Key Takeaways
- The Coupang data breach exposed nearly 34 million customers and led CEO Park Dae‑jun to resign, accepting “grave responsibility” for the incident.
- Investigators concluded the breach was a management failure, not a technical flaw, shifting accountability from the CISO to senior leadership.
- Historically, CISOs have been scapegoated for cyber incidents, yet they lack authority over budget, risk tolerance, and cross‑departmental enforcement.
- Boards and regulators are increasingly treating cybersecurity failures as evidence of corporate negligence, prompting higher‑level scrutiny.
- Embedding measurable security expectations into CEO compensation and mandating a Zero Trust mindset are essential steps to align security with business strategy.
- The future of cybersecurity accountability lies in ensuring decision‑makers feel the consequences of their choices, allowing CISOs to focus on providing risk visibility rather than absorbing blame.
The Coupang Breach and CEO Resignation
In December 2023, Park Dae‑jun, chief executive of Coupang’s South Korean operations, stepped down after a massive data breach exposed the personal information of nearly 34 million customers—almost the entire user base of the e‑commerce platform. Park cited his resignation as an acceptance of “grave responsibility” for the incident. South Korean government investigators determined that the breach was not the result of a novel, unstoppable hack but rather a preventable lapse: a former engineer who knew the system’s weaknesses re‑entered through a virtual door the company had failed to close. The investigation labeled the event a management failure, placing the blame squarely on the CEO rather than the chief information security officer (CISO). This case illustrates how senior executives are increasingly being held answerable for cybersecurity shortcomings that stem from strategic decisions—or the lack thereof—rather than purely technical flaws.
Why CISOs Have Been Scapegoated
For years, organizations have instinctively pointed to the CISO when a security incident occurs, under the assumption that owning the security program equates to owning its outcomes. However, CISOs typically do not control the levers that truly shape an organization’s security posture: they do not set the budget, define the acceptable level of risk, or compel other business units to adhere to security policies when those units pursue competing priorities. Their role is largely advisory—presenting risk assessments and mitigation options to the board and executive team, then waiting for leadership to decide on action. Consequently, when leadership underinvests in security, ignores known vulnerabilities, or fails to enforce policies, the resulting breach reflects a leadership decision, not a CISO mistake. Misplacing blame on the CISO obscures the true source of risk and hinders meaningful improvement.
Shifting Board and Regulator Attitudes
Boards of directors historically viewed cybersecurity as an IT issue, delegating responsibility to technical teams and treating breaches as unfortunate but isolated events. The scale and impact of recent breaches—such as the Coupang incident—have altered this perspective. A breach that exposes tens of millions of customers generates not only legal liabilities but also damaging headlines, stock‑price volatility, and intense regulatory scrutiny. As financial and reputational costs mount, boards are now asking tougher questions about security posture before incidents occur, while regulators pursue penalties after breaches, framing cybersecurity failures as evidence of corporate negligence rather than mere bad luck. This evolving landscape is pressuring CEOs to treat cybersecurity as a core business concern and to ensure that security strategy receives the same strategic attention as finance, operations, or marketing.
Embedding Accountability in Executive Compensation
One of the most effective ways to shift accountability is to tie executive performance—and compensation—to measurable security outcomes. If a CEO’s bonus is linked solely to revenue growth without any consideration of security metrics, the implicit message to the organization is that security is secondary. Boards should instead establish clear, specific security expectations (e.g., patch‑management timelines, incident‑response readiness, third‑party risk assessments) and define thresholds that trigger tangible consequences when unmet. By incorporating these metrics into compensation structures, CEOs receive a direct financial incentive to prioritize risk mitigation, allocate adequate resources, and enforce cross‑functional compliance. This alignment ensures that security considerations are weighed alongside traditional business goals during strategic planning and day‑to‑day decision‑making.
Zero Trust as a Leadership Decision
The Zero Trust security model—originally introduced by the author during a tenure at Forrester Research—is often misunderstood as a technology purchase. In reality, Zero Trust is a strategic leadership decision that dictates how an organization assumes and manages risk. Its core tenet—“never trust, always verify”—requires enterprises to operate under the premise that a breach is inevitable and to focus on containing lateral movement, enforcing least‑privilege access, and continuously monitoring trustworthiness. Implementing Zero Trust demands executive endorsement, budget allocation, and policy enforcement across departments; it cannot be achieved by a CISO acting alone. When CEOs champion Zero Trust as a business imperative, they signal that security is integral to the organization’s risk management framework, not an afterthought tacked onto IT projects.
Moving Beyond Blame: The Future of Cybersecurity Accountability
Park Dae‑jun’s resignation at Coupang serves as a salient example of how holding senior leaders accountable can reshape an organization’s incentive structure. When boards compel CEOs to own cybersecurity outcomes, they create a feedback loop that aligns security investments with business priorities and discourages the reflexive scapegoating of CISOs. The path forward requires three interlocking actions: first, boards must define and measure clear security expectations for CEOs; second, CEOs must embed principles like Zero Trust into the enterprise strategy, ensuring that risk mitigation is a continuous, organization‑wide effort; and third, CISOs should be empowered to provide transparent risk visibility without bearing the burden of blame for decisions beyond their control. As regulators, investors, and customers increasingly demand robust cybersecurity governance, companies that embed accountability at the top will not only reduce breach risk but also gain competitive advantage through heightened trust and resilience.
Join our LinkedIn group Information Security Community to stay updated on the latest discussions and best practices in cybersecurity.