Solving a real problem.

Could you please briefly talk about your path and maybe emphasize two to three moments that led you to where you are today?

Levi: After retiring from the military, I built my first enterprise software company and, four years later, I started an e-learning business. This was during the dot-com era, and my vision was that everyone would learn over the internet. I wanted to build an online university. The Internet was still considered something strange - an alien medium. The market wasn't ready, I made some mistakes, and we ultimately failed. I moved into the corporate world, first as a project manager for a software company that provided solutions for Telcos. This role brought me from Israel to the US. Some years later, I was recruited into a network security company, and then into eBay and Intuit. I enjoyed zigzagging through several industries, from telcos to financial services, healthcare, and technology. This opened up many learning opportunities! Today, I am CISO at Dolby.

In your experience, how has the perception of technology roles, like CISO and CIO, changed from twenty years ago to today?

Levi: Digital technologies have become embedded in our lives. In my first company, we integrated email clients. Our customers neither knew how to use emails nor sensed the need to send or receive messages during their daily activities. Researching information on the web was considered a novel territory. With time, the initial resistance faded. We can laugh about these not-so-distant times. Ever since, ubiquitous connectivity and internet-enabled business models have changed how we build industries. They enabled globalization! Every technology cycle brings unintended consequences, of course. Cyber threats and attacks are one example, as the Internet wasn't built with security in mind.

Recently, I traveled to Germany and visited the Mercedes museum. There, I saw the 1886 three-wheeled Benz car, the first automobile in the world. Just think about how the automotive industry has evolved since that first vehicle! We are still in the very early days of massive digitization, and certain things happen at a pace we aren't used to or can’t embrace too quickly. Data is a source of incredible value generation, but it is also a weapon. Its democratization comes at a cost that we can't immediately comprehend.

Around 2012, the value of digital assets - be it data, Intellectual Property, or IT systems- contributed up to 14 percent to companies' overall valuation; in the post-COVID era, this figure moved close to 90 percent.

Levi: Twenty years ago, oil and gas companies, retailers, and banks were on top of the Fortune 500 Index. Today, traditional data-centric suspects from the US West Coast are among the top 10 most valuable companies around the globe. They hardly have anything one can touch with a bare hand! Their innovation around data and its infrastructure changed how we think about competitiveness.

The magic doesn't reside in the fact that there is a lot of data. It is about what one can do with it. Consumers open an app, make a couple of clicks, and their product arrives two days later. The challenge is how to make this magic work—all the mechanisms of building data centers, when it comes to hardware, and enabling “data to eat the world,” when it comes to software. No business model is safe from disruption. Securing data flows on scale is one of the issues we look at across geographies and industries.

How has the perception of cybersecurity changed since you first started working in the industry?

Levi: Most cybersecurity folks grew up through the ranks of technology functions. Historically, cybersecurity was viewed as an IT function and strongly tied to technological advancements in general.

More businesses realize the value of technology in their business models, be it from the perspectives of distribution channels, product design, manufacturing, or operational support. Years ago, CISOs thought mostly about prevention and reducing potential risk when running businesses. Today, it is more value-focused and helping businesses to manage trust in a complex digital world. We talk about the crown jewels of data, meaning that this data helps generate value. This evolution calls for new skills on a CISO's profile.

Besides, we saw real cases of data exploitation harming individuals. Privacy became a top concern, with Europe leading the pack with the GDPR. Today, we understand that privacy and freedom are interconnected. Rethinking digital privacy and how to implement it is on the agenda!

I would like to discuss the landscape of cybersecurity vendors and how traditional companies can identify champions among them, especially if those vendors are still startups. In AI, I introduce a rule of thumb to my clients. If a company pitching to you has more sales and marketing people than real data scientists and engineers, don’t work with it. They will make outrageous claims and won’t deliver.

Levi: Several weeks ago I posted on LinkedIn:

“Dear security vendors,

Tell me what problem your solution is solving! I don’t care what alphabet soup category you fall under. I don’t care where you are on some Magic Quadrant, Hype Cycle, Cool Vendor list, which military branch your founders are from, or how many exits they had. Don’t start by “Our solution gives the CISO visibility…” or “Our solution provides …”.

All I want to know is what problem your solution is solving.

If I have this problem and it is a priority (and I have budget) at this time, I may engage. If not, please go away until it is a priority (I will let you know). You will save both of us a lot of time and effort.”

I received hundreds of pitches after this post, and even had to write a blog about it: “Saying that “The number of vulnerabilities is growing” or “The number of malicious emails is growing”, doesn’t qualify as a problem. Vendors have to ask themselves the “So what?” and “Who cares?” questions. If they can’t answer those, they need to go back to the drawing board.”

It is terrifying that most vendors can’t be clear on why they build what they build. Life as a startup is about huge financial risks, a journey with sleepless nights and disrupted relationships, and five to ten years of fighting for those achieving successful growth and implementing exits. There are opportunity costs to what a founder might do with his or her life instead of creating a company. Ninety percent of startups fail.

When I hear about “do what you love,” I wonder whether understanding what it means goes beyond superficial PR or myths about multimillion-dollar exits and Unicorns. For founders, passion is about forgetting about themselves for the sake of solving a real problem. I started as an entrepreneur and can, therefore, feel for the excruciatingly difficult journeys of startups. I am grateful our world has innovators who work on real problems and build businesses to deliver real solutions. But there is a lot of noise in the system!

What are the most pressing problems in cybersecurity?

Levi: Thirty years after internet adoption, with shifts in industrial value chains and geopolitics, we are still struggling with foundational problems that I attribute to operational discipline: inventory management, access management, configuration management, and vulnerability management. The reason is the growing complexity of our systems and the fact that many organizations are not proactive regarding cybersecurity. IT spaghetti does not allow addressing foundational capabilities at scale. Here, I see opportunities for AI.

