Here’s a number that should keep you up at night: 88% of boards treat cybersecurity as a primary business risk — but only 13% of organizations are mature enough to survive a sophisticated attack.
That’s the whole problem in two figures. The boardroom has woken up. The front line is still fighting in the trenches. And the gap between them is where careers — and now, apparently, freedom — go to die.
So I sat down with someone who’s fought on both sides of that gap for nearly 30 years, and asked the question nobody says out loud: when it all goes wrong, who actually pays? His answer changes how you should think about your own job.
In The Chair
Sunil Varkey — close to three decades in the field, CISO / Security Leader at HSBC, Wipro and Symantec, and leadership roles at telcos and GE before that. Multiple patents, four continents, and a front-row seat to every era from floppy-disk antivirus to autonomous-everything. (Full disclosure: a mentor to me and to much of this community — the kind of voice who reshapes your thinking in a single conversation.) He’s a self-described generalist who built trusted teams of specialists — which is exactly why he sees the whole board, not just one square of it.
THE BRIEF — 3 Things Worth Your Time
1. Stop absorbing every grey area. It’s how you end up in the dock. For years, a breach was an economic offense — a fine, a regulator, a bad quarter, and you moved on. Sunil’s warning: those days are ending. As our decisions reach into cars, factories and AI outputs nobody disclaims, the question stops being “how much will this cost?” and becomes “you knew, and you didn’t act — why?” He’s seen a breached US CISO walk away untouched, because a published RACI proved the accountability sat elsewhere. The trap? CISOs grab every ownerless problem thinking a bigger mandate makes them bigger — and quietly become the single name a lawyer goes looking for. So what: Your protection isn’t effort. It’s ink — a published RACI, and a risk register where the person who accepted the risk owns the decision, in writing.
2. Punitive policy is dead. Purpose is the new control. We wrote policies like our teachers assigned homework: do it, or face the penalty. That worked when we were commanding a homogeneous world. Try it now — across regions, cultures, and a generation that’ll quit before it fears a cut appraisal — and it collapses. Sunil’s shift is from punitive to participatory: people follow a control when they grasp the cause, the effect, and their role in it. His example — the analyst who “runs a scan” versus the one who knows he’s the pillar keeping the company resilient. Same task. Different human. So what: “Comply or else” builds box-tickers. Purpose builds defenders who feel genuine shame when something slips through.
3. Data used to be the crown jewel. Now it’s a liability. We called it the new oil. Sunil flips it: every field you hoarded “just in case” — the 25 you kept when you needed 5 — is now exposure waiting for a penalty. Pair that with his AI fear: shadow AI is coming whether you allow it or not, guardrails barely exist, and a generation that lets AI write every playbook is quietly losing the acquired skill to spot a hallucination or read an attacker’s intent — while attackers generate the exact same playbooks and now know precisely how you’ll respond. So what: Data minimization isn’t housekeeping anymore; it’s risk reduction. And in an AI-flooded SOC, judgment — not generation — becomes the one skill that can’t be faked.
Also in this episode
- The tool-sprawl tax: 40–45 tools, “three solutions for every problem,” and the ~20% you can cut the moment someone looks without ego
- Why the foundation — not the next shiny tool — is where you bleed: “you don’t need a major hacker; a small kid on the road can bring you down”
- Open source, done right: community tools with a commercial team behind them — the upside of open source, with someone to actually call
- Is India ready for privacy? Sunil’s answer, and a disarming analogy about the one phone in the house nobody shares
- The longest war in tech (network vs. security) — and why peers, not rivals, are how you actually survive it
One line worth stealing
“The role of a CISO is to assess the risk the right way and inform the stakeholder so they can make an informed decision. Do that, and you’re okay.” — Sunil Varkey
Watch the full conversation
The three above are the appetizer. The full episode runs from floppy disks to autonomous liability — policy, tools, privacy, the AI dilemma, and a rapid-fire close on the most overhyped idea in security today.
▶ Watch on YouTube: https://youtu.be/VyB8OfE_gRQ
Join the conversation
I closed by asking Sunil the greatest myth about AI and security. His answer: it’s the new blockchain — everyone’s talking, few have found the real use case yet. So I’ll put the same question to you: what’s the most overhyped idea in security right now — and what’s quietly mattering instead?
💬 Add your take here
Before you go
If this is your kind of thing, you have the super-power to write to ‘[email protected]’ with a security, privacy, or technology leader (or enthusiast) you would want to see in the chair (including yourself). I read every one.
— Ashish | CISO Chair™
Stay in the chair 👇
▶️ Subscribe on YouTube: https://youtube.com/@CISOchair?sub_confirmation=1
💬 WhatsApp channel: https://whatsapp.com/channel/0029Vb99Udn7tkj5oty2gw2P
📩 Not subscribed yet? Get the Brief free: https://brief.cisochair.com/
🌐 Learn more: https://CISOchair.com