Cybersecurity Perspectives for 2025 – Insights from Rinki Sethi

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today's podcast is part of a series where I get to pick the brains of cybersecurity leaders as to what 2025 will hold for our industry. We're going to explore 3 areas. First, how attackers are maneuvering. Second, how business conditions are changing. And third, how technology innovation is impacting cybersecurity. And today I'm talking with Rinki Sethi. Rinki is a Vice President and Chief Information Security Officer at Bill, a board member, former CISO at Twitter and Rubrik, and a leading industry speaker. Welcome, Rinki. It's always great to chat with you.

It's so amazing to be here. Thanks for having me, Matthew.

So, you know, every year, right, our industry changes and it seems like cybersecurity just, it always becomes more challenging. It never gets easier, right? The attackers are adapting. The business expectations always seem to be increasing and they tend to increase faster than the budgets we're given in many cases. And then there's this technology wildcard, right, where adoption of Innovative technology brings forth new challenges and new opportunities. So let's start with the attackers. In your mind, how are those threats, those cyber threats changing in 2025, either from their tactics or capabilities, resources, focuses? What do you think?

Yeah, and, you know, hopefully this doesn't sound cliché because everybody's talking about AI, but hopefully I can provide a little bit of a different angle on it. I like seeing both, like overseeing both security and IT. We're starting to see just AI pop up everywhere, LLM features and things pop up in all the third-party software we're using, but also a massive demand from employees, right, on we want the latest and the greatest. We're seeing that we could do this much more efficiently, and we've got to figure out what the standards are, the security standards are, and how we do proper testing around just security testing around these new capabilities because they're very cool and we want to be able to adopt them. But the innovation in security is what we need to adopt. And so we're starting to see there's going to be proliferation and how we control and manage that while enabling employees. I think it's going to be tough. It's been tough towards— in 2024. I think going into 2025, if we don't reinvent our security programs to think about this, I think it's going to be challenging. I think the attackers know this, that, hey, folks are using LLMs and lot of unsanctioned application usage. And so how do you— how do we as professionals get ahead of that? So I definitely see that as one. The other one I'd hop into is kind of third-party supply chain risk, which we've— which is not new. It's something we've talked about. But just weaving into what I mentioned earlier, right, it's going to continue being a big challenge. There's third parties that we hear about every day that are being breached. And how do we ensure that we, within our control, are able to manage our data and make sure that it's protected. And I only see this risk going up tremendously, and especially with AI, that now doing hacks is getting easier for the attackers. The last one I'll mention is ransomware and extortion. I was just hearing a story yesterday of a company that had to decide whether to pay the ransom or not, right? It's many times we hear it from schools and others and they're not protected with the right backup and the right technology. And so it's those types of things that I think are going to be on a rise. And I think it's becoming easier for attackers to go and figure out which companies or which organizations have good security or not and quickly go and attack and monetize on it.

So 3 great areas. So a question on the first one, AI. Right? You mentioned, you know, companies are adopting, your company's adopting, everybody's adopting it. And that obviously creates more potential attack surface. What is your worry though, from the attacker's perspective? Is it the fact that they're using AI tools themselves to be more efficient, effective, scalable, whatnot? Or is it the fact that they're going to take advantage of that larger attack surface that you and other companies obviously are potentially putting out there. Where does your worry kind of reside?

Yeah, I think the leveraging AI to conduct attacks, that's been kind of a challenge, you know, and we've always in cybersecurity used AI to tackle that as well, right? On the good side. But I think it's the attack surface increase and understanding Like these things are like everyday applications we're using are starting to integrate with LLMs. Some are open source, some are not. And understanding how your data is protected when you're using that, is it, you know, segregated in the right way? And so I think those types of things are— attackers are paying attention to that too. And so the attack surface is larger. And so how can they go after your data? And I think that's the thing we've really got to think about hard.

