Borrow a Hacker Before One Finds You with Glenn Wilkinson

And of course, those positions are now getting more complex with frontier AI and, you know, speed of discovery more so, I would say, than speed of exploitation.

So, you know, it's becoming a more cumbersome overhead for a CISO to manage.

And like...

I have to ask the question, is it still fair to put that weight directly on the CISO's head? Or should we be spreading the cyber risk piece a lot more smoothly across the organization? And when I say that, Jaguar jumps into the back of my head.

The Land Rover 2025 debacle and the impact that had on the UK's GDP, which was... a first also.

So like, is cyber now materializing into something that has almost outgrown the role of the CISO to be far more impactful organizationally across the spectrum? Yeah.

I absolutely agree.

I do a lot of workshop sessions and training.

I speak on big stages, but the bulk of the work I do is actually internal.

So if that's executive courses or speaking to CISOs or coming onto your board as a hacker in residence or as a kind of fractional CTO or field CTO.

But my observation is twofold.

So one, the typical path of the CISO doesn't equip them with the capabilities they need to fulfill their job at a very high level C-suite type position.

And what I mean by that is the vast majority of CISOs, at least the ones I've talked to and the ones that I know, they start in some technical role, usually very technical.

And they kind of climb the ladder to middle manager in IT, then the head of the IT department.

And then for whatever reason, the next logical progression is to become the CISO.

It's like, well, he's the computer guy.

We need someone on the board.

He's been here 20 years.

Let's make him the CISO.

And the problem with that is you're bringing in someone who has a technical mindset and a technical history and just a technical approach to life.

And when you're on the board, you need a very different mindset.

Your CEO and everyone else on the board – they have a very different background, training, and approach.

I think it's a little bit unfair to the CISO to throw them into senior management or put them on the board and expect them to swim.

Sometimes they will, and that's great, but I don't think it's the best logical path.

Maybe there's a different path if you want to be a CISO.