As AI Changes Cybersecurity, What Will Set You Apart? | Root To CISO Podcast

0:00kris-rides_2_07-29-2026_125053:how do you see, like with sort of AI how do you see it changing like the cybersecurity execs' position, is there sort of attributes that you think that modern CISOs are gonna need maybe something they're gonna have to work harder on?

0:15aj_2_07-29-2026_155052:Understanding where to implement controls in order to decrease the risk at scale. What sorts of controls make the biggest impact? Where you want to enable the business so that they can take core risks, and if they make a mistake or things go awry, it's not a big deal.

0:29Speaker:Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

0:49kris-rides_2_07-29-2026_125053:hi, everybody. Welcome back to the Root to CISO podcast, season three. This is part two with AJ. AJ, thank you so much again for staying with me, and we're gonna continue our conversation. I think where we left it off was you'd just taken a deputy CISO role at a healthcare company in 2019. What a time. Um, so yeah, let's talk about maybe how the first few months were and then, and then what happened after that. How was it?

1:20aj_2_07-29-2026_155052:It, I mean, it was great. The first few months were really cool. It was kind of a gentle introduction. The, um, the CISO was, we joke, a recovering attorney, so he had pivoted from legal. Um, he wa- he was also pretty young, too. He was maybe a year or two older than I was, and he was looking for somebody a little bit more technical than he was. And our skill sets complemented each other

1:39kris-rides_2_07-29-2026_125053:Mm-hmm.

1:40aj_2_07-29-2026_155052:Very well. He was, like, a lot more polished, than I was, and he really had a strong understanding of organizational strategy and dynamics. He was a really good guy. but he went out... So I started in May, and then he went out on paternity leave in September. So, I had to do kinda like my first board meeting, like addressing all the... So it was for HHS, the Commonwealth, which is his secretariat. And at the time, remember how many, I think we had 14 or so constituent agencies, so Department of Public Health, Transitional Assistance, Veterans Affairs, stuff like that.

2:13aj_2_07-29-2026_155052:So all of the health and human service, capabilities were n- you know, under that umbrella of HHS, and they each had a CIO. So, yeah, it was, it was an interesting time. So kind of two or three months in, I had to, you know, do that presentation and address a board. It was great experience, for sure. There were some lessons learned there. But the first few months, I was really happy. You know, I had a lot of fun, and I met a lot of great people, and I was...

2:38aj_2_07-29-2026_155052:Like I said, I was finally doing what I wanted to

2:40kris-rides_2_07-29-2026_125053:Yeah

2:41aj_2_07-29-2026_155052:so it was, it felt, it was a great time to be alive, you know?

2:46kris-rides_2_07-29-2026_125053:And then did the, was the CISO back by the time the pandemic hit? Where, where, like where were you when you found out about all of it? Like, were you, were you,'cause you were working in that industry, did you get a bit more insight or

3:00aj_2_07-29-2026_155052:No, I'm laughing because, um, I don't... So we, he loved video games. Well, I think he still does. Um, and he, he, he real- he was very good at them. He knew, like, all the things. And we took a day off, and he's like,"Hey, I got tickets to PAX East," and some other people we were working with. So he got a ticket and invited me, and I was like,"What a, like, what a super cool thing to do." Um, I didn't play a lot of video games anymore, but I just love, like, lights and sounds.

3:26aj_2_07-29-2026_155052:So, like, I was in, you know? I mean, it sounds so silly, but... And I also wanted to spend more time with him'cause he was a good guy. And I remember standing in line there, and, I won't say the subreddit to be... You know, I don't, I don't wanna get in any trouble. But one of the, the infamous subreddits was talking about, hey, there's a pandemic coming, um, you know, puts on the world economy. And we were talking about that and, like,"Oh my gosh,""I can't believe peop- people are, are saying and doing these things." So we were kind of following that together and the discourse around, the economic impact of the pandemic as it worked its way across the globe.

4:02aj_2_07-29-2026_155052:And really interesting because on one hand, it was scary and dangerous, and there was a lot of, bad things happening to good people, and that was awful. And on the other hand, was hard to really understand the economic impact of so many industries screeching to a halt. there was this fascinating cognitive dissonance, I guess,'cause, I got curious, so I started walking around the office when, once we get back, bo- got back from PAX East where we saw that, you know, we had that discussion regarding the economic impact and, what people were saying online.

