BLOG (2025)

2025 was marked by the acceleration of AI adoption by both defenders and attackers, greater third-party risks, and intensified governance pressure.  Security teams spent 2025 balancing rapid adoption of new technologies, especially AI, against fast‑escalating AI‑driven threats.​ Aimee Chanthadavong interviewed CISOs who described 2025 as a turning point where AI transformed security operations, attacker capabilities, identity sprawl, and board‑level governance expectations.​

Read this article about their top 7 takeaways from 2025.

Many employers hire their CISOs based on the assumption that he or she must grew up in engineering teams, solve security as an engineering problem, and stop threats by constructing proper security systems. Is this the right approach?

The article, "The Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability", written by David Schwed, explains why an engineering-centric CISO can become a liability when security is treated primarily as a technical problem rather than a business risk issue.  An engineer CISO prioritises technical controls and tools over risk communication, governance, and stakeholder alignment, which can leave executives and boards under-informed about and exposed to actual business risk. 

The holistic CISO is presented as the alternative archetype. This leader cares about technical depth and has enough engineering literacy to challenge their teams, but they do not see security as something that can be solved in code alone. They see every control as part of a system that connects people, process, and technology. 

The article concludes by stating an engineer CISO may build a facade that satisfies auditors and produces reassuring diagrams, whereas a holistic CISO builds the uncomfortable, necessary resilience required to survive contact with the real world. 

CISOs are expected to possess a wide range of technical, business, and management skills. If they can master these exemplary IT leadership skills, they will set themselves apart and ahead of their peers. 

Are you looking to become or move forward as a CISO? Then you will need to polish your business and leadership skills across a range of domains or risk career stagnation. 

An article, "7 standout CIO skills every company wants", written by John Edwards, outlines seven non-technical, business-focused skills that modern CIOs are expected to demonstrate to be highly attractive to employers. Many of these skills are relevant and helpful to cyber leaders who aspire to be effective CISOs that every company want too.

Artificial intelligence (AI) is a present-day reality reshaping the cybersecurity landscape. For CISOs, the integration of AI into security frameworks is a double-edged sword. AI promises enhanced efficiency, predictive capabilities, and automation for internal security teams. However, it also endows bad actors with new tools to exploit vulnerabilities across complex ICT supply chains. 

In the article "Closing the AI Execution Gap in Cybersecurity — A CISO Framework" written by Adam Etherington and Rik Turner from Omdia, the concept of closing the AI execution gap in cybersecurity centers on five key dimensions that CISOs must address: Cybersecurity with AI (augmentation), Cybersecurity by AI (automation), Cybersecurity for AI (tooling), Cybersecurity against AI (defense), and Cybersecurity and AI (strategy and governance). They recommend 5 areas that CISOs can navigate the complexities of AI in cybersecurity and control the new risks that AI brings.

A cyberattack on a critical semiconductor manufacturing plant in Germany disrupts the global supply chain, frays international relations, and impacts global stability.

Automation and AI dominated by a few global technology giants causes a rise in mass unemployment, social unrest and government surveillance across the world.

Foreign-made chips discovered in US voting machines leads to accusations of election fraud, foreign interference and disinformation.

These were a few of the scenarios imagined in the Cybersecurity Futures 2030 initiative. 

The global cybersecurity landscape is constantly and rapidly changing. By 2030, it will once again be radically transformed. The “Cybersecurity Futures 2030: New Foundations” report from UC Berkeley Center for LongTerm Cybersecurity (CLTC), the World Economic Forum Centre for Cybersecurity and CNA’s Institute for Public Research, provides strategic foresight on how global cybersecurity will evolve by 2030. Its findings are based on extensive workshops held in multiple regions in the world, focusing on scenario planning and the trade-offs facing digital security decision-makers. For cyber leaders seeking to shape their cybersecurity future, this report delivers comprehensive recommendations to build resilience, address misinformation, and adapt effectively to the rapidly changing digital security landscape. 

CISOs (Chief Information Security Officers) in smaller companies face significant challenges, especially budget constraints, which is driving many to plan to leave their positions within a year, says Teri Robinson who has written the article entitled "Is Your CISO Ready to Flee?". The study from IANS Research surveyed 363 SMB CISOs and found that 100% of those who said their budgets were insufficient intended to depart within a year. These CISOs are tasked with broad responsibilities across business and risk management but often have less compensation and fewer resources compared to those in larger enterprises.

