# Architecting Resilient Cybersecurity at Scale | Stan Lowe | ClearTech Loop Ep. 5

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 29 Jul 2025, 14 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17582159-architecting-resilient-cybersecurity-at-scale-stan-lowe-cleartech-loop-ep-5.mp3

Send us Fan Mail In this fifth episode of ClearTech Loop, Jo Peterson sits down with Stan Lowe, CISO at the U.S. Department of the Interior, to explore how federal-scale cybersecurity transformation offers a blueprint for all modern enterprises. This 10-minute conversation continues The CISO Slant—a 10-episode series on how security leaders are navigating AI risk, operational complexity, and leadership in the digital era. What we cover in this episode: • Deploying Zero Trust architecture at scale • Why centralized security operations matter more than ever • How to rethink security in the age of AI and cloud complexity Guest: Stanley Lowe, Chief Information Security Officer, U.S. Department of the Interior Host: Jo Peterson, Chief Analyst, ClearTech Research Full episode page with transcript and takeaways: https://cleartechresearch.com/project/cleartech-loop-episode-5-stan-lowe/Subscribe to the newsletter: https://www.linkedin.com/newsletters/7346174860760416256/ Topics: cybersecurity, zero trust, AI security, federal cybersecurity, digital transformation, ClearTech Loop, Jo Peterson, Stan Lowe Tags/Keywords CISO, cybersecurity, zero trust, AI, federal IT, risk strategy, Jo Peterson, ClearTech Loop, Stan Lowe, U.S. Department of the Interior Episode Type Full Episode Season & Episode Number Season 1, Episode 5 Custom Episode Webpage https://cleartechresearch.com/project/cleartech-loop-episode-5-stan-lowe/ 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_00: Hey, thank you so much for joining.
[0:09] SPEAKER_00: I am Joe Peterson.
[0:11] SPEAKER_00: I am the chief analyst at Clear Tech Research, and I'm here today with Mr.
[0:16] SPEAKER_00: Stan Lowe.
[0:17] SPEAKER_00: Hi, Stan.
[0:18] SPEAKER_00: How's it going?
[0:19] SPEAKER_01: Hi, good uh afternoon, good morning, wherever, whatever time you happen to be to listen to this.
[0:27] SPEAKER_01: You're like, what the how should I start that?
[0:29] SPEAKER_01: But that it's good enough.
[0:30] SPEAKER_01: It's good.
[0:31] SPEAKER_00: It's good for everybody around the globe.
[0:33] SPEAKER_00: You've just, you know, welcomed them in their time zone.
[0:36] SPEAKER_00: Exactly.
[0:37] SPEAKER_00: This is clear tough loop.
[0:39] SPEAKER_00: We're in the know on the move.
[0:41] SPEAKER_00: Um, and we're going to be talking to Stan today.
[0:44] SPEAKER_00: Stan, before we jump in, I know you've been a CISO for a really long time.
[0:49] SPEAKER_00: Tell us about the things that you've done in your last couple roles.
[0:54] SPEAKER_01: Cool.
[0:54] SPEAKER_01: I've had a hell of a career and I'm on my 30.
[0:56] SPEAKER_01: So uh that just means I can't keep a job.
[1:00] SPEAKER_01: No, so uh I uh my most recent gig was the Chief Information Security Officer for the U.S.
[1:05] SPEAKER_01: Department of the Interior.
[1:07] SPEAKER_01: Uh I was there for about uh two and a half years or so.
[1:11] SPEAKER_01: Prior to that, I was the global chief information security officer for a company called Synchronous Technologies, which is out of Bridgewater, New Jersey.
[1:19] SPEAKER_01: And then I was the Global CISO for Zscaler and Park and Elmer and a couple other government gigs.
[1:23] SPEAKER_01: So I've been kicking around over a while.
[1:25] SPEAKER_01: I don't know if that means I can't keep a job or uh I just get bored and move on.
[1:29] SPEAKER_01: I don't know.
[1:30] SPEAKER_01: Who knows?
