The New Power Bloc - Aligning CISO, CDAO, CIO and CTO for Enterprise Grade Resilience

The New Power Bloc - Aligning CISO, CDAO, CIO and CTO for Enterprise Grade Resilience

Speakers: Pedro Uria-Recio (Chief Data & AI Officer, CIMB); Prabhath Karanth (CISO, Greenlight); Roya Gordon (CISO in Renewable Energy, Renewable Energy); Thamer AlOtaibi (CTO, Cipher); Burgess Cooper (CEO, Cybersecurity, Adani Enterprises Ltd.)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=IWp8ZCNvOsE

Overview

In an era where enterprise operations are increasingly interconnected and technology decisions carry profound operational and financial consequences, the traditional silos separating leadership roles like the Chief Information Security Officer (CISO), Chief Data & AI Officer (CDAO), Chief Information Officer (CIO), and Chief Technology Officer (CTO) are no longer sustainable. This compelling panel discussion at Black Hat MEA, titled "The New Power Bloc - Aligning CISO, CDAO, CIO and CTO for Enterprise Grade Resilience," convened a distinguished group of industry leaders to dissect this critical evolution. Moderated by Burgess Cooper, CEO of Cybersecurity for Adani Enterprises Ltd., the panel explored how organizations can dismantle territorial boundaries, forge a common language, prioritize unified objectives, and construct robust governance models that deftly balance safety, speed, and innovation.

The core premise of the talk centered on the emergence of a "new power bloc"—a unified leadership front comprising these key C-suite executives—essential for achieving enterprise-grade resilience. The discussion probed how businesses are redefining their operational paradigms, embedding cybersecurity, data ethics, and digital trust into every strategic decision. The panelists, drawing from diverse backgrounds spanning finance, renewable energy, fintech, and consulting, shared invaluable insights into the practical challenges and strategic imperatives of this collaborative model, offering a forward-looking perspective on how organizations can not only survive but thrive in an increasingly complex and threat-laden digital landscape.

Background

▶ Watch: Panel introduction: The New Power Bloc (0:00)

Historically, cybersecurity functions within enterprises often operated in isolation, confined to a "dark corner" of the organization. The CISO, primarily viewed as a technical guardian, focused on monitoring networks, securing endpoints, and implementing email security, largely detached from broader business objectives or even core IT operations. This siloed approach, while perhaps functional in less interconnected times, has been rendered obsolete by the rapid acceleration of digital transformation, the pervasive integration of Artificial Intelligence (AI), and the increasing reliance on complex data ecosystems and cloud infrastructure.

The problem stems from several converging factors. Firstly, the sheer pace of technological evolution means that new capabilities, like advanced AI models and quantum computing, introduce novel attack surfaces and threat vectors faster than traditional security paradigms can adapt. Secondly, the escalating sophistication of adversaries, who now leverage AI for more potent attacks, demands a unified and intelligent defense. Thirdly, the operational and financial impact of security incidents has grown exponentially, transforming cybersecurity from a technical concern into a paramount business risk. Boards of directors are no longer content with disparate reports on security, AI risk, and operational risk; they demand an integrated, holistic view of technology risk that reflects the enterprise's overall resilience posture.

Prior organizational structures often fostered an inherent tension between security and other functions—for instance, between the CISO's mandate for control and protection, and the CIO's drive for speed, delivery, and performance. This conflict, while acknowledged as a "healthy" part of business dynamics by Thamer AlOtaibi, historically lacked systematic management. Furthermore, a reliance on spontaneous, case-by-case decision-making, particularly in areas like data and AI governance, has proven inadequate for crisis management. The need for a standardized, proactive, and integrated approach to resilience, transcending functional boundaries and embedded into the very design of systems and processes, forms the critical backdrop against which the "new power bloc" is emerging.

