Cybersecurity Vault - The Rise of Chief Trust and Security Officers

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today, we're going to take a deep dive in talking about a relatively new C-suite role and discuss the value of the Chief Trust and Security Officer. And I'm going to be talking with Malcolm Harkins and Rob Recck. Malcolm is the Chief Security and Trust Officer at Epiphany Systems, where he's responsible for enabling client growth with optimal information security infrastructure, systems, policies, and processes. He's also an independent board member and advisor to several organizations, as well as an executive coach to CISOs. And others in a wide variety of information risk roles. Rob is the Chief Trust Officer for Red Canary, where he's responsible for ensuring the company maintains the trust of its customers and employees. And previous to joining Red Canary, Rob served as the Chief Information Security Officer responsible for their security and privacy and trust programs. Did I get that right, Rob?

Previously, I was at Ping Identity, actually.

Oh, Ping Identity. Okay, my apologies there. And today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. Welcome Malcolm and Rob. Thank you for coming and talking with us.

Thanks, Matt.

Glad to be here.

So the field of C-level roles is already stacked. We've got Chief Information Officers, Chief Technology Officers, Chief Information Security Officers, Chief Security Officers. Chief data officers, chief privacy officers. I'm sure there's a chief cook by now. So what is— help me understand it. What is a chief trust officer, chief security trust officer, and why are they important to this group of C-suite? Malcolm, let's start with you.

Well, for me, it's an evolution of the role of the chief information security officer. At the end of the day, it's a trust issue. And when you look broadly at information and technology risk, not only from the traditional InfoSec side, but all the compliance-related items, privacy, other technology risk issues that could be generated that could affect the organization, its shareholders, its customers, you have to look at it as a trust issue at the end of the day. So for me, it's an evolution of that role, and it's more encompassing of, um, the breadth and depth of other related issues for the organization, well beyond the typical InfoSec scope that is generally contained to the CIO.

Yeah, I think Malcolm's right. I'd call it an evolution and maybe a reframing of what the CISO has done. Security as it existed initially was kind of a reactive, was a response to the fact that technology didn't work the way we wanted it to. And it didn't necessarily look holistically at this bigger problem of how do you build things in a way that you're going to ensure you, you meet the expectations of, of your stakeholders. And, and, and this is how I look at trust is, you know, yes, absolutely, making sure it's secure is part of that. Making sure you understand, you know, how data is used, making sure that your, your, your systems are going to be available. All these things being built in at the beginning, that's how you can trust the technologies that's delivered. It's not just a question of can I stop a hacker from getting in, which I, which I think is where security really came from, you know, 25 years ago. It, it's really us trying to be more proactively thinking, how do you build this thing that best meets the requirements in front of us so that, so that our stakeholders can trust us?

So you say this is an evolution. Is this a replacement of the CISO? Is this that next role? The CISO goes, goes away and, uh, or is this complementary to what CISOs are doing currently?

I think it could be a little bit of both depending upon the organization. So again, Matt, if you look back when I was at Intel and you were there, you know, that role and the scope evolved, right? Year on year on year. And when I eventually became Chief Security and Privacy Officer, the reason why I didn't become Chief Trust Officer is 'cause Intel CTO didn't want another CTO. And so we named it Chief Security and Privacy Officer. But for me, it's, it's again, it's an evolution. You could look at it as the InfoSec is a subcomponent, in which case you might have a CISO reporting to a Chief Trust Officer. But depending upon the size of the organization, you don't necessarily need both. You might have a security operations director, security engineering manager, you might have a director of compliance. You know, so when I look at my role at Silence, all of those things were underneath me and I had a deputy CISO, but the organization was smaller. If you go back to the size of an Intel and you evolved it to a chief trust officer, the CISO would be one component of it, and then you'd have the other risk and compliance functions underneath it.

And Rob, I mean, do you see this as a replacement or augment? And where do you see those other potential C-level officers, the, you know, chief data officer and everybody else in relation to this role?

