The definition of cybersecurity is getting bigger while the time available to respond is getting smaller. A CISO viewpoint and what InfoSec World 2026 made clear about the road ahead.
Joining my fellow CISOs on stage at InfoSec World, the conversation had already moved past controls. Nobody asked how many tools we run or how many vulnerabilities we closed. The questions were about liability, accountability, board confidence and the kind of leaders we are shaping. That shift framed everything else I heard that week. Across sessions on ransomware, AI agents, deepfakes, regulation and post-quantum readiness, the same executive question kept surfacing: can organizations preserve trust and control while everything around it moves faster?
My answer and the theme of this piece, is that it can but only if security leaders do two things at once. We must promote the business and its brand and we must protect the enterprise. Those are not competing mandates but the job in one.
The central message was simple: the CISO conversation has shifted from controls to risk. Credibility with executive leadership now rests on two things together, evidence of effectiveness and confidence of resilience. Below are the positions I shared on stage and expanded to illustrate that accountability without authority is exposure. CISOs face growing personal liability for governance, disclosure and reporting, including decisions made both before and after a breach. The lessons are already public. Uber incident taught us not to conceal. SolarWinds taught us that internal control and external statements must match. DORA and government mandates are tightening disclosure rules further.
The answer is not to avoid accountability. It is to establish clear decision rights, defensible governance and an environment where material risks surface and get addressed. That requires alignment across people (who does what), process (proof and audit) and technology (visibility, access and recourse).
CISOs need the access, resources, governance and escalation paths required to meet their responsibilities. We cannot eliminate risk alone however, we can minimize avoidable surprises through transparency, disciplined escalation and defensible decision-making.
Boards need risk intelligence, not a technical inventory nor more technology experts. They need advisors who translate technical exposure into business impact, options, recommendations and clear ownership. The question is always why it matters.
A board presentation succeeds when it improves the quality of a decision, not when it shows how much the security team knows. And boards should demand transparency over reassurance.
Security is a leadership responsibility across the enterprise, not an obligation delegated entirely to the CISO. Risk ownership must be shared. A gap between business strategy and the execution team will show up in security. Peers must be partners, working vertically and horizontally against the same goals.
The most influential CISOs follow a consistent discipline:
- Start with the business objective
- Frame risk as business consequences
- Present options, not objections
- Build relationships before you need a decision
- Follow through on outcomes
The best CISOs do not just explain what is wrong. They clarify what matters, what the options are, what they recommend and what happens next. We must be the Department of KNOW, not the Department of NO. Showing risk reduction while enabling business speed is table stakes.
The CISO role is about governance, not technical competency alone. Technical expertise earns credibility. Executive influence earns budget, authority drives organizational change, and together they determine whether a security strategy succeeds.
A model referenced by others before me is to develop business leaders who understand security, not just security experts who learn to present. That means building financial acumen, legal and regulatory awareness, executive communication and adaptability alongside technical depth. Through progressive exposure to business decisions, risk ownership and board-level communication, is how we each continue to grow and accelerate. While certifications demonstrate knowledge, leadership requires judgment, credibility and the ability to decide under uncertainty.
I emphasized that learning through watching other leaders in the boardroom and the aptitude to learn and adapt is success. A few practical lessons from my own path:
- Reporting structure is a learning opportunity – Independence and objectivity are essential but proximity to other executives accelerates growth.
- Mentorship runs both ways – Sitting in on committee and board meetings helps but sound coaches and supervisors are what set people apart.
- The CISO is a talent builder – Retaining and growing scarce cyber talent matters more than any tool you buy.
- The CISO is a negotiator – We constantly broker trade-offs between speed and safety with business units, vendors and the budget.
- Do not wait – Develop the next generation deliberately before you need them.
Finally, the fundamentals still matter. Foundational standards remain the building blocks that must be done comprehensively and effectively before we can soundly address new threats and trends. That point also echoed through nearly every session I attended.
No comments:
Post a Comment