Protect Enterprise Value in Accelerating Digital World

Trust at Machine Speed: The New Mandate for Cybersecurity Leadership

The sessions attended covered very different threats and technologies, yet they converged on the CISO panel's message: cyber risk becomes business risk almost immediately and the next frontier is maintaining trust at machine speed.

 

The adversary runs on a different clock

One presentation cited an average eCrime breakout time of 29 minutes and a fastest observed breakout of 27 seconds. Another example showed initial access reaching data exfiltration in 4 minutes, with access handed to a second actor in 22 seconds. In translations, ticket-driven response cannot keep pace.

Machines must collect, correlate and enrich signals at machine speed so people can focus on consequential decisions. Automation should not remove human accountability but instead preserve the limited time in which human judgment still matters.

 

Fundamentals are the floor, not the finish line

With the focus on emerging technology, a theme that kept returning is back to basics: phishing-resistant MFA, eliminating legacy authentication and standing privilege, complete asset and software inventory, least privilege, segmentation and Zero Trust. Vulnerability Threat Management must prioritize the exposed, unpatched and privileged first. Inspecting and addressing just critical- and high-risk vulnerabilities now need to extend to moderate and low-level vulnerabilities. Innovation is essential but automation does not replace fundamentals alone. Otherwise, the cost of getting them wrong is elevated.

 

From alerts to context

Attacks are not bound by product boundaries. The real threat may be spread across identity, endpoint, network, SaaS, cloud and threat intelligence, with no single console seeing the full chain. The value of XDR, SOAR and AI-assisted investigation is not another dashboard. It is the ability to ask one question across every feed: what else happened to this identity or this asset? The goal is a coherent attack story not a larger alert queue.

 

Identity transforms to intent

Agentic AI changes the problem and dynamics. A copilot recommends an action while an agent executes one through enterprise tools and APIs. Identity must now establish who requested the action, which agent acted, what task was approved, what authority was used and what changed.

The strongest design pattern presented was to give each agent its own identity, restrict authority to the approved task, authorize every hop, use short-lived identity-bound tokens and keep one linked audit record. APIs are the tentacles of AI. The right question is not, is this agent trusted but is this specific action permitted for the specific task. Once agents act, observability must become accountability. The SOC (Security Operations Center) should be able to determine what happened, who or what caused it, why it was authorized, what data was touched and how to stop it? Without that evidence, we have automation without control.

 

Shift in incident response to decision integrity 

Deepfakes, synthetic voice and fabricated documents target the information leaders use to decide. An attacker does not need universal belief; confusion or hesitation may be enough. Threat actors exploit delays in decision-making, advance planning, testing and stressing decisive action essential. Resilience must include authenticated executive channels, rapid corroboration, coordinated response across Security, Legal, Communications and business line leadership, and tabletop exercises that introduce synthetic evidence. The exercise question is no longer only considering if technology recovery is feasible but can the organization establish what is authentic fast enough to make the right decision.

 

From policies to provable control

Regulatory sessions span automated decision-making, privacy, chatbots, deepfakes and human safety. The direction was consistent that disclosure alone will not be enough. Organizations will need evidence that AI activity is authorized, attributable, observable and controllable. Because technology moves faster than regulation, durable governance should be built around recurring obligations rather than one law at a time. NIST's map, measure manage and govern structure offers a practical bridge from policy to operations. This is the same principle I presented on evidence-of-effectiveness standard that applies to AI.

 

Multiple time horizons

Post-quantum cryptography sessions referenced emerging NIST standards and urged preparation based on data sensitivity, system criticality and migration feasibility. The leadership principle applies equally to AI. Not every material risk must be solved today but every material risk should be understood before it becomes urgent. The level of preparation with Y2K must be applied to PQC (Post quantum computing) based on the timelines we’re not in control, leading to 2030 predictions.

 

Outside the session rooms, conversations with fellow security leaders kept circling back to three practical concerns.

1.        Tool sprawl is not strategy. The crowded market creates its own risk. Peers are pressure-testing whether a capability is genuinely differentiated or merely a wrapper, whether security is embedded or bolted on. Additional considerations pertain to how it fits the operating model and whether pricing is predictable. Buying AI is not a strategy. An investment should measurably improve the ability to see, correlate, decide and act. If it adds another silo or console, it may increase complexity faster than it reduces risk.

2.        Architecture must support change. A case study on a rapid SIEM replacement sparked discussion. The lesson was not that every migration should follow the same timeline but that platforms must allow change, playbook continuity and better enrichment without taking years to deliver value. Familiarity to market leaders is essential however, newer or resounding approach such as cribl.io and vega.io of a fresh perspective. 

3.        Security does not own every domain but it must connect them. Cybersecurity, Technology, Legal, Privacy, Communications, Compliance, Procurement and Risk need a connected operating model since modern technology no longer respects organizational boundaries. That is the shared risk ownership the required and emphasis I mentioned playing out in practice.