Yeah, I think Malcolm did a good job summarizing that chief trust officer should own underneath it security, probably privacy, risk, compliance. And depending on the size of your company, do you need an executive for each of those or do you not? There's a checkbox to be answered. Hopefully there, even if there's no other executives, if there's other executives, you might have a CISO, a chief privacy officer, maybe even a Chief Risk Officer reporting into Trust. The, the question of Chief Data Officer, I think that's a little different. And I know that some folks put that under, under Trust, some might put that under your CIO, some might put it into Product depending on what kind of a company you are. Those are questions that need to be figured out at the highest level. I think that the really key part is getting that buy-in from the senior executives that, that we're looking at this as a risk management, as a as a function around trust. Really, trust is the right word. How do we build trust with our customers? It's the way that we treat the data, the way that we're structuring this. And it's not just, you know, something that sits under a CIO somewhere. Otherwise, I think you still have that same problem that we've always had with segregation of duties and challenges where, you know, we're going to have conflict built in.

I was going to say, one thing to think about though with all the acronym soup that you mentioned at the beginning, there's two key words: chief an officer in between all those things that you mentioned. And in many organizations, if not most, one, they're not an officer of the company, so that's also a problem having that title. And two, they're not necessarily a chief because they have limited decision-making capacity in the role. And so even if you have whatever C and whatever O and whatever's in between, the question still resides: what's your scope? What's your decision authority? And are you a true officer of the company? And with that, then carrying the full fiduciary accountability and responsibility, including liability, that should be required of that role.

So what I'm hearing is this is kind of an amalgamation and kind of an alignment of a lot of these other functions, which may not be a true chief role, but a lot of these other functions to align them towards delivering trust— and it sounds predominantly towards trust of your customers, your partners, your, you know, and everything downstream. How does instituting this role, how does it fundamentally or does it fundamentally change the value proposition of everything beneath it then? What do we get for implementing a Chief Trust Officer versus leaving the way it is in, you know, in someone's current organization?

Well, for me, Matt, structure drives behavior and you get what you measure, right? So regardless of the title, unless you have the right structure in place and again, that, that accountability that I was talking about, the responsibility and then the, the span and decision authority within the company, it almost doesn't deliver anything. But that's also true of the CISO role. If you don't have the right scope, you don't have the right structure, you don't have the right decision authority. So just having the title doesn't change anything. It's all based upon structure, scope of decision-making, span of control, and then the ultimate accountability and responsibility you have.

Yeah, this is, this is why I'm saying that it doesn't— you got to have that executive buy-in about what it is you're trying to accomplish. And, and then, and really there's, there's a cross-functional element to this role that we haven't got into yet that Yes, you're going to own a few functions and maybe you're just a manager of some, some leaders, right? But that's, that's really, I think, just, just starting the conversation about what it means to institute a trust program at an organization. It's about figuring out what are your values around trust as a company and how do you institute those into other parts of the business in the same way that you'd, you'd expect to see, you know, legal or, or HR influencing other departments about how they act and security, right? Influencing how other teams act. A trust officer should also be influencing how other folks act. And, and Matthew, you talked about some of the stakeholders who we're trying to earn the trust of and, you know, be considered trustworthy by. Well, the people who interact with them need to understand what's our company's philosophy around trust. What does it mean if we're going to be the company that is willing to have hard conversations? If we're going to be the company that sticks to their word? Well, it doesn't just mean that our security people and our privacy people people do a certain thing, right? It means our salespeople act in a certain way. It means our, it means our marketing folks. It means our, our managers as they treat our employees a certain way. So these, those conversations and, well, yeah, we're going to own a few functions, but the idea of building a trust program should probably go broader, go, go deeper than just, hey, I'm running a few functions and now they roll up to me and we're going to title it something cute, right? It needs to be a change of behavior across the organization that aligns with these organizational values. I'll say coming into a company that did not have a trust program and getting to create one, I picked a company that already had, you know, had already embraced some of the concepts that I think are important to trust. But they had never done it in a formal way, right? So now I'm writing down that we're going to be willing to have hard conversations with our customers. And I'm writing down that transparency is key to success as we work with our partners. And now we're institutionalizing some processes that may have existed in the past. I think if you go into a company that doesn't have that buy-in and you say, hey, I want to be more transparent and I want to be more, I want to make sure we stick to our word more, you're going to run into a lot of friction because transparency is hard for many teams, right? This is not just a, this is not just a, hey, there's now a trust officer. Now we're trustworthy. There's a lot of work that goes into it. And I know we're talking a lot about reporting structure because that's really tangible and easy to understand. But I think it's the squishier stuff about instituting values across the team that really makes a difference and really is the thing that at the end of the day is going to earn or not earn the trust of our stakeholders.

