Podcast Transcript

Welcome to Cyber at the Top, a podcast from RSAC that unpacks real experiences, lessons learned, and practical strategies from CISOs at some of the world's leading organizations.

The pace of innovation is moving quickly, and today's cybersecurity leaders are right in the middle of it.

Beyond defending their organizations, CSOs are also shaping the future of technology. In this episode, we'll explore how security leaders can help guide innovation while still protecting the enterprise.

What role should CISOs play in evaluating emerging technologies?

How can they work more effectively with startups?

And what does it take to build productive partnerships between the security community and the innovation ecosystem? To help unpack these questions, I am thrilled to be joined by my friend, the amazing Nazrin Rezai, senior vice president and CISO at Verizon. Nazrin brings a unique perspective on how CISOs can influence innovation, from evaluating early stage companies to building long term relationships with emerging vendors. And I have to mention that Nasrin has been an incredible foundational part of the Innovation Sandbox competition at RSAC.

And Nazrin, it is so great to have you here. Thanks so much for being here. Welcome to the show.

Thank you so much for having me. I'm very excited about this next hour.

Me too. Well, let me start with the basics. Can you start by telling us a little bit about your role?

Of course. So as you described, I run cybersecurity at Verizon. So that effectively means protection of over 90,000,000 of our consumers, some of the large enterprises who run on Verizon network, the entire, you know, global government customers. You know, we have, of course, across the industry sectors who basically leverage Verizon as the resilient network so that they can do what they do.

And that includes our products, our services, our AI strategy. I'm also the executive sponsor for AI for strategy for all of Verizon. So it's an exciting place to be and crazy and challenging also at the same time. But that's what I do. I've been at the company for almost six years in August, so that's what I do. That's the role.

Oh my gosh. That's incredible.

I mean, like, an amazing estate, which is Verizon, but also having cyber, AI. How do you personally define innovation today?

I separated out, Hugh, and you and I have had conversations about this. I... Really, the work... The the the definition for me is the word practical. Is the practical application of an invention that has a business value and outcome that somebody is willing to pay for it Because it drives change, it drives... It brings risk down for me as a CISO. So if I look at it from innovator, and you talked about innovation sandbox, for that innovator is about they have found a niche, they can actually build it, and they can build a... An innovative product, to your point, and they can make money from it in the next, ideally, twelve to eighteen months. From a CISO perspective, it needs to give me something I don't have.

Something that I can do better. Something something that would either reduce or eliminate friction in my universe.

And ultimately, also, I am willing to pay for it. And it's really that balance of the practical application of an innovation to to these two dimensions that I will call innovation in cyber.

I I I love that definition because just the phrase that you had eliminate friction. Like, obviously, you're you're used to thinking about and people think about reducing risk. The combination of risk going down and friction going down at the same time. What what role should a CISO play in bringing innovation into their organization?

And how do they do that?

As you know, and you've been in this space for a very long time, CSOs have always been at that intersection of innovation and change in cyber, you know, with virtualization, mobility, cloud. We've always been there.

But I think we're at an intersection of time and a place, combination of what I call really the massive escalation of nation state.

Threat actors who are outsourcing us, outnumbering us, outfunding the entire and all industry sector. And what even in the very short period of time we have seen in the last year or two, and even in the last six months, if if if you agree with some cases that we've seen, like, with the cloud compromise or or things that we're seeing, is that with the AI, generated threats, CSOs now have to take a strategic enabler seat. They've always done it, but it was always a little bit combined with, no. You can't do it. Now we have to be at that front seat and and and ask ourself the question, how can I do it in a safe sandbox method so that I am also and my organization at the forefront of this? A number came out recently, especially with AI driven attack from recon to exploitation is down to twenty eight, twenty nine minutes.

So as a CISO, now you have to. You have to look at innovation to also bring your time down. Right?

So it is a strategic enabler. It's a strategic enabler in terms of emission based defense, and it's a strategic enabler in terms of running effective cyber operation.

That that is a sobering stat. Like, I'm just trying to soak that in. Twenty eight to twenty nine minutes.

