Cybersecurity leadership has entered a new era. The traditional image of the CISO as a deeply technical guardian of firewalls and antivirus systems has given way to something broader and more strategic: a business leader who must influence executives, shape enterprise priorities and help organizations adapt under pressure.
That was the central message from a conversation featuring Margarita Rivera, CISO at Carnival Corporation and Prashant Mascarenhas, SVP and Global Head of Solutions, Cybersecurity, HCLTech. Their discussion focused on what belongs in the “modern CISO playbook” and how security leaders can remain effective as risk becomes more complex, more interconnected and much faster moving.
Both leaders came at the topic from different professional paths, but they landed on the same conclusion: cyber risk is business risk, resilience matters more than ever and security teams must evolve from reactive operators into proactive enablers.
From technical expert to business translator
Rivera’s own career journey helps explain why the CISO role has changed so dramatically. She began with a business background before moving deeper into technology, a path that once felt unconventional but ultimately became a strength.
“What I didn’t realize is that…that foundation in business administration and understanding the bottom line and understanding return on investment and understanding risk...and really being able to speak to the business was going to be that differentiator,” she said.
That ability to translate between technical detail and commercial consequence is now indispensable. Today’s CISOs still need enough technical fluency to lead engineers, architects and security teams, but they must also be credible in the boardroom.
“Cybersecurity is a business problem. It is not an IT problem,” said Rivera.
Mascarenhas echoed that view from the services and solutions side. Having started as an engineer and worked across infrastructure, architecture and security, he said the challenge is not simply making systems work, but ensuring they work in a way the business can use.
“Business has to be able to operate. They have to be able to use things. Users need to be able to do what they need to do effectively without security policies actually being restrictive,” he said.
That balance between protection and usability is central to the modern CISO role. Security must reduce risk without becoming a barrier to how the business operates, innovates and grows.
The risk landscape has not changed, but the speed has
One of the most striking themes from the discussion was that many of the core challenges in cyber are not new. Vulnerability management, patching, identity, detection and response remain foundational. What has changed is the pace.
“I think the main differentiator is the velocity,” said Rivera.
That acceleration is being driven in part by AI, which has amplified both offensive and defensive capabilities. Attackers can move faster, automate more and scale exploits more efficiently. At the same time, defenders have access to better analytics, faster detection and more adaptive tooling.
For Rivera, that means security leaders can no longer afford to be purely reactive. “We need to become much more proactive in our approach and really leverage the technologies that are out there and leverage AI for good because we already know that the bad actors are leveraging it for bad,” she said.
Mascarenhas agreed, particularly on the role of human judgment in an AI-enhanced security operation. “You still need that human in the loop because they bring context,” he said. AI may improve time to detect and accelerate response, but it does not eliminate the need for people who understand business context, operational nuance and intent.
He also pointed to supply chain risk and shadow technology adoption as major concerns. What was once “shadow IT” has become something broader, spanning SaaS, AI tools and ungoverned digital dependencies. Security leaders must now think beyond their own infrastructure and address an expanding ecosystem of risk.
Identity is now the perimeter
If there was one area where both speakers showed urgency, it was identity.
Rivera argued that the perimeter-based model security teams relied on years ago is gone. Cloud, SaaS and decentralized technology adoption have made traditional boundaries far less meaningful. In that environment, identity becomes the control plane.
“The only tool that we have is identity,” she said.
Mascarenhas took the point even further in the context of AI and automation. “For the longest amount of time, we’ve [understood that] identity is becoming the perimeter from a security standpoint. It’s the first line of defense. I think now in the AI world, that’s your only line of defense,” he said.
That brings new complexity. Security teams are no longer managing only human identities, but also non-human identities, machine accounts and AI agents acting with delegated privileges. Questions around intent, access, segregation of duties and governance become harder when autonomous systems enter the picture.
The challenge, as Rivera noted, is that many organizations are still struggling with the basics of human identity management. The future is arriving before the fundamentals are fully under control.
Enabling innovation without losing the guardrails
A recurring tension in the discussion was how to support rapid innovation, especially around AI, without introducing unacceptable risk.
Rivera described this balance as “an art and a science,” and used an analogy from Formula One. “F1, the cars want to move as fast as possible, but how do you make sure that it has within it built in those security measures to allow the driver to go as fast as possible,” she said. “How do we build in the seatbelts and deformable structures to allow the business to go as quickly as possible without…necessarily hurting themselves or the business?”
The analogy reflects a shift in how security needs to operate: controls should be built into the way the business moves, rather than added later as a constraint.
Mascarenhas framed the same point in governance terms: “Set guardrails and then govern the guardrails.”
He also stressed the ethical dimension of AI adoption. Responsible AI, accountability, data protection and sustainable workforce development must all be part of the security conversation. Together, these considerations shape how confidently organizations can deploy and scale AI.
Rivera added that visibility is essential. Security teams need to know what is being built, how AI is being used and where risk is entering the environment. That requires not just technical controls, but education and socialization across the organization. In many enterprises, excitement about AI is running ahead of a sober understanding of the risks.
Speaking to boards in the language of business
For both leaders, one of the defining skills of the modern CISO is the ability to communicate with senior leadership in terms that matter commercially.
Rivera explained that traditional security metrics often fail at executive level because they do not connect clearly to business outcomes. “I don’t go in having a conversation of...we patched ten thousand vulnerabilities in the environment,” she said. Instead, the more effective framing is to connect cyber work to revenue protection, operational continuity and strategic priorities.
“If I say we patched 60% of revenue generating systems, that resonates a little bit more,” she said.
Mascarenhas made a similar point. Security leaders must align their message with business priorities such as mergers, growth, expansion, resilience and license to operate. When investment requests are framed as abstract technology upgrades, they can sound like complaints. When they are positioned as enabling business continuity and reducing business risk, they become easier for boards to understand and support.
He called this capability “business-aligned storytelling,” and suggested it will become one of the most important leadership skills in cyber.
Talent, upskilling and the power of the pivot
No discussion of the future of cybersecurity leadership would be complete without talent. Both speakers acknowledged the difficulty of building teams that can keep pace with AI, identity transformation, quantum risk and evolving operating models.
Rivera was clear that learning cannot stop. “If you’re not upskilling, you’re not learning, then you’re going to become just as obsolete as the technology that we’ve seen years ago,” she said.
She described a deliberate strategy of investing in people, combining internal development with selective external hiring and leading by example. She is still studying herself, including coursework on building Generative AI applications, because understanding how systems are built helps her think about how they may be attacked.
But perhaps Rivera’s most memorable point was about strategy itself. In a fast-changing environment, static roadmaps quickly lose value. “By the time you get to year three, maybe even year two, your roadmap is garbage,” she said.
Her answer was not to abandon planning, but to replace rigidity with adaptability. “The power of the pivot is incredibly important,” she said. “The only way you can have true resilience is by having the ability to pivot and have continuous improvement.”
The modern CISO: Shaping the safe future of businesses
The discussion points to a broader CISO mandate, combining control frameworks and technical defense with resilience, business fluency, partnerships and strategic adaptability.
Security leaders still need strong fundamentals. They still need to get identity, hygiene, visibility and response right. But they also need to think ahead, communicate clearly, enable innovation and stay agile as technologies and threats evolve.
That broader mandate places the CISO at the center of how the business moves safely into the future.
