CXO Spotlight

Alex Weinert, Chief Product Officer at Semperis, explains why 99% of permissions granted inside enterprises are never used, why agentic AI turns that dormant attack surface into "fireworks," and what CIOs actually need to tell their boards before the next ransomware event takes identity offline.

Alex spent 30 years at Microsoft, started the identity security team in 2012, and led the response to some of the largest nation-state identity attacks in history including SolarWinds, Storm-0558, and Midnight Blizzard. His blog post "Your Pa$$word Doesn't Matter" is one of the most-cited pieces in identity security. Now at Semperis, he is building the identity resilience category, protecting over 100 million identities across Active Directory, Entra, Okta, and Ping in a market where over 80% of breaches start with compromised identity.

◼ Why 99% of permissions granted in most enterprises are never used, and why that dormant surface becomes catastrophic the moment agents show up

◼ How the mental model of an AI agent as a "hyper intelligent, hyper active, sociopathic five year old" changes every identity security decision

◼ What actually happened when customers tried to run incident response while the attacker was sitting on the Teams call and reading their response playbook

◼ Why the first thing every CISO should do Monday morning has nothing to do with new tools and everything to do with mothballing abandoned applications

◼ How to explain identity resilience to a board in one question: what happens if nobody in your company can log in for four weeks

◼ Why identity resilience is one circuit, not three products: posture, detection, and recovery have to spin as a single wheel

00:00 Teaser

01:23 Intro

01:36 Main Episode

02:20 30 Years Protecting 20 Billion Sign-Ins a Day

06:42 Why Your Password Doesn't Matter

12:09 Why Alex Left Microsoft for Semperis

16:56 The Shift from Account Attacks to Infrastructure Attacks

18:48 Why Identity Is Still an Afterthought for Most CISOs

22:57 The 99% Permissions Problem That Breaks Everything

24:07 How Microsoft Killed 780,000 Applications in Two Weeks

26:51 The Sociopathic Five Year Old: How to Think About Agents

27:30 Why Agentic AI Changes Identity Security Forever

32:02 Expanding Beyond Active Directory: The Fabric View

35:39 Real Ransomware Stories: Card Keys, Teams Calls, and Locked Buildings

37:50 How Ready Are Most CISOs Actually

38:55 Treating Security Teams Like High Performance Athletes

40:24 The Three Beliefs Behind Identity Resilience as a Category

43:15 What Every CISO Should Do Monday Morning

45:09 How to Explain Identity Resilience to Your Board

48:33 What the Data Across 100 Million Identities Is Telling Semperis

49:59 Advice to the Next Generation of Security Leaders

54:30 What Alex Is Most Excited About in the Next Two Years

Follow Alex Weinert: https://www.linkedin.com/in/alexweinert

Follow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijau

Links:

Semperis: https://www.semperis.com

BrandStori: https://brandstori.ai

CXO Spotlight: https://www.thecxospotlight.com

CXO Spotlight on LinkedIn: https://www.linkedin.com/company/cxospotlight

Listen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZ

Listen on Apple: https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542

#CXOSpotlight #IdentitySecurity #CISO #Cybersecurity #ActiveDirectory #IdentityResilience #Semperis #AgenticAI #Ransomware #ZeroTrust #EntraID #IAM #CyberResilience #BoardRisk #EnterpriseSecurity