4:38aj_2_07-29-2026_155052:And I said,"Hey, guys, if the pandemic hits here, you think we'll all be work from home?""Under no circumstances would we ever be work from home, even if there is a pandemic." was like,"That's really interesting." I don't know what's gonna happen, you know? And so yes, we all went to work from home, and then two or three months later, the CISO got an offer that... It was in the private sector for private sector healthcare, and so he was excited for that, and also gave him an opportunity to relocate someplace closer to family.

5:08aj_2_07-29-2026_155052:So that was super exciting for him, but it was definitely scary for me because he was a good person to work for, and I'm like,"Oh my gosh, are we gonna get a new CISO?" And I had certainly made some mistakes that had given people some pause about me jumping into the role immediately. Um, one of the things I did that gave people pause was what I did at that board meeting. So leading up to that board meeting in September when he was on, when he was on paternity leave, we were like,"Hey, it would be great to get some software for a phishing test." And since then, the, the, the Commonwealth absolutely has, and they, they've done a lot of it.

5:42aj_2_07-29-2026_155052:They've done a wonderful job. But at the time, we were trying to make the business case for it, and all the CIOs for all the agencies were kinda like Nobody falls for that stuff anymore. You guys are silly. Stop it. so I said to the CISO like,"Can we cobble together like a really, you know, inexpensive phishing exercise and phish all the CIOs and see what happens?" And he's like,"Yeah, go ahead." And so we made an Outlook account pretending to be him.

6:08aj_2_07-29-2026_155052:So had we enabled those features in Outlook, it would've said external, but we didn't have that. So I think we took a picture of him and made like a, you know his [email protected] instead of, you know,@mass.gov. And it was a security office satisfaction survey on one of the survey websites, and we attached Google Analytics to a splash page. So if you click the link in the sketchy email, and we had some misspellings and like it sounded like him but sort of not at the same

6:35kris-rides_2_07-29-2026_125053:Yeah

6:36aj_2_07-29-2026_155052:'cause we were looking at like the way he articulates his ideas in emails. And we made a little splash page. And attaching Google Analytics to that it was really interesting because we got people's browser versions and where they were logging in from and information about their operating system, which if those things were outdated, it was enough to, use Metasploit, which we, I did not get permission to do despite asking, which I shouldn't have done, you know.

7:00aj_2_07-29-2026_155052:Um, you know, but, people make... You know. So, uh, we ended up building a report basically about how many people clicked it and how many people had old versions of Chrome with known remote exe- you know, code execution exploits and stuff like that. We built that presentation, so when he went on paternity leave, he's like,"Why don't you do your presentation at the board meeting?" And I was like,"That's a great idea." Now in retrospect, of course, it like, was not a great idea.

7:26aj_2_07-29-2026_155052:So after that presentation, like everybody was very entertained, but then I kinda had a reputation as like the creepy girl who wanted to hack everybody. It like really wasn't a good look. That's not who you want for like your executive leader, like the quiet girl in the corner that's"If you're not gonna give me funding, I'm gonna hack you." You know? It's just... And again, I did not do the exploits, but we presented how it easily could have been done.

7:49aj_2_07-29-2026_155052:And th- these were free tools. Except for we had to register the splash page website with DNS, so I think it was like$8. But yeah, it was interesting how in three days for$8 we were able to cobble something together that, you know, exemplified the situation so well. So in the long term that was to my detriment, but fortunately over time, I was acting CISO, and I was given the opportunity to recover from that and try to build a more put together, mature, strategy, which I did.

8:19aj_2_07-29-2026_155052:And I was able to, officially get the CISO role

8:24kris-rides_2_07-29-2026_125053:Nice. Brilliant. And then did you, so were you there, was the CISO there when everybody was going remote? 'Cause that was a big headache for a lot of people in security, right? All of a sudden to have com- people that were used to being in the office to all of a sudden being working completely remotely, sometimes on their own laptops, you know, rather than work stuff and, all of this sort of t- this sort of stuff. Was that a headache?

8:46aj_2_07-29-2026_155052:In some ways, for our specific office, it wasn't that bad because we all had laptops. Um, so we were able to bring them home with us, and we had an arrangement where we were full in office for executives, but the union had negotiated one day of work from home. So with that one day of work from home, they were able to VPN into the environment, and they had all of their productivity tooling with... I think we had an E5 license at the time. So it was very easy to not only utilize all of our tools remotely from your Commonwealth device, but for there to be, some moni- you know, solid monitoring and, and best practice access control as well.

