Published on 9/18/2025 by Daniel SCHNETZER
Last updated : 10/2/2025
The CISO’s dilemma : between transparency and internal pressure
In a world where cybersecurity has become a strategic issue, Chief Information Security Officers (CISO) are increasingly placed in an untenable position: keeping silent about critical incidents. A recent study shows that 69% of CISOs have already been asked by their management not to disclose an attack or a security breach, often for fear of reputational or financial repercussions.
However, this silence can prove dangerous, both for companies and for the individuals themselves. Indeed, the GDPR, like European regulations (DORA, NIS2…), imposes rapid disclosure obligations under penalty of sanctions. Voluntary silence can therefore turn into a major legal risk, not to mention the consequences on the trust of clients, partners, and markets.
Increasing pressure and ethical consequences
The profile of cyberattacks is evolving. Less visible, more discreet, today’s attacks often target critical infrastructures by avoiding service interruptions, which makes their detection more complex and facilitates concealment.
But this ostrich strategy comes at a price. Minimizing an incident or delaying its declaration does not make it any less real. Worse, it prevents an appropriate response both internally and externally. The CISO, meanwhile, finds themselves torn between the duty to protect the company and their own professional commitment, sometimes at the cost of their career.
To anticipate and contain an attack, it is essential to have a clear and effective response plan. On this point, UNIVIRTUAL offers a structured approach with a practical guide in case of crisis : SOS Cyberattack.
Not speaking up is leaving the door open to repeat offenses
Ignoring an intrusion or data theft amounts to trivializing the consequences. This prevents corrective actions, alert systems, and internal training from being put in place. In the long run, the entire security posture of the company is weakened.
At UNIVIRTUAL, we support organizations in preventing and anticipating cyber threats, with a proactive approach including audits, incident simulations, and advanced detection : Prevent cyber threats.
New rules demand transparency and responsiveness. It is therefore essential to adopt a robust cybersecurity strategy. This involves choosing reliable partners capable of detecting, containing, and resolving threats within the required timeframes.
To learn more, discover our cybersecurity offer.
Towards a necessary cultural change
It is becoming urgent to evolve corporate culture around cybersecurity. Rather than focusing on short-term reputation, top management should encourage responsibility, transparency, and resilience.
CISOs, on the front line, should no longer be perceived as bearers of bad news, but as guarantors of secure governance. And companies like UNIVIRTUAL, specialists in sovereign cloud, high availability infrastructure, and cybersecurity, have a key role to play in this transition.
Conclusion
Remaining silent means taking a useless risk. Acting means protecting the company, its clients, and its employees. Defining a clear strategy, supported by independent experts, ensures responsible communication in the event of an incident. The real silence is that of preparation.
More information on our website : www.univirtual.ch