[1:32] SPEAKER_00: It just means you're a system, you're a seasoned CISO.
[1:35] SPEAKER_00: Say that 15 times fast, right?
[1:37] SPEAKER_01: No leather sting of the whip.
[1:39] SPEAKER_00: Ha ha.
[1:40] SPEAKER_00: All right.
[1:40] SPEAKER_00: Well, let's dig right in.
[1:41] SPEAKER_00: Clear tech loop is this focused podcast, and we're delivering sharp real-time insights at the intersection of cybersecurity, cloud, and AI security.
[1:51] SPEAKER_00: And through a concise three-question lens, we cut through the noise and surface the clearest perspectives in tech from those on the front lines of transformation like Stan.
[2:02] SPEAKER_00: And so we're gonna ask Stan three questions, and here's the first one.
[2:06] SPEAKER_00: Stan, from a systems perspective, how should you be thinking about cyber risk in terms of dollars and business impact?
[2:14] SPEAKER_01: Uh a lot of times we look at risk from a purely a compliance perspective, especially in highly regulated, highly regulated organizations or highly regulated verticals.
[2:28] SPEAKER_01: One of the things that we we have a tendency to do is let risk drive uh our activities rather than focusing on operations and making sure that operators we have an unrelenting focus on operational excellence, which gets us adequate compliance, which drives down our risk profile.
[2:48] SPEAKER_01: One of the other issues that we have is um tool spread.
[2:54] SPEAKER_01: You know, I've never met a cybersecurity person that didn't like a tool.
[2:57] SPEAKER_01: So we've got more tools out there than we know what to do with, and that then drives up the number of dollars that cybersecurity organizations are spending on those tools.
[3:09] SPEAKER_01: So I think uh, and it doesn't significantly reduce the risk.
[3:12] SPEAKER_01: So there's no real risk reduction versus the amount of money that we're spending.
[3:16] SPEAKER_01: So I think what we're looking to do from a from my lens is to be more efficient with the dollars that we spend to help better the risk return or risk value or risk investment.
[3:31] SPEAKER_01: Uh, and that that's steering us towards more along the lines of trying to solve 80% of our problem with as few tools as we possibly can, which you know, a lot of us are talking about platformization, that sort of thing, and then using the other 20% that's specific to our particular business or our particular vertical or our particular industry, and spending the extra money, the money that we save from platformization on those types of activities, you know, things that are very specific to us.
[3:59] SPEAKER_01: And then we'll we'll actually be able to provide business value, showing, hey, listen, we're no longer a cost center.
[4:05] SPEAKER_01: We're cognizant of what the businesses are doing, you know, we're trying to be enablers, uh that sort of thing.
[4:11] SPEAKER_01: So I think that that's how folks are starting to take a look at it.
[4:14] SPEAKER_01: And I think industry should start to take note of that as the days of you know huge cybersecurity budgets are coming to an end, and they're starting to be flattened out, and you're starting to have to justify uh the amount of dollars that you're spending on your program versus the the risk reduction that you're actually providing for the organization.
[4:36] SPEAKER_00: That's a really thoughtful and fair response.
[4:39] SPEAKER_00: And you highlighted something that is absolutely a trend that's occurring, um, particularly as as I see it at with your, you know, someone of your level, there's this thinking that there's an there's this thinking if I can if I can get most of what I need with a platform and get away from siloed tools, I'm gonna do that.
[5:02] SPEAKER_01: Right.
[5:03] SPEAKER_01: And there's a whole there's a we often think we often look at the cost as from just the the the cost of the tool itself, not the actual infrastructure that is needed to actually run all those tools.
[5:16] SPEAKER_01: The different knowledge, skills, and abilities that you need to train these folks for, they become siloed, they become stagnant.
[5:23] SPEAKER_01: The the amount of infrastructure that you need to be able to support those, the total cost of ownership, sometimes we lose that because that's sort of built into our baseline budgets.
[5:33] SPEAKER_01: And we we're only accounting for the cost of the tool, not necessarily all of the second and third order costs that come along with that.