9:26aj_2_07-29-2026_155052:So because the union was able to negotiate that, it made it easier to accommodate, that switch to work from home for our group. Different organizations and different agencies had varying degrees of difficulty and challenges because all of the... Not everybody's in IT, not everybody's in security, so, a lot of personnel that were maybe working at hospitals and things like that, there were different, you know, considerations and accommodations that had to be made.

9:53aj_2_07-29-2026_155052:So that was very difficult. But for our team, it was very easy thanks to those union negotiations.

10:01kris-rides_2_07-29-2026_125053:Right. That's good. Okay, so then, so you get your first, you you recover from the, the board meeting. You get your first CISO job, and'cause that's a, a challenge for, like, a lot of people out there are, they're trying to get that CISO title, right? A, a lot of them are doing the CISO role, and I, I'll, I'll tell you my beliefs on that. I think people, there are plenty of companies that don't recognize the CISO role or are worried about giving a C-level title, and they just don't give them out unless you are truly a C-level on the board.

10:30kris-rides_2_07-29-2026_125053:But you can be in charge of the whole of security, and certainly doing that role. And there are some companies where you might get that role and really you're, you're an individual contributor and, and, and you're a hands-on person doing a lot yourself and, you know, people may not consider that a typical CISO. So there's different CISOs, I believe, anyway. So you, you, you get to that point. Um, what's your next step after that, and what made you sort of move, I guess?

10:57aj_2_07-29-2026_155052:Um, leave the organization or move

11:00kris-rides_2_07-29-2026_125053:Yeah. Yeah, leave and go to your next opportunity

11:03aj_2_07-29-2026_155052:Yeah, I mean, I loved working at the Commonwealth. I loved the mission and the amount of hard work I put into that role, even though it was an around the clock job, and I gave it around the clock effort because it was something that I loved and I really cared about. And at the time, I think I was getting a second bachelor's in IT just because I, I was a little bit like, insecure about my technical background because I was new. So I wanted to prove, like, I know Linux, I know PowerShell, I can, write some stuff in Python.

11:35aj_2_07-29-2026_155052:So while I was doing the CISO work, I was also trying to learn that hands-on aspect. And, a-after a while, I wanted a little bit of a new challenge. That was part of it. There, there were security incidents we had going into holiday weekends, um, where, I had to cancel all of my plans, and I, I did so gladly because it was important to, rise to that occasion and respond to that. That's the responsibility of a CISO. And my team, to their credit, and even people not on my team, everybody pitched in, so it, it was truly incredible.

12:05aj_2_07-29-2026_155052:Um, but despite, all the wonderful relationships and experiences I had there, I had two things going on. One of them is I found my deputy, and he had been at the organization for a while, and I felt like he was ready to step into the CISO role. And I was getting married and getting ready to start a family, and so I needed a stronger income'cause we were gonna be a single family household with my spouse staying home with children. So that was really the reason.

12:32aj_2_07-29-2026_155052:A, a part of it was I was worried about return to office as well'cause there were rumors, so I was like,"I need something that's remote," because an hour and a half is-it's getting to be too long with starting a family. But I needed that, um, that private sector, increase in order to, to be able to do that.

12:47kris-rides_2_07-29-2026_125053:Yeah. Yeah, that makes sense. I think there's a lot of people that are working with some great sort of companies, whether that's government related or, or something like, like you were doing. The downside of that is the upside's the great mission and the people you get to work with, but the downside can often be the, the, the pay. Like there's, there's great, you know, the, you're gonna be pretty safe working somewhere like that, and there's probably decent pension schemes and other stuff that, that, that is great and they tend to keep people very long term.

13:15kris-rides_2_07-29-2026_125053:But like the, the commercial world is where you can go out and, really see the increase in money and often the increase in budgets as well to do some more interesting projects. So we see a lot of that. So what was your next role after that?

13:29aj_2_07-29-2026_155052:So then I went to a vendor,

13:31kris-rides_2_07-29-2026_125053:Mm-hmm.

13:32aj_2_07-29-2026_155052:But I was only there for about a year. Um, I was a senior consultant, so customer-facing, doing all kinds of things, building playbooks and disaster recovery plans, mostly conducting assessments, CIS and NIST, ISO, a variety of assessment types. But This place was a great place to work, and we had a great team, and the office was super fun. I would go into the office even though nobody in my team was in the office, once every two or three weeks just'cause it was such a great place to be and the culture was outstanding.

