At a glance
It was a leadership-heavy week. Coinbase hired Unit 42 CTO Michael Sikorski as CISO, the Solana Foundation named former Twitter/Mozilla security chief Michael Coates to the same role, life-sciences software vendor Blue Mountain elevated Paul Adams to CISO, and Google Cloud’s Chris Betz gave his first interview since taking the CISO title there — all within days of a new publication, CISO HQ, launching specifically to help executives triage exactly this kind of news firehose. Read together, the moves underline how contested and visible the CISO seat has become across crypto, cloud and regulated-industry software alike, with security leadership increasingly treated as a headline-worthy hire rather than a back-office appointment.
Breach-driven litigation kept pace on the legal side: a proposed class action accuses TikTok of exposing the private information of more than 2.4 billion users in a June database compromise, while a separate suit against Madison Square Garden Entertainment alleges the June ShinyHunters intrusion exposed biometric data MSG has used since 2018 to build visitor “threat assessments” — a detail that could reshape how facial-recognition and surveillance programs get scrutinized in discovery. On the regulatory side, the FTC secured a $2.25 million settlement with tenant-screening firm RentGrow over Fair Credit Reporting Act violations, and the UK government paired a national “Cyber Shield” agentic-AI defense blueprint from NCSC/GCHQ with a voluntary Cyber Resilience Pledge signed by 60 companies — a soft-power move commentators read as the precursor to harder mandates under the pending Cyber Security and Resilience Bill.
Rounding out the week, a MetaCompliance survey found 78% of European CISOs believe their C-suite doesn’t fully grasp employee-driven cyber risk, and a cluster of CIO.com pieces dug into why AI ROI remains so hard to measure, what courses exist to help IT leaders manage AI-driven organizational change, and why business-process rigidity — not IT capability — is the real bottleneck holding back AI value. A SecurityWeek profile of CISO Tarah Wheeler closes out this week’s foundational reading with a meditation on the industry’s lack of ground truth and statistics.
This week’s topic map — the CISO appointment wave (Coinbase/Sikorski, Solana/Coates, Blue Mountain/Adams, Google Cloud/Betz), the breach-lawsuit wave (TikTok, Madison Square Garden/ShinyHunters), the UK’s Cyber Shield and Cyber Resilience Pledge, the FTC-RentGrow settlement, the board-CISO trust gap, and the AI ROI/change-management cluster.
View interactive topic map →
Article index
Cluster 1 — New CISO appointments
Four organizations named new security chiefs this week, and a new publication launched specifically to help executives make sense of a news cycle this dense.
Cluster 2 — Breach-driven litigation
Two proposed class actions this week target companies whose breaches touched extraordinarily sensitive data — global-scale user records at TikTok, and biometric threat-assessment profiles at Madison Square Garden.
Cluster 3 — Regulation and enforcement
The FTC closed out a consumer-reporting enforcement action while the UK government rolled out a nationwide agentic-AI defense blueprint alongside a voluntary industry pledge.
Cluster 4 — Board and executive alignment
A European CISO survey puts numbers on a familiar frustration: security leaders still don’t feel their C-suite understands the risk employees create day to day.
Cluster 5 — AI ROI and the change-management burden
Three CIO.com pieces this week converge on the same uncomfortable question: enterprises have adopted AI everywhere, but almost nobody can cleanly measure what it’s actually returning — and the bottleneck increasingly looks like process, not technology.
Cluster 6 — Foundational: the CISO as a person
This week’s longer-form read profiles a CISO whose path into the role, and whose concerns about the field’s lack of hard data, offer a candid counterpoint to the appointment-announcement news above.