Key Findings

▶ Watch: AI's dual role: A shield and a sword for risk (15:40)

The panel discussion illuminated several critical findings regarding the evolving landscape of enterprise resilience and the shifting roles within C-suite leadership:

• The Mandate for Unified Leadership: The most significant finding is the undeniable necessity for CISO, CDAO, CIO, and CTO roles to operate as a single, cohesive "power bloc." This alignment is crucial for navigating the complexities of modern enterprise, where technology decisions have deep operational and financial implications.
• Evolution of the CISO Role: Roya Gordon highlighted the transformation of the CISO from a purely technical role to a more strategic, risk-focused position. She controversially suggested that the CISO might ideally operate outside of IT, potentially aligning with finance or a Chief Risk Officer, to effectively govern and hold other teams accountable without assuming all risk. The panel even posited a potential future title: Cyber Risk Officer or Cyber AI Risk Officer.
• AI as a Dual-Edged Sword: Pedro Uria-Recio emphasized that AI is both a powerful shield against risk and a significant creator of new vulnerabilities. It expands the attack surface through technologies like Large Language Models (LLMs) and prompt injection, while also empowering adversaries to launch more sophisticated attacks.
• Shifting Resilience Metrics: Prabhath Karanth articulated a move away from traditional uptime metrics towards business-centric indicators. Future resilience, he argued, will be measured by customer satisfaction (CSAT) and other business metrics that are intrinsically linked to underlying technology performance, rather than technology metrics dictating business outcomes.
• Healthy Conflict and Leadership: Thamer AlOtaibi acknowledged that conflict between different C-suite priorities is inevitable and even healthy. True leadership, he asserted, lies not in eliminating conflict but in managing it effectively through a people, process, and technology approach, underpinned by clear governance, risk management methodologies, and regulatory compliance.
• Criticality of Third-Party and Supply Chain Security: Roya Gordon underscored the expanding scope of the CISO's responsibility to include third parties and the global supply chain. This involves rigorous security assurance plans, assessing AI capabilities in vendor tools, and preparing for future challenges like post-quantum decryption, all while navigating complex geopolitical considerations.
• Standardization over Spontaneity: Pedro Uria-Recio stressed that resilience, particularly in data and AI governance, hinges on standardization. He advocated for predefined playbooks that are not merely documented but ideally coded into data pipelines, eliminating spontaneous, case-by-case decision-making during crises.
• Extreme Ownership and Dissolving Silos: Prabhath Karanth advocated for leaders who exhibit "extreme ownership," operating as if the entire company is theirs, regardless of titles or traditional silos. This mindset, he argued, is vital as technological advancements increasingly blur the lines between CISO, CIO, and CTO roles.
• CEO as the Ultimate Guarantor of Trust: In a powerful closing statement, Pedro Uria-Recio declared that the CEO must ultimately be in charge of trust. For industries like financial services, which fundamentally sell trust, this ownership is not just important but a "must."
• Security by Design: The panel concluded with a strong call for embedding security from the very inception of any project or tool development, fostering transparency and collaboration with cybersecurity teams from the outset.

Technical Deep Dive

▶ Watch: Geopolitical fragmentation and third-party risk management (21:00)

While a panel discussion on organizational alignment typically focuses less on granular code or protocol specifics, the speakers extensively discussed the technical underpinnings and implications of their roles in achieving resilience. The conversation highlighted how various technological domains—cybersecurity, data, AI, and IT infrastructure—are inextricably linked and demand integrated governance.

The evolution of cybersecurity, as described by Roya Gordon, traditionally involved isolated functions like network monitoring, email security, and endpoint security. However, the modern CISO’s technical purview now extends far beyond these basics. For instance, in her role securing a global renewable energy company with 90+ sites (including solar, wind, and battery farms), understanding Operational Technology (OT) cyber security is paramount. This involves securing industrial control systems and critical infrastructure, a domain that demands specialized knowledge distinct from traditional IT security. Her background in nuclear and power grid cyber security exemplifies this deep technical foundation.

Pedro Uria-Recio's insights into AI and data governance offered a critical technical perspective. He detailed how AI acts as both a protective shield and a dangerous sword. On the defensive side, AI can be leveraged for alarm detection and risk reduction. Conversely, it significantly expands the attack surface, introducing new vulnerabilities through technologies like Large Language Models (LLMs) and prompt injection. These new vectors require a deep understanding of AI model behavior, data provenance, and potential adversarial machine learning techniques. His proposal for standardization in data and AI governance involves coding playbooks directly into data pipelines. This concept moves beyond mere documentation, suggesting an automated, programmatic enforcement of security and governance policies within the very fabric of data processing and movement, ensuring consistency and reducing human error, especially during crisis situations.