So Rob, you bring up a really interesting aspect. How does ethics then fit into this? Because a lot of what you're talking about, transparency and so forth, that's what I hear in discussions around ethics, whether it's AI ethics or corporate ethics or whatnot. Does the trust officer— are they the champion of that? Are they just supporting it? What role does that trust officer play in corporate ethics, both internally operations as well as products and marketing and sales and everything else?

I think it can be the driver of it depending upon the size of the organization, or it could be plugged into it, whether it be the ethics team, the social responsibility team. But, but Rob stated it perfectly. It really does become one of those corporate values and codified as a company where you understand what your principles are and what you're going to potentially forego revenue on or net income because it's the right thing to do. And, you know, so, you know, even back in my Silence days, I wrote our corporate social responsibility principles, and we codified in it that we wouldn't sell our product into countries that fell below the median score of the Freedom House Index, because I wasn't going to attempt to protect organizations in countries that weren't protecting people's human rights. So when you really start instantiating that full thing of trust, you are influencing, and sometimes you're codifying those ethics rules and principles and social responsibility principles as well. But if you're in a bigger organization, those again take on broader aspects, uh, for the, the organization, but you're a key part of the codification of those and the oversight of them.

Okay, so I, I completely get and, and absolutely behind making sure that that social responsibility, that ethics are there, and having that person So when you're selling this though, because if you're an executive and you're thinking revenue is always king and somebody says, hey, we should really have a trust officer and we may decide not to make large dollar signs doing X, Y, or Z, how do you frame the value proposition? How do you tie that back to the overall goals of revenue or whatever the organization is? How do you sell the position? Because nothing is for free, right? If a company needs to bring in, you know, someone like either one of you, there's gonna be a cost, there's gonna be an overhead, and there may be friction or lost opportunities. So how do you sell the upside and what is that?

For me, it's stickiness and brand loyalty. You know, and what I've seen with the roles that I've had where I've done it, there is direct and indirect impact to the messaging, to the time to market, to the brand, and to revenue. But, you know, trust is a function of two things: competence and character. I mean, think of— there's a book Stephen Covey Jr. wrote, you know, a decade or more ago, The Speed of Trust. I can get on a call and yeah, I can fill out a 400-question risk questionnaire, but frankly, that's a bunch of crap anyways. But I can have a discussion with a peer and say, hey, here's the real risk. Here's where our principles are. Here's how we act and don't act. And yeah, you can have your questionnaire, you can look at a SOC 2, but in reality, if you understand who I am, what I believe in, and how I'm going to act in not only my country's best interest, but yours, then, you know, again, you get a velocity in the sales cycle. That once you start measuring it, actually bears fruit.

Rob, do you have a similar view in regards to how to sell this to land or create a position like this in an organization?

Yeah, I think we're into some real meat of the conversation here from my perspective that this is not a position that should, should probably exist in every company, at least not today. Maybe someday it changes. But I think that you need to understand your organization well enough to know, like, is there, is there an ROI on creating a position like this? I think that there are generally— I've seen two types of companies where this makes the most sense. You're— and both of them come from roughly the same reason. The reason you need a trust officer is because you're partnering.

