When Shepard Tone Turn Real – CISO of Zscaler on AI, Zero Trust and the SecOps Reckoning
Overview
Across Southeast Asia, CISOs tell me the threat environment no longer just sounds more dangerous, it feels structurally different. In my most recent CSO ASEAN Executive Session, I sit down with Sam Curry, Global CISO and SVP at Zscaler, to interrogate whether AI‑powered adversaries are simply another “Shepard tone” moment of rising fear, or a genuine shift in the nature of cyber risk.
Drawing on three decades in cybersecurity, from RSA Labs at MIT and McAfee to his current role at Zscaler, Sam points to recent AI‑orchestrated campaigns and tools like Mythos as inflection points. These systems do not just help human operators; they chain mid‑level vulnerabilities, generate exploit code in real time, and exhaust static, rule‑based defenses at machine speed. For defenders, the implication is uncomfortable: assume your controls are being tested and tuned against in adversary labs long before you ever see an attack.
Our conversation keeps returning to one pivot: moving security operations from reading the “wake” in logs to actively finding the “boat” in the noise. Sam argues that demands a SecOps revolution built on stronger signal sourcing, AI‑assisted detection, and zero‑trust principles that deliberately reduce attacker options and blast radius. He cautions CISOs to brace for storms of patches as suppliers uncover more vulnerabilities with advanced AI tooling, a period of instability in already chaotic environments.
At the same time, Sam is clear that AI is not a blunt cost‑cutting instrument. Better detection generates more findings, more escalations, and more conversations with the business. The work shifts, it doesn’t disappear. He challenges security leaders to map where AI genuinely creates efficiency they can redeploy, and where it creates effectiveness that must be staffed with higher‑value roles able to interpret outputs and remain accountable.
Ultimately, ours is a conversation about business, not just technology. Sam urges CISOs to frame AI‑driven cyber exposure in the language boards recognise such as revenue, margin, risk, customer satisfaction, employee efficiency and strategy, and to show up first as business leaders who happen to specialise in security, not the other way round.
Hosts
Editorial Director of CIO ASEAN and CSO ASEANFoundryAs Editorial Director, CIO ASEAN and CSO ASEAN, Estelle covers the business-IT leadership and C-suites of 10 diverse and unique markets. Estelle addresses the current dilemmas faced by these leaders including digital transformation, adoption of innovative technology, alignment of IT with business strategies, data privacy and sovereignty, attaining optimal outcomes from technology investments, talent scarcity to name a few. Estelle’s coverage draws on her deep expertise in digital transformation, business model innovation, technology analysis-offering CIO and CSO subscribers a front-row view into how ASEAN organizations are navigating the evolving technology landscape. She brings a critical lens to the intersection of cloud, AI, Generative AI, automation, cybersecurity and risk management. Estelle unpacks the real-world impact of emerging technologies on business agility, operational efficiency, and competitive advantage-translating complex trends into actionable insights for the region’s technology leadership and communities. She is a trusted advisor, speaker and moderator for technology buyer and vendor organizations in this region.
