Tony Fergusson, CISO in Residence at Zscaler, has more than 25 years of experience in networking, security, and IT leadership across a variety of industries. Described as having a “visionary mindset,” Fergusson was one of the earliest adopters of zero-trust networking principles in 2015. A passionate advocate for reducing enterprise attack surfaces, he was the very first Zscaler customer to implement Zscaler Private Access for his organization and to apply zero-trust principles to OT devices. Most recently prior to Zscaler, Fergusson led MAN Energy Solutions’ secure cloud transformation, including its award-winning digital transformation to zero trust network architecture. He sees innovation and out-of-the-box thinking as keys to understanding and outpacing cyber adversaries.
Dive into the interview and discover how AI, quantum computing, and resilient cloud strategies are unlocking the future of cybersecurity. Enjoy reading!
How do you foresee the evolution of cloud security over the next five years?
The growing complexity of cloud environments and the increasing sophistication of cyberthreats will demand the use of AI and machine learning to analyze vast amounts of data and identify and respond to security incidents in real time. We will need to fight AI with AI. While AI threatens to overwhelm reactive security teams with the pace and sophistication of its onslaught, it can likewise enable proactive prevention through predictive processes and controls.
How can organizations ensure compliance when integrating AI into their cybersecurity strategies?
You cannot simply block the use of GenAI. Having visibility into usage is crucial. Data leakage by employees inputting sensitive information into public generative AI apps is a major risk that needs to be mitigated. Granular controls like browser isolation, DLP policies, and customized allow/block lists can enable secure adoption of GenAI. Concerns around safety, security, bias, hallucination, liability, and intellectual property need to be addressed for enterprise adoption.
An excellent first step in reducing AI-based business risk is determining where and how to use the technology. If your organization uses third-party AI tools, set policies and restrictions that protect your business from intellectual property-based risks. Block any sites hosting AI tools you do not need. Monitor the tools you allow and ensure they operate within secure business parameters.
How is quantum computing impacting cybersecurity, and what balance should businesses strike between innovation and risk?
Quantum computing poses a threat to current encryption methods like RSA and ECC due to its ability to break these algorithms, necessitating the development of quantum-resistant algorithms. Businesses should develop a transition strategy to incorporate these new algorithms, leveraging hybrid solutions that combine classical and quantum-resistant cryptography for added security.
Preparation can start now by ensuring systems are easily updatable with new cryptographic libraries, allowing for a smoother transition as quantum-safe technologies mature. Businesses need to stay updated on the advancements in quantum computing and their implications for cybersecurity. This involves continuous education and awareness about emerging quantum threats and defenses. Be curious and learn.
What are the most effective ways to communicate the value of cybersecurity investments to stakeholders?
When communicating the value of cybersecurity investments to stakeholders, it’s essential to adopt a strategic approach by using business language that translates technical terms into business outcomes, emphasizing how these measures can prevent costly incidents and offer a strong return on investment compared to potential breach costs.
Quantify the risks and benefits by highlighting the financial impact of potential downtime, regulatory fines, legal costs, and reputation damage, using industry benchmarks and data for context. Share real-world examples, such as case studies of companies that suffered due to inadequate cybersecurity and success stories of effective prevention. Align cybersecurity initiatives with broader business objectives, explaining how they protect intellectual property, maintain customer trust, ensure regulatory compliance, and enable digital transformation.
Don’t forget that cybersecurity investments that force transformation can reduce costs and operational overhead, simplify the landscape, and improve user experience—therefore, architecture is king here. Do more with less. Sell the transformation journey.