You're—

so that the company that gets the trust officer is a partner to customers who are outsourcing some really critical functions. If you go back 20 years ago and people are buying software to sit in their data center and they have their own experts who are configuring that software and making it work, and they really know how that software works better than anybody else, like they don't have to have all that much trust in the vendor. Yeah, they have to believe the vendor probably didn't intentionally put a backdoor in, but that's about the level of trust required. When you start to, you go from, hey, the software's in my data center to the software's in the vendor's data center, and now the vendor has the ability to do stuff with my data. Hey, there's more trust required. And I'd say that the next big leap is when you go from like the customer being the one to configure all of the rules and how the application's gonna work to the vendor having them owning it either themselves or via algorithms, you know, machine learning, or if you wanna call it AI, whatever you call it. Now all of a sudden this vendor is making business-critical decisions for that customer, that customer's livelihood. Think if you're a bank and you used to have your fraud software installed in your data center and you knew everything about how to detect fraud and you were the expert on every little thing that came through. All of a sudden you outsource it to a SaaS where you're configuring it and then the SaaS says, hey, look at this, we have a new algorithm that's 99% effective and drives down your risk. X amount. By the way, just trust us and it'll work. All of a sudden, the level of trust that you have to have as that bank to say, I'm going to allow a $100 million transaction to go through or not.

There's—

that's— it's huge, right? So, so what these vendors, these customers are doing is they're like, well, I love the idea. The payoff of this relationship is immense, but I, but I can't trust them. How do I get that trust? So they do things like, um, They'll say, I'm going to send a 400-question questionnaire, or I'm going to require you get this new certification. I know you've got 3, but there's this new one I want you to do. Or they say, I want to come audit you myself because I think I'm the only one who can, you know, run a successful audit. Whatever it is, they use these 3 tools, maybe contractual obligations that they throw in your contract. And then they realize that doesn't work because one of their other vendors gets popped. So what do they do? They say, well, let's use more of those 4 things because those are the tools we have.. And, you know, being on the other side of this, I say, oh, holy smokes, like this is unsustainable. It's not scalable. How do we, how do we get out of this cycle of more and more of an ineffective tool to try and solve a problem? That's where the trust program comes from. That's where the trust program can really pay dividends. So I think you have to ask the company we're talking about, is that a company that fits into this, right? Are we, are the customers outsourcing mission-critical functions to that company? You know, CRMs are a good example, security tools that are stopping bad things from happening. Anything that really gets in the way or supports key business processes is a great place for a trust officer. And then the value prop, you know, Malcolm talks about it, Matthew, you hit on it. It's about like lubricating those relationships, right? It's when they, when they first hear about you, what do they know? What do they hear from their peers? Have they heard that that's that company that, 'that's always out to jack up the prices a year after they sign you and they're always looking to put the screws to you,' or do they hear, 'This is the company that I've been happy with year after year.' And I think that's what a trust program can do, is change that narrative, lubricate those relationships, and hopefully eliminate some of that friction at the front end and upon renewals.

I love all the examples. I mean, it's great. And you had mentioned ROI and you'd mentioned about all these values. So that leads me kind of into my next question, and maybe it's an unfair question, but I'll throw it at you anyway. What are your top 3 success metrics that you would track as a trust officer that you're going to show to the board every quarter, twice a year, once a year, whatever you get face time, whatnot, to show that you're making that meaningful difference? What are your top 3 metrics?

For me, on the business side. So let's just look at it purely from the business motivation and the return on investment. One would be the deal flow where I touch a deal, right? Did it move faster? Is the average selling price higher? Is the margin better? When we've had a hiccup, because we all will experience issues that could affect our customers, a vulnerability, a breach, a mistake happening, right? Did we lose business after that or did we gain more business after it? It, right? Those things are very attributable to net income and revenue. You know, when you look beyond that and you look at the, um, the trust on the internal side of things, yeah, you can do approximations with maturity scales, you can do approximations with all the typical risk-related metrics, but at the end of the day, for me, it's a how exploitable is the organization and am I managing that exploitability to a material event that could affect my customers and the business? And if I am demonstrating that we're managing that exploitability so that there could, there's a very, very low likelihood of a material event, then that becomes the other side of it, the real risk metric, right? The other side are business-related metrics.