 

The executive takeaway is trust at machine speed

InfoSec World 2026 traced a clear focus for security leaders:

• Alerts to context
• Identity to intent
• Policies to provable control
• Incident response to decision integrity
• Cybersecurity to digital trust

 

The CISO role continues to evolve and expectations are rising. We must be technically credible, commercially aware, legally informed and capable of influencing decisions at the highest levels of the organization. But this evolution cannot rest on the CISO alone. Organizations must align accountability with authority. Boards must demand transparency rather than reassurance, and we must deliberately develop the next generation of security leaders.

The brakes on a race car are not there to make it go slower. They are there so it can take the curves at speed. Security's job is not to slow the business down but instead to create the trust and control that let the business move faster with confidence. Ultimately, the measure of a CISO is not how many tools we deploy or how many risks we identify. It is how effectively we help the organization make informed decisions, manage uncertainty, protect what matters and pursue its objectives with confidence.

 

This perspective draws on his InfoSec World tracks and my own CISO session.

Thank you to the event partnership and building strong relationship: CyberRiskAlliance.com, Snyk.com, myriad360.com, adaptivesecurity.com, onspring.com, gritsolutions.com

From the CISO Chair: InfoSec World 2026

The definition of cybersecurity is getting bigger while the time available to respond is getting smaller. A CISO viewpoint and what InfoSec World 2026 made clear about the road ahead.

 

Joining my fellow CISOs on stage at InfoSec World, the conversation had already moved past controls. Nobody asked how many tools we run or how many vulnerabilities we closed. The questions were about liability, accountability, board confidence and the kind of leaders we are shaping. That shift framed everything else I heard that week. Across sessions on ransomware, AI agents, deepfakes, regulation and post-quantum readiness, the same executive question kept surfacing: can organizations preserve trust and control while everything around it moves faster?

 

My answer and the theme of this piece, is that it can but only if security leaders do two things at once. We must promote the business and its brand and we must protect the enterprise. Those are not competing mandates but the job in one.

 

The central message was simple: the CISO conversation has shifted from controls to risk. Credibility with executive leadership now rests on two things together, evidence of effectiveness and confidence of resilience. Below are the positions I shared on stage and expanded to illustrate that accountability without authority is exposure. CISOs face growing personal liability for governance, disclosure and reporting, including decisions made both before and after a breach. The lessons are already public. Uber incident taught us not to conceal. SolarWinds taught us that internal control and external statements must match. DORA and government mandates are tightening disclosure rules further.

 

The answer is not to avoid accountability. It is to establish clear decision rights, defensible governance and an environment where material risks surface and get addressed. That requires alignment across people (who does what), process (proof and audit) and technology (visibility, access and recourse).

 

CISOs need the access, resources, governance and escalation paths required to meet their responsibilities. We cannot eliminate risk alone however, we can minimize avoidable surprises through transparency, disciplined escalation and defensible decision-making.

 

Boards need risk intelligence, not a technical inventory nor more technology experts. They need advisors who translate technical exposure into business impact, options, recommendations and clear ownership. The question is always why it matters.

A board presentation succeeds when it improves the quality of a decision, not when it shows how much the security team knows. And boards should demand transparency over reassurance.

 

Security is a leadership responsibility across the enterprise, not an obligation delegated entirely to the CISO. Risk ownership must be shared. A gap between business strategy and the execution team will show up in security. Peers must be partners, working vertically and horizontally against the same goals.

The most influential CISOs follow a consistent discipline:

• Start with the business objective
• Frame risk as business consequences
• Present options, not objections
• Build relationships before you need a decision
• Follow through on outcomes

The best CISOs do not just explain what is wrong. They clarify what matters, what the options are, what they recommend and what happens next. We must be the Department of KNOW, not the Department of NO. Showing risk reduction while enabling business speed is table stakes.

 

The CISO role is about governance, not technical competency alone. Technical expertise earns credibility. Executive influence earns budget, authority drives organizational change, and together they determine whether a security strategy succeeds.

A model referenced by others before me is to develop business leaders who understand security, not just security experts who learn to present. That means building financial acumen, legal and regulatory awareness, executive communication and adaptability alongside technical depth. Through progressive exposure to business decisions, risk ownership and board-level communication, is how we each continue to grow and accelerate. While certifications demonstrate knowledge, leadership requires judgment, credibility and the ability to decide under uncertainty.

 

I emphasized that learning through watching other leaders in the boardroom and the aptitude to learn and adapt is success. A few practical lessons from my own path:

• Reporting structure is a learning opportunity – Independence and objectivity are essential but proximity to other executives accelerates growth.
• Mentorship runs both ways – Sitting in on committee and board meetings helps but sound coaches and supervisors are what set people apart.
• The CISO is a talent builder – Retaining and growing scarce cyber talent matters more than any tool you buy.
• The CISO is a negotiator – We constantly broker trade-offs between speed and safety with business units, vendors and the budget.
• Do not wait – Develop the next generation deliberately before you need them.

