It is evident that staying ahead of cyber risks is a top priority for businesses across all sectors these days. Thomas Holderegger, Managing Director and Lead for Security Switzerland at Accenture, brings over two decades of expertise in cybersecurity strategy and solutions. With a background as the Global Head for Security IT at a major international bank, Thomas offers a wealth of knowledge on how organizations can fortify their defenses in today’s complex digital landscape.
In this interview, he shares his insights on the future of cloud security, the transformative impact of AI on cybersecurity roles, and the critical strategies businesses need to adopt to protect themselves in an increasingly connected world. Read it on!
How do you foresee the evolution of cloud security over the next five years?
Cloud security has become increasingly important as most organizations have migrated part of their workloads, data and identities to the cloud. As cloud became the new normal for them, we can expect cloud security to evolve in various ways:
- Accelerate the adoption of zero-trust, allowing for granular point to point secure access based on identities and data.
- Consolidation of cloud security vendors into security platforms or embedded into the cloud service provider offerings.
- Increased and native inter-operability of security technologies across cloud vendors, such as SIEM/SOAR, EDR, vulnerability monitoring or CNAPP solutions.
- Greater use of artificial intelligence and machine learning for proactive identification of security issues, analysis of attack paths, and recommended remediations, increasing the accuracy and efficiency of cloud security operations.
Furthermore, companies increasingly modernize the workloads that they lifted & shifted to the cloud. Cloud Security practices will probably converge into modern application and cloud-native development. While this will be accompanied by some of the technologies we already know, the challenge will truly be an organization and human one, gaining security awareness and skills among developers and embedding security engineers into app and cloud engineering teams.
How do you see AI transforming the role of cybersecurity professionals in the next decade?
First and foremost, the capabilities and uses cases for AI will continue to be developed in various ways, which will influence Cybersecurity Roles in yet to be seen ways. What we can already see today, is that AI will become indispensable in combating advanced cyber threats. For instance, GenAI-powered attacks like deepfakes can only be effectively countered using AI technologies. AI can detect anomalies and patterns that are too subtle or complex for human analysts to identify, providing a robust defense against sophisticated attacks. Other than that, there are few considerations that I believe are relevant:
- Deep-Dive Data Analysis: AI’s ability to process and analyze large volumes of textual data will drastically reduce the manual effort required. This allows cybersecurity analysts to focus more on deep dives and strategic decision-making tasks
- Controlling Non-Textual Data: The analysis of non-textual data, such as images, videos, and audio or voice, will lead to the development of new types of security controls and requires a new set of skills.
- Greater Focus on User Experience: AI will also enhance the end-user experience in cybersecurity. Security measures will become more intuitive and less intrusive, making it easier for users to comply with security protocols. Cybersecurity professionals will have to become more end-user-experience aware when building security controls, ensuring that security measures do not hinder productivity or user satisfaction.
Interaction with AI Systems: As AI technologies evolve, cybersecurity professionals will need to engage in continuous learning to stay updated with the latest advancements. This ongoing education will be crucial to effectively leverage AI tools and stay ahead of emerging threats.
How should businesses prepare their C-suite for effective decision-making during cybersecurity crises?
C-Suites successfully navigate a business through a cybersecurity crisis or other significant technical business disruption (e.g. CrowdStrike outage) and minimise damage and operational downtime when they act decisively to control and manage a crisis — rather than scramble and panic. This requires that businesses take proactive steps before a cyber attack:
- Foster Strong Relationships: Establish trust between the C-suite and the CISO or other senior leader responsible managing digital risk – they will provide expert advice and real-time data to the C-Suite during cyber crises.
- Build ‘Muscle Memory’: Conduct regular executive-level crisis simulations to build familiarity with crisis response, equipping leaders to act decisively during actual incidents.
- Ongoing Training: Knowledge is power! C-suites must remain updated on the latest cyber risks and best practices, e.g. Deepfakes, and understand their role in shaping organisational security culture (employees are watching leaders and emulating them).
- Designate Roles: Established crisis teams and clear communication protocols ensure each executive knows their responsibilities, from investor relations and PR, to legal and regulatory requirements, to steering technical responses.
Crisis Response Plan: Predefined actions and decision-making criteria are crucial for swift decision-making.
What are the critical factors for a successful partnership between business leaders and security teams?
Businesses have always managed risk and as a result, the language and understanding of risk management in a business context is mature. Monte Carlo simulations can be used to quantify risk and inform decision making. In Cyber Security, the language of risk management is still maturing and while it can be accessible when we discuss “impact” and “likelihood” there are still gaps in the language which lead to this scenario where the translation of needs and wants in cyber security are not effectively translated into something that correlates with a business’s risk appetite.
The result is that Cyber Security can be perceived as an “obligation” that is difficult to justify as opposed to an investment in the delivering on the business’s risk appetite. The closer cyber security can come to the principles and language of business risk management, the easier the conversation regarding priority and investment becomes. That is why, for example, Continuous Threat Exposure Management is so compelling as it translates quantitative evidence into possible risk outcomes and allows for prioritization based on the considered impact – much more aligned with business risk management principles.
How is AI transforming cybersecurity, and what potential risks and opportunities does it bring?
AI is transforming cybersecurity strongly, already today and even more soon. Main reason for this is the impact it has on attack vectors and attacker’s capabilities, but also on capabilities for Cyber Operations teams when detecting and responding to cyberattacks. To name a few examples, attackers can leverage AI to craft better phishing mails, to impersonate people more effectively using deepfake technologies, to get more effective in writing malware code or to analyze attack surfaces or networks more effectively they have a foothold in. Defenders get better by leveraging AI to understand scope, context and impact of possible incidents much faster, to automate time-consuming report writing, or to better automate respond actions. Latest trends and opportunities go towards not only leveraging LLM-based AI, but also predictive AI to better foresee next steps of attacks. Innovate approaches can also be observed to define detection use-cases and response playbooks using AI – on top of content libraries. To round things up, the accuracy of controls on textual data will shoot up, allowing for preventative controls that do not impact business processes. They will be complemented by including semantical analysis of text but also controls directed to non-textual data, i.e. images, voice/ audio and video.
Can you discuss the critical business impact of cybersecurity in the financial sector and how organizations can navigate these challenges?
The financial sector is confronted with many challenges seemingly unrelated to security. They need to leverage AI to offer their customers better and new services. They are confronted with new regulations like DORA, new Circular from FINMA or NIS2. They need to connect and collaborate more to support Open Banking or better use SaaS solutions so they can more effectively compete with Neobanks and other innovative competitors. They often are confronted with legacy technology, need to leverage cloud more effectively and embrace nearshoring and offshoring centers to have best access to talent and reduce cost.
Security is not only a component in this but becomes a strategic driver. Financial industry players need to move from traditional perimeter-based security to data-centric security. To achieve this, they define critical business processes and sensitive data and map them to systems and applications in their technology landscape. It is exactly these systems and applications which also require a modernization: They need to become zero-trust enabled, support modern authentication protocols, and onboarded effectively to cyber protection capabilities. For this, they often require a rebuild – which also enables them for cloud, AI and other business-driven strategic requirements.
