Stronger Incident Prevention Takes Just One CISO Decision