Laserfiche has named Garrett Boss as Chief Information Officer, placing enterprise IT operations, security, and business transformation under a single executive role. The announcement, distributed through AFP.com, gives Boss oversight of the three core functions that typically drive an enterprise software vendor's internal technology posture. The company has not yet released additional details on reporting lines, scope of direct reports, or internal portfolio boundaries.

Why combine IT, security, and transformation under one CIO?

Centralizing these three functions under a single leader has become a standard pattern among enterprise software vendors looking to compress the timeline between strategic planning and operational execution. Each of the three pillars touches a different part of the technology stack:

• Enterprise IT owns the corporate systems backbone: enterprise resource planning, identity and access management, endpoint management, collaboration platforms, and the internal help desk.
• Security covers governance, risk, and compliance; threat detection and response; vulnerability management; and the certifications customers and auditors expect.
• Business transformation drives modernization programs, process re-engineering, and the internal rollout of new platforms—work that often runs on multi-quarter timelines and crosses functional boundaries.

When those programs sit under separate executives, decision cycles slow because each function must negotiate priorities, budgets, and change windows. A CIO owning all three can sequence those decisions against a single roadmap.

What changes for security reporting lines?

In this structure, the chief information security officer or equivalent security lead typically reports into the CIO rather than directly to the CEO. That arrangement shortens the chain between a detected threat and the infrastructure team that needs to patch, isolate, or rebuild the affected system. It also aligns security spending with the same capital cycle that funds infrastructure refresh and transformation programs.

The trade-off is concentration of risk: a single executive now owns both the systems that get attacked and the controls designed to defend them, which the audit committee and board typically address through separate governance channels.

What does the transformation mandate imply?

A CIO title that explicitly includes business transformation signals that the company is preparing for a sustained internal modernization program. In enterprise software vendors, transformation work often doubles as product validation: teams deploy the company's own document management, workflow, and automation tools inside the business before those releases reach the wider customer base.

Boss's remit extends across the full lifecycle—selecting platforms, configuring integrations, and proving out security and compliance controls in production environments that real employees use daily.

What enterprises should track

Customers evaluating Laserfiche's platform should watch for the cadence of internal transformation announcements, since vendor deployments frequently preview integration patterns, API extensions, and security certifications that surface in subsequent product releases. Procurement teams that have asked for SOC 2, ISO 27001, or FedRAMP-aligned controls can use the appointment as a signal to revisit vendor security questionnaires and renewal terms.

Open questions

The initial announcement identifies Boss by name and role but does not detail prior positions, tenure, or reporting structure. Additional information on direct reports, budget authority, and the first 90-day priorities is likely to surface in the company's upcoming internal communications and customer briefings.