[5:40] SPEAKER_01: So great.
[5:41] SPEAKER_00: And there are.
[5:43] SPEAKER_00: Okay, next question.
[5:44] SPEAKER_00: In your opinion, what is the best way to integrate cyber risk into the business's overall financial risk models?
[5:53] SPEAKER_01: I think that that is that that's interesting because it's it depends on where you're setting from a company perspective, whether you're publicly traded or you're privately held, or what what vertical are you in?
[6:07] SPEAKER_01: Are you in a highly regulated organization or vertical such as finance or healthcare or potentially um energy?
[6:16] SPEAKER_01: That is going to be the approach is going to be different from all those, but it all boils down to making sure that you as a cybersecurity professional are in lockstep with what your businesses are trying to do.
[6:30] SPEAKER_01: You know, cybersecurity, we can no longer, you know, you know, security.
[6:33] SPEAKER_01: We put the no in innovation.
[6:36] SPEAKER_01: We can't do that anymore.
[6:38] SPEAKER_01: Uh you know, in order for cybersecurity to be successful in any organization now, because we're also dependent upon technology and the internet to be able to drive our revenue and to be able to protect that revenue and be able to get our product messaging out there, that in order to be able to help the organizations, you know, drive down the risk as much as you possibly can.
[7:02] SPEAKER_01: That doesn't mean zero.
[7:04] SPEAKER_01: That means within the risk acceptance profile of the organization which you're working with, is understanding what the business is doing, how they're doing it, what their goals and what their objectives are.
[7:14] SPEAKER_01: And that means getting your ass up out of your hair and going and developing the relationships with those business leaders to understand what they're trying to do.
[7:22] SPEAKER_01: So they talk to you in the beginning and not at the end, where you're now basically going, hey, listen, let's have a risk versus revenue conversation.
[7:30] SPEAKER_01: And you know how that's always going to end is it's revenue is always going to win.
[7:34] SPEAKER_01: Right.
[7:35] SPEAKER_01: Basically, go back and try and you know put mandates on the risk uh that you've identified.
[7:39] SPEAKER_01: So making sure if you have those relationships up front, you know, you'll hear about things, they'll come talk to you about, hey, we want to do this or we want to do that, or this is the new business line we're thinking about, or a new product, or a new way of doing something to help us be able to protect and drive revenue, the ability to understand at least at a 10,000 vote view of what the hell they're talking about and understanding those business terms is going to help you help them drive down that risk.
[8:06] SPEAKER_01: Consequently, the dollars that you're spending on this will be in line with the risk uh for the organization.
[8:14] SPEAKER_01: And it won't be a technology risk, it'll be a business risk.
[8:17] SPEAKER_01: So that's you know, integrate yourself into there, and that'll help protect you from a from a you know cost-cutting perspective anyway, when it comes time to validate your budget.
[8:26] SPEAKER_01: It's like, oh yeah, cybersecurity is actually helping us drive revenue.
[8:30] SPEAKER_01: Let's not hit them, let's not hit them.
[8:33] SPEAKER_00: And and HR.
[8:35] SPEAKER_00: No, I'm just with and with that, you do something that's really important as a leader, I think.
[8:44] SPEAKER_00: You give yourself, you're part of the team and you give yourself a voice at the table.
[8:50] SPEAKER_00: Absolutely.
[8:51] SPEAKER_00: Right.
[8:51] SPEAKER_00: And so, right, that those are really important things.
[8:55] SPEAKER_00: All right.
[8:55] SPEAKER_00: It wouldn't be a podcast in 2025 without um in the tech space without mentioning AI.
[9:01] SPEAKER_00: So here we go.
[9:03] SPEAKER_00: How should the CSO be thinking about AI adoption in terms of its use just to cure emerging threats?
[9:09] SPEAKER_00: And then the other side of that coin from an organizational governance perspective.
[9:14] SPEAKER_01: I plead the fifth.
[9:16] SPEAKER_00: Oh, come on now.