Karen Kaukol, CMO at Entrust, explains how to market trust and identity security when both the threat (deepfakes, AI fraud) and the defense are powered by AI. Karen spent 17 years at First Data managing digital marketing through an IPO and portfolio transformation, then joinedEntrust nearly a decade ago as CMO to lead marketing strategy for a global digital identity and security leader protecting the world's most critical transactions across 150 countries.Key Insights:■■ Why candor beats hype when marketing security. Enterprise buyers are tired of fear-mongering and AI buzzwords. They respect vendors who shoot straight about what's working, what's uncertain, and where the real risks live.■■ The paradox: defending against AI-powered attacks while using AI to market that defense. Both threaten and protect at scale. The key is transparency about how you're using AI and honest acknowledgment of what you don't yet know.■■ Buying committees have exploded to 14-17 cross-functional people who tune out jargon. You must always reframe back to the business problem you're solving, not the technical terminology.■■ Brand awareness is a revenue lever, not a cost center. Most marketers can't prove the connection. Karen shows how to build a funnel from awareness to preference to consideration to revenue, then prove it with real customer data to your board.■■ AI-enabled video production costs one fifth of traditional agencies ($100K vs $500K) and delivers 60% faster with better iteration cycles. In-house creative plus boutique agency plus AI tools creates multiplying effect.■■ The real differentiator is trust, built through learning communities, thought leadership, and third-party validation. Owning the conversation before the sales funnel means your brand becomes the discovery engine.Timestamps:00:01 Introduction01:03 Karen's 30-year career arc through product, marketing, and innovation02:53 What Entrust does: securing identity across the full lifecycle04:21 Scale of Entrust's reach: every credit card, corporate login, banking transaction05:20 Karen's CMO scope: product, brand, performance, communications06:39 How Entrust uses AI as core to marketing workflows07:52 The brand campaign that cost one fifth the traditional budget08:58 Buyers using AI to research before ever visiting your website10:35 The paradox: defending against AI while using AI to market12:46 Enterprise buyers are tired of hype and fear-mongering14:59 Why candor and transparency win over bold promises15:57 The jargon tax problem: explaining post-quantum cryptography to non-technical buyers17:58 Reframing security concepts to business outcomes not technical specs19:25 Three phases of buyer journey: awareness, trust, conversion22:37 What activities belong in each phase with real examples25:36 Building the Identity Thread: owned community as competitive advantage26:57 Quality over volume in content strategy for sophisticated buyers27:16 Moving beyond vanity metrics to actual revenue impact KPIs30:51 How to prove brand impact to board with funnel data33:48 Zero-based budgeting: reject inertia, allocate based on business case36:48 Portfolio A-book/B-book analysis forces focus over spray-and-pray40:05 What's increasing: website optimization for AI, selective in-person events42:28 What's decreasing: volume of content, commoditized brand campaigns43:20 Behind the scenes: AI video production under 100K in 60% less time47:32 What marketing skills matter most in AI era: critical thinking, judgment, curation49:30 What excites Karen about next three years of security automationlFollow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijau #TrustMarketing #AI #CybersecurityMarketing #IdentitySecurity #B2BMarketing #EnterpriseMarketing#ContentMarketing #BrandBuilding #MarketingLeadership #BuyerJourney #ThoughtLeadership #DigitalTransformation

Dennis Kozak, CEO of Ivanti, explains why endpoint management goes autonomous before customer-facing AI, why the patch apocalypse changes the math for every Fortune 500, and what makes buyers choose when seat-based licensing breaks under one-person-to-many-agents.

Dennis spent 22 years at CA Technologies through a company that ran 200+ acquisitions over 40 years, then drove 70% of Avaya's revenue as global channel chief. Three years ago he joined Ivanti as COO, became CEO on January 1, 2025, and now runs the platform 30,000 enterprises and 120 million users rely on for the operational backbone of IT and security. He is shipping autonomous IT operations across endpoints, ITSM, and security ops with two major 2026 product launches thatship the thesis.

KEY INSIGHTS:

◼️ Why endpoint management goes autonomous before help desk or security ops (and what changes inside the IT department when it does)

◼️ How the 72-hour patch reverse-engineering window rewrites the math for every Fortune 500 patching cycle

◼️ What 30,000 enterprise customers actually look like when one Ivanti POC found 80% of devices missing significant patches and some had never been patched in years◼️ Why the GSI managed services revenue stream consolidates fastest under autonomous IT, and which service lines get repriced◼️ How AI native thinking differs from AI powered thinking inside Fortune 500 ITSM teams (the reframe most CIOs miss)◼️ What variable-metric pricing replaces seat-based licensing when one person manages many agents and the help desk shrinks from 10 people to one with a good agent

TIMESTAMPS:

00:00 Teaser

01:30 Intro

01:44 Main Episode

02:46 The 22-Year Operator Arc: CA, Avaya, Ivanti

04:14 The Real Bet Behind “Embedding AI in Workflows”

