Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / Should CTO and CISO Roles Converge in the Age of AI? | Interview with Ben Wilcox

Transcript

Should CTO and CISO Roles Converge in the Age of AI? | Interview with Ben Wilcox · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple Podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, CISOs and other cybersecurity professionals. Hello, I'm Dejan Kosutic, the CEO of Advisera and the host of Secure and Simple Podcast. Today my guest is Ben Wilcox and he's the CISO and CTO at ProArc. ProArc helps bring AI ideas to life through secure, scalable solutions built on Microsoft technology.
• 0:33
  Ben is focused on helping organizations adopt AI by addressing the data, governance, identity, security, operational issues. And so in today's podcast, you'll learn whether a convergence between the CTO and the CISO role is a good thing or not. So welcome to the show, Ben.
• 0:51
  Ben Wilcox: Thank you so much for having me on today, Dejan. I'm excited to have this conversation.
• 0:55
  Dejan Kosutic: Great to have you here. So tell me, how did actually, in your opinion, how does AI actually change these roles and responsibilities in companies?
• 1:06
  Ben Wilcox: So I think in the past, the CTO and the CISO used to be able to operate really in separate lanes. And the CTO kind of drove the transformation and the CTO or the CISO side managed the risk. But today, right, we have AI, we have cloud, we have data identity, automation, and those things are really kind of collapsing those lanes together. And so today, every technology decision is also a risk decision and every security decision affects business execution, right? When you get to like the board level types of things, start, you know, are they asking you to separate the technology and the security risks or those different things?
• 1:46
  I'm of the opinion that it's not too different today.
• 1:49
  Dejan Kosutic: Okay. But isn't it the case that even before AI, you always had the same situation, right? Every technology decision was also a risk decision. So, I mean, what has really changed with the introduction of AI?
• 2:03
  Ben Wilcox: Well, I think AI, right? You could really treat security as something more downstream. And with today, with AI, it's really broken from that scenario. AI touches data, it touches that identity, it touches the permissions, touches the apps, it touches productivity tools, vendor platforms. More importantly, workflows and decision making are now part of AI.
• 2:29
  And so that means that the CTO can't deploy AI without security and the CISO can't govern AI without understanding the architecture of things. So I think we're at a little bit of a different scenario now that AI is really front and center because it's more business stuff in there. And previously, it would be okay to go do a review later on, right? Well, if the development happened and now we were doing a review and some mitigation.
• 2:57
  Dejan Kosutic: I agree with you. I mean, the security needs to be, let's say, involved from the very start of development of any system and this is how it should be, right? And I would argue that companies that treated security normally already had that approach even before AI took off, right? So I understand that from what you're saying is what companies are starting to realize, is a necessity where before they didn't see this as clearly?
• 3:27
  Ben Wilcox: I would say absolutely, especially outside of regulated industries. If we think about like a future state, right, I love to think about what's the optimal environment for businesses to operate AI, right? And that is a pattern where a normal user, right? And you know, this is really where I think the advantages of AI will be seen is right when we can democratize it and use it in a safe manner that allows everyone to do things faster, safely, and also get the business outcomes that they want. Right?
• 4:03
  And so that means that there has to be a really concise tie in between the CISO and CTO role. I think AI is like, yeah, you can be subject matter deep in tech, but now you have to be from a CISO perspective, broad across different things, right? The more business context, more around the architecture and understanding how, you know, deeper into the DevOps side of things. So when developers are developing these codes, right, that they're doing it the right way the first time. We have so many unknown future risks from a security perspective that, you know, being too open or doing it post review is just going to catch us in too much trouble.
• 4:51
  We really have to be more proactive on that front.
• 4:53
  Dejan Kosutic: Okay, but does this mean actually that companies should look towards merging these two roles or should they actually look towards that these two roles exist separately but cooperate so to say more closely?
