National CIO Review

Another month brings a new round of technology leadership appointments across industries and organizations of all sizes. This edition of CxOs on the Move features 72 executives taking on CIO, CTO, CISO, AI, and other senior technology roles. From longtime leaders earning promotions to executives joining new organizations and stepping into newly created positions, there are plenty of new chapters to celebrate. Here are the technology executives on the move this month.

The Five Eyes intelligence alliance has issued a rare joint warning that advanced AI systems could challenge current cybersecurity defenses within months. The group, which includes the United States, United Kingdom, Canada, Australia, and New Zealand, says organizations should prepare for a future where AI plays a larger role in cyberattacks and defense operations. This warning follows growing attention on Anthropic’s Mythos 5 and Fable 5 models.

SolarWinds has appointed Justin Henkel as Chief Information Security Officer, adding a seasoned cybersecurity leader with experience spanning military intelligence, threat intelligence, and enterprise security operations. Henkel joins the company from OneTrust, where he spent nearly five years and most recently served as Deputy CISO.

Mars has appointed Kemal Cetin as Global Chief Digital & Information Officer for its Snacking business, effective August 3. Cetin joins from FrieslandCampina, where he served as Global Business and Digital Solutions Officer and was a member of the executive team. He brings nearly 30 years of experience leading digital transformation, technology strategy, and business modernization initiatives across global consumer goods organizations.

ServiceNow has disclosed a security issue that, under certain circumstances, could allow an unauthenticated user to gain unintended access to information stored in customer instances. The company applied a security update on June 5, 2026, after investigating reports submitted through both customer bug bounty programs and ServiceNow’s own bug bounty program.

Microsoft has temporarily disabled more than 70 of its own GitHub repositories after discovering potentially malicious content linked to a broader software supply chain attack. The affected projects reportedly included Azure Functions repositories, Durable Task development tools, and several AI-related sample applications. This is one of the largest known instances of a major technology company taking down its own repositories as part of an active security investigation.

Something significant is happening inside large enterprises, and most technology leaders feel it before they can fully articulate it. The marketing analyst is building a campaign attribution tool over a weekend. The FP&A manager has stitched together a forecasting workflow with AI and a few spreadsheet plugins. Your own engineers are shipping in days what used to take quarters. It’s possible the technology leader themselves are participating and even driving this energy.

Cybersecurity leaders have spent years defending against familiar threats, and while those risks remain significant, Gartner’s 2026–2027 ThreatScape suggests the balance of power is shifting toward a new class of threats fueled by AI, more complex software ecosystems, and expanding attacker capabilities. As organizations race to adopt AI and agentic technologies, security teams are being forced to defend attack surfaces that are still poorly understood and constantly changing.

Organizations spend significant time evaluating vendors, reviewing security questionnaires, and validating compliance certifications. Yet many of the most important risk decisions are ultimately documented in contracts.

Cybersecurity leaders spend months building annual budgets, only to watch the assumptions behind them change before the year is halfway over. That was a central theme in a Gartner Security & Risk Management Summit session led by Elizabeth Davis. Drawing on her background in finance and cybersecurity, Davis challenged the idea that security budgets should be treated as fixed plans.