CISOs are expected to align cybersecurity priorities with business objectives and enable organizational agility while embedding security into the company culture. If CISOs feel unsupported, underfunded, and unable to execute their roles, they are likely to seek safer and better-resourced positions elsewhere. 

Companies should be aware that their CISO might leave soon if budgets remain tight, and they risk losing critical cybersecurity leadership unless they invest adequately in the security function and empower their CISOs with the necessary resources and board access.

From escalating AI-enabled threats to budgets that don’t scale alongside expanding threat landscapes, security leaders are reshaping their agendas to address several key long-standing and emerging concerns.  CISOs are dealing with rising risks, competing priorities, limited budgets, and more. The article, "The 10 biggest issues CISOs and cyber teams face today", written by Mary K. Pratt, cite the 10 issues that are top of mind today.

These challenges highlight the pressures on cybersecurity leaders to balance budget, technology, regulatory compliance, talent, and evolving threats in a complex digital environment. The writer also emphasizes the need for integrated security strategies, automation, AI-assisted defense, and unified security governance to address these issues effectively.

The article "Why must CISOs slay a cyber dragon to earn business respect?" by Evan Schuman discusses how Chief Information Security Officers (CISOs) often gain true recognition and respect from their business peers only after successfully navigating major cybersecurity crises or “slaying a cyber dragon”. The “cyber dragon” metaphor represents a significant, high-impact cyber threat or incident. Slaying it means not just containing the risk, but also demonstrating business acumen, crisis management, and the ability to coordinate effectively across technical and non-technical stakeholders.

Many CISOs face the challenge of making cybersecurity risks visible to the wider business and effectively communicating these risks in a language executives understand. CISOs often operate behind the scenes, and their successes (such as preventing incidents) can be invisible, while failures are highly visible. Unfortunately, it is common for CISOs to be valued most after a significant cyber event, where their leadership and technical skills are put to the test under pressure. Navigating such crises often brings security issues into the boardroom spotlight, helping non-cyber executives appreciate the complexity and importance of the CISO’s role. Ultimately, the path to business respect for CISOs goes beyond technical expertise. It depends on their ability to communicate risk, influence culture, and prove value during (and before) a major security challenge.

The onslaught of AI happened faster than anticipated and there is a sense among some other security professionals that regulations could unwittingly get in the way of progress -- especially when it comes to cybersecurity. 

In the article "Should CISOs Have Free Rein to Use AI for Cybersecurity?" by Joao-Pierre S. Ruth, the writer contends that CISOs should not have entirely free rein to use AI for cybersecurity, according to recent expert analysis and industry debates. While AI presents powerful new opportunities for faster threat detection, agile defense mechanisms, and innovation, it still requires careful guidance, oversight, and robust data privacy safeguards. Many experts urge a balanced approach, suggesting organizations pursue self-regulation, align with existing privacy regulations, and ensure human accountability in the deployment of AI tools. While CISOs should be empowered to leverage AI, unrestricted authority is discouraged; responsible, guided use within clear regulatory and ethical boundaries is considered the best practice. 

What is security debt?

The article "How CISOs can get out of security debt and why it matters", written by Ashwin Krishnan from StandOutIn90Secexplains, points out that security debt arises when organizations accumulate unpatched vulnerabilities, outdated systems, weak authentication, lack of employee training, and poor incident response planning. 

He explains the difference between security debt and technical debt by citing various examples of them. He cautions security debt can make an organization more susceptible to data breaches, malware and ransomware attacks.. He shares recommendations for CISOs to eliminate and prevent security debt in their organisations. Enterprises that effectively manage and minimize security debt have significantly stronger security postures. 

The article "The Evolving Role of the CSO: From Technical Guardian to Business Strategist", published by Security Boulevard, discusses how Chief Security Officers (CSOs) are transitioning from being primarily technical guardians focused on security technology to strategic business leaders. 

Today's CSOs drive revenue growth and customer trust by aligning cybersecurity strategies with overall business objectives. This shift reflects the increasing importance of cybersecurity as a core component of business planning and risk management, rather than just a technical function. The writer shares four strategies for cyber leaders to become true partners to the business.

