The Evolving CISO: AI, Leadership and the Future of Cybersecurity

Hi, I'm Joan Goodchild with cso. Welcome to another episode of Cyber Sessions. Right now we are here at the CSO Cybersecurity Conference and Awards in Nashville. And I'm so excited today to be joined by hall of Fame CSO hall of Fame inductee Gary Harbison.

He is the Chief Information Security Officer with Johnson and Johnson. So welcome, Gary. Thank you.

I appreciate it. Thanks for having me. Yeah, great.

So you've, you know, been, you're going to be part of a few different panels while we're here and one of them is really kind of about, you know, the role of the CISO and leadership and just, you know, how different people on the panel have had these different kinds of career trajectories in this role.

So let's start right there. Tell me a little bit about your own unique path in the security industry. Sure.

You know, I consider myself to have been very lucky to have a lot of the opportunities I've had. You know, this is in October, it'll be 30 years in cybersecurity and which has really gone by fast.

But had the opportunity to start out much more on the technical side in various engineering roles, learn a lot about infrastructure, end up in security technology and engineering roles, then move up into more of an architecture, more strategy, eventually make the transition to leadership and being less hands on and then eventually into the CISO role and more at the executive level.

And you know, I've worked for some amazing companies at Johnson, Bayer, Monsanto, Anheuser Busch, US Government, and worked for, with and had some amazing people that worked for me that I've learned from for years.

And so, you know, having that journey and that technical side, but also a little bit more knowledge of the business as I progressed in my career is, has really helped me out. That's interesting.

So 30 years in the industry, you've seen a lot of changes. Yes.

You've gone up kind of in the ranks and up to the executive level. How do you think the expectations for the CISO have changed?

It's a great question. And really when I started my career, the CISO role didn't even really exist.

You had folks that were the head of Information Security and had maybe a title like that, but I think back then it was really somebody that was expected more to just manage the operations and deal with attacks, and even attacks were a different type of severity because not all companies relied on digital capabilities as much.

We didn't have the pervasive use of digital technology in our day to day lives. And so there was a different scope of potential impact back then than there is now.

And what I see now is this is a day topic that comes up with all of our business stakeholders, even in our personal lives, with family and friends, because technology has brought so many great things to our lives.

But with it comes some risk from a cybersecurity perspective. And it changes the conversations a little bit on how we manage that and how we advise, you know, all of our stakeholders on risk decisions each day. Yeah.

Now, of course, you know, with 30 years in the industry, we've seen so many things change and we, you know, certainly know that the threat landscape is constantly evolving no matter what. And it's, you know, always a game of trying to catch up.

And now, of course, in the last few years, AI introduces an entirely new level of threat landscape as well as, you know, tooling and strategy to be able to, you know, handle the threats that are put on ciso's tables every day.

So just from your, again, veteran perspective, how do you think AI is now changing the conversation in different directions?

It's a great question. I think AI is going to do some amazing things for the world and it brings capabilities to help companies across every industry bring forward innovations and products and capabilities that just may not have been possible in the past.

And from a security perspective, we kind of look at it from three aspects and I always look at it like as the three legged stool.

There's how do we focus on making sure that our business can embrace and use AI in a safe and responsible way to continue to innovate faster and bring new products to market?

How can we use AI to help us as well on our security capabilities and how we deploy those.

And then we also have to stay ahead of how AI is being used differently from a threat actor perspective to launch different types of attacks or at a different speed and scale than we've seen in the past.

Another thing that gets brought up a lot now with relation to AI, of course, is the conversation around talent. And again, for years, as you've seen in this industry, there's been a lot of conversation around the deficit of talent.

We don't have enough people to fill jobs then that shifted in the last few years.

Now there's a very different kind of concern around how are we using this technology and ensuring that we're still using people as well, and what the human element role is when it comes to using AI in tandem with security teams.

What kind of thoughts do you have around that?

Yeah, I mean, I know there is a lot of concern about what AI means to jobs across several types of jobs and industries. But I heard a good quote in a interview that I had seen that, you know, someone won't lose their job to AI.

They'll lose their job to someone who uses AI to do the role more effectively. And I really think that's where we're going to see that play out.

And on the cybersecurity side, I do think some roles are going to change in terms of how they do their work or the scope of the work that they provide because they're going to use AI to do it more effectively.

But I also do think you mentioned the deficit that we've been under for many years on not having enough talent to meet the growing demand.

I think AI can help us with that and we can look at how we do work and how we accomplish work using the unique talents of the people that we have, but then having some of that other more manual tasks or more intensive analysis of data and things like that done by AI.

So I do see it as an opportunity. I understand why there's concern with folks, but I think it's going to play out to have a positive impact long term. Okay, great.

Well, Gary Harbison, thank you for joining us today. Thank you.

And congratulations on your recognition in the hall of Fame. Thank you.

I appreciate it. All right, great.

And thanks to you for watching. We'll have lots of other videos here out of the CSO Cybersecurity Conference and awards. For now, I'm Joan Goodchild with cso. We'll see you next time.