Meerah Rajavel tells the team she leads at Palo Alto Networks that they need to think of themselves in heroic terms. They are the guardians of the galaxy.
“We always have to make sure that the integrity and the security of the business is protected,” says Rajavel, the cybersecurity giant’s chief information officer since 2022.
But in the age of AI, being a “guardian” is a much tougher job.
A decade ago, CIOs would constantly be questioned about the cloud and be tasked with keeping track of how it was being applied across their organizations. Which pockets of the business were leaning into the cloud? How is it being used? Is it secure? Today, CIOs are fielding similar questions about AI. Organizations need to protect the large language models they use, the data that goes into those models, and the various tools that utilize AI in new ways.
“I need to know what is the AI landscape of the company and what is the security posture of those different AIs,” says Rajavel. “And what do I allow and what do I not allow?”
To rise to the challenge, even experienced IT leaders like Rajavel—a veteran of Citrix, McAfee, and Cisco—are devising new strategies and techniques, as well as doubling down on the basics. “I think finally, the true genesis of zero trust is coming into picture,” Rajavel says.
Zero trust, she explains, requires continuous employee verification at every intersection point. Team members need to be persistently authenticated for each application they are using across an organization’s entire infrastructure. The trick for CIOs of course, is not driving company employees crazy with constant log-in procedures. To remove some of that friction, IT teams are implementing things like passwordless authentication.
AI-generated attacks are more sophisticated and have lowered the barrier to entry for cybercriminals. And in this environment, company employees are the weakest link, said Michael Bradshaw, the CIO of Kyndryl.
At Kyndryl, which spun out from IBM in 2021, mock phishing tests are sent out to employees to test their readiness. Kyndryl tracks the rate of success and uses that data to inform how to better educate team members about cybersecurity threats. There’s also ongoing training on how to spot deepfakes, particularly those that would feature senior executives reaching out to employees through non-company-approved channels, like WhatsApp.
“If you make it fun, if you make it engaging, people will get drawn in and it’s amazing what they retain,” says Bradshaw.
Amanda Fennell, CIO and chief information security officer at Prove Identity, echoes Bradshaw in stressing the importance of educating and preparing employees for these new types of AI-enhanced ruses.
“Do your compliance training, and that’s wonderful, but also teach your humans to be human and use it to their strength,” Fennell says.
Breaches tend to happen when people have an emotional response to a fraudulent request that contains elements of distress—a text message ostensibly from the CEO asking about an urgent invoice or a phone call imitating the voice of an employee’s child on the side of the road with a flat tire. In those moments, Fennell says that employees need to take a beat before springing into action.
Fennell is hopeful that larger companies, like Microsoft and Google, will get more assertive with their AI cybersecurity offerings.
“What are the large heavy-hitting players coming out with that are battling cyber issues with AI?” asks Fennell. “That’s what you’re going to see a lot of in 2024.”
John Kell
Send thoughts or suggestions to CIO Intelligence here.
NEWS PACKETS
OpenAI leans on ChatGPT to win over business customers. With 600,000 individuals paying for business versions of ChatGPT, OpenAI is hoping to lean on the chatbot's popularity as a way to sell enterprise AI services. Ninety-two percent of Fortune 500 companies are using ChatGPT in some form, the Wall Street Journal reports, but pressure is mounting to get more businesses on board as open-source models cut into OpenAI's leading position. The Journal reports that CIOs say OpenAI needs more enterprise credibility before they go all in on its services. And because startups like OpenAI are considered riskier than established enterprise sellers, CIOs also don't want to take on the additional vendor risk.
French IT firm unveils restructuring plan. Atos is seeking 1 billion euros in new funding and plans to cut the company’s current debt pile by at least half, Bloomberg reports, as pressure mounts after a series of blunders including supply chain constraints and accounting errors led to a 97% drop in Atos’ shares over the past seven years. Atos’ plans could change if the French government gets involved and there are indications that could happen, as French Prime Minister Gabriel Attal says the company must remain under French control and has advocated for the government to ensure Atos' financial stability. Atos is also playing a high-profile role this summer by providing cybersecurity for the Paris Olympics.
Layoffs sting Amazon, Apple, and EXL. A pandemic hiring spree, high interest rates, and the reallocation of resources toward AI solutions have led tech firms to lay off tens of thousands of employees last year and steadily throughout 2024 as well. A new wave of layoffs over the past week includes “several hundred” job cuts at Amazon Web Services, which is facing pressure from rivals including Microsoft Azure and Google Cloud. ExlService Holdings cut 800 jobs amid a pivot to hire more workers with advanced data, AI, and generative AI skills. Even mighty Apple, which avoided post-pandemic layoffs until now, cut 600 jobs after parking the company’s self-driving car project.
ADOPTION CURVE
Two out of every three C-suite executives say they intend to lure AI-skilled talent externally, compared with just 34% who plan to develop those skills within their existing workforce. The "buy versus build" gap is widest for AI talent, exceeding other skill gaps like data and digital literacy, and innovation, according to a survey of 2,000 leaders by the Adecco Group.
Denis Machuel, CEO of the Adecco Group, cautions "buying your way out of disruption should not be the only approach companies take” and calls the current path "unsustainable." It is also proving to be costly. Studies show that acquiring AI expertise externally leads to big spikes in pay.
JOBS RADAR
- Kickstarter has appointed Mahesh Guruswamy as chief technology officer, where he will report to the crowdfunding platform’s CEO, Everette Taylor. Guruswamy most recently was head of engineering at Mosaic.
- SAX LLP named Rob Owen as the accounting advisory firm’s first CIO. Owen will spearhead the strategic direction and oversight of the firm’s technology infrastructure.
- Verisk has announced that Louis DiModugno has been named global chief data officer, where he will lead data management efforts globally and report to chief information officer Nick Daffan.
- Noblis appointed Ed Lee as VP and deputy CIO, joining the company from Synergy BIS, where he served as a VP. He has more than 25 years of experience in the IT and government contracting industries.
- Imaginuity has named Matt Sommer as CTO after he most recently was the owner of consulting company Emergent Systems. Sommer also previously served as CEO and cofounder of MarketChorus.
- Premier Health of America announced the appointment of Bruno Morel as CTO, effective immediately. He has held several roles including CTO, VP of engineering, and senior director of software and DevOps.