05:54 Half a Billion Endpoints: What Most People Miss About Ivanti

07:04 Bridging IT and Security When Reporting Lines Won’t Bridge

14:18 Pick One: Where Autonomous Lands First Across ITSM, Endpoint, Security Ops

14:34 Why Endpoint Wins, And What Patch Tuesday Always Got Wrong

18:42 The Patch Apocalypse: Hours, Not Days, Not Weeks

20:55 The System of Record That Makes Three C-Levels Happy

21:46 The CIO and CISO Visibility Problem: You Can’t Patch What You Can’t See

24:52 Real Customer POC: 80% of Devices Missing Significant Patches

26:10 Why Some Airlines Can’t Fly Without Ivanti Software

27:12 Every Board Asks: What Is Our AI Story

30:52 AI Native Thinking vs AI Powered Thinking

34:18 Pricing Autonomous IT: Relative Value Beats Seats

38:53 Why Lovable’s Credit Model Found Power Users

42:57 What Happens to the GSI Managed Services Revenue Stream

46:28 The Horizon: What Excites a First-Time CEO Right Now

Follow Dennis Kozak: https://www.linkedin.com/in/kozakdennis/

Follow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijau

Links:

Ivanti: https://www.ivanti.com

Flywheelr: https://www.flywheelr.com

BrandStori: https://brandstori.ai

CXO Spotlight: https://www.linkedin.com/showcase/cxospotlight

Listen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZ

Listen on Apple: https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in b2b/id1792963542

#AutonomousIT #ITOperations #Ivanti #EndpointManagement #PatchManagement #ITSM #CIO#CISO #EnterpriseSecurity #AgenticAI #PatchApocalypse #ITServices #ManagedServices#FortuneFiveHundred #EnterpriseSoftware

Ravi Soin, Chief Information Security Officer at Smartsheet, explains why 7 out of 10 workers use AI tools their company can’t see, why governance is now part of the profit rather than just the loss column, and how he answers product teams who want to ship AI agents to Fortune 500 customers in three weeks.Ravi spent 15 years building products and securing them across Sun Microsys-tems, Real Networks, and Microsoft (Education, Windows Office, Bing), before becoming both CIO and CISO at a healthcare software company in a regulated industry for 15 years. He joined Smartsheet, the work execution platform 85% of the Fortune 500 runs operations on, after Blackstone and Vista paid $8.4 billion to take it private. He is now building the AI governance layer for how some of the largest enterprises in the world actually run their work, where the data being protected is not credit card numbers but the project plans, resource decisions, and strategic timelines that define how a company operates. Why the Smartsheet 2026 research found 7 out of 10 workers use AI tools their company can’t track, while only 1 in 4 companies have governance in place How a CIO+CISO mindset rewires the board conversation: governance as part of the profit equation, not just the cost of preventing loss What changes when private equity owns the company, including a 24x7 follow-the-sun SOC across India, Bulgaria, and the US The exact answer Ravi gives a product team that wants to ship AI agents toFortune 500 customers in three weeks (NIST 800-53 controls, security gates at code check-in, defense in depth) Why responsible AI on Smartsheet starts with one rule: AI agents do nothing a human couldn’t do, and every action is logged in real time Why the basics still beat 90% of attacks, even as time to exploit collapses from years to months to days to hours

