just a technical event. It’s a trust event,” Sanchez has said. “Customers don’t separate your technology from your reputation. If their data is exposed or your service goes dark, they lose trust in your leadership.”

That shift—from a technology problem to a trust problem—is where CEOs need to adjust their perspective.

Cybersecurity Is Not an IT Problem

For decades, cybersecurity was primarily handled by IT departments. But, as Sanchez points out, that perspective misses the broader issue. At Planview, where he served as CIO, his role went beyond managing infrastructure. He was focused on creating a SaaS delivery model that would support the company’s growth and meet the security demands of large enterprise clients. Decisions about security were not just about technology—they were about market positioning, sales credibility, and revenue.

Sanchez advocates that CEOs should no longer delegate cybersecurity. Instead, it should be integrated as a strategic layer of business operations. Boards, investors, and regulators increasingly expect executives to be aware of and engaged in their company’s security posture, and the consequences for failing to do so can be severe.

Cloud Fragility Is a Business Risk

Many executives assume that moving to the cloud automatically solves security issues. Sanchez cautions against this assumption, pointing out that outages, misconfigurations, and third-party vulnerabilities remain persistent risks. During his time at SoftServe, where he led cybersecurity consulting for North America, Sanchez advised global enterprises on exactly these kinds of challenges.

The lesson here is: CEOs should not merely ask whether they are using the cloud. They must plan for the possibility of a cloud provider failure, knowing that business continuity, resilience, and risk assessments are essential.

Compliance Is the Floor, Not the Ceiling

Sanchez observes that many CEOs treat compliance as the endpoint. Achieving certifications such as SOC 2 or ISO 27001 is important, but it does not automatically equate to security.

At Framework Security, Sanchez has developed a practice that goes beyond checklists, advocating for the creation of a security culture that becomes embedded in the organization’s workflows. As he explains, passing an audit should not be the final goal. Instead, security should be part of the company’s ongoing operations.

This perspective resonates with CEOs, as it positions compliance as a foundation for building trust with customers and partners, offering a competitive advantage rather than just fulfilling regulatory requirements.

The Executive Bullseye

A growing concern, according to Sanchez, is the personal targeting of executives. From deepfake audio mimicking CEOs to ransomware gangs threatening to leak sensitive board-level information, the attack surface has expanded beyond infrastructure to people.

“Attackers’ first step is often to map out the leadership team,” Sanchez has noted from experience. “If executives think this won’t happen to them, they’re underestimating the level of sophistication we’re seeing.”

For CEOs, personal awareness and executive training are no longer optional. They are critical components of an organization’s overall defense strategy.

AI as a Double-Edged Sword

Framework Security has invested in AI-powered tools, including the launch of Minerva Insights, which automates pentest report generation. However, Sanchez emphasizes that AI can also be used by attackers. Deepfakes, impersonation scams, and poisoned training data all represent emerging threats.

The takeaway for CEOs is that AI cannot be left to the innovation or IT teams alone. It should be integrated into risk management and governance discussions at the highest levels.

Advice for CEOs

So, what should a CEO actually do? Sanchez offers some practical advice:

• Bring cybersecurity to the boardroom. It should not be treated as a line item. Ask your CISO or vCISO to present risk scenarios the same way your CFO presents financials.
• Demand business-language reporting. You don’t need to understand all the technical details, but you do need to know how specific risks impact revenue, brand, and compliance.
• Plan for continuity, not perfection. Breaches and outages will occur. The question is whether you can manage them and maintain customer trust.
• Invest in executive protection. Educate your leadership team on social engineering tactics, deepfakes, and targeted attacks.
• Move beyond compliance. Use frameworks as a foundation, then build a security culture that fosters trust with customers and partners.

A Human-Led Approach

At Framework Security, Sanchez and his team prioritize a “human-led approach.” This philosophy emphasizes that cybersecurity is not just about tools and technology but also about applying expertise and judgment to enable business growth while protecting organizational assets.

This framing is particularly important for CEOs. In a world where digital trust is just as critical as product innovation, leaders can no longer afford to view security as a responsibility for someone else in the organization. Sanchez’s career—from defending trading servers at Schwab to advising enterprises on cloud resilience—shows just how high the stakes are.

Cybersecurity is no longer a department; it’s a leadership issue. And, as Sanchez explains, the companies that will thrive are those whose CEOs recognize this shift and act accordingly.

Find Jerry and the Framework Security Team at https://frameworksecurity.com