Inside The Mind Of A CISO

AI is a disruptive technology in more ways than one. A survey of 209 CISOs and security leaders globally shows security professionals struggling to reach consensus about what AI means for their organisation and their own roles. 

Despite a range of divergent and sometimes contradictory views, the report Inside the Mind of a CISO leaves little doubt that AI is a powerful force for change. What’s less clear is whether change overall will be good or bad. And perhaps it’s too early to expect CISOs - or anyone - to be able to settle that question.

As for disruption, the survey points to a worryingly high-level of burnout among security professionals, with as many as two-thirds of CISOs who believe that security practitioners experience a higher rate of burnout then other roles.   Aggravating factors for this include the hiring landscape: over half of CISOs say their teams are understaffed and 87% are currently hiring. 

However, there is growing confidence that AI will make a positive difference at least in automating some of the less skilled roles. Nearly a quarter of respondents (23%) say that AI tools have already enabled them to reduce or repurpose headcount, while 71% expect to have made cuts over the next three to five years. 

Gartner endorses this trend. They have gone on record to say that by 2028 AI will have closed the skills gap. However, and this is the critical point, the Gartner prediction refers to “entry-level skills”. That begs some big questions about the security workforce as a whole. What skills will be needed to address the next wave of AI-enabled threats? Will AI tools mitigate those too? Or will we just see the bar raised in future?

Not to leave those questions hanging, I believe the answers are “We don’t know yet”, “Not entirely” and “Yes”.

While it would be reassuring to think that AI will close the skills gap, I think it’s more accurate to predict that it will change it. The bottom line for organisations of all kinds is that finding the right people to mount an effective defence will be challenging for the foreseeable future.

CISOs are realistic about the threats facing their organisations. Asked about their top priorities, only 18% had the goal of “avoiding breaches at all times”. Most of the responses were more pragmatic than optimistic, with 17% voting for “balancing risk against business objectives” and 20% for “building resilience”. In other words, few CISOs believe they’re in a war that will be over anytime soon. The majority are settling in for a long campaign. 

The top priority for 31% of CISOs is “building a security brand”, reflecting their belief that effective cybersecurity is now a major factor in competitive advantage.

This is a significant finding reflecting a shift in attitudes from a “do enough” compliance culture to a business environment in which being seen to “do more” has become a critical measure of business viability and being a business enablement powerhouse.

Few CISOs in the survey believe organisations are doing enough today, however. Most believe that the majority of organisations do not fully understand the risks of being breached and, as a result, are not as well defended as they could be.

While they also understand that many of the decisions organisations make will be a trade-off between business benefit and security risk, CISOs have serious concerns that some may start taking risks that will compromise their customers’ long-term privacy or security for the sake of short-term savings. 

As for AI, while CISOs are currently split about its use, this is more a matter of timing than any deeply held conviction. 

Nearly eight in ten (78%) are already using AI in their security teams and of the rest only 3% say they will never use it. Does it outperform some of their security professionals in certain cyber processes? Yes, according to 44%, while most of the rest (47%) believe that it will eventually replace team members when the technology improves. This is not a view shared by ethical hackers, who believe that while AI adoption will increase, it will never replace human ingenuity. 

The picture may be more nuanced. As we saw earlier, there’s no doubt that AI will replace low-level security roles with certain operational type characteristics. What happens further up the skills hierarchy is less clear. 

Even with the benefits of AI from a hiring perspective, the jury is still out on AI’s long term potential. 58% of CISOs argue that the risks of AI outweigh the benefits. CISOs are scrambling to put defensive measures in place to prepare, with 95% of CISOs having already implemented AI-based defensive measures, including crowdsourcing and pen testing. 

In a sense this part of the debate is academic. The AI train is rolling and like it or not most CISOs are already onboard.  

Nick McKenzie is Chief Information officer and Chief Security Officer at Bugcrowd

Image: Jacob Wackerhausen 

You Might Also Read:

Helping CISOs Embrace Artificial Intelligence


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« UK vs. US: The Artificial Intelligence Landscapes Compared
Chinese Hackers Exploit Cisco Vulnerability To Deliver Malware »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

National Cyber Security Centre (NKSC) - Lithuania

National Cyber Security Centre (NKSC) - Lithuania

NKSC is the main Lithuanian cyber security institution, responsible for unified management of cyber incidents, monitoring and control of the implementation of cyber security requirements.

TruSTAR Technology

TruSTAR Technology

TruSTAR is a threat intelligence exchange platform built to protect and incentivize information sharing.

Meiya Pico Information Co

Meiya Pico Information Co

Meiya Pico is the leading digital forensics and information security products and service provider in China.

Keepnet Labs

Keepnet Labs

Keepnet Labs is a phishing defence platform that provides a holistic approach to people, processes and technology to reduce breaches and data loss and presents anti-phishing solutions.

CSIRT Italia

CSIRT Italia

CSIRT Italia is the national Computer Security Incident Response Team for Italy.

ST Engineering

ST Engineering

ST Engineering is a leading provider of trusted and innovative cybersecurity solutions.

Cyber Physical Security Research Center (CPSEC)

Cyber Physical Security Research Center (CPSEC)

CPSEC aims to contribute to the security enhancement of industrial infrastructure that creates value across cyber space and physical space.

astarios

astarios

astarios provide near-shore software development services including secure software development (DevSecOps), quality assurance and testing.

Liongard

Liongard

Liongard automates the management and protection of modern IT environments at scale for IT MSPs - Managed Service Providers and Enterprise IT Operations.

ProcessUnity

ProcessUnity

ProcessUnity is a leading provider of Third-Party Risk Management software, helping companies remediate risks posed by third-party service providers.

Lifetech

Lifetech

Lifetech is a software development, product engineering and system integration company. Cybersecurity services include SIEM deployment and training.

Cyber-Security Council Germany

Cyber-Security Council Germany

The German Cyber Security Council's objective is to consult businesses, government agencies and political decision-makers and to support them against cybercrime.

Federal Bureau of Investigation (FBI)

Federal Bureau of Investigation (FBI)

The mission of the FBI is to protect and defend against intelligence threats, uphold and enforce criminal laws, and provide criminal justice services.

risk3sixty

risk3sixty

Risk3sixty are information and cyber risk management craftsmen helping build business-first security and compliance programs.

Positka FSI Pte Ltd

Positka FSI Pte Ltd

Positka, being a Splunk Singapore partner, provides Splunk & Phantom Services, Cybersecurity & Risk Management, Analytics & Big Data, Lean Process Optimization, and Managed Security Services.

Seven AI

Seven AI

Seven AI develops cyber security software designed to identify online threats.