Vicky Bindra, CEO of Trulioo, explains why the total volume of agentic com-merce transactions today is in the thousands not the millions, why the biggest blocker is a missing shared responsibility model, and what every CIO should know before their AI agents start placing orders with vendors.Vicky is one of the most uniquely qualified people to answer these questions.He spent 25 years building the rails that move money around the world at Visa, Mastercard, FIS, and Nuvei. He now runs the identity verification company that spans 195 countries, 14,000 ID documents, and 700 million business entities, deciding whether AI agents get to use those pipes. He is defining Know Your Agent as a new compliance category alongside KYC and KYB.KEY INSIGHTS: Why the move from click to buy to code to buy actually adds friction at thestart before it gets frictionless, and what that means for merchants, issuers, and CIOs deploying agents right now. The missing shared responsibility model for agentic commerce, and why merchants are quietly refusing to adopt until Visa, Mastercard, and Amex publish the rules for liability shift. Know Your Agent (KYA) as a new compliance category: who developed theagent, what the code can and cannot do, and how to bind an authorized agent to a specific customer. The CIO playbook for B2B agentic commerce: run human in the loop andagent transactions in parallel for a month, validate the construct, then identify where the real risks actually are. Why B2B agentic commerce is the bigger prize than consumer, because payment does not move with the transaction and the fraud surface collapses to two questions: quantity and delivery. The real scale of agentic commerce today: total transactions in the thousands, biggest single purchase in the small hundreds of dollars. What the hype cycle is getting wrong.TIMESTAMPS:00:00 Teaser02:20 Intro02:34 Main Episode03:22 Why an identity company was the bigger bet after 25 years in payments05:01 From click to buy to code to buy, and why the early friction is the point07:43 What breaks at Trulioo when the entity on the other side is no longer a person09:26 The fundamental difference between B2B and consumer agentic commerce11:35 Step by step, what happens when an AI agent buys something on your behalf15:26 Fragmented risk systems and why velocity without visibility is a liability16:11 If you let bad people in the door, it is very hard to get them out17:46 Know Your Agent (KYA) as a third compliance category alongside KYC and KYB21:13 The data layer, verifying both the human and the agent, and how to match them23:06 The industry liability shift merchants are quietly waiting for24:02 Agentic commerce needs a shared responsibility model, same as cloud did25:30 The B2B CIO playbook, vendor purchases, and what can blow up in your face28:24 High value goods and shortage industries as the riskiest B2B agentic surface29:21 Why B2B validation must run in parallel, unlike consumer29:44 Visibility, verification, and human in the loop, the three part B2B synthesis31:21 The real scale of agentic commerce today, transactions in the thousands32:03 Why B2B will be the bigger prize, and an optimistic read on consumer33:56 The merchant’s dilemma and what they can do tomorrow morning36:55 What a 25 year old entering fintech or AI should be learning right now40:00 The next couple of years, the optimist’s read on where this is headedFollow Vicky Bindra: https://www.linkedin.com/in/vickybindraFollow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLinks: Trulioo: https://www.trulioo.com/Flywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZListen on Apple: https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542

Jesper Borg-Alsson, Chief Security Officer for Northern Europe at Palo Alto Networks, explains why your current security strategy is built for threats that no longer exist. With 20+ years managing security at scale from NATO toNotPetya incident response to advising Fortune 500 CISOs, Jesper reveals the gap between resilience (the floor) and anti-fragility (the framework that wins). He shows why organizations need to embrace disruption rather than just survive it, and what makes one vendor chosen over another when every competitor claims identical features: the ability to turn threat landscape volatility into your competitive advantage.Jesper's pattern: when complexity explodes, he builds frameworks that separate signal from noise and connect security directly to business outcomes. At Palo Alto, he works across Northern Europe advising CISOs on the specific shifts required for AI-era threat landscapes where access-to-impact now happens in under 60 seconds.Key Insights:■■ Resilience is the floor, not the ceiling. You need controls before, during, and after incidents. But mature compliance frameworks fail when process dependencies aren't mapped to digital systems. Perfect technology can coexist with fragile operations.■■ AI accelerates both attackers and defenders exponentially. Threat actors use AI to optimize attack velocity and evasion. Your security operations team cannot respond at sub-60-second attack speeds without new architecture,tooling, and decision frameworks.■■ The Imagine-Invest-Improve framework turns anti-fragility from theory into practice. Imagine phase stresses assumptions with tabletop exercises. Invest phase splits budget 80-20 for core resilience and high-risk innovation.Improve phase harvests every failure as learning.■■ Data recovery after ransomware breaks AI models silently. Restoring encrypted datasets without understanding AI training data dependencies reintroduces bias and degrades performance over time. Most organizations have zero process for this.■■ Three strategic investment areas now dominating: observability and visibility into what's running inside AI systems, integration security as AI agents multiply and create new attack surfaces, and data security through purpose-led data segmentation at creation point.

