GUIDE

The Strategic CISO Playbook

Name: The CISOs' Guide to AI Governance
Author: TrustCloud

How five security leaders turned risk constraints into business advantage

Read the guide to learn how to:

Run security as a profit center. Tie every dollar to revenue the business can measure.

Replace questionnaires with evidence. Publish real proof and let buyers serve themselves.

Build a security culture beyond the security team. Make security everyone’s job through champions.

Diagnose your real constraints before you act. Name what is actually in your way.

Use AI and continuous monitoring to do more with less. Put AI where the work is repetitive and the evidence is verifiable.

Who it’s for:

CISOs, CIOs, Heads of GRC, and security and compliance leaders who want to prove security’s business value, not just pass the next audit.

Featured security leaders

Dave Brown

CISO and CIO, Andesite and Author of The Lean CISO

Myke Lyons

CISO, Cribl

Jon Zayicek

Former Customer Security Assurance Leader, Cribl

Lori Kevin

VP, Security & Compliance, IMO Health

Matthew Martin

CISO, Western Carolina University

The Strategic CISO Playbook

How five leaders turned risk constraints into business advantage

Introduction: The End of the Checkbox
Sravish Sridhar, TrustCloud

Part 1: Run Security as a Profit Center
Dave Brown, Andesite

Part 2: Replace Questionnaires with Evidence
Myke Lyons and Jon Zayicek, Cribl

Part 3: Build a Security Culture Beyond the Security Team
Lori Kevin, IMO Health

Part 4: Creativity Within Constraints
Matthew Martin, Western Carolina University

The Playbook: Five Moves That Define a Strategic CISO

Keep Going

Introduction: The end of the checkbox

Sravish Sridhar, TrustCloud

I started the Strategic CISOs conversation series for a simple reason. I kept meeting security leaders who ran security as a way to help the business grow, not just a way to pass the audit, and I wanted more people to hear how they did it.

For years, GRC programs operated with a point-in-time model. That may have been adequate when environments were stable and change was slow. Neither is true now. Every new AI agent, every integration, and every vendor widens the risk surface faster than an annual review can check.

Each of them runs their program differently, and they do it while working under real constraints. Dave Brown had to run his program like a profit center, proving every dollar he spent was tied to future revenue. The team at Cribl was buried under security questionnaires. Lori Kevin needed to cultivate a security culture across the whole business. Matt Martin walked into higher education with a fraction of the budget he was used to. Four very different problems, and in every case the constraint became the reason they built something better.

I am grateful for what each of them was willing to share, and for how candid these conversations have been. The common thread across all four is trust: once they were able to see risk continuously, they could bring business stakeholders into the process and clearly demonstrate the business value of trust.

That is what this series is for. Real conversations with the leaders redefining the CISO role. Here are my top lessons from the Strategic CISOs series, and the playbook you can borrow from all of them.

“I have started thinking about the CISO role in terms of a historian and a navigator. A historian can tell you in detail what risk used to look like. The leaders in this series wanted to navigate: to see risk as it forms and steer clear before it becomes an incident. That is what cyber risk assurance makes possible: a posture that is current, not accurate as of last quarter.”

Sravish Sridhar
Founder and CEO, TrustCloud

Part 1

Run Security as a Profit Center

Dave Brown, CISO and CIO, Andesite

Dave Brown spent 21 years in the Coast Guard, ran a computer incident response team, did a stint at the Department of Homeland Security, and served eight years as a CISO at a company later acquired for $1.2 billion. He also wrote The Lean CISO. So when he built Andesite’s security, compliance, and IT program from scratch, he did not start with a control framework. He started with the questions most security leaders skip:

Do I understand how this business actually makes money?
How can the security program help it make more?

Dave defines a profit center in plain terms that a CFO can evaluate: look for three numbers moving in the right direction at the same time. Revenue up, costs flat or falling, and overall risk down. If all three are true, the program is paying for itself. If you can only speak to security’s impact on the third number, you are still running a cost center. Dave treats risk reduction as a measured business outcome he can put in dollars, not a soft claim.

Revenue: Up ↑
Costs: Flat or falling ↓
Overall risk: Down ↓

When security operates as a profit center, its influence on all three of these is visible. The overall risk picture, where most CISOs focus, is only one of these important metrics to track.

