# The CISO Role in the Age of Generative AI with Rob May

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 23 Sep 2025, 12 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17885925-the-ciso-role-in-the-age-of-generative-ai-with-rob-may.mp3

Send us Fan Mail AI isn’t just another shiny tool — it’s a catalyst to rethink how we secure and govern our organizations. In this ClearTech Loop episode, Jo Peterson sits down with Rob May — Executive Chairman of ramsac, UK Cybersecurity Ambassador, and author of Harnessing AI and The Human Firewall. Rob shares a practical playbook for CISOs navigating AI adoption: Reframe the Role of AI: Treat it as assistive intelligence — a thought partner that changes the questions you ask, not just a productivity add-on. Red Team Smarter: Use generative AI to simulate likely attack paths in your environment so you can adjust defenses before alerts ever fire. Build Security In: Stop bolting security on at the end. Embed privacy checklists, automated testing, and audit trails directly into the AI development lifecycle. Govern with Confidence: CISOs must own the narrative around visibility, accountability, data use, and explainability. AI is both a defense multiplier and a governance responsibility. If you’ve been wondering how to balance AI innovation with trust, or how to expand your CISO mandate without slowing your teams down, this episode is for you. Watch the full conversation + subscribe to our LinkedIn newsletter here: https://www.linkedin.com/newsletters/7346174860760416256/ Key Quotes “Don’t think of it as artificial intelligence. Think of it as assistive intelligence.” — Rob May “When security and AI teams work side by side, you don’t slow down innovation — you accelerate trust in the outcomes.” — Rob May “AI can be both a force multiplier and a new category of risk. The CISO’s role is to maximize the former and govern the latter.” — Rob May Episode Notes Listen: https://www.buzzsprout.com/2248577/episodes/17885925 Watch on YouTube: https://youtu.be/Tzf6dwfUh50 Subscribe to ClearTech Loop Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/ Rob May’s books: https://www.amazon.com/stores/Rob-May/author/B078GYKHZJ Resources mentioned: • Harnessing AI: https://www.amazon.com/dp/1915074252 • The Human Firewall: https://www.amazon.com/dp/1915074236 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_00: Hi guys, thanks so much for joining.
[0:09] SPEAKER_00: I'm Joe Peterson.
[0:11] SPEAKER_00: I'm the Vice President of Cloud and Security for Clarified 360 and the chief analyst at ClearTech Research.
[0:17] SPEAKER_00: And I'm here with an amazing guest today.
[0:19] SPEAKER_00: I'm here with Mr.
[0:20] SPEAKER_00: Rob May, the founder and chief executive chairman of Ramsack.
[0:25] SPEAKER_00: Hi, Rob.
[0:26] SPEAKER_01: Hi, Joe.
[0:27] SPEAKER_01: How are you?
[0:28] SPEAKER_00: Good.
[0:28] SPEAKER_00: Thank you so much for joining.
[0:30] SPEAKER_00: It's an absolute pleasure.
[0:32] SPEAKER_00: Yeah, it's a pleasure.
[0:34] SPEAKER_00: So we're recording ClearTech Loop today, which is on the move and in the know.
[0:38] SPEAKER_00: And in case you don't know Rob, you should know him.
[0:42] SPEAKER_00: Rob and his partner started Ramsac more than 30 years ago.
[0:46] SPEAKER_00: And as he's as executive chairman of Ramsec, Rob guides the strategic vision and long-term direction of his organization.
[0:54] SPEAKER_00: He's building on his years of experience as managing director.
[0:58] SPEAKER_00: But now he focuses on shaping the corporate strategy, fostering innovation, and ensuring sustainable growth.
[1:06] SPEAKER_00: And in his spare time, because you know he's got like an extra hour a day, right?
[1:13] SPEAKER_00: Rob is also a technologist, a global AI ambassador, a writer of books, um, UK cybersecurity ambassador, vistage speaker.
[1:23] SPEAKER_00: He's got his FCFE, F L O D, F R S A, Fellow of BSDC, and Society of Leadership Fellows.
[1:33] SPEAKER_00: Did I capture all that right, Rob?
[1:35] SPEAKER_00: That seems like a lot.
[1:37] SPEAKER_01: Yeah, that is a lot.
[1:39] SPEAKER_01: But um, I I always say, you know, if you want something doing, ask a busy person, right?
[1:44] SPEAKER_01: It's um so true.
[1:46] SPEAKER_01: Well, isn't it so many of those things overlap as well, and one feeds another and and inspires thinking in what in, you know, it it's it's all good and I love it.
