2 factors I think: * the CTO title is the new project manager. It seems as soon as someone is in a position to choose whether to use Postgre or MySql they brea

2 factors I think: * the CTO title is the new project manager. It seems as soon as someone is in a position to choose whether to use Postgre or MySql they break out the CTO moniker. You can now be the CTO of just about any organizational unit, no matter how small. * CTO != CISO (quite the contrary usually). Being tech-savy doesn't mean you grok security, especially its operational, wetware/social aspects. Obligatory xkcd: https://www.xkcd.com/538/ https://www.xkcd.com/538/ I would tend to go with the second explanation in this case. When I read the quote "It is almost impossible to imagine a scenario in which an external hacker is able to gain access to the primary encryption keys", I thought it pointed to a lack of imagination (and probably a bit of Dunning-Kruger syndrome) rather than security expertise.