14:04aj_2_07-29-2026_155052:the reason that I left in a year was because, a lot of the process for doing... A lot of this information gathering was just question and answer based. And so that, first off, that's only so reliable, and it's very time-consuming. And we spend so much time asking the questions, receiving the responses, and distilling that information into a presentation that it deprives us of that meaningful opportunity to partner for remediation.

14:37kris-rides_2_07-29-2026_125053:Yeah

14:38aj_2_07-29-2026_155052:which is where I feel like, it's one thing... frustrating as a CISO to receive a list of deficiencies that is now your problem. Um, it's, it's another thing entirely when somebody's like,"Included in this process, we're gonna help you fix at least some of these."

14:51kris-rides_2_07-29-2026_125053:Yeah

14:52aj_2_07-29-2026_155052:that's a great feeling, and we thought maybe a way that we could enable that and make the, our organization a little bit more bulletproof in terms of the revenue that we bring in and what we cost, maybe we can automate portions of our intake and information aggregation process in order to serve more customers, make a bigger impact, maybe have a clearer pathway to guiding them toward our products and being like... and, and maybe giving them a discount if they, you know, something like that.

15:19aj_2_07-29-2026_155052:Keep them in the ecosystem, build that relationship, build trust. And we were told no. And I get that. People say no for a variety, and I'm sure they had a good reason that I wasn't privy to. the organization had grown very quickly. And their intention was to continue growing very quickly as we saw rates starting to tighten and, some macroeconomic headwinds becoming, a little bit fraught. this was before, that ChatGPT, 3.0 release. Like, just slightly before it.

15:54aj_2_07-29-2026_155052:So I was worried about layoffs, and I did not want to get laid off. So, um, fortunately through a mutual friend, you know, somebody... I knew somebody who, knew somebody at Oracle, and they were like,"Oh, the field CISO team needs somebody who..." And the requirement is you had to have been an operational CISO. So rules a lot of people out. And so since I was a crisis CISO specifically, I was afforded the opportunity to interview, and fortunately, I got the role.

16:19aj_2_07-29-2026_155052:And, unfortunately, my teammate and I, he, one of my teammates who was, like, working on that automation that we were proposing, he left Maybe the week, like within a week or two of me, and, I think two or three months after, the whole, the whole unit got laid off. And that was very upsetting. You know, just because it was such It was a great company culture. It was a great team. It was great products. Had they maybe just done a few things differently, a lot of like really good people would still have really good jobs.

16:49aj_2_07-29-2026_155052:So that was upsetting, but at the same time when I was interviewing at Oracle, it was really cool because Oracle had automated a lot of those processes better than I knew that they could be automated. So when they were showing like some of their scripts, I was like,"Oh, I didn't e- like I didn't even think of that. Like this is th- this is way better than anything I could've thought of." So that also showed me that there was It was a place that I could like join, stay, grow and learn a ton of things, have a ton of fun and feel like I was really making an impact.

17:16kris-rides_2_07-29-2026_125053:Yeah that's great. And then, and what's the part of the job that you really like? Field CISOs, like we talked about, is a little bit different from a, a lot of other sort of types of CISO roles. What are the things that you really enjoy about the role?

17:31aj_2_07-29-2026_155052:There's, there's a grittiness to it, you know, working with customers that are going through transformations, that are, going through audits, that are preparing for challenges related to AI. And it's very exciting to work across large groups of customers with different, business outcomes they're working toward in the cloud and using Oracle products, and hearing what they're doing and why, and what they're not doing and why, and, what's scaring them and what's exciting them.

18:04aj_2_07-29-2026_155052:It can be tough when you're a CISO, you feel like an island, and you're like,"The things that I'm thinking, is anybody else thinking these things? Am I thinking the wrong things? And do I even... Am I a charlatan? How did I get here?" You know, that imposter syndrome can rear its head. But being in a position where I've talked to probably dozens if not hundreds of CISOs of different organizations now, and really gotten an incredible sampling of perspectives and experiences across industries, it's given me, a much richer understanding of organizational strategy, how different organizations respond to different types of change.

18:40aj_2_07-29-2026_155052:And it, it almost feels like getting um... when you go to a restaurant by yourself, and you just get, one meal, and you're like,"Okay, this was good, but I wonder what else there is." But then if you go with, 30 people and you get family style, and then you get to try everything,

18:55kris-rides_2_07-29-2026_125053:Yeah.