Follow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLinks:Palo Alto Networks: https://www.paloaltonetworks.comFlywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on S #AISecurityFramework #NotPetya #DataSecurity #IntegrationSecurity#VulnerabilityManagement #IncidentResponse

Muneer Hafez, CTO at Independence Pet Holdings, explains how to build a transformative AI platform while keeping legacy systems running, why most AI projects fail to deliver real dollars, and the radical choice to bifurcate yourorganization instead of asking people to choose between jobs and innovation.Muneer spent 30+ years in technology across Siemens, PwC, Deloitte, EY, and TransUnion, scaling everything from enterprise infrastructure to M&A integration at massive scale. At Independence Pet Holdings, he's managing one of the most complex transformations in enterprise today: modernizing 10 acquired companies with 10 different legacy systems, 10 different policy administration platforms, and 800,000+ insured pets, all while building an AI-native operation from scratch. The journey reveals why "stabilize first, then innovate" kills speed, how tribal knowledge becomes your competitive advantage, and what CIOs actually care about when vendors claim the same capabilities.Key Insights:■■ Why bifurcating your organization (legacy + AI-native running in parallel) is the fastest path to transformation, even though it costs more upfront.■■ How rebadging employees instead of laying them off solves three problems at once: tribal knowledge protection, team morale, and self-funding the new stack through cost savings.■■ Why 89% of AI projects deliver only blue money (soft benefits) instead of green money (dollars to the P&L), and what CIOs must demand from their teams.■■ The three fatal mistakes in every failed transformation: incremental culture change, shared resources that always prioritize the revenue engine, and copying old processes into fancy new tools.■■ How one-page strategy (vision without jargon) converts skeptical boards and tech teams, and why it beats 20-page presentations every time.■■ What IT professionals and developers should actually be learning now if they want to stay competitive as AI commoditizes coding.00:00 Introduction03:51 Career arc: from software engineer to CIO to business translator08:49 TransUnion's 50 data centers: the patterns that prepared him for this11:37 The sprawl revealed: 10 policy systems, hard-coded business logic, single points of failure14:39 800K+ pets insured but the systems are 15-20 years old18:49 Most people say "stabilize first, then AI." He chose both at once.20:33 The bifurcation strategy: two parallel organizations24:32 Why rebadging beats layoffs: tribal knowledge, morale, and self-funding26:34 Blue money vs. green money: why most AI projects don't move the needle31:42 The SAP lesson: conform yourself to the tool or it fails from day one35:04 People is always harder than technology36:45 Building culture from scratch: one-page strategy over 20-page presentations39:37 Self-funding through cost restructuring and managed services41:42 Risk mitigation: protecting the BAU while building the new42:01 One year in: what's working, what's still ahead46:53 Lemonade is the competitor. He wants to leapfrog them.48:07 The one-page strategy: for tech teams vs. business teams54:18 Partner selection for legacy vs. innovation: big fish in a small pond57:35 Why vendors driving strategy kills competitive advantage59:50 What developers and data scientists should focus on to future-proof careers01:04:01 Pet parent Miso: why he works with cats instead of dogs01:06:26 What excites him most about AI over the next two to three yearsFollow Muneer Hafez: https://www.linkedin.com/in/munirhafezFollow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLinks:Independence Pet Holdings: https://www.independencepetholdings.comFlywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZListen on Apple:https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542