 

Finally, the fundamentals still matter. Foundational standards remain the building blocks that must be done comprehensively and effectively before we can soundly address new threats and trends. That point also echoed through nearly every session I attended.

 

 

AI, Trust, and Taking the Curves at Speed

AI will not replace people but the people who use AI well will shape our future.

AI rapidly becoming one of the most powerful tools many of us will use in our careers. It is already changing how we create, analyze, communicate and make decisions. The speed of change is extraordinary but what matters most is that we still get to decide how we use it.

 

As a security leader, people sometimes expect us to be the person standing at the finish line waving a caution flag. Not the case but instead to make innovation safe enough to move faster.

I often compare cybersecurity to the brakes on a race car. Brakes are not designed to slow the car down. They are what allow a us to take the curves at speed with confidence.

The same is true for cybersecurity, governance, legal oversight, internal controls and risk management. When designed well, they are not obstacles to progress. They are the very mechanisms that enable organizations to move boldly while maintaining trust.

And trust matters.

 

Our customer, business partners, employees and communities must trust that we are using AI responsibly, protecting information appropriately, and making thoughtful decisions about the technology we adopt. That is why cybersecurity can no longer be viewed as solely the responsibility of security or technology teams. Most cyber risk enters through everyday business decisions: selecting a vendor, implementing a new application, sharing information, adopting AI capabilities, changing a process, or responding to an email.

 

Cybersecurity is fundamentally a business issue. That was a central theme of our recent discussion bringing together leaders from Security, Legal, Internal Audit and Communications. Each function sees risk through a different lens but all arrive at the same conclusion: managing risk requires shared ownership, accountability and collaboration.

 

Technology moves quickly. Legal obligations evolve. Threats adapt.

Trust can be gained over years and lost in moments. The organizations that succeed will not be those that avoid innovation. They will be the ones that embrace innovation responsibly while maintaining the confidence of their customers, employees and partners.

 

At AAA, our mission is grounded in saving lives, creating member value and delivering exceptional experiences. Trust is what makes each of those objectives possible. Cybersecurity exists not simply to prevent bad outcomes but to enable the business to fulfill that mission with confidence. As AI continues to reshape our industry and our workplaces, I believe three habits matter more than ever:

Protect what's ours.
Verify before you commit.
Ask when you're unsure.

The future belongs to organizations that can innovate quickly. The winners will be those that can do so while preserving trust. That's not just good cybersecurity but good business.

 

#ArtificialIntelligence #CyberSecurity #Leadership #Trust #Innovation #RiskManagement #CISO #AI #CyberResilience #DigitalTransformation

Global Security Outlook - WEF report

The World Economic Forum (WEF) Global Cybersecurity Outlook 2026 is this year's publication by the World Economic Forum and Accenture. It examines technology through the lens of business, economic, social, and geopolitical perspectives, with a focus on cybersecurity resilience. It reinforces the view that organizational, national, and global success are directly interconnected with cybersecurity. Building resilience in interconnected ecosystems, in conjunction with AI, is both the leading strategy and the execution priority going forward.

AI is here, and it's moving far more quickly than its mainstream interest of just a couple of years ago. It's an accelerator for both the good and the not-so-good. This is the modern competitive advantage era, and organizational access to AI has nearly doubled in just one year.

The report identifies three dominant themes for 2026:

1.        AI is supercharging the cyber arms race

2.        Geopolitics is now a defining cybersecurity factor

3.        Cyber-enabled fraud has become a board-level risk, exceeding ransomware in CEO concern rankings

Cybersecurity is Prime Time

Given the scale and scope AI touches, it has become broader than an IT dilemma — it's now a matter of business resilience, economic stability, and national security. The attack surface is widening, threats are becoming more potent, and the impact is far-reaching.

Insights from the report's survey found:

·      87% identified AI vulnerabilities as the fastest-growing cyber risk

·      A 37% to 64% increase in one year for organizations assessing AI security before deployment

·      77% of organizations now use AI for a cybersecurity function

Previously, AI concerns focused on AI-generated phishing, malware generation and adversarial attacks. Now, AI is viewed as an attack vector, a defensive capability, a governance challenge and a force multiplier for both criminals and defenders alike.

This raises concerns in two primary areas:

·      Data leakage — sensitive information exposure, prompt exploitation, uncontrolled model interactions

·      Agentic AI risks — excessive privileges, autonomous decision-making, prompt injection, accountability gaps, identity proliferation

Geopolitical Domain is the New Frontier

Geopolitics has entered the risk domain due to rising volatility, now outweighing concerns related to disinformation, technology convergence, and natural disasters. As a result, intelligence-driven collaboration, deeper engagement with government agencies, and shared situational awareness are top of mind.

