Welcome to Nasdaq trade talks,
where we meet with the top thought leaders and
strategists and emerging technologies,
digital assets and regulatory
landscape and capital markets.
I'm your host, Jill Malandrino,
and joining me on the desk at the
Nasdaq market site to wrap
our in studio coverage for
Cyber Security Awareness Month,
which spotlighted the evolving
landscape of digital threats and
the strategic response to shaping financial services.
We have Eunice Nunez,
global cybersecurity executive,
Colonel Giorgio Xavier Kitara,
CIO and CISO of I Merit,
as well as Doctor Alexander Yampolsky,
co-founder and CEO of Securityscorecard.
We're here to discuss how the role of
the chief information Security officer,
known as CISO, has evolved from
a technical risk manager to a business enabler.
It's great to have all of you with us.
Welcome to Trade talks. Let's kick it off with you.
When we think about the role of the CISO,
it's no longer just to manage technical risk.
It really is to enable
the business to grow and be competitive.
Jill, thanks for having me
and the rest of the team here today.
I would say over the years,
the CISO or security, security,
senior leader organizations, the role has evolved
more about being a security enabler and a collaborator.
The CISO, as it evolves,
has to be a communicator and really
understand how the organizations make their money,
how their culture operates,
and what are the strengths or weaknesses that they have,
and be able to tell that story effectively
so that we can help prioritize the work we need to do.
Oftentimes, we're challenged by
not having enough resources,
by not having the right people in place.
But it's good to understand at
a high level where we're going as an organization,
where the market is going.
And I would say over the last year,
the two most popular letters in the alphabet are AI.
And I think that as a cybersecurity executive,
our role is to make sure that
we're leaning in understanding
our environment and be able to then
move forward with prioritization,
conviction and building
a strong culture of cybersecurity awareness.
And George. A lot of it comes down to is this
a delicate balance between
innovation and trust within the org?
It is. And we have to be able to enable innovation.
So at AI we do what's necessary for the client.
That's the difference between checking
a box and building trust.
So you have to move forward right.
So let the company
innovate same time put in place the controls.
But they got to move forward
with innovation making money.
And that's the challenge for
the CISO today and going forward.
Yeah. And I it
can't be overstated just how important this role is.
And to be able to communicate that because
one outage can cascade
not only through your enterprise but
across clients, partners, vendors.
The role of a CISO became so much more complex.
You have to be a translator between
the technical teams and the board of directors,
but also we're no
longer protecting just our own companies.
We'll interconnect it to each other.
Your data is in a cloud.
65% of data breaches today
happen due to negligence of third parties.
So the CISO needs to enable
innovation with AI while keeping the company secure.
Act as a translator between
the board and the technical team.
Make sure you don't do it on increased budgets,
because everybody's keeping their budgets in check.
And on top of it, worry not just about their own company,
but also about the supply chain ecosystem and
making sure that your
third and fourth parties are secure.
So it's a complicated job.
Yeah, it certainly is. And I would
also argue that it has to be
a cybersecurity culture within the org from the top down,
because, um, security by design,
I think is going to be
a competitive advantage moving forward.
Absolutely. And, you know,
when people ask me for advice,
when boards of directors ask me for advice,
how do you keep a company secure?
The one simple advice I give is make sure
your CISO gets to present at
your audit and risk committee,
because if a CIO sees
that the CSO is at the board meeting,
the CEO is going to provide the budget,
you're going to provide enablement.
It all starts with a culture.
Culture beats strategy for breakfast.
As Peter Drucker used to say,
culture eats strategy for breakfast.
So it starts at the top.
If the board and the CEO are talking about cyber,
and if they're technologically
literate, the change happens.
The board members, you know,
if in the middle of a board meeting,
you raise a hand and say, what's EBITDA?
People are going to give you a strange look.
You're supposed to know what EBITDA is.
But if you're a board member
in the middle of a board meeting,
you raise a hand and say, I'm not sure
what denial of service attack is.
It's still totally normal.
So it's a it's also the onus on the board
and the CEO to make sure that we
don't just speak the language of numbers,
but we become AI and
cybersecurity literate in our conversations.
And I think that's one of
the key things you mentioned, Jill,
earlier today, which is
around as the role continues to evolve.
It's not just about technology anymore.
Cybersecurity cuts across
multiple components of an organization.
It's reputational. it's financial,
it's HR, it's all risk.
And what I'm seeing as being one of
many directors right now that are
on public boards and private boards,
being from a CFO background,
what I'm finding out is that we need to not
only have a seat at the table,
but we need to be part of the planning,
the communication and the
go to market strategies as well.