• 5:10
  Ben Wilcox: Well, it probably depends on your industry what's acceptable right in some regulatory areas yeah you do have to have separate. These are going to be mandatory separate roles, right? The CISO has to be a separate person and that's what their responsibility has to be. Now in smaller organizations, I think we're going to see more combined future states with more of that T shaped expertise. It could be, hey, I'm really great at the CTO role and I'm midway deep in security or deep in security and mild across both architecture and business side of things.
• 5:54
  So I think you can get both of those things. It's not going mean that there's the end of the CTO or the CISO role, there's but definitely broader knowledge is required across both. In some cases, yeah, it could be collapsed into a single entity.
• 6:10
  Dejan Kosutic: Okay. From your experience, because you're acting in both roles, right? So can you give me an example of one decision that was easier because you are actually acting as both or one decision that was actually harder?
• 6:23
  Ben Wilcox: Oh, I run into hard ones all the time. But how I balance that is by having a really good team around me that is also deep in one space, right? So sometimes I get into the conundrum speed, security, right? We have to make a decision around what we're doing from a product or feature release to something where, hey, is that going to impact our security and is that an acceptable risk? And so I'll give an example here.
• 6:58
  We wrote an agentic product last year. We started writing it. It's to help manage Microsoft licensing and do it in much more compelling ways with deeper insights. We tried all the products out there, none of them we thought were that great. And we're like, all right, so we are a product company, we write products for people around their business and let's write our own on this.
• 7:22
  Well, about two months into the agentic development process, we get into our first security review, right? And our first security review, the team does their static code analysis, dynamic code analysis and comes back and says here are all the things that should happen. Well, the security team says, or I'm sorry, the development team says, all right, thanks for the feedback, but here's our new code base and none of the stuff that you actually just did is relevant anymore because the agentic coding side of it changed the code so much that like what we just provided was really outdated. So we went back and we rethought about how we're going to handle this type of risk because now we're saying, Hey, we got things to go fix. The team is saying, Hey, we got to do things faster, right?
• 8:14
  Because you're giving me these vulnerabilities that I need to go fix, but is that actually even valid anymore because our agentic defecation of code is so much quicker. So we changed our process and what we started doing was doing much more faster agentic security reviews. We're looking at from a architectural perspective, making sure that we are developing within the ground rules that the security team has put in place saying, hey, you're going to be doing this and this is the type of architecture that's going to be working. The security team worked with the development team to make sure that we were doing that correctly. And then lastly, as we started finding risks, right, how much speed versus areas are?
• 9:01
  And you know what, we ended up pausing the deployment for a little bit to make sure that we got the security right. Because our processes have changed so rapidly and we had new tools, new context that we just didn't feel comfortable putting something out there. So in that instance, right, security kind of won the gate, but it was also, we were developing way faster than we previously ever had. And we probably got about two years worth of work done in about, you know, five months. So I think we were able to kind of find that balance there, but it did change stuff.
• 9:36
  Dejan Kosutic: Yeah, that's actually a great example of speeding up things to the, let's say, AI speed, if I can use this word. Okay, but did you find yourself, let's say, at some point where your life or your job was much harder because you were in both of these positions?
• 9:57
  Ben Wilcox: Oh, certainly. I mean, sometimes I have to make a decision around what's best in either scenario. And in that instance, I had to rely upon my hat of the CISO a little bit more, just because the risks were unknown. We had a whole bunch of things happening in the background and we're getting aside from the executive team, right, my coworkers are all wanting to get this out the door as soon as possible, get in front of our customers, but we just weren't ready. So I did have to make a decision there of go or no go and is the risk too much?
• 10:38
  We just felt like it wasn't quite ready where we wanted it to be.
• 10:42
  Dejan Kosutic: How do you then make a decision? I mean, if you have to kind of balance between speed and risk, right? So what's basically the criteria that you are using to make a decision?
• 10:54
  Ben Wilcox: It all comes down to the data, right? What's the data? What's impact to the business if something does happen here? Is it more than a single company? Is it multiple companies?