Yeah. And the good news there is that's something we can control, right? That's within our boundaries. Those are the applications that are involved. You know, how the attackers are going to use AI and all those cool tools. We don't really get to control that. But what you're talking about is something that it's an opportunity. It's an opportunity to get ahead of it. It's an opportunity because it's within our domain. So it sounds like it's a positive thing out of all the bad. There's a silver lining to that particular bad thing. And then, you know, the supply chain attacks. Yeah, I think absolutely 2025, it's scalable, right? You hit one supplier and now potentially all their clients, it's the same story. And why would you move away from something that works, right?

Yeah, exactly.

I did hear on ransomware— oh, go ahead.

Oh no, I was just going to say, you nailed it. And I think there's so much innovation happening in this space. Like, you and I have talked about this in the past, that like, how quickly can we— because you want to enable your employees to be able to use all this. And so how quickly can we bring in that security innovation to be an enabler to protect, kind of build a wrapper around this such that, like, employees can use it and you're still protected at the same time and you're not playing whack-a-mole.

Yeah, I mean, that's the key, right? You want to benefit, you want your organization, your company, everybody to benefit from these wonderful AI tools, technology. But at the same time, it's a race to be able to get security and proper controls, behavioral process, all that in place so it's not a liability to you, right? And an advantage to the attacker. Now, you had also mentioned ransomware, and I read recently, it was from Chainalysis, or Chainalysis, they said that ransomware actually went down in 2024, not the number of attacks, but the actual ransoms paid. And they attributed that to victims kind of moving away from paying it and not paying it, as well as some law enforcement and, you know, actions that took out some big, big actors. Do you think that's going to hold true in the next year where, you know, companies are feeling, you know, in mid-stride and they've got better security and backup tools? You mentioned that they can recover. They don't have to give in and pay the ransom. Or do you think the attackers are going to adapt to that, get better and push forward and earn more money next year? What do you think?

Gosh, it's a tough question. I think it might be a little bit of both. And it's like, you know, we as security practitioners, all we want to say, don't pay the ransom, don't pay the ransom. But, you know, we are not in that necessarily. I think there's a couple of things. I do think there's organizations that have really matured around this capability. They have good backup. They're making sure the backups are immutable, that they don't— that they're protected from ransomware. They have good protection on their servers and their infrastructure. But then there's like schools and organizations that don't have the budget, that don't have the security expertise. They're still open to massive risk here. And it's a ransomware attack that drives them then to create the budget to go and invest in proper protections. And I think there's a lot of those out there and we hear about them every day and some we don't even hear about because because they're kind of quietly dealing with this. So I do think that there's opportunity. And of course, the attackers are getting more sophisticated, too, right, on like, what can we do and how can we continue to monetize on this? So I think it's— and then, again, like, I think the last thing, and we've been preaching this forever, is like, you do want to— that's the one area I think you really want to exercise like incident response and making sure that you've got a good plan together. Discuss tabletops.

Do something as simple as tabletops.

Yeah, do a breach simulation, do something and practice it all the way seriously to like how are you going to communicate externally and what, what is the point of view so you're not caught in a corner deciding in the moment on are you going to pay or not and how do you want to handle this and what would we do and what would be the impact because under pressure we know it's like very, very difficult and sometimes the wrong decisions are being made. So I think that's a really key important thing and No matter how much we say this, like, it unfortunately still happens and lots of organizations are unprepared.

I mean, that's great advice. It really is. You don't want to practice a crisis in an actual crisis, right? Time is not a resource that you have an abundance of. And practice, even a simple tabletop exercise typically uncovers gaps. You don't have a current contact list or, you know, you don't have the right people to make a decision for external communications. Little things like that. It makes a difference if you just walk through it. So, okay, let's pivot a little bit. Running cybersecurity teams, and you've ran them your career here, it never gets easier. It always seems like expectations are going up or there's more crunches on budget or things of that sort. In 2025, what do you think are going to be the big challenges in running a successful successful cybersecurity capability?