Yeah. And, you know,
part of that is to George, you have to be able to
collaborate across those functions.
To your point, because I think companies
almost get in their ways because they operate in silos.
That's right. And I don't operate in silos.
So one of the things we do,
and one thing we do
at Merit is actually meet with everybody in
the executive leadership team
and make sure we have good relationships.
When a security incident happens,
it's not going to be just security.
It's going to be it legal, finance,
engineering, all working together to
figure out how to go do containment.
Right. We need to practice what we preach,
not just the executive leadership
level, but all the way down.
So I talked to my talk to my the people on my team,
talk to the folks across you
and make sure they know what's happening.
right? If you see concerns, talk to them about it.
But we have to work together on this.
So it's very, very important we reach out of our silos.
If somebody wants to work on
a new technology or new innovation, don't hold them back.
Figure out how do we protect that?
How do we protect their flank as they move forward?
Yeah. Well, I mean,
it always comes back to where people are,
the front line, and that's where
the vulnerabilities are going to exist,
which was my point before,
where it has to be a cyber first,
privacy first mentality as the culture of the company.
Absolutely. And so it starts
with people and training people
and making sure that people know
what to fall for and what not to fall for.
However, it's becoming more and more
complicated right now with
the proliferation of deepfakes.
Yes, somebody can take a video
of Unesco or myself or yourself,
and it looks just like us.
Sounds just like us.
Places a phone call and says, hey,
can you please initiate the wire transfer?
So we need to evolve our techniques.
We need to train people,
but we also need to train them in different ways,
just like we teach our children.
If you walk in on a dark street,
Maybe look around or don't walk
home from school alone if it's after hours.
We need to start embedding this education
into everyday lives at
school and also in companies as well.
I agree, and I think
that the role of awareness and training,
it's not just per discipline,
it should be holistic across the board.
I think one of the things that I
would like to see more is,
as you do awareness and training and
education is that you're looking at it
across the organisation rather than
a compliance assessment or awareness training.
A cyber awareness training.
And we have a leaning moment today where we're seeing,
as you mentioned, advanced attacks on integrity,
where I'm dubbing it
the Agentic security process enablement,
where we need to lean in to make sure that we
are enabling these processes that we do today,
whether they're manual or human.
We're leveraging AI to help us deal with deepfakes,
help us deal with the advanced attacks that
are coming through our organizations
today. Alex, I agree with you.
Yeah. I mean, you know, George,
you could see, um,
it's not too uncommon.
It's happening these days where somebody that's
a high level position at a company
making a statement. It's a deep fake.
It can move markets, it can create
geopolitical incidents and so forth.
So I think when you,
you know, incidents, response plans,
crisis management, it's not
a set it and forget it exercise.
It is something that continuously needs
to just like you're adapting to AI.
You have to adapt your response and proactive mitigation.
Not just in a. So we
definitely have a security incident response plan.
We definitely practice it.
But we also need to be looking at the frontier of
how our Scholars Program program works.
We look for fraud.
We proactively make sure that on screening,
trying to block out anything from from the nation states,
trying to conduct warfare,
making sure people are who they say they are
coming in to make sure our clients are protected.
So we take security very seriously, but more importantly,
making sure we understand
the changing nature of of what the technology looks like.
So I myself, I'm doing a doctorate in
cyber security data science as well as a genetic AI.
I'm trying to encourage my
own team members to look at the gold,
what I call the Golden Triangle.
Practical experience, certifications and
ongoing education with AI fluency
in the middle of all that, right?
We need to move forward like that.
I set the example they follow.
We talk together and figure out,
hey, what don't we know?
Yeah, well, part of the challenge is to
that AI has erased
this gap between the good actors and the bad actors,
and it really does come down to who is faster,
who's more successful, who's well funded.
And sometimes that can skew to the bad actor side,
because they don't necessarily have
all the layers of compliance and approvals,
just like a nation state wouldn't have.
That's exactly it. For example,
the tools like AI,
LLM for the hackers where you can just type,
can you give me an exploit against
Citrix devices and all of a sudden
you don't need to run sophisticated scripts,
it just gives you an exploit.
So the bar for being able to
be a sophisticated hacker just dropped.
Also, as companies adopt AI,
people are rushing to adopt AI.
It's a boardroom mandate.
But security is an afterthought.
There's a proliferation of a use of shadow AI,
just like we had shadow it
with a proliferation of shadow AI,
where an employee might be sitting in a bank,
upload financial ledger sensitive documents,
just just to get help,
maybe to ChatGPT or worse,
off to deep sea in China.
And all of a sudden your sensitive data is leaked.
That's right. It's not protected.
And I just think that we don't
design AI right now with security in mind.