• 11:07
  How sensitive is that information? Right? Like that's really what it came down to. And we always want to make sure that as an organization ourselves, because everything we do has security as part of Reputation is equally important on that, right? And if we're releasing a product to our customers, it has to be right the first time, right?
• 11:27
  We can't have an issue there and we go through three different pen tests and everything looks great, the reality is that there's still exploits in code and can we fix those pretty quickly? And it turns out with many of the new AI for security code stuff that's out there. We can fix them quickly and we can identify them pretty quickly. Just had to change that process.
• 11:53
  Dejan Kosutic: Okay, so are you saying that in this, let's say, balancing act, the security is more important than the speed of delivery?
• 12:01
  Ben Wilcox: No, I think it's just you have to make a context decision on every single evaluation that you do, right? What's context of this? Is it associated with data that's regulated? Is it associated with sensitive identities? Is it this, you know, can you contain the blast radius, right?
• 12:20
  What is the blast radius if something happens here? If it's these systems and we can easily identify it, great. If it's something like AI, then you really have to start thinking a little more broadly and think of basically use your imagination to think about what is the art of the possible here, right? Because now we're talking about AI agents and that leads to workflows, leads to access to other systems, it leads to identity, it leads to data that could be flowing in and out of your environment with very little security controls on it. So those types of decisions have to be thought of differently.
• 13:00
  So like my decision making process is let's talk about what the business problem is, let's talk about what the technology is, what are the compensating controls that we have, where are there gaps, and what are the possible risks. And then from that I can basically have a matrix to say, hey this is a risk that I need more information on. This is a risk I need more information from the tech team or the development team, one that I might need more from a security team perspective and then I can identify how to balance that productivity versus security side of things.
• 13:36
  Dejan Kosutic: Okay. So from what you're saying, it seems that if you merge actually these two roles, I mean, the CTO and the CISO, one of the benefits is obviously speed, right? Probably the other benefit is better security because it's kind of integrated earlier on in the project or the product. Are there any other benefits of actually merging these two roles?
• 14:00
  Ben Wilcox: Well, I certainly think from a broad perspective, you're able to identify and see things much more comprehensively across the board, right? The more context that you're able to have, the better it always is in decision making. I think it also leads to better potential business outcomes because you're able to convey that and get that point back to the board, right? Ultimately, the funding of all these things, right? And when it comes to technology and risk usually sits at the business execution level, right?
• 14:31
  And so they're looking at this and saying, you know, where is this risk coming from, right? Is it coming from IT, data, AI, cloud, or vendors? And frankly, the board doesn't care. They care whether it affects your revenue, your resiliency, your compliance, your reputation, your customer trust. And so by having an accountable single source, right, you're able to move things faster, you're able to have more accountability directly with a team.
• 15:02
  And frankly, I think you're being able to maybe convey a broader, better, more comprehensive story back to the board that matches up with what they're looking for.
• 15:12
  Dejan Kosutic: Yep, yep, definitely makes sense. And can actually security, let's say, enhance or support innovation within the company?
• 15:23
  Ben Wilcox: Yeah, 100%. And that's where I think that there's a call to action for the security teams, is to broaden your horizons, right? Look at your your skilling areas, Be deep in security, but add in, you know, knowledge around how your development teams, you know, are developing and how to secure a code. Add in more knowledge around architecture. So wanting to ask and understanding how more about the business operates day to day and how because if we can understand that as security practitioners, we're going to be able to understand what the next part is that like that agentic workflow that's going to be happening to everyone, right?
• 16:10
  These processes are being created, reinvented, and they're there to support the business on the AI side. People want to be able to secure that, you're going to have to understand why, right? And then what's happening on the other side?
• 16:24
  Dejan Kosutic: Yeah, and the customer requirements and basically those that are declared there may sometimes not declared, right? What they anticipate should be as part of security, but they are not saying clearly. And if the security team can actually understand it, then they can really support or enhance this product development process.
