Why a Conversation at Gartner Reinforced the Need for Preemptive Cybersecurity
David Jemmett, Chief Executive Officer
“A report sitting in an inbox does little to protect a business.”
One of the best parts of attending the Gartner IT Symposium/Xpo in Orlando last week was seeing people I had not seen in more than a decade.
The keynote speakers were excellent. Having time to step away from daily responsibilities, listen, and exchange perspectives with other leaders made the week worthwhile.
But one conversation particularly stayed with me.
A Conversation About Preemptive Cybersecurity
I met Carl Manion, Managing Vice President at Gartner, whose work includes emerging cybersecurity technologies.
What stood out to me was his focus on preemptive cybersecurity.
In a September 2025 Gartner announcement, Carl said, “Organizations will need to deploy additional countermeasures that act preemptively and independently of humans to neutralize potential attackers before they strike.”
The conversation reinforced something I have believed for a long time: cybersecurity needs to focus more on preventing disruption before it happens. The goal is to anticipate and disrupt threats before they harm the business.
That matters to me because I have seen what happens when cybersecurity becomes an executive priority only after something goes wrong.
When a business leader calls during a breach, the questions become immediate and personal. Can we keep operating? Is customer information exposed? How long will recovery take? What do we tell our employees, customers, and board?
Those are difficult conversations. They are also why I feel so strongly about acting earlier.
The Business Cost of Waiting
Incident response is essential. Every organization needs experienced people who can contain an attack, investigate what happened, and help restore operations.
But if the first meaningful action begins after an attacker has disrupted the business, we have already surrendered valuable time.
For a CEO, that time translates into interrupted operations, diverted resources, potential financial losses, and difficult questions about trust.
Our security investments should help us address weaknesses before attackers exploit them and limit the damage when an incident occurs.
Consider a system that needs a security update, but taking it offline would interrupt customer service. The security team can explain the risk and the options. Business leaders need to help decide when and how to make the change.
What This Means for Business Leaders
You do not need to become a cybersecurity expert to challenge your organization’s approach.
Start with these questions:
- Where is the business most exposed?
- Who is responsible for addressing those risks, and by when?
- How has our team tested whether security controls work under realistic conditions?
- What is delaying action on the most serious findings?
Identifying a weakness creates value when someone takes responsibility for correcting it. A report sitting in an inbox does little to protect a business.
At CISO Global, I believe our work should help customers address the security risks that could interrupt their operations.
My message to fellow executives is simple:
Have the conversation about preemptive cybersecurity while you still have time to act on it.