One of the most important moments in the panel came not from the stage, but from the audience.
The question was direct and practical:
“What is the ideal way to put a framework in place for the C-suite to start thinking like a Chief Information Security Officer (CISO)?”
🎧 Watch the short extract
The answer matters, because the reality today is this:
most major cyber incidents do not begin with a system failure, they begin with a person.
Phishing, impersonation, deepfake audio, fake internal IT requests, compromised credentials
— these are now the primary entry points for both criminal and state-linked attacks.
What has changed since this discussion only reinforces the point.
Artificial intelligence-enabled phishing and voice cloning are now sophisticated enough to fool experienced executives, not just junior staff.
Recent incidents across finance, energy, healthcare, and government show that compliance frameworks alone offer false comfort.
Regulators and insurers are increasingly explicit that boards are accountable for cyber resilience, not just cyber spend.
A Practical Framework for the C-Suite
The framework discussed on stage was deliberately simple and executable.
1. Start with threat reality, not tools
Understand what threats you are exposed to based on sector, geography, and strategic relevance — before buying technology.
2. Identify the “crown jewels”
Secure the systems, data, and processes that actually generate value or mission impact.
3. Fix the basics properly
International standards exist for a reason. Compliance does not equal security.
4. Train people relentlessly
Employees are the weakest link and therefore the strongest line of defence when trained correctly. Cybersecurity today is behavioural as much as technical.
5. Make cybersecurity a team sport
Chief Information Security Officers are not blockers of growth. They are enablers of resilience, valuation, and trust — if the C-suite participates.
The Boardroom Reality
The most dangerous misconception in boardrooms today is that cybersecurity can be “delegated”. It can’t.
▶️ Watch the short extract
This short video highlights key insights from the FII panel discussion on how the C-suite can start thinking like a Chief Information Security Officer, focusing on real-world threats, human risk, and executive accountability for cyber resilience.
🎧 Want the complete conversation?
Watch the complete FII panel discussion on YouTube for the full exchange and deeper context.
With Thanks to my fellow panel speakers:
Yasser Alswailem – CEO, sirar by stc
Philippe Keryer – SEVP Strategy, Research & Technology, Thales
Ameya Talwalkar – Founder & CEO, Cequence Security
Moderator: Xenia Wickett, Director, Wickett Advisory
And the FII Institute team for hosting an important and timely discussion.