• 16:44
  Ben Wilcox: Actually, there's I think a lot of broadness adding to these capabilities that can help with security's desire to maintain their compliance, right? Because if we look at going through a compliance audit, it's all about your evidence. Better evidence supports an easier audit, You're able to maintain and show that you're doing these things and so by having kind of one of these strong convergence points or at least where there's more knowledge that's similar across both of these roles, right, it can certainly provide better evidence because the teams are going to know what needs to be enabled. And I think if we look at this next level of whatever is coming with AI and trying to prove your compliance with AI usage, you're going to have to be able to see all these things, right? Your systems, your telemetry, your processes, all of this stuff and being able to understand how you're going to remediate the vulnerabilities at speed too because all of that's shifting very quickly.
• 17:52
  Dejan Kosutic: Okay, yeah, makes sense. Okay, and if a company is considering actually merging CISO and the CTO roles, which kind of, let's say, rules do they have to set or which kind of preconditions do they need to put in place actually to make these two roles work well let's say in one person?
• 18:15
  Ben Wilcox: Well certainly I do think that it's not a role I think it's emerging It's not a role that's easy to go source right now. You'll have to find someone that has a good amount of experience in either one of those things that can be deep enough, but also broad enough at the same side, right? If this is something that's of interest to you, right, the CISOs should start expanding their horizons and the CTO should expand their horizons into the security realm, right? Start participating more in the security aspects, the security reviews, start understanding why your organization has compliance obligations and what it takes to keep those compliant. And then other considerations I would say is, right, definitely know what your compliance obligations are, right?
• 19:06
  Do you have to have a dedicated CISO? Publicly traded companies here in The US have to have a named CISO role. I'm sure that there's other compliance obligations out there too, but can you do it? Is a question number one. Two, do you have someone internally that you feel would be deep enough to be able to and have the desire to be broad in their knowledge set and also be able to go deep in the areas that they need?
• 19:34
  And then third, I would say they do still need a supporting team on either side that are technically deep in that traditional I shape learning, right? So someone that's very deep in both the tech side and security side that can support them because they will be in the middle at some point and need some guidance on either side or find a great partner out there that can be that guidance as well.
• 20:02
  Dejan Kosutic: Okay, I agree with you. Does this mean that, let's say, if the company decides to merge these two roles, that it should also have some kind of, let's say, other function that will check upon this new role, let's say, internal audit function or, I don't know, enterprise risk or something like that?
• 20:21
  Ben Wilcox: Yeah, I think that those are great supporting ones that go along with it. I mean, having someone out there handle all the day to day risk activities. There's certainly more and more emerging. I do think that that is its own full time job, right? You can employ agents and to help bring knowledge in.
• 20:41
  At the same side, risk making decisions should not be left up to agents.
• 20:46
  Dejan Kosutic: Yeah, definitely. Okay, speaking of agents, and generally the cybersecurity aspects of AI, so what did you actually learn? You mentioned that you were working on a project within your company related to AI agents. So what kind of learning did you get from introducing AI agents into your company? I mean, specifically from AI governance or a security governance point of view.
• 21:15
  Ben Wilcox: Yeah, first it came into the visibility piece, which we quickly determined that, and this is starting last year, right, the tools didn't really exist that gave us the visibility that security really wanted. Right? If you're kind of security is always trailing, I always like to think about right, here's your innovation curve and then security is always a little lower, right? And you know, could be three months, six months behind. And so the visibility piece is always critical.
• 21:47
  And so we didn't have it at first. That's something that we've remediated.
• 21:53
  Dejan Kosutic: When you say visibility, what exactly do you mean?
• 21:55
  Ben Wilcox: Oh, just visibility into what exactly is happening, right? The telemetry pieces, every single query, every single ask, every single data flow and being able to understand like if you had an AI agent that had internet access, right? How do you control what it has access to? Do I want this thing broadly going out and having access to the entire internet? Or do I want to try to put a traditional security control in place that says, you know, you're allowed to go to this one website and that's it.
