By Alain Sanchez, EMEA CISO, Fortinet, November 2026
Zero risk is an illusion
I have heard the expression a hundred times, mostly from junior salespeople who have not yet noticed two things: Firstly, zero risk does not exist. And secondly, if it did, it would mean zero business. A company that takes no risk disappears, overtaken by those who dared.
Board members do one thing all day: they make decisions based on risk. The CISO’s job is to inform them, with precision and data, how much risk they are taking, so that they can assess it. Superior security is what allows a company to make bold choices. For example, a Formula One driver will take a bolder trajectory into a corner because he knows his braking system is better than the one in the car behind him, and that the energy he will recover under braking will charge the batteries for the next acceleration. Good brakes exist so that you can drive faster and more safely than the others.
The same evidence, two different decisions
Late September gave us a good illustration of how thin the line is. A provider of secure file transfer received a warning from federal authorities about a credible, imminent attack. No breach was confirmed; no vulnerability was identified. The company still asked its customers to switch production off for a few hours and did the same with its own hosted services. During the shutdown, its engineers found a critical flaw nobody knew about, fixed it, and restored service three days later. No compromise was ever reported.
Was the shutdown really necessary? Nobody will ever know. Every CISO who read that story asked themselves the same question: would I have pulled the plug on the basis of a tip, with nothing in my logs? Some would have. Others would have restricted external access, isolated the exposed feature and kept the business running. Both answers are right. They depend on what the company does, on how far it can afford to penalise its KPIs for three days, and on what it can afford to lose forever.
There is no risk curve that fits all
This is where the thin line moves from one company to another. What is unacceptable for a commercial bank, whose license depends on the continuity of payments, can be a reasonable choice for a trading house that lives on speed and accepts a technical outage as the price of being first. A hospital and a luxury hotel group do not prioritize risks the same way, and I see too many executive committees where the final risk level is decided by the lawyers rather than by the people who run the business.
The CISO’s job is to make that decision explicit, then to keep the company inside it while the threat landscape keeps moving the walls. And it moves fast. FortiGuard Labs measured in its 2026 Global Threat Landscape Report that the time between the disclosure of a critical vulnerability and its exploitation in the wild has fallen to 24 to 48 hours, against 4.76 days a year earlier. Exploitation attempts grew by more than 25% while brute-force attempts fell by 22% meaning that attackers try less and aim better. More than 7,800 ransomware victims were confirmed over the period, almost five times more than just a year ago.
What PHP2Shell taught us
The recent PHP2Shell episode illustrated how visibility is critical. Two remote code execution flaws were discovered in PHP, the most used language of the web. A researcher found the first one on 1st August 2026 through AI-assisted code analysis. On 17th October, four days before the planned disclosure, a honeypot operated by a large cloud provider recorded the first exploitation attempt. On 20th October, the details leaked. On 21st October, the PHP project released its patches early, and the national agencies published their advisories. By 22nd October, FortiGuard Labs issued an outbreak alert, virtual patches, and endpoint detections.
So, what does the decision-making process look like during those 72 hours? The vulnerable component sits everywhere and nowhere, in a web front end at the edge, in an internal tool at the core, in a SaaS application run by a third party, in a container image somebody pulled from a public registry last year. 48 hours is not a realistic timeframe to patch everything, but this does not mean shutting down the service is the only option.
The only defensible path is to know, at that very moment, which of your exposed systems runs which version, which ones are already being probed, and which one, if lost, impacts the business the most. The CISO who has this visibility can tell the board the best approach: we isolate these four, we accept the risk on those twelve until Friday, and here is why. The CISO who does not have the holistic view will not choose the best approach to protect the network and data against a cyberattack. Visibility is the braking system.
I recently spoke to a Group CISO in a central bank who confessed that his SOC team had to manually correlate logs from siloed platforms, meaning that the correlation that announces an attack was too slow. A slightly abnormal authentication at the edge, a new outbound flow from a core server, a configuration drift in a cloud tenant, an unusual payload inside a third-party integration, a protocol behaving two milliseconds off its habit. Each of these independent alerts alone is not enough to raise a red flag, but their conjunction is suspicious. FortiGuard’s findings make the same point from another angle: most confirmed cloud incidents in 2025 started with a stolen or misused credential that nobody noticed being used from the wrong place, well before any sophisticated exploit.
This is why, in recent presentations, I have insisted on taking a holistic view rather than having a growing stack of point products. Collecting logs is one thing, but smartly spotting odd correlations based on the latest threat landscape is where the value is. An organisation that has visibility across its entire attack surface and can read the small changes in temperature before a fever can afford to take risks that a blind one cannot.
Back to the corner
The provider that pulled the plug in September did the right thing for a company that could not see what was coming. The question for the rest of us is whether we want to run a business and make decisions that are biased by blind spots. The Formula One driver brakes later than the others because he sees exactly what his car is doing in real time. The CISO’s thin line runs between a risk you can see and one you cannot. Only the first one is a business decision.