Just like when internet appeared,
it wasn't designed with cybersecurity in mind.
We just rushed to adopt it.
I agree. Last time I reviewed the numbers on this,
I think it was July.
The big AI players spent something like
$300 billion advancing their AI capabilities.
And my question was automatically,
how much of that was invested in cybersecurity?
The number was minuscule.
Probably about 50 basis points.
So our lean in moment today truly is about making
sure that as we enable
the business with the Gentech, AI, etc.,
that we are bringing security in
from the inception at this inflection point,
at this lean in moment,
so that we don't wait until
the train has already left the station,
we need to catch up and make sure we're thinking
securely by design as we do this.
Otherwise we're going to be.
I feel that we are exactly where we were
1520 years ago with
a data loss prevention and email protection.
We're right back to where we started.
Now the avenue is no longer email.
The avenue is not the browser through the avenue.
Now are these AI companies.
But I mean, there there is no choice
but to think cyber first and develop and model that way.
Think about the rush again.
We were talking about this off camera,
but the dividing line November 2022,
when generative AI became part of everyone's vernacular.
Right? And there was such a rush,
whether internal or external,
to get product out there.
Perhaps we didn't think about the risk,
or maybe we didn't even know the unknowns.
Right? And those gaps and
vulnerabilities are starting to be exposed.
And hopefully organizations learn from that.
You have to you have to model out cyber first.
You have to model out cyber first.
But more importantly, you got to figure
out your employees like to your point,
how do we protect the AI?
How do we protect our data?
Right? What data is going to go into AI?
Acceptable use of AI?
Making sure to your point about shadow AI,
making sure our tools to detect that.
So there are tools out
there that attackers are currently using today,
like IP or proxy and such that we can quickly
detect and say that person's not
coming where they are, right?
So you can use tools to detect that at the same time.
Education, education, education doesn't change, right.
So you want to make sure you've got a good
education program for your organizations.
But this technology is going
to evolve and evolve and evolve right.
It's not once and done.
So you do that.
We got to make sure we understand what's happening.
Shadow AI is a real thing.
If you don't partner with
your divisions and with the people in your company,
they're going to go find their own solution,
bring it in and get their own shadow AI up and running.
And now you're suddenly
finding your data's in the cloud. Somebody else's.
But Alex also comes back to
even with all these new tools being introduced,
not every single person within
the organization needs to have these tools.
They haven't used it before or
it doesn't relate to their function.
Is it necessarily prudent to give
them access if it's something
that doesn't even make sense for their role?
Well, you have to. I think it's just like you spoke.
I think the old concepts become new again.
We had the least privilege principle
in cybersecurity for many years,
which basically means you get access to
the technology and the tools only on a per unit basis.
Um, so you. Absolutely right.
However, I do think as I look into the future,
every company is going to be an AI company,
just like we don't go to each other and say,
oh, I use ML, that's my competitive advantage.
Everybody uses ML in the company.
Similarly, I think ten years into the future,
or maybe even less, every company
is going to be an AI company.
So that's why so many people are rushing to adopt it.
And that's why a lot
of guardrails come as an afterthought.
I think that right now,
because we've seen also over the last few months,
a lot of acquisitions in the AI, AI protection space.
Obviously, we don't have all the tools that we
require today based on the capabilities.
So the human becomes the control.
So I have a contrarian,
a bit of a contrarian view here
is that you need to provide
the training for the tools that
you're going to help enable your people.
I don't think you just
allow access without proper training.
So I think you need to do both here,
because we are now leveraging
humans as our number one control
until the technology and the security tools
are in place to help us cover our bases.
They're not there yet today.
But as we do that, I feel that education, training,
access and the limited controls we
have in place today can help us get there faster. Jill.
Yeah, but again, it has to be communicated.
How do you quantify, right,
what your cyber risk is financially?
How do you express this is
the value that we are bringing to the org,
whether it's very abstract to
say if we spend this amount of money,
we won't lose XYZ.
Should we have a breach? As it relates to
reputation, it's very intangible.
So how do you put up in boards
in the C-suite wants to see this?
What are those metrics? How do you
quantify success as a CISO?
Dollar cost, cyber quantification of the risk,
assigning a dollar amount if this system goes down,
if we lose this data, what is the litigation cost?
What is the downtime?
You mentioned AWS here earlier, but my point is,
is that you have to talk to the board
in terms of numbers of this system is not available.
What does it cost look like. And you have to be able
to balance our budget with that.
Right? At the same time,
you brought up a good point about human human feedback
and reinforced learning impaired
does a lot of work to make sure we train the AI
with reinforcement learning from human feedback.