Cybersecurity strategies now factor the following components into organizational risk management plans:

·      Nation-state threats

·      Cyber warfare

·      Sanctions

·      Trade restrictions

·      Digital sovereignty

·      Disinformation campaigns

The emphasis has shifted from viruses and malware to managing:

·      Geopolitical exposure

·      Supplier country risk

·      Sovereign cloud considerations

·      Foreign technology dependencies

·      Critical infrastructure targeting

Cyber Fraud Overtakes Ransomware

Even the most discussed topic — spanning awareness, testing, and incident response efforts has shifted to cyber fraud. These attacks extend beyond the office into personal life, with 73% of respondents reporting they were personally affected by cyber-enabled fraud in 2025. Board-level findings show that CISOs remain most concerned about ransomware, supply chain disruption, and software vulnerability exploitation, while CEOs are more concerned with cyber-enabled fraud/phishing, AI vulnerabilities, and software vulnerability exploitation. Studies also show CISOs focus on technical disruption, ransomware, and operational continuity, while CEOs focus on financial loss, brand damage, fraud, and shareholder impact. As a result, cyber programs that frame risk in technical language will increasingly struggle to resonate with executive leadership.

The Supply Chain Crack Widens

Extending security controls, protections, and assurances beyond company walls builds greater resilience. Effective practices include involving procurement in the process, assessing supplier security maturity, developing joint cyber resilience strategies and recovery exercises, performing ecosystem mapping, and pursuing cyber threat collaboration.

Top concerns fall into three categories:

1.        Inheritance — inability to assure third-party integrity

2.        Visibility — insufficient insight into upstream dependencies

3.        Concentration — dependence on key providers

Given this, the report points to supply chain maturity as low industry-wide.

Objective of the Game is Resilience

It's no longer a question of whether an organization can stop a breach from happening, but how quickly and effectively it can recover. The WEF highlights its Cyber Resilience Compass, with key dimensions including: Leadership, Governance, People & Culture, Business Processes, Technical Systems, Crisis Management and Ecosystem Engagement.

Highly resilient organizations:

1.        Have board ownership

2.        Assess AI before deployment

3.        Include security in procurement

4.        Assess vendor maturity

5.        Conduct ecosystem exercises

6.        Possess sufficient cyber talent

7.        Report strong regulatory alignment

Economic Discipline Underappreciated

The report emphasizes that cyber resilience influences GDP, that supply chain attacks create macroeconomic impacts, and that cyber investment decisions should be treated like business investments. The establishment of the Centre for Cyber Economics (CCE) reflects a growing focus on quantifying cybersecurity as a measurable business value contributor rather than merely a cost center. As a result, cyber resilience is directly tied to the bottom line — business continuity, revenue protection, operational availability, and stakeholder trust.

Skills Shortage is Real

North America, Europe and Central Asia view roughly two-thirds of their cybersecurity workforce as capable, while global readiness sits between 30% and 50%. A direct correlation was identified: organizations lacking cybersecurity talent are dramatically less resilient. The most difficult positions to fill are threat intelligence analyst, DevSecOps engineer, and identity & access management specialist. This reinforces the need for workforce development, automation, managed security services, and AI-assisted operations.

Risk Through 2030

Future-focused risk areas include:

·      AI Agents — autonomous attack execution and autonomous business operations

·      Quantum Computing — acceleration of post-quantum cryptography adoption

·      Autonomous Systems/Robotics — cyber-physical consequences become more immediate

·      Digital Currencies — financial infrastructure becomes increasingly dependent on secure digital assets

·      Space Infrastructure — satellite disruption impacts critical services

·      Undersea Cables — concentration risks around global communications

·      Climate-Driven Cyber Events — natural disasters increasingly intersect with digital systems

Resilience is interconnected across design, architecture, and operations — it is itself an ecosystem. Over the next five years, the winners will be organizations that can simultaneously:

·      Govern AI safely

·      Measure resilience, not just protection

·      Manage third-party ecosystem risk

·      Align cybersecurity to business outcomes

·      Incorporate geopolitical intelligence

·      Prepare for post-quantum and cyber-physical disruption

·      Demonstrate cyber-economic value to boards and executives

Conclusion

The 2026 outlook makes one thing clear: cybersecurity is no longer just a technology conversation but a business, economic and geopolitical one. AI is reshaping the threat landscape as fast as it's reshaping the defense, fraud has overtaken ransomware as the board's top concern, and resilience, not prevention alone, is becoming the measure that matters. Organizations that connect cyber strategy to business outcomes, invest in their people, and treat resilience as a shared responsibility across the ecosystem will be the ones best positioned for what comes next.