18:55aj_2_07-29-2026_155052:"Oh, this is this is way better." And then you're kind- Like, you leave and you know, what's good and what's bad at that restaurant, and what, like, if you had to go back, what you would 100% get no matter what. Um, I feel like I've had that experience with, like, security and industries and, that can feel very empowering.

19:14kris-rides_2_07-29-2026_125053:Yeah. Yeah, I love that. I spent early, sort of the early part of my career building consulting teams, uh, you know, within staffing. I was building some consulting teams and within that, I think one of the benefits for people that had gone out and consulted or been contractors over multiple clients was that they really got to, it's almost like interning at multiple different places and getting a feel for different environments, different industries.

19:39kris-rides_2_07-29-2026_125053:Um, and they found the ones that sort of they liked and where the opportunities were. So yeah, I love that. I think there's a lot-- We see a lot of people come through some of the big, the big consultancies, big four, big five consultancies, and they get burnt out eventually from the travel, but they've got such broad experience that they're often snapped up very quickly, when they decide to sort of put roots down. So yeah, I can imagine it's it's something that's interesting.

20:03kris-rides_2_07-29-2026_125053:Every day's maybe a little bit different, right?

20:05aj_2_07-29-2026_155052:Absolutely. Yeah. And then one of the other things I love is, is kind of what I briefly touched on earlier when we gave customers reports, it would've been nice to help them through things, and that's what we get to do now. Because we've automated that information collection process and a lot of our security features in the cloud aren't monetized, we can sit with a customer and just be like,"I can fix this with you in one hour for no additional cost." And that's cool.

20:29aj_2_07-29-2026_155052:It's fun. It's exciting. I sleep very well at night.

20:32kris-rides_2_07-29-2026_125053:Yeah

20:32aj_2_07-29-2026_155052:customer trust, and there's no better... Like, the instant gratification. Think about professionally how many opportunities we have to get on a call and at minute zero we have a problem that isn't solved yet, and at minute 59 or 60 you have a problem that was meaningfully solved, and now you can move on. I've found that to be a rare rewarding feeling that has been very fulfilling and enjoyable.

20:59kris-rides_2_07-29-2026_125053:Yeah. That's amazing. To, to identify, to identify the problems and then be able to come up with a solution, in the course of such a short amount of time. That's, I think that's what most people want. And I think once when I think back, and I think people I've spoken to, even people myself and, and people within teams, like a lot of the time, days go past and you don't have a win, right? You, you don't necessarily have a win. You don't have a, you know, you, you make...

21:24kris-rides_2_07-29-2026_125053:And so you try and break it down and make little wins, and that, that makes the day better. But if you can have those wins every day, like there's al- always a, a nice point to go back at the end of the day and sort of get some sleep and know that you've achieved something. Yeah, there's a lot to be said for that, and I think that's what most people, I think, are driven towards doing if they can. And the ones that aren't getting that are often the ones that are looking elsewhere for other opportunities.

21:47kris-rides_2_07-29-2026_125053:Now with, like how do you see, like with sort of AI rapidly changing and having changed the, the, you know, everything, the world, how do you see it changing like the cybersecurity execs' position, especially, the people that you're interacting with?

22:04aj_2_07-29-2026_155052:A few things. Um, one is definitely, I would say AI security is 70 to 80% first principles. You know, it's gonna be access control, it's gonna be segmentation, it's going to be all that stuff. But because of the speed of it's just not possible. You can discover all the vulnerabilities in the world, but the feasibility of, perhaps patching all of them wholesale, you might have hundreds of thousands of vulnerabilities across an enterprise. So that's challenging for organizations.

22:36aj_2_07-29-2026_155052:That means a few things. One of them is exposure management, you know, trying to prioritize, that, making it harder to get a foothold, making sure those systems are patched. Next is understanding, attack chains and attack graphing. So to move from thousands of patches that to humans look disconnected, and some of them are even low priority, to understanding that attackers utilizing AI tooling can string together maybe dozens of low priority, findings into a, a meaningful, impactful, critical exploit.

23:10aj_2_07-29-2026_155052:So instead shifting our, defense methodology to disrupting chains. Our industry, we're really good at preventing attacks, and we're pretty good at recovering from attacks. But in terms of disrupting attacks when they start, I think there's a huge opportunity for improvement there. And, also just improving our patching processes. We know that, there's gonna be a lot more patches to be had from all the major vendors. So anybody using a major technology vendor, um, they're gonna be finding a lot more patches utilizing these great AI tools and, what a phenomenal privilege to be able to do that for your customers.

