Zach Lewis is a CIO, CISO, and author with a career spanning 15 years across IT infrastructure and security leadership in higher education and healthcare.
Lewis joined the University of Health Sciences and Pharmacy in St. Louis in 2016, took on the role of CIO and CISO in 2021, and in 2023 led the university’s recovery from a LockBit ransomware attack without paying the ransom. He wrote a book covering this attack and what he learned: Locked Up: Cybersecurity Threat Mitigation Lessons from a Real-World LockBit Ransomware Response.
In his current role, Lewis leads a team of 27 and chairs the Enterprise Risk Management Committee. He is also a Venture Advisor at Glilot Capital Partners and a keynote speaker. Lewis was named Non-Profit CISO of the Year in 2023 and one of the St. Louis Business Journal’s 40 Under 40 in 2025.
Expert Insights spoke to Lewis as part of our ongoing series interviewing cybersecurity professionals to bring you their unique insights into cybersecurity today, the challenges they are facing and the realities of what it takes to defend complex global environments.
To kick things off, could you tell us a bit about yourself and your journey into cybersecurity?
My name is Zach Lewis, and I serve as the CIO and CISO for a private university in the Midwest of the US called the University of Health Sciences and Pharmacy. I’ve been at the university for almost seven years, and I’ve worn both hats in this dual role for over five.
I came up on the IT help desk and infrastructure side, working at tech startups, coal companies and co-location facilities. I’ve also done some consulting, some MSP work, a whole bunch of different things. But I came up through end user support into network and system administration, then got into some leadership roles, and here we are.
Your book Locked Up is based on a real LockBit ransomware attack at your organization. For readers who haven’t picked it up yet, can you walk us through what happened and what those first hours were like?
LockBit at the time, in 2023, was the most prolific ransomware group in the world. They had some pretty major victims, and while we weren’t one of the major ones, we were still a victim nonetheless. They had a very cult-like following, where people would even get tattoos of the logo, and the leader of the group was anonymous at the time and put out a $1 million reward for anyone who could unmask him. So, very full of themselves, very confident, and a very efficient ransomware group.
They hit us in April 2023, claiming to have stolen 75 gigs of data. That number continued to increase over time while we negotiated with them, ending up around 380 gigs.
Once we figured out we’d been attacked, we opened up with the FBI and our insurance providers. We had threat negotiators and forensics experts, and we were doing a deep dive trying to figure out how they got in, patch those holes and remediate the environment, all while negotiating with the threat actors on the dark web about how much they were going to charge for our data and how we’d go about getting it back.
In terms of our response, I think we did a really good job. Once we figured out it was ransomware, we had an incident response plan. It had the first few steps of who to call and in what order, where our sensitive stuff was, insurance contacts, just the plan of action. A good incident response plan will help in the first few hours of any incident. Every incident is different, so it’s only so good for the first day or two, and then it kind of goes off the rails and you have to be adaptable. But our response at the beginning was very good. We’d planned for it, we’d practiced, and we were able to move appropriately.
If you look back a little before that, though, and figure out how the threat actors got in, what they were able to do and why we weren’t alerted, you see some control failures. We’ve definitely learned from those mistakes and patched them up. You might get hit again one day, but you don’t want the same pathway to be used again.
The book goes into all of that: what our environment was like beforehand, what it was like during the incident, the negotiating, the decisions we had to make, why we made them and how long we waited, and the emotional toll on myself, the team, the university as a whole and our end users. It covers talking to the media, doing disclosures, everything we remediated after the fact, and what we added and changed in our stack afterwards. Anything I could think of, I threw into the book to give a framework for people who might, and likely will, go through a ransomware attack, so they have something to build off and understand what they’re going to experience.
There’s just nothing like that out in the market that dives into that kind of detail. There’s always some legal reason, confidentiality issue or regulation that doesn’t allow that information to be shared. We were in the right place at the right time to release all that, and so we did.
Ransomware attacks are still rising year over year. What do you think the industry keeps missing when it comes to the root cause?
Depending on the statistics you look at, ransomware attacks continue to rise year over year, primarily because we keep paying ransoms. But we’re actually seeing the number of companies paying ransoms dip a little, which is good. People are able to recover, and I think that speaks to better backup programs and a little more resilience. But the payments that are getting made are still very high, which keeps ransomware very lucrative. It’s about a billion-dollar-a-year industry. So attacks keep going up, but payments are down. That’s good, but it’s still not getting to the root cause.
We really need to circle back as an industry and figure out what we’re missing and not doing that keeps allowing these attacks to happen.
I think there’s a lack of fundamentals, and they get missed because they’re not glamorous. They’re not sexy. Do you have internet-facing servers that are unpatched? Are we doing good patching? Do we have good identity? Do we have good data controls? I think data and identity are the two big pillars that need some focus right now.
Let’s be honest, patching a server isn’t cool. It’s not a new tool, and it’s not a new startup coming out. Hundreds of new startups come out every year, but obviously the problem’s not getting any better. So, where’s the disconnect? I think it’s the fundamentals that we overlook in a rush to do something really cool and fun. We need to spend a little more time on them and shore up our environment.