When Dave joined Andesite, he spent his first 90 days working to understand the business and its inner workings, mapping security objectives to organizational objectives. He wanted stakeholders to see security as a vital part of business operations. In his own worked example, Dave put roughly 150,000 dollars into the compliance priorities that opened specific markets, against a pipeline of about 3 million dollars, and closed 1.5 million of it. Pitched in those terms, that spend is an investment the finance team can weigh like any other. Transparency is essential here. Rather than answering the same security questionnaires deal after deal, Andesite gives buyers a real-time view of its posture, and that changes how fast deals move.

“When a customer asks about our security posture, we don’t send them a 200-question spreadsheet. We give them a real-time view of our compliance and controls. That transparency shortens deal cycles.”

Dave Brown
CISO and CIO, Andesite

The payoff shows up everywhere once you start measuring it. Using a trust center, Andesite cut questionnaire turnaround from three or four weeks down to three or four days. Automating evidence collection took a task that used to run about 50 minutes per control down to seconds. And Dave watches what customers actually download, because a document nobody opens is a signal to stop spending time maintaining it.

“That’s what allows our team to optimize budget. Not just spend more, but spend smarter.”

Dave Brown
CISO and CIO, Andesite

Dave’s lesson for any security leader is to focus on order of operations. Learn the business first. Tie the program to outcomes the business already cares about. Then report those outcomes the way every other function reports results. Do that, and the business will credit security for growth it can measure.

Part 2

Replace Questionnaires with Evidence

Myke Lyons, CISO, and Jon Zayicek, former Customer Security Assurance Leader, Cribl

Nobody enjoys the security questionnaire. At TrustCloud, we like to say, “Friends don’t send friends security questionnaires.” Jon Zayicek believes that wholeheartedly. But behind the joke is a serious argument. A questionnaire is a survey-driven way to assess risk, a low-trust exchange of high-stakes information that buries both sides in manual work. Cribl set out to replace the questionnaire with something better. In doing so, they turned the assurance team into one of the most measurable revenue contributors in the company.

“We decided to be transparent, and it’s really worked out well for us.”

Jon Zayicek, former Customer Security Assurance Leader, Cribl

Transparency, at Cribl, means showing rather than telling. Their trust portal publishes real artifacts: attestations, pen test summaries, current policies, and a notification center that gets ahead of a vulnerability and tells customers where they stand before they have to ask. That posture deflects repeat questions and builds buyer confidence at the same time.

Transparency does two jobs at once: fewer questions, more trust.

Jon estimates that approximately 80% of closed-won deals go through his assurance team. When a buyer needs to judge the risk of working with Cribl, this is the team that answers. The team tracks it the way a revenue function tracks pipeline: share of deals touched, SLA turnaround on questionnaires, and cycle time. Two years ago a questionnaire could take them four to six weeks to complete. Now most turn around in about two days, sometimes 24 hours, because they put AI on the highest-volume, lowest-risk work first: drafting questionnaire answers from a maintained knowledge base.

The Questionnaire

Send a questionnaire

Four to six weeks

Low-trust exchange

A document you send

Invisible to sales

The Trust Experience

Publish real evidence

Days, sometimes 24 hours

Continuous, verifiable evidence

A portal, refreshed monthly

Logins flag buying intent

“Every business is being asked to do things with AI. This is absolutely the most no-brainer opportunity for you to provide value back to your business.”

Myke Lyons
CISO, Cribl

Myke Lyons, Cribl’s CISO, reframes compliance itself along the same lines. He treats each new attestation as a pipeline-generating decision, evaluated on the potential market it unlocks rather than the boxes it checks.

In other words, GRC becomes RGC: revenue-generating compliance, not governance for its own sake.

“Make the trust portal not just ‘we really take security seriously in the company.’ Of course you do. Give some substance to your trust portal.”

Myke Lyons
CISO, Cribl

Substance means artifacts, tested evidence, and advisories, refreshed close to monthly cadence. And because those portal logins flow back into the CRM, they double as buyerintent signals. When the person who runs compliance at a prospect logs in three times in a week, the seller can read that as a deal getting more serious, and act on it. Revenue-generating compliance gets noticed. Cribl’s CRO put Jon forward for President’s Club and sent him to Hawaii for what his team had built, because the sales organization kept telling the CRO how much that work was worth to them. Cribl’s assurance work connects into Salesforce and the sales motion, so the team describes what it does in the language the business already uses, and trust becomes part of how deals move forward. For most organizations that connection is the missing piece. The evidence exists, but it sits to the side of the deal, and the assurance team is measured on questionnaires cleared rather than revenue supported.

Assurance wired into sales gets noticed. Assurance off to the side gets overlooked.