Detailed write-ups
1. A CISO hiring wave: Coinbase, Solana and Blue Mountain all name new security chiefs
FX News Group · crypto.news · GlobeNewswire · July 7–8, 2026
Three organizations filled their top security seat within 48 hours of each other. Coinbase hired Michael Sikorski, Unit 42’s CTO for the past four years (with earlier stints at Mandiant, FireEye and the NSA), as CISO, with Sikorski framing the move as stepping “out of the advisory seat” to secure a “decentralized” financial-services ecosystem against “AI-enabled attackers” directly. The Solana Foundation named Michael Coates — Twitter’s first CISO and a former Mozilla security chief — to lead security across a network he says now processes more transactions daily than most of the crypto industry combined, citing tens of billions in daily stablecoin volume as the reason the role mattered enough to take. And life-sciences EAM vendor Blue Mountain elevated its existing security lead, Paul Adams, to CISO, explicitly tying the promotion to AI governance: the company is racing to align its ISO 42001 and FDA AI/ML compliance programs before “the timeline between a gap in governance and a real compliance event” compresses further, in Adams’s words. Taken together, these three appointments span crypto, Web3 infrastructure and regulated life-sciences software — a signal that security leadership hiring is accelerating across sectors with very different risk profiles but a shared driver: AI is moving faster than the governance and compliance frameworks built to contain it.
Sources: FX News Group · crypto.news · GlobeNewswire
2. Google Cloud’s new CISO Chris Betz on integrating AI in cyber defenses
Infosecurity Magazine · July 7, 2026
In his first interview since assuming the CISO title at Google Cloud — a promotion from VP of infrastructure security, with the Office of the CISO now reporting directly to him — Chris Betz laid out a three-pillar framework for AI-powered security defense: the security expert, the harness, and the model, deliberately in that order. His central claim is counterintuitive in an industry obsessed with model benchmarks: “a less capable model with a good harness and a good expert is more powerful than the best model without a good harness or good experts.” Betz, who previously held CISO roles at AWS and Capital One, described running multiple AI models simultaneously (including via Anthropic’s Project Glasswing) rather than standardizing on one, both to hedge against any single model’s blind spots and to manage token cost. He also detailed Google’s vulnerability-finding pipeline — Naptime, then Big Sleep, now CodeMender for fixing what’s found — and flagged that CISOs he’s spoken with in France, Germany and the UK are each seeing more than 10x the vulnerability volume they used to. For CISOs building their own AI-defense roadmap, Betz’s framework is a useful gut-check against vendor pitches that lead with model capability alone.
Sources: Infosecurity Magazine
3. TikTok data breach lawsuit claims June 2026 incident exposed info of over 2.4 billion users
ClassAction.org · July 7, 2026
A proposed class action filed in California federal court (Mortazi v. TikTok Inc.) alleges the company’s negligence allowed cybercriminals to deploy malware and exfiltrate an unencrypted internal database containing names, usernames, emails, phone numbers, birth dates, gender, language and location data for more than 2.4 billion users — first reported publicly on June 11. The complaint argues TikTok collects and retains this data specifically for targeted-advertising profiling, and that the company’s own privacy notices promising “strong protections” created a duty it failed to meet, citing FTC data-security guidance as the applicable standard. Notably, the suit doesn’t allege payment or government-ID data was taken, but argues the sheer scale and combination of identifiers (enough to build a detailed behavioral and location profile per user) creates a lifelong phishing, identity-theft and social-engineering risk for the class. For CISOs at consumer platforms handling comparable data volumes, the case is another data point in the plaintiffs’-bar pattern of using scale of exposure, rather than sensitivity of any single field, as the primary damages narrative.
Sources: ClassAction.org
4. Lawsuit claims 2026 MSG data breach may have exposed sensitive biometric info used for threat assessments
ClassAction.org · July 8, 2026
A separate proposed class action (Granados v. Madison Square Garden Entertainment Corp.) alleges that the ShinyHunters group’s June 16 intrusion — which the group claims accessed 26 million unencrypted records — compromised more than routine PII. MSG has collected facial scans and other biometric data since 2018, per the complaint, combining it with social-media activity and other signals to build “threat assessment” profiles not just of visitors and celebrities but of local protesters and even law firms that might litigate against the venue — the same biometric program previously challenged in a separate suit over MSG’s use of facial recognition to ban rival attorneys from its venues. The complaint also notes this is MSG’s third publicized cybersecurity event since 2015 (a point-of-sale compromise in 2015–16, a 2025 Cl0p/Oracle EBS-linked breach, and now this). For CISOs at venues, retailers or any organization running facial-recognition or behavioral-profiling programs, the case is a preview of how discovery into biometric threat-assessment systems — not just the breach itself — is likely to become a growing source of litigation exposure.
