Kirsty Paine on CISO Leadership, AI Risks and Practical Cybersecurity Strategy

Cybersecurity leaders are being asked to do more than manage technical defenses. They must explain risk in business terms, coordinate across teams and weigh new tools such as artificial intelligence against their limits. Kirsty Paine, field CTO and strategic advisor at Splunk, sees that shift as one of the defining changes in the chief information security officer’s job.

In an interview with Techopedia, Paine discussed CISO responsibilities, AI-enabled threats and defenses, industry differences, and the habits that can make a security program more effective. Her comments draw on Splunk’s CISO research and her work with the World Economic Forum’s cybersecurity center.

The CISO role now reaches across the business

Splunk’s recent CISO report found that 86% of respondents said the role had changed so much since they took it on that it was almost a different job. Paine links that change to organizations treating security as a strategic business concern. The CISO is increasingly expected to shape decisions across the company, rather than focus solely on technical controls.

That broader remit is reflected in who enters the role. Paine says more CISOs now come from other technology teams or business functions, and more have direct access to senior leadership. In the same report, 47% said they reported directly to their CEO. That access can help security leaders bring risks into business planning earlier, though it also means they must explain priorities to people who may not share their technical background.

Boards are taking a more active interest in security and asking CISOs to justify spending. Paine views that scrutiny as evidence that security has entered higher-level discussions, even if the available funding still falls short of what security teams want. The practical challenge is to show what a proposed investment changes and which risks it addresses.

That calls for metrics that are relevant to the organization, within the CISO’s influence and useful for tracking change over time. Paine says 90% of CISOs in the report found that their boards cared about different performance indicators and security measures than they had two years earlier. Measures tied to risk, investment returns, testing outcomes and cyber insurance can give business leaders a clearer basis for discussion. The aim is to connect technical work to outcomes such as potential loss and service disruption.

For security professionals, Paine emphasizes adaptability and collaboration. The field changes quickly, and security leaders need to understand how technology can support the business while keeping essential safeguards in place. Yet security, engineering and IT teams can still work in separate lanes, limiting their ability to build safer systems together. Paine argues that people entering the field should be ready to learn from other teams and share responsibility for common goals.

AI brings defensive uses and new exposure

Paine expects AI to affect both attackers and defenders. In Splunk’s CISO research, 70% of CISOs believed AI would give attackers an advantage over defenders and raise the difficulty of reducing risk. She also points to research from Splunk’s SURGe team: people had only a random chance of correctly identifying whether phishing messages were written by AI or by a person. That finding illustrates how difficult it can be to judge a message by its wording alone.

At the same time, organizations are testing AI for practical security work. Paine says 35% of industry leaders surveyed were experimenting with it, including for workflow automation, cyber defense, malware analysis and risk scoring. These uses could help teams sort information and assign attention faster, especially as the volume of alerts and other security data grows.

AI also brings risks that teams need to account for. Paine cites data leakage involving large language models, deepfakes and social engineering as areas of concern. The technology may help address skills shortages, but it does not remove the need for experienced people to set priorities and review results. She recommends that IT leaders establish AI policies and train staff in how systems are deployed and used.

There is a familiar implementation trap here: enthusiasm can outpace planning. Paine cautions against assuming that AI will quickly deliver every hoped-for benefit. Organizations need to assess their capabilities, decide where a tool fits and set realistic expectations for when it may produce value. The useful question is not simply whether to adopt AI, but which tasks it can improve and how teams will evaluate the result.

Industry priorities vary, while service availability grows in importance

Threats affect organizations of every size and sector, though their consequences and security needs differ. Paine highlights healthcare’s exposure to frequent cyberattacks, which can have serious effects on people’s care. She also notes that manufacturing recorded the fourth-highest number of incidents in 2023, behind finance, education and public administration.

Financial institutions are often further along in security maturity, Paine says, while telecommunications also places particular weight on service availability. She describes a change in emphasis from the familiar CIA triad—confidentiality, integrity and availability—to “AIC”: availability, integrity and confidentiality. The reordered priorities reflect how incidents can take services offline and make reliability a direct concern for security teams.

That shift has operational consequences. A security plan needs to account for how quickly an organization can detect and investigate an incident, how it will keep essential services running, and which teams must coordinate during a disruption. The right balance depends on what the organization provides and which interruptions would cause the greatest harm.

Three issues shaping CISO priorities

AI moving from experiments into operations. Paine expected work on AI prototypes and early experiments from 2023 to progress into production use in 2024, for both defense and attacks. Defenders may use the technology to extend their capabilities and make better use of limited staff. Attackers may use it to support threats involving data exposure, impersonation or social engineering. Paine’s caution is that implementation takes planning and a realistic view of what a system can accomplish.

Pressure on organizational budgets. Splunk’s report found that 92% of CISOs expected their cybersecurity budgets to rise in 2024, while 83% anticipated cuts in other parts of their organizations. Paine described the figures as encouraging but still insufficient for the level of security many teams wanted. Economic conditions can affect attackers as well: she says 80% of surveyed CISOs had noticed an increase in threats alongside a weakening economy, and she points to a shift from ransomware toward extortion as one possible change in criminal tactics.

Coordination across teams and working hours. Security work depends on communication between technical teams and business leaders. Paine says organizations need the ability to identify, investigate and report incidents quickly, which can require automation and coverage beyond the standard working day. For teams responsible for services that must remain available, coordination needs to be planned as an ongoing operational function.

Build strategy around measurable needs

Paine’s advice for creating a security strategy starts with an honest assessment of the organization’s current position. Leaders should identify what matters to the business, then choose security changes that support those priorities. A strategy built around an abstract target can miss the day-to-day obstacles that put people and systems at risk.

Some useful improvements may be modest. If cumbersome password requirements hinder staff, a company could consider changing them and adding single sign-on. If employees struggle to report phishing, a simpler reporting process could reduce risk while easing frustration. Paine’s test is whether a change produces a measurable, practical improvement in the organization’s baseline security practices.

That approach also gives CISOs a stronger way to explain decisions to senior leaders. A clear link between a problem, the proposed change and the result makes it easier to discuss investment and priorities. It can help teams avoid spending effort on visible but low-impact work while basic practices remain difficult to follow.

Paine’s work across security communities

Paine is completing a two-year fellowship with the World Economic Forum’s cybersecurity center. Her work covers two of its five focus areas: cyber resilience in manufacturing and the partnership against cybercrime. Other areas include digital trust and quantum technologies. She describes the center’s role as creating settings where participants can share ideas and build communities around improving security.

The center’s Annual Meeting for Cybersecurity took place in mid-November and brought together 150 technology and security executives. Splunk’s Petra Jenner, its general manager for EMEA, and CISO Jason Lee were among those attending. Paine and colleagues also recorded a podcast about the meeting, touching on transparency, trust, information sharing, collaboration and CISO mental health.

One line from that discussion stayed with Paine: “a time of crisis is not the time to exchange business cards.” The point is practical: relationships and information-sharing channels are more useful when teams establish them before an incident creates pressure.

Paine began her career as a mathematician at the UK National Cyber Security Center, working on cryptography, machine learning, big data and post-quantum security. Her work later expanded into international technical forums and collaboration with industry and policymakers on security, privacy, cryptography, AI, internet technologies and the Internet of Things. She is now a field CTO and strategic advisor at Splunk, where she provides technical leadership, and she co-hosts The Security Detail podcast with Audra Streetman.

Her account points to a consistent test for security leaders: connect technical decisions to the services and people they protect. AI may change the tools available, but effective adoption still depends on clear priorities, capable teams and changes that can be measured in practice.