The UK government extended a £1.5 billion guaranteed loan to Jaguar Land Rover (JLR) to keep operations running after a debilitating ransomware attack that halted production for over four weeks. The article "Too Big To Fail, Cyber Edition" by Forrester Research highlights the broader systemic economic consequences that arise when a major national employer like JLR experiences a devastating cyber and raises a few key questions. Was conglomerate ownership and convenience shielding poor IT supplier performance? Was JLR in the middle of negotiating a cyber insurance policy at the time of the attack? The writers proposed 5 key measures that organisations should take in the wake of such a major operational disruption.

Robert Lemos' article, "Plastic People, Plastic Cards: Synthetic Identities Plague Finance & Lending Sector", highlights that post-pandemic, financial fraud involving synthetic identities has seen a resurgence. Financial institutions are facing potentially $3.3 billion in damages due to this type of fraud. Synthetic identities are created by criminals using stolen information from data breaches combined with fabricated details. These synthetic identities are then used to commit fraud in the finance and lending sectors, causing significant losses and challenges for lenders. This situation calls for enhanced fraud detection and identity verification measures in the finance and lending sectors to combat the surge in synthetic identity fraud.

As C-level executives, CISOs are accountable for anything that goes wrong but are not given the same C-level treatment and access that would help them execute their functions with authority. 

Cybersecurity leaders agree that they must engage with the board or management team at their organizations to do their jobs. In reality, board engagement lags, and that disconnect drags down CISOs’ job satisfaction.

Carrie Pallardy, in her article entitled "Lack of board access: The No. 1 factor for CISO dissatisfaction", highlights the risks that a lack of board engagement leaves CISOs accountable for cyber risks without having the empowerment or support needed to address them properly. She provides recommendations for CISOs to build a better relationship with the board so that they can perform their job effectively. 

It's budget season. Once again, security is being questioned, scrutinized, or deprioritized.

If you're a CISO or security leader, you've likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they're framed in a way the board can understand and appreciate.

The article "How Leading CISOs are Getting Budget Approval" published by The Hacker outlines strategies for CISOs to secure cybersecurity budgets effectively by speaking the board’s language of business continuity, compliance, and cost impact. Here's the article.

Have you ever wondered why people are chosen to become CISOs?

Ira Winkler, a former Chief Security Architect at Walmart, wrote an article that explores why people are chosen to become CISOs and what it takes to succeed in that role. It highlights that CISOs are often chosen based on a combination of gut instinct, experience, and intangible soft skills, as well as proven communication and executive presence to effectively work with organization executives and boards. He also contrasts the "art" of a seasoned CISO's gut-based decision-making with the emerging application of science and data-driven approaches in cybersecurity leadership. It discusses the preference for external hires over internal promotions like Deputy CISOs, since experienced CISOs tend to have demonstrated the ability to influence at the executive level.  Read his article here.

In an article entitled "Is the generative AI bubble about to burst?", its writer Matthew Tyson postulated that the AI industry could experience a significant correction in 2025. He explains that the AI hype has peaked in 2024 and anticipates a pullback in promises, investment, and exaggerated marketing in 2025 due to these factors:

• AI technologies have underdelivered compared to the hype, with terms like "AI-enabled" becoming overused and likely to lose their marketing appeal. 

• The industry will settle into practical, narrower AI use cases rather than broad or general AI claims. 

• Generative AI is expected to become a tool used mainly for automating workflows, product creation, and basic security tasks, rather than transforming industries overnight. 

• Cyber threats will grow with AI-enabled social engineering and phishing attacks becoming more sophisticated due to AI’s low barrier to entry.

The article reflects a growing consensus that while AI has real potential, many organizations are still struggling with integration and ROI, and the exuberant valuations seen recently are unsustainable. Read this article. 

Cyber leaders are besieged not only by malicious code but also by an unending wave of stress and mental fatigue. The weight of constant vigilance, the pressure of imminent breaches, and the unyielding demands of their high-stakes environment are forging a silent crisis, one that threatens to compromise not just their well-being, but the very security they are trying to protect.

