Move fast, keep risk at bay: Like Hensley, Jeff Trudeau, CSO of Chime, says the role is fundamentally shifting from a control function to a strategic partner in how the business adopts AI responsibly. At Chime, that means being embedded early in how AI is built and deployed, not reviewing it after the fact, Trudeau says.”We’re focused on three areas: securing AI systems themselves, governing how AI is used across the company, and helping leadership make clear risk/reward decisions as we scale,” he says.Noting that AI increases both speed and surface area, Trudeau says his role is to ensure the firm can move fast without introducing unacceptable risk. “That requires tighter integration with engineering, product, and data teams, as well as more direct engagement with executive leadership and the board on how AI changes our risk posture.”Khalfan also characterizes himself as a strategic CISO with a strong operational and engineering foundation. He strongly believes that a well-defined security strategy aligned to business goals is essential for the success of any cybersecurity organization.”Security cannot operate as a separate function; it must be embedded in how the business grows, innovates, and continues to earn trust,” he says, adding that “strategy without execution is just theory. We operate in a threat landscape that changes daily, and there are moments when tactical action is critical to managing immediate risk.”Rapid AI adoption is a perfect example, he says. Echoing Trudeau, Khalfan believes the CISO must help the organization move fast while still protecting customers, data, infrastructure, and reputation.”The best CISOs know how to balance both, thinking long-term while acting decisively in the short term,” he says. All roads lead back to trust and strong governance, he notes. “Trust is the foundation of both technology and business. You must build trust in the system across customers, merchants, partners, and infrastructure to ensure AI and agent-driven transactions are reliable, secure, and verifiable.”
AI is creating the greatest security challenges: For Trudeau, the biggest challenge of the burgeoning AI era is the pace of change. AI is accelerating how software is built, how attacks are executed, and how quickly systems evolve. Traditional security models, periodic reviews, and static controls don’t keep up, he says.”We’re addressing that by shifting to more continuous, embedded security practices. That includes integrating security into development workflows, investing in detection and response capabilities that adapt in real-time, and building stronger data governance around how sensitive information is accessed and used by AI systems,” Trudeau says.At the same time, the focus is on maintaining trust at scale. “As we introduce more AI-driven experiences, we have to be clear about how systems behave, how decisions are made, and where human oversight remains,” Trudeau says. “That’s as much a product and trust challenge as it is a technical one.”AI is also impacting what Brown & Brown is seeing with phishing campaigns, notes Hensley. “AI is maturing in its ability to impersonate individuals, both voice and video, while quickly generating supporting documents to further convince teammates that a fraudulent request is genuine.”A preview of Anthropic’s Mythos release shows that AI can now rapidly discover previously unknown vulnerabilities and automate their exploitation, Hensley says. “This changes the paradigm. Vulnerability management will likely become a higher priority for organizations as they cannot wait weeks to patch hosts based on a perceived risk tolerance of mitigating controls.”Most organizations will have to empower their IT platform providers to deploy automation for near-real-time patching, while holding them accountable for the contracted service-level availability, he says.
Managing identity, data, and humans: AI is not the only challenge CISOs have to contend with. Khalfan says that identity, data security, and context are his most important challenges to solve for.”Identity is becoming more complex, as humans, machines, APIs, and autonomous agents all interact with critical systems,” he says. “Knowing who, or what, is requesting access and ensuring the right level of trust and least privilege is fundamental.”Context is the multiplier, Khalfan adds. “Security decisions without business context create unnecessary friction, and business decisions without security context create unnecessary risk. Security leaders must create systems that make both visible in real-time.”To execute, his team focuses heavily on getting the fundamentals right: strong data governance, dynamic policy tuning, continuous validation of the control environment, frequent deployment of security improvements, and designing controls that are embedded into workflows rather than added afterward, Khalfan says.”Security at scale is less about isolated controls and more about building resilient systems that continuously adapt,” he says.As much as AI has added new trials, Hensley finds that the human element, along with the expanding attack surface, remain the greatest security challenges. This includes the arms race between attackers and defenders. “Sophisticated social engineering is at an all-time high, challenging our teammates to be not only vigilant but also often the first line of defense,” he says.To stay ahead, “we are tackling from all angles, including security awareness training, enabling new advanced AI features in our security tools, and taking more proactive actions on behalf of our teammates based on risk/reward evaluations,” Hensley says.