All right, Rob, your top 3.

Yeah, I don't know that I have as great of metrics as Malcolm does. The key is understanding how well you do what you do first, right? So, you know, part of what I do is security. Part of what I do is communication around trust. So being able to measure, am I effectively managing incidents? Am I effectively managing incident response and communications around that? Responding to customer inquiries around things. Those are things that we measure, and I'd say that those are kind of like legacy security measurement things as well. It's not necessarily specific to trust. And then after I talk about how well I do, then I get into these impact metrics, which I think is what Malcolm was already getting to is, all right, I do those things effectively. Now what is the impact to the organization of that? The number of inquiries or number of hours spent talking to customers or prospects about, about our security practices, you know, being able to drive that down. The, the number of positive contacts that we have and measuring those things over time. Are we, are we proactively reaching out? That tells me that, that we're, you know, we're starting to be— to control that message versus, you know, it's all inbound, much less in our control in that case, right? I have not got to a point where I'm able to measure like bottom line increase, or I guess it'd be top-line increases related to the trust program. But I can talk about like net promoter score and measurements of how trustworthy our customers perceive us to be. And those are a couple of things that we're working on. I wouldn't say they're done, but we're working on those.

I mean, I'm sold, right? I mean, the reality is, especially in cybersecurity, trust is the currency because a lot of what we do is trying to not make bad things happen. And that's really, really tough to measure. And so a lot of it comes down to trust. And, you know, just the attributes you guys were talking about. It's about that consistency. It's about that character. It's about that transparency, all that. Okay, so I'm sold. What kind of skill sets and experience should boards be looking for to fill these massive size 27 shoes?

So you want the definition of the unicorn for the role?

Yes! I want to know the color of the tail, the length of the horn, how many twists, everything.

So for me, I think it relates to a few things, and I've codified this in a couple of my books that I call the Z-shaped Chief Information Security Officer, Chief Security and Trust Officer, whatever you want to call it. You have to have a breadth of business acumen because that's your ability to relate to the business. That's your ability to drive metrics, top line, bottom line improvements. You have to have a breadth of technical acumen. That's your ability to communicate with the technology side of the business, whether or not it's the technology for sale or the technology that's used internally. And then the hash that creates the Z that connects the dots between those things are the risk security controls compliance-related items that can create the connective tissue between the business, the technology, and then those security and risk-related items. And then wrapping around all of that is a set of values, right? The integrity, the objectivity, the accountability, the, the willingness to risk self and your role to preserve the right thing and put yourself in harm's way for the business and for the customer at times, right? So you have to have what I'd say, um, personality and behavior characteristics in addition to competencies at the business level, the technology level, as well as the risk, security, and controls and compliance level.

So Malcolm, I, I'm just going to be a devil's advocate. Didn't you just describe a CISO as well? Like How is that any different between a chief trust officer and a CISO in your mind?

Yeah, Malcolm, how is that different?

It's an evolution. And many CISOs, one, are not an officer. Two, they're really not a chief. They're a direct report of the CIO. And by and large, a lot of them don't have the operational ability to say, "Hell no, not on my watch," and make it happen.

So Rob, would you add to any of those skills? And what do you think about the soft skills necessary in this role, whether it be empathy or communication or things of that sort?