Yeah, I think we're seeing— like, I can talk from the CISO perspective. We're seeing the role of the CISOs change quite a bit, right, from when we started our careers today. I mean, I remember nobody even knowing what a CISO— what cybersecurity was like. What is it that you do? And then all of a sudden, almost a decade later, all these breaches started happening and all of us— you're now parents, grandparents know what cybersecurity is and they're worried and it's important to them. And now, it's like gotten to be a very business-centric role and the expectations are, you know, the stakes are high, the expectations are high. And I think our role is changing quite a bit and we've seen kind of, you know, it be center in the news with some high-profile breaches. And so, I think that's going to continue. I think our roles are going to start, continue to evolve what is expected from practitioners is going to continue to evolve. Um, I think the regular regulatory and compliance, uh, around cybersecurity is shifting. Um, and so, uh, we're seeing more and more, uh, you know, orders coming around cybersecurity globally, uh, that I think are going to impact us hopefully in positive ways. I actually think that more regulation and more controls and more audits and things are better, um, just like you have on the finance side. So Maybe it's wishful thinking, Matthew, but that's what I really want things to change to make our roles kind of not easier, but there have to be more structure around how we do checks and balances. I think the other thing is that the boards care about cybersecurity. It's being talked about everywhere and there's a lot of interest. And I think board members— now you see as a part of NACD and a lot of the board guidance, cybersecurity is a big portion of it. Like, what should we be asking? How should we be conducting? And it's not just a list of questions, but what relationship should the board have with the CISO? And how do you have the right conversations? I think that's really important, right, on how they're supporting security as part of the business. I think the other thing is like we've got to in how we run our programs, you can see we're reading a lot of things around IT and security tools. We see innovation every day and we're like looking at it. It's like, okay, there's a lot of talk about AI, but this is still a long ways. It seems years away from us really like being able to implement it in a way that it's going to replace anything. But I do think it's time for us to really look at that innovation and figure out kind of how we're going to upskill, uplevel our talent. To make sure that they see their future and are excited about leveraging technologies that drive efficiency rather than scared of it or saying, "Oh, that's going to replace me." It's like, "No, no, this is going to create massive opportunities for an industry where the talent shortage is already insane." So, I think that's going to be a big shift. I hope we all like talk about this in the right way. And people don't have this fear of, "I've got to hold on to my job," but rather like, "Hey, how do I upskill and uplevel?" And I hope those conversations start this year. And I I think I'm starting to see it, and hopefully they'll continue.

I personally think they will. I think they have to with the pace of innovation, and it has to come about. But let me ask you an ugly question, so I'll apologize now. And it goes back to that growing expectation, the growing role of the CISO, and as well as from the board members, right? A lot of CISOs have come up from the technical space. They are proficient, they are skilled in that, but they're not necessarily savvy in regards to business conversations. And, you know, at least I've seen kind of a chasm between your typical CISO who's very proficient at what they do and the board who's trying to oversee, and the CEO and the C-suite trying to oversee the business decisions and whatnot. There seems to be a chasm between the communication and expectations of those groups. CISOs aren't talking business, and business don't necessarily understand the finer pleasantries of managing cyber risk. Do you think that's going to change? Are we going to have CISOs that are going to be getting more MBAs? Are we going to have board members that are going to have to learn more of the language or structure of cybersecurity and what it really means and how it contributes to the business or doesn't? What do you see in 2025? Is things just going to fall apart or are we going to get better? What do you think?