In the way that you describe it, it's CISOs need to be at the forefront of innovation. And you're right, they have been for a really long time, but it's amazing how it's being thrown into the spotlight, especially with numbers like that.

But there's there's so many cybersecurity startups that have gotten funded in recent years. How do you identify which emerging technologies or companies are worth actually paying attention to.

So I think one of the things that I think good cyber organizations do on a regular basis is to analyze what they have, you know, as part of their strategic planning and what they need to bring to the organization.

So in that scanning, either part of... Sometimes fits into the architecture engineering function or it could be different parts of of the organization.

We look at... We scan, you know, the the the landscape, and we look at these innovative company and say, back to the first comment I I was making that, which pain point are they removing for me? Right? And would that give me, like, a five to 10 x return or just scratch my, you know, itch a little bit? You know what I mean? So that's number one. Number two, we do a ton of networking with our peers.

So we ask the question, question, hey. What are you using? I have this particular issue. How are you closing the gap?

So networking with peers is the second dimension. Third dimension is we have very major partnerships. Right? Every CISO has partners that they trust.

I do the same. And then I ask, let me look at who they are partnering with. Yeah. Have they even early on in their innovation thinking and life cycle gotten the attention of some key partners in that space?

The other dimension that's really important to you is that we're getting smart in CISO organization, and especially as we're shifting in building AI platforms in...

Maybe fortunately or not fortunately for for these startups that we're building platform that we want these startups to be rip and rip...

Replaced if we don't like them. So if that's the conversation, what do they have? What is their secret sauce? If if I look at 10 of them, and all 10 with some variation technologies are the same, Do they have a data strategy?

Do they have an architecture that they bring to the table? Are they integrating with my platform in a way that make them irreplaceable? So that's that's another dimension that these companies need to think about. And then another one in terms of identification as we think about it, are these technology getting, foothold into multiple sectors, not just financial, not just this?

So if if if we're hearing from our peers or multiple tax sectors that they can they can meet the need, then they have really thought through the the problem statement that they're trying to solve. So those are some of the dimensions of how we identify some of these companies.

Nazrin, I love how you phrase that. I don't think I've ever heard those insights crystallized in that way. Like, I'm just putting myself in the seat of a startup founder, for example.

What you just said is that CISOs are actually evaluating, look, this thing, we think it's gonna address a pain point, but we don't know. We're gonna try it, and we're designing our architecture and our system so that if it doesn't meet the needs, it's coming out. That's like such an important thing for a startup to have in the back of their mind. It keeps them on their toes. It also says they really have to deliver and they need to deliver quickly.

That's that's very, interesting. And I'm wondering, how do you then balance the need for innovation with risk management and operational stability? Is it through the use of this kind of platform that you're talking about that really allows agility?

Multiple additional things come into that. So number one, so take take Verizon. The ultimate challenge for us at Verizon is if we innovate too fast, we impact the network that our customers run on. If we innovate too slow, we miss the boat on the business.

Right? So it's it's it's really a delicate balance. So in that scenario, as we look at these innovation or, you know, startups, we we look at it from a lens of risk. It rest...

Risk tiering structure. For example, you know, we are in the business of you have wireless service from Verizon, so what you care about is your customer experience and your billing. Right?

And then number two, you want the wireless network to be up. Always always 100%. So that in my risk tiering is zero tolerance, at highest stability, and and so in that, if I'm experimenting with technology, the way I go about it from a risk, it's a little bit different versus a beta test test could be with a customer, but it's a smaller scale. So that risk tolerance changes.

And as a result of that, also, my governance model changes. What do I mean by that? So if we are experimenting with an innovative company in my zero tolerance threshold, my exit criteria is a gate. But if I am having a threshold in the other categories, then maybe it's more of a guardrail.

And the guardrails are still automated. We're trying to get more and more away from humans doing that, but, we're still not there and a 100% with it. But the the governance element of that category of innovation also equally important. Right?