Prabhath Karanth, in his dual CISO and CIO role at a fintech company, provided a practical view of integrated technical ownership. His responsibilities encompass platform engineering and operations, including Site Reliability Engineering (SRE) and cloud infrastructure. This direct ownership of systems and configurations enables him to embed security practices more seamlessly, reducing friction and accelerating the secure deployment of products. This reflects a technical architecture where security is not an add-on but an intrinsic component of DevOps and CloudOps workflows, driven by a leader with oversight across both development and security.

Thamer AlOtaibi, with his extensive background in digital transformation and establishing a Security Operations Center (SOC) as early as 2002, underscored the historical technical foundations and the continuous evolution. His experience as a CIO also highlights the technical tension between rapid deployment (IT) and stringent controls (cybersecurity). Managing this tension involves implementing controls over technology and leveraging technology to enforce governance processes.

The panel also touched upon future technical challenges. Roya Gordon explicitly mentioned the need to consider post-quantum decryption, indicating a forward-looking technical awareness of emerging cryptographic threats that could undermine current encryption standards. Her discussion of security assurance plans for third parties also delves into technical due diligence, evaluating vendor security postures, incident response capabilities, and the integration of AI capabilities within their tools. This implies a need for technical assessments of vendor architectures and security controls, especially as supply chains become more complex and interconnected.

In essence, the "technical deep dive" in this discussion wasn was less about specific code snippets and more about the architectural and systemic integration of security, data, AI, and IT. It emphasized the technical challenges of managing new attack vectors (LLMs, prompt injection), the need for automated, code-driven governance in data pipelines, and the strategic imperative of embedding security into core infrastructure and development processes from the ground up to build truly resilient systems.

Demo / Proof of Concept

▶ Watch: Controversial take: CISO should operate outside IT (32:00)

As a panel discussion focused on strategic organizational alignment and future trends, this session did not feature a live technical demonstration or proof of concept. The content was delivered through expert discussion, sharing of experiences, and conceptual frameworks rather than showcasing specific tools, code, or attack simulations.

Defensive Implications

▶ Watch: Ultimate currency: The CEO is in charge of trust (34:00)

The insights from this panel offer a robust framework for organizations and security professionals seeking to bolster their resilience in the face of evolving threats and technological shifts. The defensive implications span strategic, operational, and technical domains:

1. Strategic Alignment of C-Suite: Organizations must actively dismantle traditional silos between CISO, CDAO, CIO, and CTO. This "new power bloc" should establish shared metrics, decision rights, and unified runbooks to ensure a cohesive approach to technology risk. The goal is an integrated view of risk for the boardroom, moving beyond isolated reports.
2. Redefining the CISO's Role: CISOs should proactively evolve their mandate from purely technical enforcement to a strategic risk management function. This involves understanding the entire business—operations, trading, renewables—beyond just IT. Roya Gordon's controversial suggestion of placing the CISO outside of IT, perhaps reporting to finance or a Chief Risk Officer, warrants consideration for organizations struggling with accountability, enabling the CISO to act as an independent governing body. The CISO must become a "jack of all trades" with a strategic rather than purely technical focus.
3. Proactive AI Security and Governance: Given AI's dual nature, organizations must implement robust AI governance frameworks. This includes understanding and mitigating new attack vectors like prompt injection and vulnerabilities in Large Language Models (LLMs). Defensive strategies should encompass securing AI development lifecycles, ensuring data integrity for AI models, and implementing controls against adversarial AI attacks. Simultaneously, organizations should explore leveraging AI as a defensive shield for threat detection and risk reduction.
4. Standardized, Automated Governance: Spontaneous, case-by-case decision-making, especially during crises, is a liability. Enterprises need to develop standardized playbooks for data, AI, and cybersecurity incidents. Pedro Uria-Recio's vision of coding these playbooks into data pipelines represents an advanced defensive posture, ensuring automated, consistent, and rapid responses. This shifts governance from a manual, reactive process to an automated, proactive enforcement mechanism.
5. Enhanced Third-Party and Supply Chain Security: Defenders must extend their security perimeter beyond their organizational boundaries. This requires comprehensive security assurance plans for all third-party vendors and supply chain partners. These plans should be regularly updated to assess new risks, including vendors' AI capabilities and their readiness for emerging threats like post-quantum decryption. Geopolitical factors influencing supply chain security must also be integrated into risk assessments. Organizations should embed robust cybersecurity clauses in contracts and enforce strict notification and recovery protocols for incidents involving third parties.
6. Redefining Resilience Metrics: Shift focus from traditional technical metrics (e.g., uptime, RTO, RPO) to business-centric outcomes. Resilience should be measured by customer satisfaction (CSAT), business continuity, and the ability to maintain trust even during service degradation. This ensures that security investments are directly tied to business value and customer experience.
7. Fostering Extreme Ownership and Collaboration: Leaders across the C-suite must cultivate a culture of "extreme ownership," transcending job titles and traditional departmental silos. This involves actively fostering cross-functional collaboration, establishing common language, and ensuring that security is considered by design from the very inception of any project or product development. Bringing cybersecurity teams in from the beginning avoids costly retrofitting and improves overall security posture.
8. CEO-Level Accountability for Trust: Organizations, particularly those in trust-dependent industries like financial services, should formally acknowledge and empower the CEO as the ultimate guarantor of organizational trust. This elevates trust from a departmental concern to a core strategic imperative, ensuring it receives the highest level of executive attention and resource allocation.
9. Investing in Future-Proofing: Proactive engagement with emerging technologies like quantum computing and Y2Q (quantum readiness) is crucial. While these may seem distant, early discussion and strategic planning, as highlighted by Roya Gordon, can prevent future vulnerabilities and ensure long-term resilience.

