CISO Of 2030 (a sequel of CISO of 2025)

This talk is a follow-up to a 2019 presentation on what the CISO role would look like about six years later. The speaker, who now works as a CISO, revisits the predictions from that earlier talk and assesses which ones held up. He argues that the role has moved toward business language and board-level discussion, that CISOs are now held accountable rather than simply replaced, and that breach disclosure rules and litigation have raised the stakes.

The middle of the talk covers what is driving change. He discusses moving away from vulnerability counts and framework scorecards toward quantified risk, using attacker sophistication to test whether controls hold up against realistic threats, and treating third-party risk and customer questionnaires as real drivers of security investment. He also covers reporting lines, which increasingly point to the board, and argues that DevOps practices, identity, and policies such as restricting personal device access can reduce risk and cost.

He closes by urging security leaders to frame their work as enabling business decisions rather than as fear, to show how controls perform against real-world threats, and to build trust over time as a lasting asset. The takeaway for practitioners is to shift conversations with executives from technical detail toward business impact and measurable risk.