A CISOs Ideal Management Tool

There are a growing number of start-ups and incumbents using AI capabilities to provide tooling for CISOs and teams to help them run their security programs at various scales. Some of these are well thought through, from the ground-up, others are legacy GRC tools with some AI sprinkled on top. Some are even quite terrible with the AI sprinkling simply magnifying the horror of the original bad tool. 

As you might expect, the nature of the better and newly developed tools vary depending on whether the ideal customer profile is envisaged as a small to medium sized enterprise vs. a major corporation. 

At the smaller end of the scale it might be conceivable, say, if a “CISO” is a one-person team or very small organization that they need a “jack of all trades” type of tool that provides all the functions of a security program from security operations, identity/access management, compliance, vulnerability operations, to third party risk and more. But for larger organizations there are two problems with scaling up such tools that were mainly envisaged for smaller organizations. 

• CISOs who run large(r) organizations (this is medium to large organizations all the way up to Fortune 100) don’t spend their entire day in front of tools or dashboards. Their role is more complex, spanning projects, relationships and using influence to get the right outcomes, and obviously dealing with lots of sporadic issues and events. Rather what they typically need are insights not just data, which are curated by their team with or without a comprehensive management and decision support system. 

• The CISOs of those same large(r) organizations have department leaders or deputies who work for them running functions like product security, security operations, vulnerability operations, compliance, risk management, third party risk, and so on. Each of those teams and leaders will typically want specialized tools with specialized context graphs and possibly their own fine-tuned models. They typically don’t want a less functional element of a generic tool. Of course, this is simply the AI-era variant of the suite vs. best of breed choice further up the management stack. But it does point to the fact that CISO management tools need to not only provide some base broad capabilities but also need to interoperate and use specialized tools where they exist. In other words they’re an orchestrator and a means of context graph federation (maybe integration). 

But from all of this, in my view and from talking to others, the main thing the CISO wants is to be able to ask and answer questions that yield deeper insights than just simply looking at vulnerability stats, auto-generated board slides, or other “vanilla” output. 

This is not unlike other executive roles in large organizations. To pick my favorite recurring example of finance: the CFO, or similar, in a small to medium sized business is typically an in-house or outsourced accountant who does indeed live in a tool or system that does all that they need to do their job. But as you get to bigger organizations the CFO has a team of financial analysts, accountants, a treasurer, and other specialized teams or roles. The CFO doesn’t live in a tool, spawning tasks, although they might pick up a customized report, or occasionally do some personal digging. Instead, they are typically working with insights from the tooling to strategically guide the capital allocation in support of their business goals along with ensuring and evidencing sound financial controls. 

CISOs are executives like the CFO and other members of the C-suite, so we should look to see what insights they need from a next generation CISO tool or broader security program management system. Now there probably will be some useful capabilities in and around workflow improvements across the security program, some of which the CISO or their deputies might use directly, some might be used by their teams, or both. This isn’t to diminish tools like that if they add value. But, overall, the essential tool is one that provides true management insight to trigger actions that deliver strategic outcomes in the fastest and most cost-effective way, while also providing as many adjacent business benefits as possible. 

In looking at the functions that might do this, rather than given some broad and vague topics (like “manage risk”, “be a strategic risk advisor”, or “protect the company”), this is one space where it’s useful to pose some actual questions a CISO might have to trigger those insights they can get from such a tool. 

So, here are 10 “acid-test” questions that a CISO’s management tool should provide with high accuracy, repeatability and evidence. If it can’t do these things then the tool is likely just an LLM wrapper with some fancy dashboards. These questions are deceptively hard in the sense that to answer them with the right rigor requires an enterprise knowledge graph, precise risk models, comprehensive real time micro-level data aggregation, and deep cross-domain knowledge. Again, I’m not saying these are the questions or the only questions. Of course, there are many more that CISOs will need. But, these are a good test set that if a tool or product can’t adequately answer then all the other needed questions will most likely also be unanswerable. 

1. If I get an extra $250k (or whatever amount) of budget, where should I spend it to get the most security risk reduction? 

2. If I have to cut the budget by $250k (or whatever amount) where should I do that to make the least impact on my current security risk posture?

3. What are my top 5 most exposed business processes in terms of security and reliability risk? What are the 3 top three things in each case I should do now to deal with that?

4. What are my top 10 most recurring risk issues / vulnerabilities / incidents and why do they keep recurring (answer at each of the 5Y’s levels)?

5. What of my currently accepted risks would need urgently revisiting because of any one of these triggers (a) an incident at a competitor (b) an imminent change in regulation or law (c) a control set has become more economic?

6. What controls could I make more economical, such that they can be deployed to more places, that would have the most risk-reducing effect while keeping costs flat?

7. What are my minimum viable business processes and what is the most severe but plausible scenario that they cannot withstand?

8. What are my top 10 most critical suppliers that if they were to cease operations for 5 days would create the biggest harm to my operations that would impact my customers the most?

9. Who/what are the 100 humans and 100 agents that if they were to go bad for whatever reasons (e.g. extortion or other malign influence, error, etc.) would have the highest blast radius to my operations (including the compromise potential of their extended graph of privileges)?

10. What digital channels or capabilities that if unavailable due to security or reliability events would have the biggest revenue loss over our typical busiest 5 day period?

And, given this post will likely get a lot of people claiming their product does exactly this and can answer all of these things and more, I ask you to be really tough on yourself and remember (as above) that these are actually very hard to answer with undeniable rigor, accuracy and precision to permit tangible and immediate action. All based on measured reality vs. human self-assessments or manual risk assessments. Think, can you really do this without it being a vague call to action that requires further human analysis or can’t stand strong model validation and historical back testing against real data, decisions and scenarios. 

Bottom line: Next generation tools for CISOs should deliver more than just dashboards. They should deliver profound insights. This is hard. Very hard. Hopefully there will be some companies (incumbents or start-ups) that can pull this off. Perhaps some CISOs will home grow such tooling.