[1:56] SPEAKER_00: So what you're saying is it's hard to be popular.
[2:00] SPEAKER_01: Hey, I wouldn't know.
[2:02] SPEAKER_00: I think you might.
[2:04] SPEAKER_00: I think you might.
[2:05] SPEAKER_00: So we've got three questions today, and I'm loving, I'm gonna love to hear your takes on it.
[2:10] SPEAKER_00: Let me let me uh ask the first how can cybersecurity professionals leverage generative AI to break out of this traditional tools and tech mindset and actually drive more innovative thinking and execution in their security programs.
[2:29] SPEAKER_01: Okay, um, actually, that's a great question.
[2:32] SPEAKER_01: Uh, and I think it speaks directly to a broader shift that we're seeing across Infosec, moving from a defensive, tool-based posture to a much more proactive, intelligence-led, and adaptive approach.
[2:49] SPEAKER_01: And generative AI gives cybersecurity professionals the chance, I think, to move beyond that usual tools and tech mindset and start thinking more strategically.
[3:04] SPEAKER_01: So instead of just speeding up tasks, I think it helps us rethink how we approach security altogether, whether that's generating tailored threat playbooks, summarizing threat intelligence, or helping craft clearer risk narratives.
[3:22] SPEAKER_01: Um in one of our, well, if I think about it, in one of our recent projects, we use generative AI to simulate likely attack paths sort of based on our own environment.
[3:33] SPEAKER_01: And then that helped us preemptively adjust controls before any alert was even triggered.
[3:41] SPEAKER_01: Basically, it's AI-assisted red teaming, right?
[3:44] SPEAKER_01: But the real value, I think, comes when we treat AI as a thought partner, not just a productivity tool.
[3:56] SPEAKER_01: I think it pushes us to ask better questions, to think more proactively and design security programs that are adaptable, not just reactive.
[4:07] SPEAKER_01: One of my one of my team uh said to me, the best use of AI is when it changes the questions that we ask.
[4:17] SPEAKER_01: And that's the mindset.
[4:18] SPEAKER_01: It's great, isn't it?
[4:19] SPEAKER_01: And I I think that that's the mindset shift that we need to drive innovation in in cyber, in in my view.
[4:29] SPEAKER_00: Well, I think it's great that, you know, as a young engineer, I could have used someone to give me a suggestion before I went to my boss every time and said, excuse me, excuse me.
[4:41] SPEAKER_00: Yeah, you know, right?
[4:43] SPEAKER_00: It would have been great.
[4:44] SPEAKER_00: And and I think that's one of the benefits is that it is upskilling our uh younger, junior folks in the space by doing just what you're saying, giving them a way to think differently about the outcome and maybe prompting questions on their parts.
[5:06] SPEAKER_01: Totally.
[5:06] SPEAKER_01: I say to a lot of people don't think of it as artificial intelligence, think of it as assistive intelligence.
[5:12] SPEAKER_01: And and when when we look at each person in our organization, what assistance do you need?
[5:19] SPEAKER_01: And if we can surround you by assist with assistance that helps you, um then that that's a winner, right?
[5:28] SPEAKER_00: Yeah.
[5:29] SPEAKER_00: Um, so okay, how can organizations embed security and privacy controls into AI model development without slowing down innovation?
[5:39] SPEAKER_01: Great question.
[5:40] SPEAKER_01: Uh, and one that's increasingly front of mind for leadership teams, I think, trying to balance responsible AI use with competitive pressure.
[5:52] SPEAKER_01: And the key, the key is to stop thinking of security and privacy as blockers, which some people do.
[6:00] SPEAKER_01: Instead, my view is you design them as part of that AI development lifecycle right from the get-go.
[6:09] SPEAKER_01: And we've we've found that when security teams partner early with the developers and engineers, controls can then be embedded seamlessly, like automated model testing for data leakage or um setting up clear audit trails for training data and so on.
[6:28] SPEAKER_01: And there was a project we were involved with not so long ago, and we created just a lightweight privacy checklist that sat directly in the model development workflow.
[6:38] SPEAKER_01: So no extra meetings, no long reviews, and it helped it helped the team stay compliant without losing momentum.
[6:47] SPEAKER_01: And and the trick is to build just enough guardrails to protect what matters while still leaving space for exploration.
[6:57] SPEAKER_01: And I think the fact is when security teams and AI teams work side by side rather than in silos, which we all know happens, um, you don't slow down innovation, you actually accelerate, you accelerate trust in the outcomes.