So that's that's the dimension that I'm thinking about. And the other one is that as we're thinking about how to test resiliency, stability, you really need to take some of what I call chaos engineering construct into practice. Really test out not just in your kind of really isolated sandbox, but maybe test it out and break it during, like, low network time, which is hard to do in my universe, but still be able to stimulate real world failure failure and be able to deal with that. But, with that, I have low tolerance for it in the network and wireless side of the house, but maybe in some other applications.

And probably the last dimension I would say to you, that is very important from a risk management, and it's something that I think over time, CSOs are getting better and...

CSO organization are getting better and better at, is to really make our risk management strategy threat informed.

Not just an esoteric notion of risk, but is it exploitable? Is it actually something that my sector is dealing with now? What is my tolerance to experiment knowing that the threat is my door, at my door, and it's being exploited, or or or the dimension is a little bit different? So it's combination of all of those elements that constitute the thinking around innovation and resilient environment. The risk sharing, how you govern it, how you think about testing it, and lastly, truly that risk management strategy to be threat informed.

With that well thought out strategy, you know, I've got to imagine that you see more cybersecurity startups than almost any CISO on the planet. Everybody wants Verizon because it's a marquee logo for their company and it kind of anoints them. And then you're also a part of Innovation Sandbox and a judge there. And so you see all of these new companies that are coming in all the time.

What's been your experience working with cybersecurity startups?

I think it's the first one. I think you and I agree, and we've experienced very clearly during the innovation sandbox judging period. If you get on my calendar, have a decent demo. Show me slides.

Not really. No. You just got on my calendar. Show me a deep end demo. Something number one.

Number two, they need to understand my business model. They need need not to speak about their output, but my outcomes.

Right? And and so so that's number two. They also need to not just speak to the cost that they bring to me because the, you know, the OpEx or CapEx of the the software they're selling me, but also what would be additional integration cost I have to deal with. Do I have to bring additional resourcing in the picture because I don't have the skill set?

So that's additional dimension. I think it it probably third dimension is, these days, almost every, startup talks about AI enabled and AI enabled that. It can...

We're kind of past AI assistant model, and it needs to be authentic. So you need to really go from alerting to resolving an action.

And lastly, probably is so fundamental and so basic, and you would think that security software would be good at this, but be enterprise ready. If I, pentest your software that your API security issues and access management and just some of the basic stuff that are critical for the resiliency of a company, our scale and size, sometimes are not present. So I would say those are the dimension that definitely make a startup stand out.

Oh, that that's great. And you're right. It is incredible how many times a startup comes in and then a company that has resources of Verizon, for example, goes and actually tests it or looks at those API calls and they're like, what are you doing? Right?

Is this into my environment? And...

Oh, okay. So let me let me try and imagine myself as a fly on the wall when somebody has managed to get a half hour slot with you. Okay, so I'm a startup. I've been, you know, months.

I've been trying to kind of like get your attention. I now have my time. You said I better have a demo. Okay, so I'm gonna come with a demo.

What would make that startup stand out to you during that half hour call that they got on your calendar?

Those elements. Those... Like, they they understand my problem.

They... I've actually developed something that touches me, and they they can... Like, I recently... I can't even remember who it was. I met with a company very similar. It's just demo was so relevant to us.

And Right. Relevancy. Right? And then they didn't...

They they truly said they they understood our stack. And they basically said, very honest, let me tell you, because they know. I ask every startup, what will you replace? They said, I'll tell you what we're bringing to the table right now.

We'll not replace anything.

But here is what we do.

Honest feedback. You know what I mean? Don't, like, sugarcoat something that, you know, you know it. So it's just that that that understanding on my business, the... Really having thought through my pain points and being able to articulate, I go, you know, that's that's a use case and critical use cases that they're putting on the table. And then you say, yeah. I'm willing to experiment.

Okay. Okay. So so you've laid out kind of the prototypical good example.

I'm sure you've seen some other ones. You know, from their software being Swiss cheese and, you know, full of potential vulnerabilities, what do startups often misunderstand about selling to enterprise security leaders?

Have the sales guy talk.

