Choosing a Clear Direction in the Face of Growing Cybersecurity Demands – Source: www.securityweek.com

For years, Chief Information Security Officers (CISOs) have faced an uphill battle in securing the resources they need to protect their organizations. Often, security budgets are only increased when a data breach happens or after a significant compliance failure, when the damage has already been done. This approach leaves organizations vulnerable and security leaders struggling to justify proactive investments.

The AI Dilemma – Accelerating Innovation while Ensuring Efficiency

Now, in our AI-driven world, CISOs face an even tougher task, as the rapid pace of change puts additional pressure on them to increase productivity and go faster, while at the same time maximizing efficiency by doing more with less. In this rapidly changing AI environment, CISOs are worried about investing in the wrong solution or simply not investing because they can’t decide what the best option is. They risk being left behind through decision paralysis.

In fact, the role of CISO has never been more demanding. As cyber threats grow in frequency and sophistication, security leaders find themselves leading the charge in an unrelenting battle for cyber resilience. They’re under pressure, not only to prevent attacks, but also to ensure their organizations can operate and grow securely and effectively.

Dealing with Relentless Pressure

CISO’s must balance multiple priorities with many facing overwhelming workloads, budget constraints, insufficient board-level support and unreasonable demands. From a revenue perspective they must align cybersecurity strategies with business goals, ensuring that security investments support revenue generation and protect critical assets. They’re under pressure to automate repetitive tasks, consolidating and streamlining processes while minimizing downtime and disruption. And then there is AI and the potential benefits it may bring to the security  team and to the productivity of users. But all the while remembering that with AI, we have put technology in the hands of users, who have not traditionally been good with tech, because we’ve made it easier and quicker than ever before.

There is also an expectation of higher-than-average availability, coupled with mounting compliance requirements, as CISOs must understand the scale of risk and what is deemed acceptable risk, while protecting business critical systems. This has made CISO burnout an industry-wide problem, and one that could exacerbate a company’s security risks. As a result, Gartner reported that around 50% of CISOs will change jobs in 2025 due to stress.

Why CISOs Are Struggling to Execute Their Goals

This reminded me of a book that I read a few years ago by Kevin Maney called Trade-Off: Why Some Things Catch On, and Others Don’t which explores the idea that successful products and brands thrive by excelling in either fidelity (quality of experience) or convenience (ease of access), but not both.

Maney argues that consumers make choices based on a trade-off between these two factors. The book suggests that businesses should focus on dominating one of these areas rather than trying to balance both, as mixing them can lead to failure.

I would argue that there is so much complexity and so many more tasks in their remit now that CISOs are a bit “like rabbits caught in the headlights”: shocked, overwhelmed, and paralyzed by the sheer scale of demands coming at them thick and fast.  They freeze and don’t know what to prioritize, putting them in danger of not being able to execute any of their goals particularly well.

Efficiency or Speed? The Critical Security Decision for CISOs

My advice? They need to choose one key goal rather than trying to do everything.  Do I want to “go faster” and innovate? Or do I want to become a more efficient business and “do more” with less?

Whichever they opt for, they also need to figure out all the different tools to use to accomplish that goal.  This is where cybersecurity automation and AI comes into play. Using AI, machine learning, and automated tools to detect, prevent, and respond to cyber threats without human intervention, CISOs can streamline their security operations, reduce manual workload, and improve response times to cyberattacks and, in effect, do more with less.

If the goal is to go faster, then they need to anticipate all the potential risks that AI can present. There is a high potential chance of error in AI systems which can, for example, unintentionally amplify biases present in training data. In fact, some hiring algorithms have been found to discriminate against certain demographics, leading to unfair hiring practices. Cybercriminals can manipulate AI models by subtly altering input data, leading to incorrect outputs or security breaches and adversarial AI attacks.  And then there is data poisoning whereby attackers can corrupt the training data of AI systems, causing them to learn incorrect patterns and make flawed decisions.

AI-Steady or AI Accelerated?

According to Gartner, AI and automation are simply scale functions, meaning they primarily serve to enhance efficiency and expand capabilities, rather than fundamentally change business models.  Gartner recommends that organizations either take an AI-Steady approach or an AI-Accelerated approach – but not both. This entails adopting AI at different paces, either gradually integrating it (AI-Steady) or aggressively scaling it (AI-Accelerated) to maximize impact.

Going back to prioritization, I believe that CISOs are looking at AI in the wrong way.  They need to choose one approach, either “going faster” or “doing more”, establish that it is working effectively and then work out how to add the other. In other words, they must have a single purpose to be more productive versus trying to accomplish multiple initiatives at once. And rather than procrastinate, they need to get moving, before they do get left behind.

The Power of Momentum in Decision-Making

I compare this to sailing. It is nearly impossible to turn a sailboat if you are not moving. A sailboat turns through tacking, which involves turning the front of the boat through the wind, shifting the sails to the opposite side. The key to tacking is you have to be moving in the first place to turn; whether you want to choose a direction or change direction you simply must be moving.

So, readers, if you are stuck, just choose a direction and get moving. Sail into that direction and if you need to tweak, you can start to tack. The key question is what direction are you going to go in first? 

Learn more at SecurityWeek’s 2025 AI Risk Summit + CISO Forum at Half Moon Bay