So I have opinions. I have opinions about a lot of things. I think we're, this is a relatively, it's a very immature space, right? We're, we're, we're figuring it out as we go. So you're going to hear some anecdotal stuff from me. Um, I, my, my take is that generally a Chief Trust Officer has been a CISO in the past, and this is a person who wants to, who can't be contained in that box. Like they, they see too many places in the organization where they can have a positive impact. Where they, where they can influence, where, where, where frankly, like they have good relationships and, and maybe they're ready to have somebody else handle the, the, the management of the day-to-day program of security, but they want to be, have the, that broader impact. I, I think it's probably that person who you see as what's that thing for them to do outside of the typical security stuff, uh, outside of the typical CISO role. Um, I obviously Malcolm couldn't be more right about there's the ethics side of it and, and yes, you need that in a CISO. Um, I think it's even, even more so, you're like, you're just changing the weighting a little bit more, right? Like maybe it's 50/50 between, um, character traits and skills in the CISO role and the Chief Trust Officer role, maybe it's 70/30, you know, character traits versus, versus those skills. I don't know, but it, but it feels like as you go to that, that next level, you need someone who's going to have a much broader impact than just managing that team underneath them.

Yeah. And I, the one thing to add, um, to what Rob said as well, The external presence is certainly greater than traditional CISO roles because CISO roles are predominantly internal focused. The Chief Trust Officer role has a substantial external presence and has to because of the brand value and living up to the brand promise associated not only with the role, but what the company wants for it.

So I see a risk here, right? And the risk I see is, great, I'm on the board, need to have a trust officer, want to have that equity in future relations with our customers and partner suppliers, all the great things. I go out and I bring in a Malcolm or Rob who have all these skills, right? Who have the Z, who have the soft skills, who have that experience, external presence and recognition and they're able to drive that program, that's great. But the day that my Malcolm or my Rob leaves, does everything fall apart? Is everything so resting on the shoulders of the reputation and the brand of that person, right? And the characteristics of them being able to lead and be recognizable as part of my organization. Do I take 10 steps back as soon as they walk out the door?

If that's the case, one, you've hired the wrong person because they're not building that longevity there.

Okay, so don't hire Malcolm and Rob. Got it.

Okay. And number two, that would also be the same worry a board would have about the CEO, the general counsel, or the CFO, right? If everything uh, deteriorates with the loss of that one position. Not only did the executives operationally who are running the company do the wrong thing, but the board also did the wrong thing.

Yeah, any, any place that you have a strong relationship between a brand and a person, you have this risk. You know, I, you know, Jared with Subway, a lot of risk there, and, and, you know, that didn't necessarily work out great for them. I, I think that there is always going to be that type of a risk. You know, you have to manage that risk. And, you know, succession planning exists for CEOs and CFOs and general counsels. Succession planning should exist here. And frankly, so should bringing along other people to be part of that brand. You know, if you're, if you're the only person who is, who you're known by in the, in the space, and thinking in the security space, there's, you know, we know lots of rock stars who represent a company. You know, that company probably needs to bring another rock star behind them. And start to mitigate that risk.

Hey, but Matt, you know, you mentioned an important item, you know, the board wanting it. The board can want it, but if the company doesn't, because remember, the board's role is governance, it's hiring and firing of the CEO, it's fiduciary accountability. This is an operational responsibility. So it's the CEO that needs to want it. If the board just wants it and imposes it on the CEO, I still think you're going to have a problem. But the company itself needs to mature to the point that they want it and they need it and they see it as a part of their values and they see it as a part of their growth. If they don't, it's just going to be a hollow title, just like a lot of CISO roles are.

Yeah, I see that as a fair, as a fair challenge, right? If the operational people, the CEO is, is not all for it, you're going to be undermined at every turn. So what are the typical challenges? Let's say you come into a new role. What are those first 100 days? What are the mountains you're going to have to climb? Or at least a new trust officer would expect to have to climb?

I'm not sure it's all that different than what a CISO has to go through. It's all about relationships and understanding your business. You know, they, I'd say it's just even more so, right? Like you're not going to be successful if you don't have strong relationships with your general counsel, with your, your head of product, with your head of engineering. These, these relationships are the key to a successful trust program, just like they are to a successful security program. You should expect that there's people have been burned in the past, maybe not by trust, but by security. People have, you know, there are institutional practices that they know that they don't like and they're a little bit defensive about. You know, if you come in like looking for things to point out that are problems, people are going to become more and more defensive as they go.