Yeah, it's so interesting that you ask that because I'm a computer science engineer by trade, right? And yeah, it took me a long time to— like, it was like the role was very technical, right? And then it started changing and yet like we weren't skilled with it at all. It was when I sat on the board of Fordruck that I got exposure because like, let's talk about CISO reporting structures. Not all of us sit on the CEO staff were not in all of the business meetings. Like many of us report to CTOs or CIOs, or, you know, and we're— and if your leader does a really good job of giving you the business acumen, then you might start saying, okay, I understand what's going on. But otherwise, you might not. And then sitting on the board of Forgerock was really eye-opening for me because I was like, wow, like this is what they're talking about. And this is what they're thinking about. And they're talking about like, COVID and how it's going to impact the workforce. And then I'm like, oh, there's a vulnerability that needs to go and get fixed. And it's like a mismatch, right? And I'm like, okay, how do, like, how do you, how do you bring that, right? And yet, a cybersecurity breach could cost the company everything. So, how do you bridge that gap? And it took me like, okay, I need to get like, I need to understand financials. I need not to a deep level, but become more business savvy and self-educate and understand what's important for leaders. In the company. But what I also realize is like, we've always held kind of risks. Like, we as security practitioners are like, "Okay, there's all these risks and it's ours to go and fix." And I think what we have to do is change that mindset to make it transparent. And so, it's our job to surface risks, to bring complete transparency, to manage accountability, and make sure that the folks that are risk owners understand that you have a risk in your business This is the impact of that risk and making sure that you're giving your advice and educating them around it. But then, ultimately, the accountability is on that leader. And when things are happening that you feel that could pose significant risk to the business, there's an escalation path where you're not necessarily the bad person that's going and reporting it. But that there's an agreed-upon methodology around that. And I think that's the biggest important piece. And I think putting it back in business terms. But I do think we have to get more business savvy. I think the other thing I will add is like different organizations of different size. If it's a startup company, you might need more of a security architect or a very technical leader in the beginning, and that will change over time as the business sees its successes and grows. So I think it's a really interesting paradigm shift that's happened for us. And, you know, some of us have, like, struggled and really, like, gone and learned that how do I transform, but it has really required a transformation for me personally on like, how do I get out of my technical, like, speak, which I still love, but, and go into communicating and educating and continuing to do that. And especially at the board too, what is the most important thing that they need to take away? And it's not necessarily the technical jargon, right?

Yeah. And they speak a different language and that transformation you're talking, I love that word because I think it really is. You're not surrendering your skills as a CISO. You're learning how to be a business leader on top of that and then be that important translator. Because if you go into the board and you want to talk about CVE something, you've already lost them. You've already lost your fight. You have to walk in and say, "Hey, here's a business impact. There's something going on. We call it a vulnerability, but there's a potential business impact that you need to understand. I'm going to talk to you in terms of revenue or margin or market share," because that's the language they understand.

Totally.

And a lot of CISOs, especially junior ones, think, "Well, no, I own all risk. I manage risk. This is what I do for the company." And they don't realize that's what the board does, too. They're managing the business risk, the competitive risk, you know, but they don't understand cyber yet. So we got to figure out a way to cross the chasm from both sides, meet in the middle somewhere. But I think a lot of it really has to come from the CISO. They have to be able to speak the language of the board so the board can make those good risk, business risk decisions that translates down into how the CISO has to deliver.

But yeah, I couldn't agree more. I mean, I, it's, yeah, it's such an important change that's happening. And I think we have to be kind of self-starters in this way to, because there's not a, there's not a playbook on this. Not yet. Not yet.

There needs to be a masterclass.

Yeah.

You know, to help both sides. But yes, yes. Okay. So you had mentioned AI. Everybody's mentioning AI, AI, AI, AI. And I agree, it's one of the disruptive technologies out there. But let's kind of focus in from a disruption perspective. Is it only AI that we need to worry about in 2025? Is there, you know, blockchain or quantum? Is it just AI? And if it is, You know, let's dive in a little bit deeper. What are those risks that we really need to be thinking about? You had mentioned kind of the infrastructure. You know, we're adopting it and it can create all sorts of new vulnerabilities and exploitation opportunities. The bad guys potentially may be using it. Are there other elements or layers to this story?