23:45aj_2_07-29-2026_155052:But the challenge will be in making your environment easily patchable, and that's

23:51kris-rides_2_07-29-2026_125053:Yeah

23:51aj_2_07-29-2026_155052:a lot of different things to a lot of different organizations. Maybe you're moving from homegrown stuff to SaaS in order to, decrease the, the aspects of the stack that you're responsible for. Certainly there's pros and cons to that, and I understand why there might be apprehensions, but I also understand why that's a very attractive option to a lot of organizations. So yeah, it's that exposure management. It's that looking forward and thinking,"How can I make my environment really easy to patch?" Because a lot of patches are coming, and then for the stuff that you can't patch, um, and for adding context to vulnerabilities, understanding attack pathways, so if they start, you have a meaningful opportunity to disrupt them before having to immediately resort to restoration processes.

24:36kris-rides_2_07-29-2026_125053:Right. Wow. Is there a, is there sort of attributes like that you think that modern CISOs are gonna need maybe different or, or those strengths in, in areas, um, where they've always been needed, but maybe something they're gonna have to work harder on? Is, is, are there things that... 'Cause I know, like, obviously the resilience part of things, it, it does seem like, like there's gonna be an awful lot more of the attacks, things are gonna happen quicker.

25:04kris-rides_2_07-29-2026_125053:That all seems to be like putting an, an, in, in an already stressful job, adding more stress to it. Um, and it kind of feels, some people are talking about, you know, obviously automating more stuff, having AI do more things for them, but then the people that you have got there, there's less of them. So it's interesting. I don't know, I don't know how that changes the attributes of a, that CISOs might need to have or might need to focus on

25:30aj_2_07-29-2026_155052:I see there being room for a lot of different perspectives and skill sets to be important. So, I've done a little bit of a side quest with AI safety. Um, and it's interesting because you see, this fascinating duality. You have a lot of people with machine learning backgrounds because, of course, that's obvious. But then you also have a lot of people with philosophy backgrounds, and how cool is that? For both of these people to team up in research studies in order to better understand how LLMs function and build the foundation to, understand how various things work and what the operational impact could be so that they're laying the foundation to build capabilities and controls.

26:12aj_2_07-29-2026_155052:I think there's, there's a lot of information out there about that 20 to 30% of security risks that are unique to AI, I, I think there's a lot of guidance about what to do to decrease those risks. I don't think there's a lot of guidance for how to do it. How do you meaningfully input these controls utilizing defense in depth in order to, be able to find... um, to prevent, detect, and correct, and respond to, and restore something like, memory injection.

26:40aj_2_07-29-2026_155052:It's much less straightforward than SQL injection. We're all used to that. We know where to find the logs. We know how to prevent it. We know how to detect it. We know how to do it. With memory injection, the detection is much more difficult. Prevention is much more difficult. So there's... And then understanding where to implement controls in order to decrease the risk at scale. What sorts of controls make the biggest impact? Um, y- you want that asymmetric symmetrical sto- asymmetric risk story where you want to enable the business so that they can take core risks, and if they make a mistake or things go awry, it's not a big deal.

27:13aj_2_07-29-2026_155052:And I think that a lot of different perspectives will be needed to solve those how problems. You know, I've heard a lot of people say there's two types of CISOs. There's checklist CISOs, and they're bad, and then there's strategic CISOs who, get it and, they got it going on. I, I think there's room for both, you know. I think that there's gonna be more checklists and, um I'm not sure that there's a way necessarily around that. Should we, should we right size the amount of requirements we have?

27:44aj_2_07-29-2026_155052:We should do our best, but I think there's gonna be more requirements, so I think there's room for checklist CISOs if they have a strategic deputy. You know, I think there's... I think what we should be thinking about as we're building our teams is people with genuinely different backgrounds and perspectives that can contribute novel ways to solving these problems. If you look at a lot of those research papers out there, people are asking very cool questions from very different backgrounds, and soon that research is going to have to make its way into production to actually solve real problems, and it's, it's gonna take all of us.

28:16aj_2_07-29-2026_155052:So I think that a lot of different people who maybe haven't had their time in the sun yet, I think that opportunity is there if they're willing to, get after it and put in the work.

