Jonathan Fischbein is the Chief Information Security Officer at Check Point Software Technologies.
If 2024 was the year of artificial intelligence (AI), then 2025 is the year of the chief information security officer (CISO). The use of AI both in production environments and in attacks will continue to increase, while the threat landscape itself expands. CISOs, correspondingly, are more important to organizations than ever.
As we approach the new year, there are several important factors that CISOs will need to focus on to be successful in their always-expanding roles.
Artificial Intelligence Demands Secure-By-Design Philosophy
Artificial intelligence is firmly in the arsenal of attackers and defenders both. AI tech will continue to realize and mature, and as a result, we will see much broader use in protection environments. Attackers will be practicing new techniques to compromise AI models to steal more sensitive information, as well as finding new ways to leverage it to move laterally within an organization. Consequently, not only will threat volume increase, but threat complexity will as well. Defenders will need to guard against more threats that are, at the same time, more targeted, reliable and workable at-scale. Phishing and ransomware campaigns will be more targeted and will evade existing security products with greater facility.
Because of this, boards of directors will demand rapid AI implementation to combat the effectiveness of offensive AI, as well as to drive commercial competitive advantage. For CISOs, this means balancing the pace of innovation against secure-by-design implementation, a crucial dynamic in the modern threat environment. Security can no longer be an add-on; it must be built into every aspect of the network. Innovation cannot have an impact if it’s not secure. In fact, without a secure-by-design philosophy, “innovations” may simply offer an expanded attack surface for threat actors. Implementing a secure-by-design philosophy throughout the organization must be a priority for CISOs in organizations of all types.
Clearly, boards are more engaged in cybersecurity discussions than ever before. As they build the cybersecurity foundation for innovation within their organizations, CISOs will also be expected to articulate AI and emerging technology risk to their directors, most of whom may not have practitioner-level expertise.
Managing The Rise Of Regulation
Government groups, at the federal level and all the way down to state and local organizations, are prioritizing AI regulation, which will place additional responsibilities, accountability and stress on CISOs. It’s important that security leaders engage with regulators and form a cooperative relationship to ensure that smart regulation complements innovation and doesn’t restrict it. As CISOs remain in the firing line, it may also be smart for them to purchase corporate directors and officers (D&O) insurance to hedge their personal risk.
Closely related to increased regulatory burden is the higher threshold for cyber insurance. Recent big-name breaches will drive a greater demand for this kind of insurance covering business interruption events, including outages by third parties. Each standard demands a project, focus and time and will likely require the CISO to set additional policies and new standards, and deploy more products.
While these actions can improve the organization’s security posture, it also demands a greater share of the CISO’s time and effort. Consolidating security products and pursuing a platform approach is the best way for security leaders to manage this dynamic.
Consolidate To Fight Saturation
The cyber vendor market is approaching saturation as customers struggle to differentiate marketing hype from real capability. In the year ahead, we’ll see the rise of cyber advisory services influencing board decisions and investments.
CISOs should be prepared to place an emphasis on consolidation to ameliorate the challenges of saturation. Over the last several years, many organizations have adopted a variety of point products that are highly effective in narrow niches.
However, this nest of individual solutions also leads to blind spots and extremely limited interoperability. The cyber market, not to mention the threat environment, is at a stage of sophistication that demands centralization. This is especially important considering the talent shortage in cybersecurity, which, as organizations have continued to implement more and more products, has spread teams too thin. Even if the technical capacity of the solutions is higher, teams of limited sizes are forced to contend with a greater variety of tools to address an increasing variety of threats, making the network harder to manage.
This is a dynamic threat actors consciously exploit, seeking inevitable blind spots in organizations with too many distinct vendors. Working from a single pane of glass maximizes the effectiveness of your cyber talent.
Cybersecurity Is The Foundation
Cybersecurity is now universally recognized, by boards, executives, regulators and practitioners alike, as the foundation for doing business in the modern era. CISOs are now the essential nexus among all these groups, with a mandate to implement strong security while articulating a clear-eyed assessment of the landscape as well as a strategy to be effective within it, to stakeholders across the board.
They’re under more pressure than ever before. To be successful, security leaders must focus on consolidating and centralizing operational security while participating substantively in designing balanced regulation that allows their business innovations to thrive.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
