Inside The Mind Of A CISO

AI is a disruptive technology in more ways than one. A survey of 209 CISOs and security leaders globally shows security professionals struggling to reach consensus about what AI means for their organisation and their own roles. 

Despite a range of divergent and sometimes contradictory views, the report Inside the Mind of a CISO leaves little doubt that AI is a powerful force for change. What’s less clear is whether change overall will be good or bad. And perhaps it’s too early to expect CISOs - or anyone - to be able to settle that question.

As for disruption, the survey points to a worryingly high-level of burnout among security professionals, with as many as two-thirds of CISOs who believe that security practitioners experience a higher rate of burnout then other roles.   Aggravating factors for this include the hiring landscape: over half of CISOs say their teams are understaffed and 87% are currently hiring. 

However, there is growing confidence that AI will make a positive difference at least in automating some of the less skilled roles. Nearly a quarter of respondents (23%) say that AI tools have already enabled them to reduce or repurpose headcount, while 71% expect to have made cuts over the next three to five years. 

Gartner endorses this trend. They have gone on record to say that by 2028 AI will have closed the skills gap. However, and this is the critical point, the Gartner prediction refers to “entry-level skills”. That begs some big questions about the security workforce as a whole. What skills will be needed to address the next wave of AI-enabled threats? Will AI tools mitigate those too? Or will we just see the bar raised in future?

Not to leave those questions hanging, I believe the answers are “We don’t know yet”, “Not entirely” and “Yes”.

While it would be reassuring to think that AI will close the skills gap, I think it’s more accurate to predict that it will change it. The bottom line for organisations of all kinds is that finding the right people to mount an effective defence will be challenging for the foreseeable future.

CISOs are realistic about the threats facing their organisations. Asked about their top priorities, only 18% had the goal of “avoiding breaches at all times”. Most of the responses were more pragmatic than optimistic, with 17% voting for “balancing risk against business objectives” and 20% for “building resilience”. In other words, few CISOs believe they’re in a war that will be over anytime soon. The majority are settling in for a long campaign. 

The top priority for 31% of CISOs is “building a security brand”, reflecting their belief that effective cybersecurity is now a major factor in competitive advantage.

This is a significant finding reflecting a shift in attitudes from a “do enough” compliance culture to a business environment in which being seen to “do more” has become a critical measure of business viability and being a business enablement powerhouse.

Few CISOs in the survey believe organisations are doing enough today, however. Most believe that the majority of organisations do not fully understand the risks of being breached and, as a result, are not as well defended as they could be.

While they also understand that many of the decisions organisations make will be a trade-off between business benefit and security risk, CISOs have serious concerns that some may start taking risks that will compromise their customers’ long-term privacy or security for the sake of short-term savings. 

As for AI, while CISOs are currently split about its use, this is more a matter of timing than any deeply held conviction. 

Nearly eight in ten (78%) are already using AI in their security teams and of the rest only 3% say they will never use it. Does it outperform some of their security professionals in certain cyber processes? Yes, according to 44%, while most of the rest (47%) believe that it will eventually replace team members when the technology improves. This is not a view shared by ethical hackers, who believe that while AI adoption will increase, it will never replace human ingenuity. 

The picture may be more nuanced. As we saw earlier, there’s no doubt that AI will replace low-level security roles with certain operational type characteristics. What happens further up the skills hierarchy is less clear. 

Even with the benefits of AI from a hiring perspective, the jury is still out on AI’s long term potential. 58% of CISOs argue that the risks of AI outweigh the benefits. CISOs are scrambling to put defensive measures in place to prepare, with 95% of CISOs having already implemented AI-based defensive measures, including crowdsourcing and pen testing. 

In a sense this part of the debate is academic. The AI train is rolling and like it or not most CISOs are already onboard.  

Nick McKenzie is Chief Information officer and Chief Security Officer at Bugcrowd

Image: Jacob Wackerhausen 

You Might Also Read:

Helping CISOs Embrace Artificial Intelligence


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« UK vs. US: The Artificial Intelligence Landscapes Compared
Chinese Hackers Exploit Cisco Vulnerability To Deliver Malware »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Securosis

Securosis

Securosis is an information security research and advisory firm dedicated to improving the practice of information security.

Cyber Security Centre - University of Hertfordshire

Cyber Security Centre - University of Hertfordshire

The Cyber Security Centre provides training, teaching and research in the fast paced topics of cyber security and digital forensics.

International School of IT Security (ISITS)

International School of IT Security (ISITS)

The International School of IT Security (ISITS) is a leading provider of professional training in the field of IT Security.

Giesecke+Devrient (G+D)

Giesecke+Devrient (G+D)

Giesecke+Devrient develop security technologies in four major areas: enabling secure payment, providing trusted connectivity, safeguarding identities and protecting digital infrastructures.

Latvian Information & Communications Technology Association (LIKTA)

Latvian Information & Communications Technology Association (LIKTA)

LIKTA brings together leading Latvian companies, organizations and professionals in the field of Information & Communications Technology

Luxembourg Institute of Science & Technology (LIST)

Luxembourg Institute of Science & Technology (LIST)

LIST is a mission-driven Research and Technology Organisation. Areas of research include IT and aspects of IT security.

Ntrepid

Ntrepid

Ntrepid products provide protection from web threats and enable organizations to safely conduct their online activities.

DQM GRC

DQM GRC

DQM GRC are one of the UK's leading providers of data governance, e-privacy and GDPR services, to commercial organisations across all industries in the UK.

Eco Recycling (Ecoreco)

Eco Recycling (Ecoreco)

Eco Recycling is India's first and leading professional E-waste Management Company that has set industry benchmarks with its innovative & environment friendly disposal practices.

Granted Consultancy

Granted Consultancy

Granted Consultancy is a business consultancy that specialises in securing funding to support companies with the development and commercialisation of new and innovative products and technologies.

Griffiss Institute (GI)

Griffiss Institute (GI)

GI's primary role is to advocate and facilitate the co-operation of private industry, academia, and the Air Force Research Laboratory in developing solutions to critical cyber security problems.

Crosspring

Crosspring

Crosspring is an incubator/accelerator for people who have the ambition to start a successful business or want to extend their existing business in the areas of FinTech, AR, VR, Cybersecurity and SaaS

DataExpert Singapore

DataExpert Singapore

DataExpert Singapore provide solutions and services in the areas of Digital Forensics, Data Recovery, Data Duplication, Data Degaussing & Wiping, Data Destruction, and IT Disposal.

BT Security

BT Security

BT provides telecommunications and network infrastructure services to keep businesses around the world connected and secure.

Jit

Jit

Jit empowers developers to own security for the product they are building from day zero.

ATHENE National Research Center For Applied Cybersecurity

ATHENE National Research Center For Applied Cybersecurity

ATHENE is the largest research center for cybersecurity and privacy in Europe, conducting application-oriented top-level research for the benefit of the economy, society and the state.