• 22:27
  Some of those controls didn't exist in the past and thankfully over this last year we've gotten more tech that enables traditional security controls in AI.
• 22:40
  Dejan Kosutic: Okay, makes sense. Okay, any other learning from the project of yours?
• 22:47
  Ben Wilcox: Certainly, I think once you look at the architecture, understanding what that potential impact is because let's take a scenario like information leakage, What sort of information could it leak? Is it able to talk to other agents out there and gain more knowledge than what it previously has even context to, right? So maybe my single agent here is this, right? I got another agent over here that can provide some other context but you know, there's no security boundaries between these two and this agent can talk to this agent. And now it has much more context and should it have that context?
• 23:31
  Is that information that we want to tie together? What if that accidentally gets exposed to the wrong user?
• 23:38
  So getting those types of thinking about what sort of data is tied in and also adjacent to your agents is really important.
• 23:51
  That ties back to identities as well, because identity really is how we do segmentation these days, right? The cloud native approach, right? Historically, was there, your network centric security and now it's identity based security. And that's where like that governed identity around that agent really becomes important because now that's actually what typically dictates to someone to have access to this AI agent.
• 24:23
  Dejan Kosutic: Okay, and how do companies actually then make these AI governance decisions like which data to use, who can access this data, can these be, let's say, processed, what kind of privileges do agents have, I don't know, all kinds of things. So in practice, what do you think is the best way to make all these governance decisions?
• 24:47
  Ben Wilcox: Governance is certainly very challenging because the stuff's being generated on the fly, but it also has access to historical data. You do need technical controls in place that can look at your data and determine is this sensitive information, is it not sensitive information. That's going to help with near long term evidence, but broadly stating that, right, use the technical policy tools, right, that help establish how your agents can use your governance policy, right. It's not just paper, right, it has to be a technical control and these you know for example it could be Azure policies. Azure policies are set on a tenant right and they describe how a Azure environment can operate.
• 25:38
  Now does it mean that it has every single thing in there? No, it's very broad right? It says this is what type of security needs to be implemented from the beginning. This is the type of things that we enable. This is type of cost management, etc.
• 25:52
  Broad governing standards. Now then you can start drilling in and also saying, hey, you know what, every single time that we deploy an agent, it's going to be using a managed identity service from agent three sixty five. That's another set of policies that can be enabled on there. And so by going through and identifying where your risks are, can map that back to the technical controls and then map that up broader to a technical policy that can be enabled on your tenant so that every single time you go forward you're not reinventing this game, right? But also I think your change board has to be very fluid and understanding that this stuff is changing really fast And the things that we do today, we maybe want to start simple at the bottom, but we want to start incrementally adding in more technical controls or those technical controls may not be fitting the business case and we need to change it.
• 26:51
  How are we doing that?
• 26:52
  Dejan Kosutic: Okay. And I mean, companies typically tend to make these kind of decisions on the fly, right? Without any... Sometimes without any deeper analysis. So again, from your experience, what kind of decisions should be made more formally with a strictly defined process on risk analysis, the decision, who can actually decide on what, and what kind of decisions can actually be really made on the fly that are less important?
• 27:20
  So from your experience, what does your experience tell you?
• 27:24
  Ben Wilcox: Broadly, right? How are you going to do these types of reviews? What sort of reviews do you want to do? Do you want to do it on every single type of agent that gets deployed? I can tell you that the amount of agents that get deployed is astronomically fast, especially once you turn it into citizen developers and allowing people to build their own.
• 27:45
  And so I would gain it in a couple of ways, right? Understand how someone can do it quickly, give them an easy path, right? If it doesn't fit into that path, then there's, you know, a different it could be architectural pattern, could be a different approach that they want to be taking, maybe different tool sets. But when it starts deviating outside, that's where you want to get into your probably your individual reviews. But make sure your organization knows what's expected, right?