The article "The Human Firewall: Why Prioritizing Mental Health is Essential for Cybersecurity Success" written by Megan Thome, discusses the mental health challenges faced by cybersecurity professionals and recommends four actionable strategies for organizations to prioritize mental health in cybersecurity. Leveraging technology such as automation tools can reduce cognitive load by simplifying communication and workflows, decreasing error rates and supporting mental health. Organizations investing in mental health are protecting their most valuable asset, their people, which in turn strengthens cybersecurity defenses. Read this article.

A new wave of AI-powered attacks is pushing companies to adjust their cybersecurity spending, according to a new survey of CISOs worldwide by BCG and GLG. 

The survey results show that AI-powered cyber attacks have become the top concern, cited by 80% of CISOs in the survey. Persistent concerns like cloud risk, third-party security, and endpoint protection continue to hold steady. To prepare for AI-powered attacks and evolving cyber threats, CISOs expect to continue increasing spend across cyber categories, especially in threat intelligence and application security—and increasingly on AI-enabled solutions. Given the evolving landscape of cyber threats, companies cannot afford to relax. That is particularly true for AI-empowered threats, which increasingly rely on social engineering and fraud and are extremely cheap to produce convincingly and at massive volume. View this survey. 

Budget time is here. Do you struggle with getting your cyber budget for the new year? 

An article entitled "Navigating the Cybersecurity Budget Tug-of-War" written by Scott Cooper, a VP at Index Engines, addresses the complex challenges organizations face when allocating budgets for cybersecurity. A tug-of-war exists between IT operations teams prioritizing system availability and performance and cybersecurity teams emphasizing data protection and compliance. He provides insights into navigating internal budget battles by advocating for balanced, coordinated, and business-aligned cybersecurity investments. Read this article. 

In the past 25 years, many cycles of security innovation had brought more complexity, challenges, and generated opportunities for career growth. From combatting mass-market worms like ILoveYou, to organised cybercrime like Botnets and DDoS campaigns, to cloud security threats and DevSecOps, and finally to targeted Advanced Persistent Threats (APT)  and ransomware attacks. Each cycle fueled demand for new defensive skillsets and more cyber professionals.

Today, the AI era will redefine both attack surface and defense strategies. This will open green fields for cybersecurity careers, as innovation sparks fresh opportunity. Cybersecurity leaders will focus on how organizations will secure AI solutions, given that these systems are inherently designed to ingest, interpret, and act on available data.  An article entitled "Will Secure AI Be the Hottest Career Path in Cybersecurity" written by Melina Scotto , Founder of Mastin & Associates, explains why AI will be the next hottest career path in cybersecurity. Check out this article. 

Being a CISO today is a balancing act of strategic leadership, financial literacy, technical expertise, and human connection, regardless of the company size. The role is no longer about defending the perimeter; it's about driving the business forward with resiliency while managing risk with clarity, courage, and strategic intent.  

An insightful article entitled "Redefining the Role: What Makes a CISO Great" published by Dark Reading discusses how the CISO role is evolving to meet new demands in cybersecurity leadership and shares 11 key takeaways about what it really takes to be an effective CISO.  Read this article. 

Many cyber leaders are concerned about the new security risks that will be introduced by agentic AI applications.

Good news. The Open Worldwide Application Security Project (OWASP) has published a new Securing Agentic Applications Guide for securing agentic AI applications powered by large language models (LLMs). This guidance offers concrete technical recommendations for developers and security professionals involved in building AI agents with autonomous, multi-agent capabilities. Agentic AI applications operate autonomously, passing data or results between AI tools without human prompts, adapting dynamically to changing environments. This autonomy can raise significant security concerns, especially when these AI systems write code, configure systems, or operate with minimal human oversight. There is also concern that such technology could be exploited by cybercriminals to automate attacks like account takeovers. This guidance aims to address the gap in traditional application security methods, which do not fully cover the complexities of agentic AI with its autonomy and multi-agent interactions. Download this report here. 

The Q3 2025 "CISO Top 10" rankings, published by CyberRisk Collaborative, offer a sample roundup of the areas that cyber leaders are focusing amid rising geopolitical tension, regulatory scrutiny, and digital transformation next quarter. It is organised into two sections - "Executive Management Priorities" and "Technology Priorities" - that capture the changing expectations, cyber risks, and leadership priorities facing CISOs. Together, this report reveals an important update of a dynamic profession undergoing major reinvention. Download these reports here.