Having the technical people who actually understand the space tell us exactly what this will do, it's it's really, really important. It's really a combination of the elements I talked about. The... They talk to us about...

They've put...

Everybody puts their report out, and they show us, here is how much my my software can detect. I'm over it. Detection doesn't do much for me. What what else can you do for me?

It's just really understanding some of the trends that are happening, some of the pain points that I'm experiencing, and you giving me yet another UI with yet another set of outputs and outcome...

No. Outputs for more detection doesn't solve my problem. And then you try to...

You understand the company. So you say, okay. What are you doing this in other space? And and and then then they say to you, well, that's not my department.

I'll bring somebody else. Okay. Then you wasted my time.

Let's say someone hits the right points during that discussion with you, the kind of an initial discussion. May... Maybe you have a couple other discussions. Your team has discussions with them.

What's the next step? Like, how do you structure pilot programs or proof of concepts with these emerging vendors that you find interesting?

So I think number one, the responsibility is on us, which is defining success metric. Right? What are the use... Killer use cases that we wanna go after? What is success metric? And that's number one. Because a lot of times, they have a perspective, their product, what it can do, and and they wanna drive to those use cases. We need to start with, got it, about your product, here is what I wanna test, number one.

Number two is, again, bringing back the risk management and the resiliency construct. How will we test the environment that we would test in? Is it going to be maybe basic logic test in with synthetic data, or do I have to have a VPC that I fully simulate production but cannot write to production? And at some point, I need to do some scaled production testing volume, and I need to really have those criteria.

For example, in our AI work stream, we are really working with some of these very innovative companies in in terms of how how they can combine voice and audio and content to bring to really, really low threshold of human scale interaction versus an AI interaction. Can they give that to us through these different solutions that that they're offering to us? So that's number two. Number three, I think, terms of the structuring of the pilot, Hugh, is to...

As I said, don't just test what they're they're asking for, but... Or what they're suggesting their technology can do, but also test what I say corner cases, edge cases. Make sure that you also do integration test cases. Right? And also, probably the most important thing, especially in very, you know, resilient environment, such as ours, what's the kill switch? If, you know, what would that method be in in in my environment? So get the thinking about your use case, really clear criteria of dimension of the output that you're looking for.

Make sure that you test out all the critical use cases. And then lastly, what is exactly exits? Because we have done this at Verizon, and I think many many of us are guilty of this. We pilot, and we kinda go to production, but we never go to... What was our gonna go?

If I structure this for the dimension I described and I went to production with it, have I really thought about my scale? Is this the product I I want? So that exit criteria and the gono go is not just the financial dimension. For example, I'll give you an example.

We we are...

I was just reviewing a risk assessment from my team by way of example, not that I'm singling this out, like a cloud desktop solution for for some of our engineering teams. And and there is the co work, feature inside the the cloud desktop that allows you to really...

The the...

These autonomous agent to run task on your behalf. So they can ultimately automate so much of what you can do. Love it. Check.

But there are still some elements of that that we have to work out, and it...

It's not all about cloud. Some of it is about our architecture and how we need to bring that together. So for me, success, but only x number of users.

And since the back end of this particular desktop, it was against our Google environment, through the workspace, I can control the number of people that can get onto this. So sometimes you have to think about this. Have they fully met all of your use cases?

What is that go, no, go, and exit criteria? You still wanna be innovative. So, yes, let's x number of people experiment. Let them get value. But in the background, then you close all these other issues. And then at some point you say, yeah, this is ready for scale.

That's great because you've then got a clear framework ahead of time. And you know, you know, when when things are sober before you've actually kind of run a what are the criteria that would make me want to further expand this or to actually hit the switch where it really becomes integrated at scale?

And and I'm wondering, I'm assuming at some point in that journey, you're looking at these different vendors and you're kind of making a decision. Maybe it's not a hard decision, but it's a feeling that you have.

Is this gonna be a transactional vendor for me? Or is this a place that really is strategic to me, that I want to build a long term relationship? And if you put it into that long term relationship category, what advice would you give to CSOs to build a productive long term relationship with those vendors that you think these are the ones. We're gonna grow with them.