Key Takeaways

• The "New Power Bloc" is Essential: Achieving enterprise-grade resilience demands the unified alignment and collaborative operation of CISO, CDAO, CIO, and CTO roles, breaking down historical silos to address interconnected technology risks.
• CISO's Evolving Mandate: The CISO role is transforming from purely technical to a strategic, cyber risk officer function, requiring a deep understanding of the entire business and potentially operating independently of IT to ensure effective governance and accountability.
• AI: A Double-Edged Sword: Artificial intelligence both expands the attack surface (e.g., LLMs, prompt injection) and offers powerful defensive capabilities; organizations must develop robust governance and security strategies to manage both aspects.
• Standardization and Automation for Resilience: Effective governance, especially in data and AI, requires standardization and predefined playbooks, ideally coded directly into data pipelines, to ensure consistent, rapid, and automated responses during normal operations and crises.
• Extreme Ownership and Collaboration: Leaders must adopt a mindset of "extreme ownership" and prioritize cross-functional collaboration over traditional job titles, embedding security by design from the project's inception.
• Trust as the Ultimate Currency: Trust is the paramount outcome of high resilience, and the CEO must ultimately be recognized as its chief guarantor, elevating it to a core strategic imperative for the entire organization.

About the Speaker(s)

The panel was moderated by Burgess Cooper, CEO of Cybersecurity for Adani Enterprises Ltd. In his prior career, he served as a cyber leader at EY and held CISO positions at HSBC and Vodafone, bringing a wealth of experience in leading cybersecurity strategies across diverse global enterprises.

Pedro Uria-Recio serves as the Chief Data & AI Officer at CIMB, a prominent bank operating across Southeast Asia. His background includes previous roles as a Chief Data & AI Officer at Chutelos, also in Southeast Asia, and a tenure as a McKinsey consultant. Pedro specializes in data analytics and AI, with a particular focus on leveraging these technologies to address cybersecurity challenges within the financial services industry.

Prabhath Karanth holds the dual role of CISO and CIO at Greenlight, a fintech company based in the US specializing in family finance. Prior to Greenlight, he was a CISO at Nan Trip Actions, a global fintech and travel company, and spent a decade at Adobe. With a background in consulting and industry, Prabhath is responsible for cyber security, platform engineering and operations, IT, and data functions.

Roya Gordon is the CISO for the North American region of a global renewable energy company, overseeing the cyber security of over 90 sites, including solar, wind, and battery farms, as well as a trading business. She began her career at a nuclear laboratory, focusing on power grid, nuclear, and pipeline cyber security. Roya also has experience consulting for major oil and gas companies on ransomware resilience and threat intelligence, and a background working for security vendors, giving her a strong Operational Technology (OT) security perspective.

Thamer AlOtaibi is the CTO of Cipher, a cybersecurity group, with over 25 years of experience in cyber security and digital transformation across various industries. Before joining Cipher, he served as the CIO of Sammy Group, the CIO of Nomac Aqua Power, and the CISO of Sedara Chemical Company. Notably, Thamer was part of the team that established STC's Security Operations Center in 2002, an experience that significantly shaped his journey in cyber security.