CISO's perspective from the frontlines
My blog posts on Cybersecurity, Life as a CISO, Positivity, Leadership, Strategy, Mentorship, Security ventures and advisory. All views and opinions are my own and do not represent my employer or any other organization.
If you’ve been in cybersecurity long enough you remember the mantra of “defense in depth”. “Defense in depth” meant bigger firewalls, more appliances, and a thicker stack of tools protecting the data center. These days, in the age of AI, cybersecurity defense feels less like building a fortress and more like trying to drive a battle tank through a sky full of cheap...
How Humans Learn, How Machines Don’t, and What That Means for the Next Generation of Cybersecurity Practitioners In Part 1 of this series, we traced how AI in cybersecurity went from an academic curiosity to a marketing buzzword, and finally to something genuinely new with the arrival of Large Language Models (LLMs) and the need for developing AI Literacy. But there’s a bigger...
What is AI Literacy and why every security practitioner needs to have it? Is it the ultimate new skill in cybersecurity? If you just dropped into the security industry today and are listening to the chatter, you’d be forgiven for thinking that AI in cybersecurity was invented in the last couple of years. Every vendor, analyst, and conference keynote talks about it like it’s a brand-new thing. But...
Have you ever wondered why many security strategies look more like a BINGO card than actual strategy? Organizations are still rarely proactive about cyber security. Usually something triggers organizations’ decision to invest in cyber security, whether they suffered a breach, they are required to do so by some regulations, their clients demanding it, or they decide to IPO, just to name a...
Once upon a time in a company far far away Several years ago, in a different organization, my team and I successfully implemented a Vulnerability Management program. It was a massive undertaking, taking over a year to complete and sizable budget. Our goal was to continuously scan over 100,000 devices and automate the reporting of findings to relevant teams. The project went beyond reporting by...
Trust is the bedrock of any successful and healthy relationships. In organizations, it fosters collaboration, empowers team members, strengthens decision-making, and inspires confidence in leadership. Building trust takes time and consistent effort, but the rewards are a culture of transparency, accountability, and a workforce that is both motivated and secure. Therefore it is critical for CISOs...
CISOs are bombarded with pitches from security product vendors, that all sound the same “We give the CISO visibility“. They tout their dashboards, each claiming to offer the most comprehensive, in-depth view of the security landscape, send alerts to the SIEM or give you various reports. But here’s the truth: visibility without actionability is just noise. The problem with...
“What does a Cyber Security Practice Model should look like?”, I’ve been asked that question many times over the years, and with the lack of standard in this field, I had and also heard different answers. Ultimately, I was looking for a simple model where the building blocks of a security practice can be understood even by those who are not experts in the filed. The model I came...
Recently I finished reading the book Range: Why Generalists Triumph in a Specialized World by David Epstein, which I find not only interesting but very relevant to Cybersecurity. Our world is becoming increasingly specialized, and it’s easy to believe that the key to success is to focus on one thing and become an expert. This is especially true in Cybersecurity where over the years I had...
CISOs talk to each other, a lot!!! even on weekends, and when something is going on the word is getting our fast. We also rely on each other professionally and mentally, and some time even emotionally. A few weeks ago, in a conversation with other CISO friends. I expressed my frustration about a sales tactic a Business Development Representative (BDR) tried to use on me, and boy the flood gates...
CISO's perspective from the frontlines