From product to security culture, from reaction to asymmetric trust: how the role of Ciso is changing in the company
by P.Sol.
For years, we have portrayed cybersecurity as a defensive 'arms race' made up of new products, patches and controls added 'downstream' of projects already in production to guarantee security against intrusions and attacks from outside. Today, that paradigm has run out of steam. The cloud, digital supply chains, remote working, sensors and connected machines within the IoT are exponentially multiplying the access - and fragility - points of companies, while the acceleration imparted by artificial intelligence, particularly on the offensive front, renders the logic of successive patches ineffective. On the contrary, it increasingly imposes the need for a preventive and proactive approach.
What is needed is a concept of 'security by design', which is not just a slogan: it is the ability to transform security into a strategic design that permeates processes, technology and people. This is where the Ciso comes in, the security and IT manager who takes on an increasingly central role in corporate governance.
Gartner had already pointed this out strongly a year ago as part of its strategic forecasts: the discussion on AI and security is no longer ancillary, it is at the heart of every corporate governance strategy and redefines responsibilities and priorities, with impacts on organisation and risk controls. The transformation is not just about the tools: it is about who orchestrates. Ibm reconstructs the historical evolution of the chief information and security officer, who has evolved from a technician focused on firewalls and compliance to a risk manager capable of reading the enterprise and linking digital trust to business continuity, a sort of security 'architect' capable of tailoring defences and tools to the organisation and corporate structure.
Asymmetrical Trust
In Italy, the snapshot is evident in Deloitte's figures: in its recent Future of Cyber Survey, the cyber theme frequently enters the agendas of boards (discussed at least monthly in 69% of companies) and Ciso increases its weight in strategic choices; more than half of organisations plan to increase investment in security over the next 24 months. It is not a matter of 'spending more' on products, but of bringing the security manager to the strategic decision-making table as the architect of a resilience posture: mapping value streams, measuring risk in terms of business impact, translating threats into design requirements for applications, data governance and identities, human and non-human.
The adoption of a zero-trust approach was the big step of the last decade: 'Never trust, always verify', was the slogan of absolute distrust, of a total absence of trust. But AI is eroding the areas of predictability in our systems and even in our behaviour. One interesting proposal that has emerged in the debate over the last few months is the move to 'asymmetric trust': expanding the use of deception and decoy resources to shift trust to fake assets and make the attacker's lateral movement more costly and uncertain. This is not a repudiation of Zero Trust, it is an operational complement to it to take the advantage away from the criminal first-mover.