It is not just about hard technical skills. Soft skills matter for effective cyber leadership too. 

The article "Why Sincerity Is a Strategic Asset in Cybersecurity" from SecurityWeek emphasizes that sincerity is foundational to successful cybersecurity programs because it builds trust, fosters teamwork, and enables genuine risk reduction.  The writer contrasts sincerity with insincerity, likening insincere actors to merely "hitting play" on a talk track, which fails when engagement and improvisation are required. The essence is that better security starts with sincerity at every level—from leadership to individual contributors—and influences technology, process, and people aspects of cybersecurity programs. Read more here.

While the CISO role is critical and increasingly influential, it is also marked by high stress, growing complexity, accountability pressures, and evolving technological challenges. These factors contribute to the role’s reputation as difficult and sometimes undesirable. In this article,  "Has CISO become the least desirable role in business?", CSO Online highlights the challenges that CISOs face and proposes measures that they can take to develop broad leadership, technical, and strategic skills to succeed in 2025 and beyond.  Read this article.

Imagine AI agents working autonomously to perform complex tasks by mimicking human decision-making through interaction with external systems for your team. Sounds good?

While agentic AI offers powerful automation benefits, it also presents a complex and evolving security challenge. CISOs must understand and address these new attack surfaces through careful agent selection, robust oversight, strong security controls, and cautious adoption to safely leverage agentic AI in their organizations. "The Wild West of Agentic AI – An Attack Surface CISOs Can’t Afford to Ignore"  by SecurityWeek examines the benefits and risks that Agentic AI brings. Read this article.

This question can be a good opportunity to shine or a tough one to answer, especially when it comes from a member of your C-suite or Board. SANS has released a CISO Scorecard and Cloud Security Maturity Model poster to provide a comprehensive framework to help cybersecurity leaders assess and advance their leadership performance and cloud security posture. This poster will also enable CISOs to manage cyber risks and align security with their organizational goals.  You may download this infographic. 

The Security Guidance for Critical Areas of Focus in Cloud Computing , now in its 5th version, is a comprehensive resource for understanding modern cloud components and cloud security best practices. This new version incorporates the latest developments in areas such as Zero Trust, Generative AI, CI/CD, Security Monitoring and Operations, Resilience, Cloud Telemetry, Security Analytics, and Data Lakes. Published by the Cloud Security Alliance, this guide is vendor-neutral and reflects real-world cloud security practices, making it a vital resource for organizations and individuals involved in cloud security.  Download this report. 

How does one steal from the world’s most secure banks and government facilities - without breaking a single law?

This book is a gripping and often humorous account of the author's work as an ethical hacker and social engineer. FC aka Freakyclown, an elite penetration tester with over 20 years of experience, shares vivid real-life stories of testing physical security at some of the world's most secure banks, government facilities, and companies by attempting to "steal" money, data, and other valuables—without breaking any laws. Overall, How I Rob Banks is recommended for anyone interested in cybersecurity, physical security, or thrilling true stories of espionage and penetration testing, blending practical security insights with Ocean’s 11-style intrigue. 

The Hackers News is offering a FREE copy of this eBook (worth $25) for a limited period now.  Get your copy here. 

The article "A CISO's Guide to Reporting on Cloud Security (Without Putting Everyone to Sleep)" by Sarah Elkaim offers practical advice for CISOs on effectively reporting cloud security metrics to stakeholders, especially boards, without overwhelming them. Reporting is critical not only for demonstrating security but also for validating the security program’s value by showing how efficiently threats are detected and resolved, risk is reduced, and resources are used wisely. Elkaim offers a valuable list of essential metrics for CISOs to track. Presenting real incident case studies alongside metrics makes reports more tangible and relatable for stakeholders. Reporting should show how security efforts enable faster innovation and reduce disruptions, linking security to broader business goals. This is a recommended read for all CISOs and cyber leaders. Read this article here.

This Gartner infographic lists 9 top cyber trends and it emphasizes the need for more focused cybersecurity programs that prioritize business continuity and collaborative risk management. CISOs in 2025 will do well to enable secure, AI-enabled business transformation while embedding resilience and collaborative risk management across their organizations. This requires agile capabilities, clear accountability, and a balance between security and business enablement. Download this infographic.