Your book covers the operational and technical side of the response, but also the emotional and interpersonal challenges. What did that side of things look like for you personally, and is it something CISOs are prepared for?
It’s high stress. It really is. From the moment you find that ransom note, you feel this sinking feeling in your stomach. This is the bad day, right? This is what we’ve always talked about, and it’s now happening. And you start to wonder: am I a bad CISO? Is my program bad? What did I miss? Is it my fault this is happening to the company, to our end users and our customers? A lot of the time the CISO takes that on their shoulders, and they’ve got to relax a little bit.
There was a real trend over the years that whenever a breach occurred, the CISO would be fired. They were the scapegoat. We’ve seen that change a little in the last couple of years, as companies realize these attacks are going to happen and it’s not necessarily the security team’s fault. We’ve got to be right all the time, and the bad guys just have to be right once to get in. It’s a very hard job to balance. So companies are seeing that you want to keep the people who understand your environment around, not fire them. They know where the controls are and where the failures are, so they can fix things up and make the environment better, instead of bringing in a whole new team that has to learn from scratch.
But there are late nights, there are overnights, and there’s that fear that you’re going to be fired, while at the same time you’re trying to fix an environment that’s down. Am I fixing this for a company that’s just going to let me go when it’s done? Are they only keeping me around to the end? Am I going to be targeted personally by the ransomware group? There’s a lot that goes into that.
It weighs on your family too. I remember calling my wife and telling her what had happened, and that I’d be working multiple late nights and wouldn’t be home. You bring that home with you. There’s a lot of stress there, and it affects everyone for a little while.
CISO stress and burnout is a growing conversation in the industry. What does that actually look like day to day, and what do you think the industry needs to do better when it comes to supporting the people in these positions?
That’s a great question, and one I’ve thought a lot about. I’ll talk from my own perspective first, then the industry as a whole.
Outside of being in the middle of a ransomware attack, I feel like I balance my stress pretty well. Wearing two hats, you have to learn to adapt and do multiple jobs at one time. I’m probably more of a technical leader than a big-time strategic leader at a Fortune 50. I still like playing with the tech, but I’m also leading the team and setting the strategy, so I get to dip into both. If I get to take on a challenge, or accomplish a project, a goal or a task, I feel fulfillment there. I don’t want to be cyberattacked and have to recover from that, but I do enjoy the rapid-fire change of where I’m at right now. I get to do a lot of stuff, which is fun.
As far as the industry goes, there’s so much there. I think part of it might be the reporting structure. That’s always a big conversation piece: where does the CISO report? You have a chief title, but you don’t report to the CEO or the board. It depends on the organization, and it can work in certain instances, but you have leaders who get into these roles expecting to report to an executive, because they’re a chief, and they don’t. That builds stress and discomfort, especially if they’re not getting the funding they need.
Then there are the attacks, and the additional workload being piled onto people now, especially with AI, privacy and data. It seems like there’s a new pillar of security added to the role each year.
You also see a lot of really smart, technical folks being promoted into these roles who aren’t prepared for how much of the job isn’t technical, and they don’t always get the support they need. There’s probably a generational element too, depending on the ages of the people in these roles and the ages of the people they report to.
It’s really hard to pinpoint just one thing. I think we see a mix of three, four, five different things piling together, equating to the burnout and fatigue we’re seeing in the industry.
You mentioned that technical leaders often get promoted into the CISO role without realizing how much of it involves talking to people. Do new CISOs understand the business side, or does it catch them off guard?
A lot of really smart, technical folks get promoted into these roles, and they think, “I’ve made it to the top. I’m the CISO now.” What they didn’t anticipate is that it’s not all technical. You have to be able to talk to people, present to the board and sit in a lot of meetings. They’re not prepared or trained for that, so I think it hits them out of nowhere.
A lot of them, especially the new generation of CISOs, also come in and don’t understand the business well enough. They don’t understand how it makes money. Something I learned early on is that security, while important and there to protect your business, becomes a hindrance if it gets in the way of the business. You’re just a speed bump. The board is there to oversee the business and make sure it’s making money, and the leadership team, stakeholders and shareholders all want to make money too. If you’re there saying, “No, we can’t do this because of X, Y or Z,” you’re going to be put in the closet and not listened to, and they’ll move forward anyway.
So you have to really understand how the business operates and how it makes money, make sure you’re not hampering it, and be strategic in where you’re layering in security so you don’t keep that money from flowing in.
You’re in higher education and healthcare, which is a very different security landscape to big enterprise. What are the biggest challenges that come with protecting an organization like yours, and what do you wish more people understood about it?
Higher ed is severely underfunded, so it’s a prime target. We have a lot of young people with fresh data that’s untainted by debt, credit cards or accounts, which makes them prime accounts for threat actors to attack and take.
We have a lot of those accounts, and they change very quickly. Students are in, they’re out, and we have hundreds of new ones coming in all the time. In higher ed, we probably have the biggest turnover of accounts and information of any industry at any given time. That’s a lot of information to protect.