• 28:14
  Hey, you're expecting an architectural document, you're expecting to understand what sort of security controls you're expecting and understand what type of data this agent has access to and who are the end users that are going be consuming this, right? Is there other, right? Is it external to your company, internal to your company? Is there sensitive information? All of that stuff needs to be understood and then a good risk decision can be made around how do I take this forward.
• 28:41
  So one's a quick easy path, one's a little bit more customized, I'd say.
• 28:46
  Dejan Kosutic: Okay, and then who makes these decisions? Mean, is this the CTO or the CISO or someone more from the business side?
• 28:55
  Ben Wilcox: Well, I think it's a collaborative effort honestly. All three people need to be in the room and have a voice, right? The business side needs to be able to explain what the business outcomes are. The CTO needs to be able to make sure that they are aligning with the right architecture to support that. And the CISO needs to help identify the risks and what sort of compensating controls are best to address that.
• 29:25
  You know, think we're at a point where from a security perspective, security can't just be a no person, right? People are going to find their way to do it. So we have to enable and we have to find the right ways to get them to be able to do what they want but keep the organization safe.
• 29:44
  Dejan Kosutic: Yeah, and do it from the risk perspective, right? So try to kind of minimize the risk, but not slowing down the innovation.
• 29:53
  Ben Wilcox: Correct. 100%. That's the era that we live in. We can't slow it down. That's for sure.
• 29:59
  Dejan Kosutic: Okay, great. So let's wrap up the discussion for today. So what are your, let's say, top recommendations for companies? Mean, what should they do and what should they not do when they try to, let's say, merge CISO and CTO role?
• 30:15
  Ben Wilcox: Well, don't try to just club it all together quickly. Just do a little bit of experimenting, right? Make sure you got the right team members in place that can support it. Make sure that you have the right training and enablement and the right personal characteristics, right? Someone has to be very interested in what's emerging at all times, especially in this role.
• 30:37
  It has to be what's the best, what do we have from security capabilities as well as what can we do from an agentic perspective. Those two things have to be understood in that space. Understand, you know, organization from a compliance perspective. Are you able to do this even, you know, from a legal perspective because it may not be something that's capable. Know, short term and long term paths.
• 31:03
  Maybe you might have a couple people that you feel are good in this role, right? Give them adjacent responsibilities, right? Challenge your security team, right? If you've a superstar security architect, right? Challenge them to be more outside of the traditional network security boundaries or cloud boundaries, like how are you going to secure AI?
• 31:24
  On the same side, if you got a really great developer and architect there, challenge them. Let's look at the security aspects. How can we expand your knowledge so that we're developing things more securely and doing it fast, right? And have those two people work together in these reviews and do it sooner, right? Don't wait till the project started and make the mistake of, you know, two months into the project having our first security review.
• 31:55
  We could have actually been, I think, faster had we collaborated, you know, earlier on, right? So everyone's kind of understanding and getting up to speed together versus two months later, the first one happens and now we spend the next three months trying to get things back.
• 32:12
  Dejan Kosutic: Okay, great. Thanks for these insights, It's been a pleasure talking to you.
• 32:16
  Ben Wilcox: I appreciate it, Dejan. Thanks for having me on.
• 32:19
  Dejan Kosutic: Thanks again, Ben. And thanks everyone for listening or watching this podcast and see you again in two weeks time in our new episode of Secure and Simple Podcast. Thanks for making it this far in today's episode of Secure and Simple Podcast. Here's some useful info for consultants and other professionals who do cybersecurity governance and compliance for a living. On Advisera website, you can check out various tools that can help your business.
• 32:45
  For example, Conformio software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. The white label documentation toolkits for NIS2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients. Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients. And a learning management system called Company Training Academy with numerous videos for NIS2, Dora, ISO 27,001 and other frameworks enable you to organize training and awareness programs for your clients workforce. Check out the links in the description below for more information.
• 33:33
  If you like this podcast, please give it a thumbs up, it helps us with better ranking and I would also appreciate if you share it with your colleagues. That's it for today, stay safe!