Yeah, I mean, I think like we're hearing a lot about quantum and quantum computing and threats and opportunities. Cutting-edge tech that's being— we're still, I think most of us are still waiting to see application of quantum, right? But I, you know, there's definitely threats. I still go back to zero trust, right? I mean, and it sounds again, it's like, it's probably boring and overplayed. But when we think about our identity and access management programs, just if we start with that, this is still such a huge problem on getting that in control. And you're, Like, look, we can probably, between you and I, probably name 50 startups that are working on non-human identity, identity governance, like human identity, threat detection around identity. So there's so much in that space. And so we know it's still a big problem, right? And yet we're excited about AI.

AI is sexy. That's great to talk about.

Yeah, it's fun, right? But yet we have these fundamental things that we still need to handle. I think the application of AI is like, I think the part that gets exciting is, is there a cleaner, faster, more innovative way to do this because we still don't have control on it? Then we think about like asset management. And so I think like there's 4 things that I think are coming together. It's around identity access management. It's around your identity and access management, asset management, your Data security, vulnerability management. And I think there's like, those things are like everybody I talk to, every like security person, it's like that's still a challenge, real big challenge. And the last mile is still a big challenge, Matthew. This is like, it sounds so old school and boring and this is what we're focused on in 2025. But that last mile of taking a look at all your identity issues or vulnerabilities, prioritizing them, deduping them, assigning them, understanding the exploitability, then getting Jira tickets assigned, then chasing the owner to go and remediate issues, finding out if people still need access. These things are still so challenging and they're actually the most time-consuming part of security, right? Like, it's the part that takes the most resources. It's the part where if you get behind, you start getting into compliance issues and you get into security risk. And so, I think this is still— and I think this is the part where we as practitioners, like, can AI help us, like, just deal with that and so that we can then go and focus strategically on the aspects of zero trust that really need focus. And so I think that's still a big thing. And that's where I think AI becomes like this sexy new term that we're like, can it help us with some of these things we've been dealing with for a decade?

So I'm kind of reading between the lines here, but tell me if I'm picking up on this. Essentially, you're saying we have fundamental block and tackling that we still have to do don't get distracted by all the shiny new innovative technologies unless they can tangibly help you with the fundamentals, the basics that we're still struggling with, right? Deal with the 80% first before you're going to go after the last 20%. Is that what I'm getting from you here?

Yeah, I think like I will hear pitches from any innovator that wants to talk, but it's always about, yes, I don't need to know that you're leveraging AI or using LLMs or whatever. It's, What problem are you gonna help me solve that is like burning for me, right? And then, it's interesting on, okay, if you can do this in an interesting way, let's talk about it. So, I totally, yes, like we need to stop thinking about the buzzwords, but like how is this actually gonna help our program really kind of progress, you know, level up or become more efficient or do it in a way that's, you know, maybe that you need to scrape your existing technology and tools and just do this in a completely different way. So, I think that's where it starts becoming interesting. I think most of the application of it still has a little bit to go.

Agreed. And I think we also have to kind of pull back from some of that sexy marketing. I was at a conference talking and some of the CISOs were like, yeah, you know, we're looking at deepfake technology and anti-deepfake technology and worrying about that. And I'm thinking, okay, no, that's great. That's sexy. But that's such a tiny fraction of the attacks. You haven't fixed yet your social engineering, your employees clicking on bad phishing emails, and you're getting, you know, 500,000 of those a day in your enterprise. How many deepfake attacks are you getting a day? Well, you know, I mean, you know, we got one a couple of months ago. Okay, so you've got one last quarter and you're looking at investing in that versus trying to improve your social engineering resistance. There's something wrong here, right? We're being distracted. So, okay. So last question here, and this really kind of gets back to everything that we're looking at in 2025. You know, we've got a lot of cybersecurity leaders and CISOs that watch this podcast. What is your advice to them? Right. We're just starting February here. We're coming to the mid part of February. This is our opportunity, what should they be focusing on? What's the one thing that they should just nail in the next few months for their organization?