Dr. Diana Cano, Chief Information Officer at Cambium Learning Group, explains why AI readiness fails when it starts with technology instead of business strategy, how education can use AI responsibly at the scale of 29 million students and 3 million teachers, and what CIOs actually need from partners when every vendor claims to be AI-powered.Diana has moved across five industries, from GE and Honeywell to ETS, Odyssey, and now Cambium Learning Group, bringing a repeatable pattern of leading change through complex technology environments. Two years ago, she joined Cambium Learning Group, an education technology company serving millions of students and teachers, to help scale technology, AI adoption, and responsible innovation in a market where every decision can directly affect learning outcomes.◼️ Why AI readiness fails when it becomes an IT initiative instead of part of the business strategy◼️ How CIOs can move teams from AI curiosity to confidence through low-risk, practical experimentation◼️ What partners must prove before their AI solution is trusted in a real enterprise environment◼️ Why shadow IT can become a feedback loop for CIOs instead of just a governance problem◼️ How mission-driven companies compete for AI talent when they cannot match Big Tech salaries◼️ Why education’s slower AI adoption is not hesitation, but purposeful responsibility00:00 Teaser: AI Readiness, Shadow IT, and Vendor Claims01:18 Introduction02:37 What Five Industries Taught Diana About Change04:57 Applying Physics to Leadership and Management07:50 Building AI Readiness for 29M Students08:36 Why AI Adoption Starts With Relatability13:29 Explaining AI Value to Business Leaders17:34 The AI Hurdle CIOs Don’t Talk About Enough19:10 Why CIOs Need Learning Tours, Not Listening Tours23:26 Why Every Employee Is Becoming a Technologist24:00 Why Shadow IT Is a CIO Feedback Loop25:00 How CIOs Can Self-Fund AI Initiatives29:42 Competing for AI Talent With Mission32:58 How CIOs Should Evaluate AI Partners34:24 The Three Proofs Every AI Vendor Must Pass39:14 Why AI Will Change Tech Pricing Models43:31 AI Use Cases That Delivered Real Value49:23 What Responsible AI Looks Like in Education54:35 Why AI Can Personalize Learning at ScaleFollow Diana Cano: https://www.linkedin.com/in/dianacanoFollow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLINKS:Cambium Learning Group: https://www.cambiumlearning.comFlywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZListen on Apple:https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542#CXOSpotlight #DianaCano #CambiumLearningGroup #CIO #ChiefInformationOfficer #AIReadiness #EnterpriseAI #AIAdoption #ResponsibleAI #EdTech #EducationTechnology #DigitalTransformation #TechnologyLeadership #ITLeadership #AIGovernance #FutureOfEducationSubscribe to CXO Spotlight for more conversations with technology leaders shaping the future of enterprise AI, digital transformation, and business leadership.

Mignona Coté, a top 10 CISO in the world with three decades of security leadership across AWS, PepsiCo, Bank of America, and Infor, reveals what vendors keep getting wrong in the first meeting, why every cloud platform is equally secure, and how the "human in the loop" governance model breaks the moment AI touches your stack.Mignona has led security through three major technology inflection points: the explosive growth of the internet at GTE and Verizon, the financial crisis at Bank of America where she ran security for 200,000 people across credit cards, home loans and Merrill Lynch, and the cloud adoption wave at AWS. Most recently as SVP and CISO at Infor, she was responsible for the security of a platform serving more than 60,000 companies across industries. She is a top 10 CISO globally, a two-time Dallas ORBIE Award winner, and a Hall ofFame inductee who today advises a portfolio of security startups.◼ Why every cloud platform is equally secure, and the real question CIOs should be asking instead◼ How AI has broken the traditional "human in the loop" model and what has to replace it◼ What vendors must do in the first meeting to win a CISO's trust (hint: bring two people, not fifteen)◼ Why CISOs who stay in one role too long start solving yesterday'sproblems◼ The empathy framework that turns developers into security allies instead of compliance checkboxes◼ What CISOs talk about privately that never makes it into theboardroom00:00 Teaser00:53 Intro01:07 Main Episode01:53 Three decades in, top 10 CISO globally, still learning from 5am to 7am02:47 What it means to be the security officer for 60,000 companies03:46 From the dot com era to the financial crisis to the cloud04:14 Why each company forces a completely different security program05:29 What banking, telecom, and consumer tech each taught her07:26 Leaving the single-company CISO role for advisory work08:15 What builders of enterprise AI platforms keep getting wrong10:37 The “default secured” principle every product team should adopt13:11 88% human error, 63% inadvertent sharing: where SaaS responsibility sits14:39 Empathy as a security strategy, and why auditors get it right17:32 “Shift left, shift left. I call it shift anywhere.”17:37 How AI compounds the threat and breaks old governance models19:07 Building a governance model that flexes like Lego21:28 What feels different about this AI inflection point22:16 Inside the CISO Ascent Board: what CISOs never tell the board26:07 The advice she would give early-career security professionals26:53 Why staying in one role too long will hurt you28:25 Why CISOs have to get hands on with the technology29:46 What single-cloud security misses about multi-cloud reality31:35 The questions CIOs should ask vendors, but rarely do33:39 Choosing the right partner: accessibility over sales pitch34:27 The CrowdStrike account rep story every vendor should hear35:12 What IT services companies must change to sell to CISOs36:34 Chirag’s keynote reframe: “Nobody wakes up saying let me see a demo today”37:20 The late-night call, the board presentation, and digital watermarking38:28 What excites her about the startup security space40:29 What AI will change about the CISO role in two years41:07 The one question the host forgot to askFollow Mignona Coté: https://www.linkedin.com/in/mignonacoteFollow Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLinks: Flywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZListen on Apple:https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542#CXOSpotlight #CISO #Cybersecurity #CloudSecurity #MultiCloud #InformationSecurity #SaaSSecurity #AISecurity #SecurityGovernance #EnterpriseIT #CIO #CISOCommunity#VendorSelection #ITServices