What that means is that we have people looking at the AI,
looking at the decisions that AI makes
to make sure it's correct, right.
Validating that AI model,
validating the data that's coming through,
validating the outputs of it.
It's one of the things we excel at.
Our scholars program does
quite a bit of work around that,
and you've got to be able to show that.
Otherwise what's going to happen is,
is you're going to put this model in place,
put data into it.
Next thing you know, you have a disaster.
You've got to make sure all those controls are in place.
There's actually a guardrail to make sure
that the AI and the model is working as it should be.
But to the board, you've got to be able to
show what the dollar cost
quantification is for if
an incident happens or if
data gets breached, what that looks like.
Right. So you got to be able to figure out data
versus I mean you've got a breach versus controls, right?
So it's a balancing act.
Yeah. Alex, same question with you as well.
And you know, I've discussed this in prior conversations.
But being able to quantify
that technical performance and what that
equates to for the value of the business,
how do you benchmark that okay.
So we spent x, y, z in cybersecurity
this year while we didn't have a breach.
And we know we you know we've
saved that arbitrary number.
How do you justify
those costs going forward if you didn't have a breach.
How do you make those business cases?
Yeah. So well, that's actually our business.
We're in the business of providing trusted,
objective KPIs for companies to measure and quantify
risk and were used by 70% of the fortune 100.
You have to have data based on evidence.
You have to publish your algorithm.
The algorithm needs to be transparent.
You need to expose accuracy rates.
What are the corner cases?
So like I'm a strong believer that you need KPIs.
Just like if you drive a car you need to have
a speedometer knowing how fast you drive.
But whenever you start having one KPI,
you can get blindsided.
You can start gaming the KPI.
So KPI is a data point,
and I think it's imperative
for a board member to report objective,
trusted KPIs of how you're doing and
how your peers are doing and showing,
just like George spoke.
The downside if an event happens,
here's how much money you can lose.
But having said that,
you also need to articulate a strategy.
Here's my strategy.
Here's where we're going. Here's what I know.
Here's what I don't know a single KPI very valuable,
but it's not going to always show the full picture.
It's all about the context.
And we talk about having
the appropriate skill sets for
AI and upskilling and reskilling and so forth.
What about for the cyber function?
Is the talent available to
execute on this I believe, what is there?
Half a million jobs need to be filled in cyber roles.
So so I think that as I mentioned earlier,
I'm going to keep talking about this.
It is our moment to lean in.
I know that a lot of cyber professionals,
they become like fanatics.
I love the Mets, so they become fans of us.
They become fans of tools, of solutions.
I think we have to fall in love with the problem
again and then leverage the latest techniques,
the latest tools that we have in place.
And today the Lean In is truly with
AI enable Agentic security.
Process enablement is what we need to lean into,
because it's not going to be enough to
leverage our same techniques and tools that we
had in the past with
the attackers and what they're using today.
We have to lean in. So that's
my thesis from now moving forward.
I would also say that it doesn't
necessarily have to be like
a hardware software role that you go into cyber,
you know, whether it's legal, whether it's policy,
um, risk management, anything.
It could be a reporter on cybersecurity
and raising awareness.
So it doesn't necessarily have to be like
a plug and play role either,
which I think opens up more opportunities.
It's a multi-dimensional role.
Cyber risk today and cybersecurity is
what operational risk management was 15 years ago.
It cuts across everything in the organization.
So the capabilities, I would say,
for managing a cyber career
and a function that's effective within organizations,
cuts across all components
of a modern organization. Yeah.
I was going to add to that.
So to me, this is not just my passion.
It's also what I enjoy doing,
but also it's my profession,
not just to me.
It's like being a doctor or a lawyer.
I think we need at least five years
of experience working in it.
The OSI model infrastructure,
Understanding networks and protocols.
How data flows across your network
in and out, North, south, east,
west and then understanding that part
because that's what we're really protecting, right.
That data.
And then we need at
the same time to start learning about cybersecurity.
I think a lot of people want to rush
into cybersecurity saying, hey,
I want to learn cybersecurity in
a couple a couple of weeks or a couple of months.
It's I love the ambition,
but I think they need to get with
the fundamentals down at the same time,
as a company, when you get the fundamentals down,
how are we going to protect that data?
Right. Patching vulnerability management.
Who's touching your data access controls.
Principle of least privilege.
These things need to be practiced
and preached to entire organizations.
They know why we're doing it, how we're doing it,
and making sure that we we can lead by example.
All right. Appreciate everyone's insight.
Thanks for joining us on trade talks.
And thanks for joining me for market site.
I'm Joe Malandrino, global markets reporter at Nasdaq.