When I hear about AI replacing people and removing jobs, I think about times when the cloud became a favorite kid around the block. People said the same thing, but guess what? There are more IT and Engineering folks around, though their roles may have shifted and evolved! AI will help with scaling up skills, synthesizing data and information, and allowing faster decision-making. There is a risk of overreliance on AI. Besides, we need tools to validate what is right or wrong whenever automation and AI are involved.

Geopolitics plays a massive role in the future of AI, and I wonder what landscape we will face five years from now.

Lautrebach: Listening to you makes me think about two issues. One is the role of the human in the technology loop, which some regulators love to standardize. Another is whether we will ever be able to run faster than cyber criminals.

Levi: Domain expertise is paramount when balancing man and machine. We shouldn't stop at looking at AI in industries and organizations. Robotics is a fast-growing and hugely enjoyable field, from self-driving vehicles to humanoid robots. Being one step ahead of those exploiting vulnerabilities and trying to harm companies and people is a question of incentives. Every company has competing priorities and fights for budgets. But what is the most important thing on the menu? The biggest question in my role is to decide what NOT to do now.

Steve Jobs famously said: "Deciding what not to do is as important as deciding what to do".

Levi: If we look into the threat model, we must first understand how it is connected to the company's overall mission. What problem does our company try to solve? What threats may impact this mission? Once we know it, we can decide how to act proactively, including incentivizing people and investing in technology tools. As long as we move forward, we improve. Even if we are two percent better than the year before, we are still two percent better.

These mental exercises apply to everything on my operational desk. I must run fast while considering opportunity costs, making tradeoffs, and constantly mapping challenges vs. capabilities (people, process, technology), budgets, and risk scenarios.

How can you truly measure what you manage in cybersecurity, and what is the role of metrics in communicating your results to the executive leadership teams and the board of directors?

Levi: Security leaders struggle with metrics because our industry doesn't have standards. We don’t have one common universal language that everyone is using. We have a lot of frameworks instead that are similar but also different.

If we take the Finance function and ask how executives run it, we will have matching answers in 80% of cases. Accounting rules, treasury, taxes, and M&As will influence organizational design and operational metrics. Best practices around finance have evolved over the decades, enabling businesses to become global.

We don't have the same situation in Security. You will receive two different answers if you meet two CISOs and ask them how they practice.

There are two types of metrics. One group is about what we collect and report on. Some of this group's metrics might be helpful to CISOs, but others just cover noise. How many attacks have we seen? How did we respond? I always ask myself: what do I really do with this information? Does it help me to improve how we run our business? I want metrics to drive behavior. Dashboards with nice colors are fine, but if they don't hint at correlations between things, I can't decide whether I spent too much or too little, just as an example.

Behavioral metrics build the second group, fluctuating as the business develops, reflecting shifting priorities and financial risk appetite. Ultimately, the CISO's job is to tie up what happens in cybersecurity to enable business success and effectively and efficiently address the most critical risks.

How do you address technologies that might be highly valuable for keeping costs down and innovation up, but which might add new vulnerabilities to the mix, e.g., open source?

Levi: First and foremost, we must recognize that we live in a very complex world. Today's software, on many occasions, heavily utilizes open source. Open source helps move fast and innovate, but it comes with risk. Companies must take a very pragmatic approach to what they do and consider their risk exposure. Let’s take a simple example. If an organization is in the food business and has a recipe app, intruders might steal their recipes. No one will probably die because of that. But when a medical device malfunction occurs and there is an elevated level of radiation poisoning patients and doctors, we deal with another situation. Before introducing new software, we must test, iterate, evaluate, and understand what might go wrong. This is easier said than done! How do we develop and implement proper due diligence for testing?

It goes back to the threat. It's going back to what we're trying to accomplish, what we're trying to solve, and what risk we need to mitigate. I think one of the areas that many organizations still struggle with is how do they implement the shared responsibility model, keeping a vendor and their clients aligned and accountable for what might go south? In cybersecurity, every choice of solution will cause a cascade of risk tradeoffs. Deciding with a clear intention in mind is key here. And not forgetting to document everything properly!

What are the most essential features in a cybersecurity leader?

Levi: Two words come to mind – authenticity and transparency. In the past, security professionals were quite secretive about what they did. The rest of humanity considered them as those dark wizards with hoodies in the back room. This perception is changing.

My philosophy is practicing complete transparency, it is essential for building relationships and trust that are critical for delivering our mission and enabling the business. It is paramount to show up, demonstrate clarity and reliability, and continuously deliver.

From your perspective, what would help CISOs improve and even thrive?

Levi: Just before the pandemic, I attended the RSA and found myself in a little B&B in San Francisco. Early in the morning, I met two people - from China and Germany - at the breakfast table.

You probably know those jokes about an American, a Chinese person, and a German entering a pub. I found myself in exactly this scenario! We started talking, and a new world of cybersecurity practices opened up. Local culture drives how cybersecurity gets shaped and organized. In China, as I was told, a CISO was the best friend of a CEO. Our German friend could not believe his ears. Ultimately, we had a fascinating exchange about nuanced cultures and practices.

I wish CISOs had more opportunities to participate in honest discussions with peers and leaders outside their tribe. It is crucial to learn what keeps a CFO up at night, what happens in product design, and how the board of directors thinks about their companies' competitive position. The precondition is absolute openness and honesty. The pollination between functions and geographies enforces thinking and sharpens the eye. Cybersecuirty function can't evolve and thrive if trapped in silos.