There is a further horizon. TrustCloud is building toward assessments that run agent to agent, a third-party risk tool on one side talking to the vendor’s system on the other, with far less human handling in between. That is coming. What a team can do today does not wait on it. Cribl’s advantage came from moves any organization can make now: evidence a buyer can reach without asking, and an assurance function wired into the sales motion to drive revenue.

MEASURED ON QUESTIONNAIRES CLEARED

MEASURED ON REVENUE SUPPORTED

Part 3

Build a Security Culture Beyond the Security Team

Lori Kevin, VP of Security and Compliance, IMO Health

Lori Kevin leads with a strong conviction: a security culture across the business cannot be built by the security team alone. She has spent six years working through that at IMO Health, and her starting point makes all the difference. It begins with values.

“Trust is the foundation of everything my team does. We’re building a security function around the core values of trust, accessibility, clarity, and strong communication. We want the whole organization to know how to access security policies and see the strategic value security offers to their department.”

Lori Kevin
VP of Security and Compliance, IMO Health

Lori arrived in cybersecurity through customer support, operations, and the software side of the business, and she draws on all those experiences in her current role. Those insights help her translate risk into terms the rest of the business already understands.

“I haven’t just been in security. I’ve really been in the weeds of software development and customer support, and that’s helped me evolve a security approach that’s transformative and looks at it through a business lens too.”

Lori Kevin
VP of Security and Compliance, IMO Health

Everyone brings different strengths, and a leader’s job is to recognize them instead of making everyone fit the same mold. That’s important in security, where teams separate into silos or lean too hard on a few key people. She is candid that she was not good at letting go when she started, and she credits her team for telling her when it is time.

“I want my team to kick me out of meetings,” Lori says. The growth she cares about happens when people step up and take ownership.

“The more that I am involved, the less development opportunity there is for the team. That is where trust comes in for me. If I keep stepping in, I get in the way of someone else being able to develop. As managers, our job is to create those opportunities so our teams can explore and grow.”

Lori Kevin
VP of Security and Compliance, IMO Health

Her approach to reporting is to think the way leadership thinks and translate everything into risk language, focusing on the risk, why it matters to the business, and what her team is doing about it. She treats those updates as an ongoing dialogue layered on top of a set reporting rhythm.

“Conversations with executive leadership cannot be overly technical. You have to figure out what story will actually lead to action. For me, that means framing things from a risk perspective, because that’s what’s going to resonate.”

Lori Kevin
VP of Security and Compliance, IMO Health

My favorite security initiative from IMO Health is its security champions program. Most champions programs work closely with product and engineering teams, and Lori does that too, because secure development is non-negotiable. But she refused to stop there. Her program runs more than 30 champions across an organization of roughly 350 people, pulled deliberately from marketing, admins, HR, and the individual-contributor ranks, not only managers.

The best delegation move a security leader makes is getting out of the way.

Champions were asked, never volun-told. The forum rarely has an agenda. And the culture shows up in small, human ways: when someone spots a simulated phishing test and fires her a screenshot, their running joke is “not today, Lori.”

That reach, from product all the way to HR, is what turns security from one team’s mandate into shared ownership of risk across the company

Starting a security champions program

SIZE IT PROPORTIONALLY
~1 in 10, weighted to product and engineering
RECRUIT BY INVITATION
Source names from leaders and team, never volun-tell
OPEN WITH A KICKOFF
Set the mission, purpose, and time ask up front
KEEP THE FORUM LOOSE
Members bring topics and host discussions
GAMIFY PARTICIPATION
Phishing leaderboards, quizzes, small rewards
RENEW ANNUALLY
Members stay or nominate a successor, seats rotate
HAND OFF THE RUNNING
Move day-to-day ownership to the GRC team

Part 4

Creativity Within Constraints

Matthew Martin, Chief Information Security and Privacy Officer, Western Carolina University

I first knew Matt as the leader who spends his own time flying to Ghana and Uganda to share cybersecurity expertise with executives and students, work that began with a cyber resiliency conference in Accra and grew into an ongoing nonprofit partnership. That instinct, more than any tool or certification, is the key to how he leads.

After two decades running security in financial services, where budget requests were typically granted, Matt made a deliberate choice to lead security at a university. He wanted to test his belief that strong security fundamentals hold even in an environment where the budget, the team, and the operating model vary greatly from the enterprise. He calls the approach creativity within constraints, and the first thing he learned was that he was focusing on the wrong constraint.

“I thought I was dealing with constraints around dollars. It turned out the dollar constraint was actually one of the smaller constraints.”