Sources: ClassAction.org
5. UK government rolls out agentic AI defense plan alongside industry pledge
SecurityWeek · July 9, 2026
The NCSC published details of Cyber Shield, GCHQ Director Anne Keast-Butler’s blueprint for “a national-scale, collaborative approach to agentic cyber defense,” inviting academia, critical-infrastructure operators, frontier AI labs and the cyber-defense sector to help build six core capabilities: reliable/explainable AI, federated agents, vulnerability discovery and mitigation, coordinated detection and response, national-level scanning, and national-level mitigation. On the same day, science and technology secretary Liz Kendall launched the voluntary Cyber Resilience Pledge with 60 founding signatories, committing to three modest asks — board-level cybersecurity ownership, enrollment in NCSC’s early-warning service, and Cyber Essentials implementation across the supply chain. Independent commentators quoted in the piece are skeptical Cyber Shield addresses today’s actual breach causes (process and configuration failures, not sophisticated AI-driven attacks) and note most critical-infrastructure operators remain constrained by legacy systems and patching timelines that no amount of agentic tooling fixes on its own. The more consequential signal, per one analyst, is that the Pledge arrives alongside the pending Cyber Security and Resilience Bill — voluntary asks today reading as a preview of mandatory ones tomorrow.
Sources: SecurityWeek
6. Why AI’s ROI stays so hard to pin down — and why the bottleneck is process, not IT
CIO.com · July 8–9, 2026
Three CIO.com pieces this week form a coherent argument about the current state of enterprise AI value. The lead feature surveys companies like Novo Nordisk, which used AI-powered process mining (a Celonis-built “digital twin” of clinical operations) to discover its own workflows didn’t match documentation before it could even attempt to measure AI’s impact — and found that true ROI on a years-long drug-development cycle simply won’t be visible for a while yet. A companion piece cites Deloitte’s 2026 Global Leadership Technology Study finding 75% of IT leaders believe operating models and business processes, not technology, must change before AI delivers more value; as one VP put it, “if you can’t diagram how your work flows from intake to completion, you’re not ready for AI augmentation.” The third piece rounds up ten executive-education programs (Harvard, MIT, Stanford, Northwestern and others, ranging from $15 to $18,630) aimed at helping IT leaders manage the organizational-change side of AI adoption specifically, rather than the technology itself. For CISOs increasingly asked to justify security-AI spend to the same skeptical board raising these ROI questions, the throughline is useful ammunition: the measurement problem is enterprise-wide, not a security-program failing, and baseline-setting before deployment (not after) is the recurring fix cited across all three pieces.
Sources: Why Is It So Hard to Measure the ROI of AI? · 10 Courses for IT Leaders Navigating AI Change Management · IT Isn’t Holding AI Back, Your Business Processes Are
On our watch list
- The new CISOs’ first 100 days. Watching what Sikorski, Coates, Betz and Adams prioritize first — especially whether crypto-sector CISOs (Coinbase, Solana) treat AI-enabled attacker sophistication as differently urgent than their enterprise-software peers.
- Discovery in the MSG biometric suit. If plaintiffs get access to MSG’s threat-assessment methodology, expect the details of what “threat assessment” data actually covers (protesters, law firms) to become a template for challenging similar corporate surveillance programs elsewhere.
- Whether the UK’s Cyber Resilience Pledge becomes mandatory. Watching how quickly board-level cybersecurity ownership and Cyber Essentials-across-supply-chain move from the voluntary Pledge into the pending Cyber Security and Resilience Bill.
- Whether AI-ROI measurement standardizes. With Deloitte, Novo Nordisk and multiple executive-ed programs all converging on “baseline your processes first,” watching whether this becomes a documented best practice CISOs can point boards to, rather than ad hoc consulting advice.
- The scale of the TikTok breach class as it develops. At 2.4 billion users, this is one of the largest breach class actions ever filed; watching whether the case survives early motions given the mix of foreseeability and duty-of-care arguments plaintiffs are using.
|