You early on to your point sense that. And then of course the POC and the experimentation shows that. Remove roadblocks from them.

I mean, at Verizon, we are guilty, guilty, guilty of our sourcing processes. If I brought you a brilliant idea, McKenna, I do not have to wait three months for contracting. Write a pilot contract for me and with the exit criteria and then do another one. I think for us is how do we internally to our structure make that sourcing relationship an easy one, the contracting relationship boundary an easy one.

We sometimes give them there are 450 questionnaire for a long term relationship, but where all they wanna do, do a proof of concept with us.

So we need to... If we wanna be agile and fast and do this experimentation fast and get it to our platform fast, and if we wanna kick him out fast, then then do... We need to do our part. And I said, we are guilty of it as any other. So I said to my team recently as part of our AI first effort, we need a different set of contract. We need a different set of criteria for that initial, you know, experimentation and sandboxing versus the long term contract. So I think we we can do that. Two, for the CSOs, it's be ready.

Be ready on your end, back back to the element of what I described described earlier, know exactly what you're testing. And and and then once you see the value with this... And I and I actually...

Many startups come to us, and they wanna give us everything we want. And sometimes that's not a good answer. If they really truly understand their architecture and the second and third and generation of their product, they need to to be that adviser to us. I can do this, but here is what you're missing in the process.

And sometimes if you sense those strategic partnership and we have had those relationship with few of our partners, then you you listen and you build those partnership. It's so interesting with our security business at Verizon. The the reverse of it, we would regularly meet with the CSOs of companies for which we do either managed service or EDR or whatever as it...

And they would say to...

The CSOs would say to us, don't listen to my people. You know best. You have given me a product that's solving my problem.

Challenge us if what we're asking doesn't make sense. So sometimes, in the process of meeting the needs of large enterprises, some of these innovative company water down the the capabilities of their product and what it needs to become.

So that's that's a balance. But if if I see a partner that really methodically works with me through this, and also on my end, I've facilitated how that that that sandboxing can occur, that could very well become a very, very long lasting relationship. And then I am willing to work with them through their growing pains. And, okay, I'm here, but now I'm making a switch to this area.

Check. You know?

Why don't you develop it? I give you an idea. We do some of that together.

I I I love that because that's that's both advice to the CSOs, like removing roadblocks, make it easier for them to contract, allow them to come in.

But then you're also saying for the founders and even folks that you're working with, even established vendors, be honest with you because a a lot of what I read between the lines of what you're saying is real trust and relationship building. Like, tell us how we're not using the full capabilities of your product, for example.

You know your environment better than anybody, but we know our product.

Let us learn even more about your environment and help us help you. It's it's a true two way street. Like, I I I love that. It's a great road map for both.

And so then if you look ahead, how do you see the relationship between CSOs and the startup ecosystem evolving? Do you think it's gonna change dramatically from what it is now, or do you think we're gonna continue down the current path?

There is if, like, if...

Look at the AI space. Right? You and I both know because we look at these every year. There...

We get how many? 200, three...

5,300 of these. And and you look across, and you see many of them really bringing the same value proposition to the table, just different shapes and, you know, how they're bringing. So I think as we move forward, it is going to be those startups that can combine this notion of something in their secret sauce that makes them sticky, shift toward more agentic and less alerting to resolving and using reasoning to solve my problem. I think if most CSOs you ask, they want to change their cyber defense structure, And and and current tooling does not allow that.

So how do we solve for that? And so we're going to we're going to see a lot of that. The the other elements that you and I didn't interesting discussion that sometimes pushes us to not to experiment early with startups is that the pace to which incumbents are catching up.

Yeah. Tell me about that.

So what I mean by that, if you asked me a year ago in terms of what set of AI solution in terms of design or build or runtime I would want to experiment with, I would look at certain ones because the incumbent... The the the existing tech stack that I that I already used didn't have these set of capabilities.