Gosh, one thing I mentioned this earlier, you know, we've— we're always talking about taking a look at our programs and our security programs and like making them better. I think it's the most important time now that if we don't reinvent our programs completely, and as much as you love or hate AI, it's here. And if we're not really looking at this from the lens of we've got to relook at our program and, you know, these vendors that have been here forever, do we need to kind of relook at things? Do we need to relook at the attack surface or the threats? Really kind of figure out are there better ways to doing things? Because I don't think with the talent shortage, with all of us being asked to become more efficient now, I think if you don't look at your program, people are going to see writing on the wall. And that's the last thing we need for our industry. And so, it's like how we uplevel our program and inspire people to upskill is going to be super, super important. It's time to reinvent. And I really strongly believe that the earlier we get on that You know, and it might not mean that you rebuild everything in your program this year. But saying like, hey, 2 to 3 years, here's where— here's kind of the roadmap of what we see coming and how we need to upskill. But then also like what we might be looking to transform within our organizations. I think that's going to be really, really important, inspiring for people on your teams to retain talent. But also just staying ahead of the curve. And I think it's kind of like what we I feel like this time period is even more crazy than what we went through when the cloud transformation happened, right? So, and I think it's going to be faster. So anyway, that's my, and that's probably controversial because there's a lot of leaders I know that disagree, but I strongly believe this.

Well, it is controversial because really what I hear you saying is be proactive, right? Be proactive in the people and their concerns about AI taking over their job. Be proactive in understanding how the threats are adapting. Be proactive in realizing how your company's going to throw itself at every AI tool and it's going to cause security issues, right? That's always been that brass ring we've wanted to be— transition from reactive to proactive. And it sounds like you're saying 2025 is that year that you really do need to start getting closer to that. You really need to take steps, tangible steps to be more proactive. Otherwise, you're going to take it in the shorts by the end of the year, right? People are going to abandon, you're going to have all sorts of more vulnerabilities. AI won't be your friend and you'll be very unhappy with it. I mean, do you think that's possible? Do you think we can as an industry become more proactive given everything that we have to do day to day?

I think it's really hard. It's really hard. And all it's going to take for you to, it's like somebody asking you that, hey, Like every board is asking their execs like, "Hey, are we applying AI to product and to your whatever?" And it's like going to be a matter of, I think, moments that like, "Hey, how much are we going to keep adding to the team? Like, how are you becoming more efficient? How are you leveraging AI? And why are we not moving faster?" And you don't want to be reactive to that and then go have the team scramble. "Oh no, we need to figure out how we patch on AI to our program." Rather think about it like when it's more thoughtful, it's like, "Hey, Really, like, technologies have a ways to go for us to— but we see kind of that line of, you know, we see that light at the end of the tunnel that 2 to 3 years from now, our SecOps might look different, right? Because there's going to be technologies that are going to come in that are going to do better detection or whatever it is. And we can see that happening even though it's not here today. But having that vision and being able to chat about it and looking at it now is going to be super important. Otherwise, you're going to be like, "We got to go do something to patch something on just so we can answer to these things that are being asked." that's not the place you want to be. And, you know, I've always believed that practitioners want to be in the places that are the most innovative. You know, great practitioners want to be in the place that are most innovative. So I think it's really important to think about.

Yeah, no one wants to be in that grind, that reactive bolt-on. You have to do, you know, 80% more work because you didn't get ahead of it in the beginning. You know, that ounce of prevention is really worth, you know, equivalent to that pound of cure. Great, great insights. You know, Rinky, Vice President and Chief Information Security Officer at Build, thank you for sharing your cybersecurity insights today. Truly, truly just so many gems. Thank you so much.

Thanks for having me, Matthew. I can't wait to do this again with you.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.