[7:17] SPEAKER_01: And I think that's that's the key thing.
[7:19] SPEAKER_00: You know, it's interesting.
[7:21] SPEAKER_00: I was around when cloud started, right?
[7:24] SPEAKER_00: And for a long time we saw cloud security sort of bolted onto after the fact.
[7:34] SPEAKER_01: Yeah.
[7:35] SPEAKER_00: Do you think we've learned some lessons since the evolution of cloud?
[7:43] SPEAKER_01: You would like to think so.
[7:44] SPEAKER_01: Yeah.
[7:45] SPEAKER_01: But you and I both know that we're seeing parallels.
[7:48] SPEAKER_01: You you see stuff resurfacing that you say, yeah, actually we had something similar.
[7:54] SPEAKER_01: Um look, some lessons have, and I guess it, I guess it depends on the vintage of the uh the consultants who are involved and as to whether they've learned the lessons that need to be learned.
[8:05] SPEAKER_01: But yeah, I think we have learned some lessons, but definitely there's a there's a pattern being repeated in some cases.
[8:14] SPEAKER_00: I love, I'm gonna steal that.
[8:16] SPEAKER_00: I'm vintage now.
[8:18] SPEAKER_00: So, no doubt, because of your you know strategic position at Ramsec, you're you know some of the senior people, probably many of the senior people in security roles in the UK.
[8:33] SPEAKER_00: And I'm sure, just like here in the US, they're having these conversations among themselves around AI adoption.
[8:44] SPEAKER_00: How should the CISO be thinking about AI adoption in terms of not only its use in securing emergent threats, but from an organizational governance perspective?
[8:56] SPEAKER_01: Yeah, another really good and timely question, especially as I think as the as the CISO role continues to evolve.
[9:05] SPEAKER_01: It's not I think the CISO used to be generically about technical leadership, and I think it's evolved.
[9:13] SPEAKER_01: It's not just technical leadership, it's also about strategic governance, and we we see that on both sides of the pond, you know, more and more.
[9:21] SPEAKER_01: And I I think the CISO should be uh looking at AI through two lenses.
[9:27] SPEAKER_01: Uh they need to look at it as a security asset because it is, but then on the other hand, the second lens is it's also a governance responsibility.
[9:39] SPEAKER_01: Um, you know, there's two there's two sides to the coin.
[9:42] SPEAKER_01: And uh I think first, in terms of threat defence, uh AI uh there's no question, AI can help teams spot patterns across huge data sets that it can triage incidents faster, predict attack paths before they're they're exploited.
[10:00] SPEAKER_01: And we we've used AI-driven threat modelling to prioritize controls more intelligently and based on likelihood, not just compliance.
[10:10] SPEAKER_01: And that that's that's real risk reduction.
[10:13] SPEAKER_01: But but governance is just as critical for the CISO.
[10:18] SPEAKER_01: And they need they the CISO needs to be a key voice in how AI is adopted across the organization, ensuring there's visibility into where models are used, how they're trained, what data they touch, you know, there's there's so many things, and that includes setting clear policies around model accountability, access control, um, what else, explainability, and of course, all the time without overburdening their teams.
[10:51] SPEAKER_01: And I think basically AI can be both a force multiplier for defense and also a new category of risk in its own right.
[11:04] SPEAKER_01: And the CISA's job is to maximize the former and govern the latter in a way that that builds confidence at every level throughout the organization.
[11:16] SPEAKER_01: And I think I think that's that's where their thinking needs to be.
[11:22] SPEAKER_00: What you're saying is so spot on and key.
[11:25] SPEAKER_00: I mean, there are organizations that are lucky enough to have a separate risk officer.
[11:31] SPEAKER_00: Many organizations depend upon the CISO to be their chief risk officer, too.
[11:38] SPEAKER_00: And I think that risk side of the equation sometimes gets overlooked, right?
[11:45] SPEAKER_00: And it is much more strategic, you know, than just technology.
[11:51] SPEAKER_00: So that's a good take on things.
[11:53] SPEAKER_00: Well, we're at the end of our time.
[11:55] SPEAKER_00: Thank you so much for making your time to come on and and give us some intelligent insight into all that's going on here in the AI security space.
[12:05] SPEAKER_00: And we'll have to have you on the podcast again.
[12:08] SPEAKER_01: Yeah, that'd be great.
[12:09] SPEAKER_01: It's a pleasure as always speaking to you, Jay.
[12:12] SPEAKER_01: Thank you very much.
[12:13] SPEAKER_00: Okay, take care.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.