28:29kris-rides_2_07-29-2026_125053:Yeah there's so much. I, I get to speak to, like, all sorts of people in our industry, and have got connections through friends and investors, and I hear about all some of the technology stuff that's being worked on now is crazy. Like the memory injection stuff you talked about. There's, like, a lot of this stuff like physical sensors that notice, temperature changes and things like that, that might indicate compromise. You know, there's some crazy stuff, but there's a...

28:55kris-rides_2_07-29-2026_125053:If there's anything, I'm under NDA that I can't talk about on, but there's so much interesting stuff going on. I suppose keeping ahead of all of that is gonna be another important thing for, for the CISOs, understanding where some of the challenges lie and what are the latest technologies that are coming out to, to help with those. I'm gonna finish, like, I, you know, I, I-- we talked about your career. I run a cybersecurity staffing and professional services company, but the staffing side is what we're most well known for.

29:23kris-rides_2_07-29-2026_125053:And the AI has made a lot of, uh, a lot of changes to the industry. Resumes all look perfect. Uh, people automating ad responses. Like for those people that are out there and trying to get a, a new role, you know, I'm sure you've hired many people over the years that you've been in the industry. What's the advice that you give to the people out there that are trying to change or maybe have been laid off and are looking or, you know, are in a situation where they need to stand out from all of the other AI resumes that are out there?

29:54kris-rides_2_07-29-2026_125053:What do you think are the ways that, that people can do that?

29:58aj_2_07-29-2026_155052:Go places and do things. You know, are you gonna hire perfect resume that may or not, may not be a real person? Or if you have a role that's open and you have a person that's like a 60% fit and you know that they're a reliable quality person, who are you gonna wanna hire? You know, and that's the what. In terms of the how, I mean, there's so many great organizations out there. There's IEEE and ISACA and Women in Cybersecurity. There's dozens of organizations who constantly need volunteers.

30:32aj_2_07-29-2026_155052:and also there's constantly calls for all kinds of papers. So if you have experience and there, you know somebody without a lot of experience and you wanna throw something together, like bring them along for the ride. Go ahead and present. Become an authority. Um, you know, if you have, if you have some time on your hands and you're applying to stuff, look for opportunities to go someplace and volunteer. Um, it gives you... a good look and it, and it'll feel good.

30:56aj_2_07-29-2026_155052:It'll give you the opportunity to give back to the community and build meaningful relationships, which won't only help you get a job, but it'll, it also helps you, stay up to speed on things. Um, there's no better feeling than, I mean, yeah, a lot of us are reading all of the new AI security stuff and all of the new headlines and talking about it with ChatGPT, but talking about it with a friend, it's something else entirely. Like being able to connect with somebody who you've built a relationship over the years and you've invested with that, and you have a professional friendship.

31:25aj_2_07-29-2026_155052:And catching up with them and talking about, what they're experiencing at work and what their perspectives on things are. Like what an easy, fun, positive way to improve your life and your knowledge and your wellbeing. So places, connect with people. Don't just be another resume. Find a way to be a face.

31:46kris-rides_2_07-29-2026_125053:Yeah. I love, I absolutely love that. I think that's our moat as people, right? The the connection side of things, that's a, a real moat that AI is gonna struggle to jump over. So, um, I think, I think that's a great piece of advice. I also think there's a lot of, like the stuff you're talking about, the people that they're connecting with may well be the next creator of the next solution and hiring dozens of people, you know, to build that solution and, having those connections, that's how those jobs are gonna be got.

32:15kris-rides_2_07-29-2026_125053:So thank you so much. AJ, you've had, an amazing career so far. Um, I, yeah, I've, I've loved hearing about all the twists and turns. Thank you so much for your time. Thank you for being part of this. Thank you for the audience for joining us as well. Um, but thank you

32:33aj_2_07-29-2026_155052:Thank you for your time and thank you for having me. I appreciate it

32:35kris-rides_2_07-29-2026_125053:you're more than welcome. It's been great. And, hopefully I'll get to catch up with you soon. In the meantime, for our audience, make sure that you like and subscribe and do all of those great things that we need to make sure that we keep the, uh the, the great guests coming. And make sure you ask me any questions you wanna ask. Connect with us on LinkedIn as well. I'm sure both myself and AJ would love to hear your thoughts, and hopefully you've enjoyed this.

32:58kris-rides_2_07-29-2026_125053:Thank you so much

33:00Speaker:thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.