Now we're getting to a stage and a place that incumbents are catching up much faster. I ask myself the question, like, for example, in our detection of shadow AI, Do I need yet another platform that takes my CrowdStrike and my proxy date? No. They they... They're getting good at what they're doing.

I'm getting good at what an... I... So I don't need to create these extra layers of analytics that creates more complexity. So if you keep bringing solutions for me that are the role of incumbent, but you want me to pump my data into your environment. And by the way, you have AI enabled it, so cha ching, cha ching, in terms of my cost of... Total cost of ownership. You need to really think about that. So I think it's this this also coming together of faster to innovation in incumbent. We're going to see kind of these layers that are going more of just pure integration of existing technology to solve a particular problem losing its value over time.

And do you think that that innovation from the incumbents, from the bigger players, are you seeing a lot of it organically within those players, or is it through m and a?

Both, but you and I know it's mostly m and a.

Yeah.

We look at... Which is completely fine. Right? A lot of these startups that you and I look at just position themselves for that acquisition? So that's a clear strategy. If you have that, that's good.

So that... Then going back to one of the criteria that we talked about earlier, I look at it and go, who would they be a good candidate for partnership and and integration with? Right?

So that's kind of also comes into that positioning.

Okay. I've got two last fun questions for you. And and this one, I I can't wait to hear what you're gonna say. I have no idea what you're gonna say.

What is one innovation or trend that you're super excited about right now of anything that's going on?

What's your favorite? What what are you most excited about?

CSOs are under tremendous pressure with what's happening in the world, what's happening, like, again, I use myself. I do not see in any shape, possible shape or form that the pressure that we're feeling and the complexity of matters we're dealing with and the geopolitical dimensions of what's happening around us changing that would make the burden of cyber less. It's it's just on this escalating factor. Right? It's just da da da da da. So we have... I mean, if you look at the data, most cyber organizations are still nicely sourced, funded, and variations some years, 2% out, five year, but we're still funded. But the reality is that the way we operate is it's very, very human intensive still.

And and so what excites me is is a rethinking. And and and I talk to my team about this, and sometimes they worry about this and go, are you replacing me? I said, no. You're replacing the part of your job that you don't love doing.

And and as part of that, how will you do that so that we keep pushing up and up and solving more complex problems for our company. So what excites me is any kind of direction toward more agentic autonomous defense, where I really can look and attack and say, cybercriminal, nation state, analyzing the behavior, taking those patterns, putting them together, looking at the the the... My environment and my footprint, and being able to to really going from what 10 people or 20 people do for me today to to resolution. And sometimes, Hugh, this is easy for a company that's 100% cloud native, but not companies like mine that has very large on prem presence, that has very large network presence, that there's still, you know, physical routers and switches. So a world where we can simplify that in both detection and prevention, it's a time that I buy to respond to an attack.

An attack not to prevent it, but an attack to reduce time to lateral movement, so I can respond adequately to that. It's a big challenge we're dealing with, and I don't see the pace of technology and innovation, especially in AI space, reducing. I don't see nation state not getting more and more sophisticated in how they use AI either for malware creation or, you know, from recon to exploitation. And then businesses are under massive pressure to transform and change.

So it is not this open checkbook.

Right? So we need to do more and more and more with less and less and less in a world that the threat is escalating.

I I love it. It's the innovation that enables and unlocks the talent that you have inside of the organization to be even more effective and bring out their best skills to bear. Yeah.

That's awesome. And a final question for you. If our listeners who are cyber leaders take one lesson about working with innovative companies from this discussion, what would it be?

Get your house ready to be in a position to identify them, leverage them quickly, and fit them where they absolutely need to fit in to solve your major problems. Facilitate that. Take an active role in that.

I love it. And I and I love the phrase get your house ready. And, Najran, just on a personal note, I I can't thank you enough for being here.

And just the talent and acumen that you bring to this cybersecurity space in general, and the fact that you're so generous with your time to share that with others, it's inspiring. I I I really, really appreciate it. And listeners, thank you so much for joining in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check 1rsac.com for new content posted year round.

Nazrin, this is amazing. Thank you so much, and I can't wait to see you soon.