Yeah, I think it gets back to, again, some of the behaviors. You have to have the right partnership collaboration ability to be affable and become a part of a culture and understand certain things. You also have to have enough of an authoritative style to command a presence with a level of respect to move the needle on unpopular decisions. And you're going to have to navigate both sides of that. And when you don't, it's going to be a problem, right? And, you know, but I think, you know, Rob's correct. I think the bigger challenge becomes one of the size of the organization. Doing it at an early stage to mid-stage startup, smaller team, smaller people, CEO gets it, it's why they wanted it, you know, that's easier. If you go into a much larger organization with calcified organizational structures and calcified political powers, unless you're given free rein to break things and perhaps break people, it's going to be a long road to, to really move the needle on things.

And yet what you're— what both of you are saying is organizations like that where you don't necessarily have consistency of character, you don't necessarily have the same level of ethics and, and transparency across the board those larger organizations that are calcified and stuck in their ways and very territorial internally speaking, it sounds like they may need a trust officer more than anyone.

They probably do.

Yeah. I, I say that there are two ways you can get a trust officer. You could have a, a forward-thinking leader who is excited to, to solidify and institutionalize some practices they already have. Or you could have a company that had a really bad thing happen very publicly that they now need to respond to. And as a, as a candidate for these positions, you should think really hard about which kind of company you're interested in being a part of. I think that those companies that had a bad thing happen, they do need that role, but it might not be a very good role to get. It might be a really, might be a really tough place to walk into.

No doubt. Okay, so we've talked about medium companies, large companies. Can you guys give me some examples of organizations that are either proactively embracing establishing this role, or as Rob said, something really, really bad happened and this was their response to get back on the rails? Do you guys have examples of companies or at least industries that you're seeing moving faster than others?

Malcolm, I'll mostly let you answer this, but I just want to point out, was it 20 years ago when Bill Gates created the Microsoft Trustworthy Computing Initiative. I think that's what they called it. I feel like that was a grandfather for this position and really to embrace changing the way software companies and, you know, software companies that clearly needed to be very trusted pursued this. I think they did a really good job at that point of creating that trustworthy computing program and really changing how security people saw Microsoft as a, you know, versus being the adversary to being a real partner. And they set it up for other companies that came along later, which, like I said, I'll let Malcolm talk to that. But I think that it's worth calling them out as a start for this thing.

Yeah, I think Rob's right. And I think, you know, from my recollection, probably one of the first chief trust officers or chief security and trust officers was John Stewart when he was at Cisco. And I think that codified in his title well over a dozen years ago. You know, my Chief Security and Privacy Officer role at Intel was, again, as I mentioned earlier, going to be a Chief Trust Officer, and then for title reasons, it became Chief Security and Privacy Officer. But we've seen, I think, in the past 4 or 5 years, the growth of that title and change. SAP has one, Salesforce.com has one, a couple others too. I think I see them more in the tech technology industry, you know, the creators of technology or people who have a large technology service practice. You know, so I think that's from an industry segment where you find more of that than other areas.

Do you think it's more important because you mentioned technology? Do you think it's more important in organizations that are leveraging artificial intelligence or some of the newer innovative technologies, whether it be blockchain, AI, quantum, whatnot, or is it all still just kind of even?

Well, I think it depends upon the context of the company. Take for example, I'm Kellogg cereal, I'm Wendy's hamburger, I'm, you know, take somebody in the food and beverage industry. Do you really need a chief trust officer? Is the real trust that is being focused on is food safety. Right. And that probably is the predominant trust that you want. So the, that food safety side carries the weight. If I was in pharma, you know, the drug pharmaceutical industry, the efficacy of the drugs and the side effects and how you test and all that stuff, that would create the weighting of a kind of a chief trust officer that way. I think, you know, why we've seen it more in the tech sector is again, because of the implications of the data and the privacy issues and the compliance issues and the breaches and the security side of things. And you think of things like SolarWinds or Log4j, where there's an inextricable link between product security and information security. When you see those interrelationships and then you see them play itself out, in terms of societal harm that could be created. That's why I think that Chief Trust Officer with a technology weighting, um, has, has applied itself more on the tech side of the marketplace than any other industry.