There’s also this thought process around academic freedom, where people can do and share information very freely and openly, and the thought of putting that behind security is disheartening and upsetting to them. So you have to balance that.
If you look at healthcare, it’s the number one most attacked industry. It’s also an industry likely to pay a ransom when it’s attacked, because there’s loss of life at stake. They want to make sure no one is dying and everyone’s getting their medicines and being protected, so they pay the ransom.
They’re getting attacked all the time, and there’s a lot of sensitive data, probably not much funding, plenty of legacy tech, and a lot of stuff connected to the internet that maybe shouldn’t be. Put those two together in an organization like mine, and we get the healthcare data, the student data, a lot of regulation and a lot of sensitive financial information, and you’re trying to juggle all of that. We also have research happening on sensitive new drugs and medications that gets passed around, so you’re also watching for insider threats trying to steal that and take it to other countries.
There’s a little bit of everything here, and not a lot of money. So, you’ve got to be really strategic in where you’re putting those funds, and try to just not be a very appealing target.
You built a gamified security awareness program that reportedly reduced phishing success by 80%. How did you approach that, and what made it work?
There are a few pillars to that. We started with email security in general, because email is the biggest threat vector: phishing, business email compromise. And now, with the advent of AI, attackers can craft messages that are really customized to their target. So we brought in an advanced AI email security platform from a very early-stage startup, which in itself helped reduce the phishing and malicious emails getting in.
Then you also want to train your end users to spot these things. With AI, it’s not so much misspelled words, bad grammar or punctuation anymore. These emails are very well crafted. So we teach them to look for different things: is there a call to action? Is there some sort of speed or urgency behind the ask?
When we run phishing campaigns, users who catch the email get prizes, like university swag, and we share with the whole campus what was caught and who caught it. Those who miss it get additional training, with a few different tiers for repeat offenders, and we work with their supervisors. We also share our scores after every campaign, so people can see whether we’re improving. It keeps people engaged.
We try to make it fun, but we also do the learning aspect on the back end, and we put the newest, latest tools in place to limit those emails as much as possible. If we train people and they never get a phishing email, that’s great. That’s the best use case. But if we don’t train them and one gets through and they click it, it could spell doom. So, we try to do a little bit of everything and make it as fun as possible.
There’s a lot of fear and doomsaying around AI in cybersecurity right now. Where do you stand on it, and how do you see it changing the landscape for both defenders and attackers?
I was recently on national news here in the States doing a talk on this, and we talked about AI doomsday. I am not a doomsdayer. I love AI. I think a lot of the doomsday stuff we’re hearing right now is hyperbole, and a lot of it is about regulation and trying to grab market share and lock it in so others can’t play in that space. I think we need competition. There need to be more players in the space competing against each other to make the best models.
I think we’re going to see a big shift from new features and capabilities in models to more safety features coming out in new versions. It’s weird to me for a company to say AI is going to end all humanity, but then continue to release models. If you know it’s going to end us, you should probably just stop making it. I don’t think that’s the case.
Do I think AI is going to take my job? Probably not right now. If it wants to in 10 years, that would be cool. Take it. At that point, it’s probably going to do a better job than me anyway. If we can use the tool to alleviate some of the workload and stress that comes with the gig, 100%, let’s do that. I’m very pro-AI, so let’s keep rocking and rolling with it.
How do you see the CISO role evolving over the next few years?
There’ll definitely be a lot more focus on AI. I think the role in general needs to evolve and not just be information security anymore. It’ll have to become more like a CIO, or maybe those two roles blend together in some way.
As AI becomes more prominent, we’re going to be managing a lot more agents, and agents are going to be doing a lot more tasks. I think we’ll have a harder time hiring for entry-level roles, especially if some of that help desk and tier one work gets outsourced to AI or agents as they get smarter. That will pose some interesting dilemmas for CISOs and other hiring managers about where we get our entry-level folks and how we train them up to the next tier. We’ll have some growing pains to sort through there.
But really, it’s going to be about understanding AI, because the threat actors, the bad guys, are going to be using it, and as humans we’re not going to be able to keep up with the amount of noise coming in from them. We need AI to combat AI, and we’re going to have to learn how to use it, be efficient with it, and keep adapting to new threats. We’re already seeing tons of new vulnerabilities being discovered by AI tools, and I think that’s going to continue. But overall, we’re going to see a more secure landscape and better, more secure software being created, and that’s going to be a win for all of us.
Finally, what advice would you give to CISOs who are early in their careers or just stepping into the role for the first time?
Definitely network. Reach out to people in your communities. I’m part of several private chat groups where I talk to other CISOs and CIOs. Go to events, put yourself out there, meet people, market yourself, brand yourself, because really, it’s an industry about who you know. Whether you’re looking for a gig somewhere else or you need help with a problem, the more people you know, the better.
Keep reading and stay up to date on the news. And build connections with your federal partners, which in the States means the FBI or CISA. It all comes back to networking and building that group.
