A practical approach
I’m super proud to have written this book. It’s the much improved second edition – and I can’t wait to hear what you think about it.
Please leave an Amazon review if you can – this really helps beat the algorithm, and is much appreciated!
How can security teams use AI to move faster without cutting corners?
That’s the question I’ll be digging into at an upcoming virtual roundtable for fellow RSAC CISO Boot Camp alumni: AI for Defence – Building Security into Design and Delivery.
I’ll share practical examples from my own experience, including:
🔹 Building and deploying security architecture AI agents to shorten secure-by-design review cycles
🔹 Embedding AI-assisted threat modelling into product and engineering workflows to catch risk earlier and position security as a trusted design partner
🔹 Implementing secure coding guardrails and using context-aware agentic AI code analysis in the delivery pipeline to resolve issues before they reach production
🔹 Deploying multi-agent vulnerability triage and remediation capability
📅 Monday, November 23
🕖 7:00-8:00 AM AEDT
🔒 Open to RSAC CISO Boot Camp alumni globally
It was great to share my views on AI governance and the application of AI for cyber defence at the RSAC CISO Bootcamp.
I loved the audience participation – it’s a great community, and it’s a privilege to be able to exchange actionable tips with my peers.
Another wonderful day packed with practical sessions on cyber risk, board reporting, crisis response exercise practice, frontier AI model risk management, data breach mitigation and more.
Where else would you talk to the Deputy CISO of Anthropic and the former director of the US Cybersecurity and Infrastructure Security Agency (CISA) on the same day?
Just like meeting the Babbage’s Difference Engine, it was an honour to meet Sir Tim Berners-Lee, the inventor of the World Wide Web.
It was good to get his book signed, but also share my book, The Psychology of Information Security.
I recently gave a presentation on the Behavioural Analysis for Multi-Agent Systems. The idea at its centre is simple. AI agents drift from their intended goals in much the same way people drift from security policy, and psychology has spent decades learning to read that kind of behaviour. I explore some key themes in this blog.
I’m proud to have been recognised as one of the top Chief Security Officers in Australia!
I couldn’t have done this without the support and commitment from my team, peers and the wider cyber security community globally.
It was great to learn more about the state-of-the-art research in cybersecurity applications of AI, both from the attacker and defender’s perspectives at the Unprompted conference in Sydney today.
The talks from engineers at OpenAI, Google, Microsoft, TikTok, Slack and many others demonstrated the practical use cases for threat hunting, vulnerability discovery, detection and response to speed up and automate workflows.
Safety, cost management and scale were the top themes for me – you don’t always need the latest model for every task, deterministic scripts can complement your agentic AI pipelines, guardrails and alignment are still key. Best results live at the intersection of system automation and human judgment.
And, of course, it’s the people who make events like this so worthwhile – it was good to catch-up with old friends (and make some new ones) and exchange ideas and research. AI and cybersecurity is a team sport. Reach out if I can help.
I look forward to experimenting and applying technical insights at work.
I had a great time talking to Peter Davidoff from the Australian Government about the evolving approach to security.
We touched on the challenges and opportunities of securing critical national infrastructure, the increasing role of AI and practical examples of developing a defence-in-depth approach to security architecture.
A big thanks to the audience for great questions!
I”m very proud to have joined the board of SMART Recovery Australia with the mission to help people live a life beyond addiction through evidence-based, inclusive and empowering programs.
And no better way to start than with a strategy offsite bringing together fellow directors and the executive team for a day focusing on financial sustainability, AI governance, risk appetite and long-term impact measurement.
I look forward to contributing and applying my experience in board directorship, social impact measurement, AI in the not-for-profit sector, NFP governance, cybersecurity, strategy and leadership.
When both attackers and defenders use AI, it’s the people who become the edge.
Attackers already run at machine speed, and faster tools only close part of that gap.
It was great to sit down with Dan Raywood to talk about building security culture and the evolving role of a CISO 👇
Security failures are rarely just a technology problem. They’re a design problem – a mismatch between how controls are built and how people actually work.
That was my message keynoting at CIO Leadership Live.
AI has amplified the security fundamentals.
☑️ Defaults beat persuasion: passkeys by default, automatic updates, SSO. The secure choice should be the easiest choice.
☑️ Shadow AI is a friction signal, not a compliance failure. If people are pasting data into unapproved chatbots, your sanctioned path is too slow. Give them a fast, safe alternative.
☑️ Build trust, not fear. Blameless reviews and visible leadership create the psychological safety people need to report incidents early.
The CIOs who win with AI won’t be the ones with the strictest rules but the ones whose guardrails make the secure way the easy way.