Nidhi Aggarwal, Chief Product Officer at HackerOne, explains why the zero-day clock dropped from 23.2 days to 20 hours in a single year, why the entire CISO playbook is being rewritten around continuous defense, and what she is hearing from the CISOs at 20% of the Fortune 500 who are losing sleep over Mythos and autonomous AI hackers.Nidhi is one of the most uniquely qualified people to answer these questions. She co-founded a cloud platform that Google acquired. She holds six US patents. She has built products at McKinsey, HP Labs, and VMware. She now steers the AI roadmap at the platform that pays out $81 million a year to ethical hackers, manages over 2 million security researchers, and just watched an autonomous AI climb to number one on their own leaderboard. Her customer list is the companies that would be on the front page of the Wall Street Journal if they were breached.KEY INSIGHTS:◼ Why the entire security architecture was built on an assumption that is no longer true, and what CISOs should do with the boardroom attention Mythos just bought them.◼ How the zero-day clock compressed from 23.2 days to 20 hours in 12 months, and why that single metric reframes the entire CISO operating model.◼ Why "vulnerability ops" is the DevOps moment for security, and what a continuous detection pipeline actually looks like in practice.◼ The Mozilla case that changed her mind on AI slop: 122 vulnerabilities found, 14 high and critical, zero that represented true exposure. Why defense is offense.◼ Why the ethical researcher community is adopting AI faster than CISOs and why that is the single biggest silver lining in this moment.◼ The HackerOne platform data nobody else has: 300% increase in open source vulnerability reports from January to March, duplicate rates jumping from 22% to 47%, and what the high and critical findings actually tell us.TIMESTAMPS:00:00 Introduction01:17 An atypical path from HP Labs to McKinsey to Google acquisition to HackerOne05:19 What HackerOne is today, not what you think it is08:06 The Wall Street Journal customer list10:07 Mythos and the moment CISOs spent the night editing their war plan11:04 The zero-day clock, 23.2 days to 20 hours13:01 How CISOs should proactively prepare right now14:42 Humans, agents, and AI together on the leaderboard17:28 How to propose the new cybersecurity posture to the board18:10 The full continuous defense playbook20:04 Vulnerability ops, the DevOps moment for security21:04 Bug class elimination instead of whack-a-mole23:22 Mozilla, 122 vulnerabilities, and the power of defense23:29 Defense is offense25:53 The new cybersecurity team, aligned with business speed28:42 Patterns from CISO conversations right now29:02 Platform data, 76% volume increase tied to Opus 4.630:10 300% increase in open source reports, duplicate rates, high and critical findings32:15 The AI creating the problems is the solution35:09 The CISO nirvana state, a self-healing security layer36:40 Diversity of thought as a security capability39:30 Why this future is more possible than it sounds40:24 Advice to the ethical researcher and cybersecurity communityFollow: Nidhi Aggarwal: https://www.linkedin.com/in/nidhi-aggarwal-6454ab1/Follow: Chirag Khanijau: https://www.linkedin.com/in/chirag-khanijauLinks: HackerOne: https://www.hackerone.com/ Flywheelr: https://www.flywheelr.comBrandStori: https://brandstori.aiCXO Spotlight: https://www.linkedin.com/showcase/cxospotlightListen on Spotify: https://open.spotify.com/show/4xVy5IPCvf68BrGaALfUMZListen on Apple: https://podcasts.apple.com/us/podcast/cxo-spotlight-growth-influence-leadership-in-b2b/id1792963542#CyberSecurity #CISO #HackerOne #AIsecurity #AgenticAI #BugBounty #VulnerabilityManagement #ZeroDay #EthicalHacking #SecurityLeadership #AISecurity #CTEM #AppSec #AIRedTeaming #PromptInjection