Hall of Fame advice on meeting the current CISO moment: Meeting today’s cyber leadership challenges requires CISOs to lead from the front, something both Hensley and Khalfan practice. That means only adopting AI that is secure and trusted. “Security should not be the department of ‘no’; it should help business partners move faster with confidence, Khalfan says.Leading from the front also means challenging the status quo, and viewing yourself as a business partner/risk advisor, Hensley says.For Trudeau, it’s about being able to translate risk into business terms.Stay close to the business. “If you do not understand how your company creates value, you cannot effectively protect it,” Khalfan says. “Security leaders need to speak the language of growth, customer trust, and operational resilience, not just technical risk.”Trudeau agrees, saying that security leaders must align their work directly to business outcomes. “If security is seen as separate from growth, you’ll always be reacting instead of shaping decisions.”Be the enabler. “The best CISOs help the business move faster and safer, not slower,” Khalfan says. “Your job is not to create friction everywhere; it is to create friction where the risk is highest and remove it where trust can be increased through better design.”Engage early. “The earlier security is involved in product and AI development, the more leverage you have to influence outcomes without slowing teams down,” Trudeau notes.Khalfan echoes that, saying that data security, identity, and observability are the foundations on which trusted AI systems are built. Business and cyber teams must work hand in hand to ensure those outcomes are achieved, he says. “Whether it is defending against AI-enabled threats, protecting AI infrastructure, or evaluating the risk and reward of AI innovation, security must be involved early, not after deployment,” he adds.Stay proactively compliant. Khalfan says that PayPal’s security organization continually monitors and updates its governance and requirements based on the evolving regulatory frameworks.Solve business problems. This is a sure-fire way to meet the today’s cyber challenges and raise your profile as CISO. “When security becomes a driver of trust, speed, and competitive advantage, your seat at the table becomes permanent,” Khalfan says.For example, Khalfan drove company-wide bot protection initiatives, a collaborative, multi-team effort that enhanced fraud prevention. It greatly reduced fraudulent traffic at the top of the process, resulting in higher quality customer engagement, he says.Talk the talk. If you want to understand how to secure AI, you need to actively use AI, Khalfan stresses. “Security leaders cannot govern what they do not understand. Hands-on experience creates credibility and better decision-making,” he says.This often requires investing in fluency beyond security to understand how AI systems work, how your company builds products, and what leadership cares about, Trudeau says.Build credibility through consistency. “As the scope of the role expands, especially with AI, leaders are looking for clear, pragmatic guidance, not theoretical risk models,” Trudeau says.
There’s no ‘I’ in team: A core part of raising to today’s challenges and elevating your CISO role requires security leaders to bring your teammates along. They will always be your greatest resource, Hensley says. “My military experience is part of my DNA and has shaped every part of my life, especially how I think of teammate development, building highly cohesive functioning teams, and prioritizing what is most important,” he says.So many things in life will come and go, but your impact on others will impact generations, Hensley adds. They carry your values forward from culture, ethics, and standards.”My legacy will be the teammates that I have served alongside through my career,” he says. “I encourage security leaders to focus on the impact you can make on your team every day, it will ultimately serve to elevate your profile and leave a lasting mark.”
Hall of Fame advice on meeting the current CISO moment: Meeting today’s cyber leadership challenges requires CISOs to lead from the front, something both Hensley and Khalfan practice. That means only adopting AI that is secure and trusted. “Security should not be the department of ‘no’; it should help business partners move faster with confidence, Khalfan says.Leading from the front also means challenging the status quo, and viewing yourself as a business partner/risk advisor, Hensley says.For Trudeau, it’s about being able to translate risk into business terms.Stay close to the business. “If you do not understand how your company creates value, you cannot effectively protect it,” Khalfan says. “Security leaders need to speak the language of growth, customer trust, and operational resilience, not just technical risk.”Trudeau agrees, saying that security leaders must align their work directly to business outcomes. “If security is seen as separate from growth, you’ll always be reacting instead of shaping decisions.”Be the enabler. “The best CISOs help the business move faster and safer, not slower,” Khalfan says. “Your job is not to create friction everywhere; it is to create friction where the risk is highest and remove it where trust can be increased through better design.”Engage early. “The earlier security is involved in product and AI development, the more leverage you have to influence outcomes without slowing teams down,” Trudeau notes.Khalfan echoes that, saying that data security, identity, and observability are the foundations on which trusted AI systems are built. Business and cyber teams must work hand in hand to ensure those outcomes are achieved, he says. “Whether it is defending against AI-enabled threats, protecting AI infrastructure, or evaluating the risk and reward of AI innovation, security must be involved early, not after deployment,” he adds.Stay proactively compliant. Khalfan says that PayPal’s security organization continually monitors and updates its governance and requirements based on the evolving regulatory frameworks.Solve business problems. This is a sure-fire way to meet the today’s cyber challenges and raise your profile as CISO. “When security becomes a driver of trust, speed, and competitive advantage, your seat at the table becomes permanent,” Khalfan says.For example, Khalfan drove company-wide bot protection initiatives, a collaborative, multi-team effort that enhanced fraud prevention. It greatly reduced fraudulent traffic at the top of the process, resulting in higher quality customer engagement, he says.Talk the talk. If you want to understand how to secure AI, you need to actively use AI, Khalfan stresses. “Security leaders cannot govern what they do not understand. Hands-on experience creates credibility and better decision-making,” he says.This often requires investing in fluency beyond security to understand how AI systems work, how your company builds products, and what leadership cares about, Trudeau says.Build credibility through consistency. “As the scope of the role expands, especially with AI, leaders are looking for clear, pragmatic guidance, not theoretical risk models,” Trudeau says.
There’s no ‘I’ in team: A core part of raising to today’s challenges and elevating your CISO role requires security leaders to bring your teammates along. They will always be your greatest resource, Hensley says. “My military experience is part of my DNA and has shaped every part of my life, especially how I think of teammate development, building highly cohesive functioning teams, and prioritizing what is most important,” he says.So many things in life will come and go, but your impact on others will impact generations, Hensley adds. They carry your values forward from culture, ethics, and standards.”My legacy will be the teammates that I have served alongside through my career,” he says. “I encourage security leaders to focus on the impact you can make on your team every day, it will ultimately serve to elevate your profile and leave a lasting mark.”
First seen on csoonline.com
Jump to article: www.csoonline.com/article/4168684/cisos-step-into-the-ai-spotlight.html