Yeah, I'll just, I'll just add on real quick. I think it's— Malcolm is right on everything he said. The— to me, the key is not— it's not all technical companies, right? It's companies that are going to be doing high-value, um, key business process work for you. If you're outsourcing that to a third party, that's where the trust is. If it's, you know, if it's some kind of commoditized something, yeah, you're probably not so worried about whether they can host a website unless you're, unless your website's your life, right? It just depends on, depends on your, your business. Um, the, when you think about them just making these decisions that make or break your company, If, if we do or do not have a CRM that is— that's got accurate information that doesn't get leaked, right? Like, that makes or breaks our company. If we do or do not allow those transactions, if we allow authentications into our environment, like, those are the things that can make or break our company. And that's where I think a trust officer role really makes a lot of sense.

All right, so what are the potential downsides of companies moving to a role like this? This.

Well, it's a double-edged sword. If you don't live up to the trust, you're going to die by it.

That's true. Trust me and then not. But we see a lot of that already and it doesn't seem to have huge, huge impacts. But moving forward, I think it will have more.

Yeah, I think you're setting expectations. You know, you're, you're putting yourself out there as someone who's saying, you know, we want to do the right things. And, and, you know, I'm not going to suggest that people with trust officers aren't going to have breaches. That would be a silly expectation to set. But it's more about behaviors than it is outcomes that I think that we should be held accountable to. If we say we're going to be transparent with how we communicate and then we cover up a breach, or if we say we're going to accomplish these things and it turns out we didn't, and we didn't let folks know about it, like, that's the kind of thing that a trust officer should be able to be held accountable for and should change. Now, what's the downside here? You know, the downside is if you do this right, like, you're going to change behavior inside your company, and it's going to be a distraction for some amount of time. Like, hey, it's work. Just like, just like patching those vulnerabilities, you know, is part of security work, and it is a downside to people who want to just keep working on other things, you know, implementing a trustworthy or a trust program, you know, becoming a trustworthy organization is going to take time. It's going to take time away from some other things. So it's just an opportunity cost question. I think that's the biggest cost.

Okay. Last question. Last question here. So for those professionals out there that are thinking, yes, this looks like my dream job, I would love to do that. I'm in a CISO role or a chief privacy role or whatnot, or for organizations that are thinking, yeah, that sounds right for us. We need that. We— I want the benefit. What is your advice to them, to the individuals or organization? What are the first steps? What do they need to be worried about or what should they be doing?

My first step would be, again, codify it in your corporate principles, corporate values. If you don't do that, hiring for the role doesn't make sense. If you do start to do that, then you can start looking for the right person that either has the skills and acumen to do it, or you can find the right person who has most of that, and they'll grow with you, and, and they'll— you'll grow with them in that evolution of the trust program and trust effort.

Yeah, the— for the, for the individual who's looking to make this change, I think you, you really need to be thoughtful about what's the type of company at which you could be as successful Chief Trust Officer, you need to know more than how to run a security program. You need to know how value is delivered to your customers. You need to understand how communication there works and what your stakeholders expect from you. I think that this is not the type of role where you'd likely to be a Chief Trust Officer for a CRM company and then a Chief Trust Officer for a, you know, a foods, a cereal manufacturer, you're really likely to need to stay in one industry where you can be an expert on more than just your space, but also the space that you're serving.

Your perspective is hugely appreciated. I, you know, I think we're going to see more of this role come out as we depend on digital technology for all the things in our lives and critical infrastructure and everything else. I think this does have a growing need. To make sure that trust is right behind the technology that we use and rely on every single day. So thank you both for your insights and appreciate your experience here. And thank you to the audience for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you all.