[9:19] SPEAKER_01: No, so so AI.
[9:24] SPEAKER_01: I I'm of two minds about AI.
[9:26] SPEAKER_01: One, you know, AI is it's software.
[9:30] SPEAKER_01: So, and it's using data, software using data to make intuitive decisions based upon algorithms, right?
[9:37] SPEAKER_01: So if we break it down into those basic forms, we already have security controls to be able to control that in place.
[9:44] SPEAKER_01: We have data security, we have product security, and we have uh platform development security, right?
[9:51] SPEAKER_01: However, at its basic needs, if you've got those, that's a good starting point.
[9:55] SPEAKER_01: You should have those anyway, but again, you know, everybody's at a different place.
[9:59] SPEAKER_01: Sure.
[10:00] SPEAKER_01: From a security perspective, that sort of falls into, you know, the the the one of the first three tenets of cybersecurity, which is know thy shit, know thy environment, know what's in there, what's running, how it's moving, who well, who's doing what to who.
[10:18] SPEAKER_01: And that sort of tailors in or you know, steps on the answer that I gave before, which is knowing what your business organizations are up to, is having those conversations.
[10:27] SPEAKER_01: Hey, what are you using AI for?
[10:29] SPEAKER_01: So AI is is going to be, it's here to stay.
[10:35] SPEAKER_01: You need to be able to understand what your organization's doing with AI, what their plans are for AI, and be able to essentially use the tools that are coming out to be able to one, discover what AI is, what like what language models are, what AI is running in your organization, you know, sort of like a discovery tool.
[10:53] SPEAKER_01: You know, again, I was saying we can't have any more tools.
[10:56] SPEAKER_01: But you know, this is the 20% part of that that's going to be specific to your organization, where you need a discovery tool to find out who's running AI in your organization, be able to query your firewall logs, who's accessing AI that may not be in your organization, but the AI may not be in your organization, it may be hosted elsewhere.
[11:14] SPEAKER_01: There's that discovery part of that.
[11:16] SPEAKER_01: The second part of that is making sure that the integrity of the data that's being used to train the model is is sacrosanct, or there's a gold standard that you're not introducing hysteria or biases or uh hallucinogenic data or data that would cause a hallucinogenic episode in your large language model, you know, asking a particular question, you know, why does a duck have feathers?
[11:49] SPEAKER_01: Well, the psi is the sun is blue, and you get that answer back because you've basically not curated your data and made sure that the data that you're using to train that model is adequately protected.
[12:01] SPEAKER_01: We're back to the basics of data protection.
[12:04] SPEAKER_01: Third is utilizing AI from a cybersecurity perspective to be able to handle the massive influx of information into cybersecurity systems.
[12:18] SPEAKER_01: You know, cybersecurity is effectively a data problem, is being able to find the bad guy in a needle in the haystack.
[12:24] SPEAKER_01: And AI is an awesome pattern recognition thing.
[12:28] SPEAKER_01: So being able to utilize AI to be able to take care of the noise for the analyst and only surface those things that the analyst really, really, really needs to take a look at and do the investigation where a human needs to be able to interject some common sense or some um abstract reasoning into the decision-making process.
[12:52] SPEAKER_01: That I think will, you know, well, one, will you know, make the analysts' lives a whole lot easier because they're not looking at a lot of noise, but it essentially gives them much more fidelity into the things that the organization needs to be worried about and needs to respond to.
[13:07] SPEAKER_01: At the same time, that will help drive down the number of false positives that you're looking at, which again, you know, we're all back to money.
[13:15] SPEAKER_01: So how you know, driving efficiency into the organization by using um uh AI, you know, agentic AI is gonna be the next big thing.
[13:24] SPEAKER_01: That's gonna be interesting because that's a whole separate thing by itself.
[13:27] SPEAKER_01: Uh, the ability for a model to learn and develop and then uh on its own and make decisions on its own without external input is gonna be really interesting.
[13:36] SPEAKER_01: And how are we gonna secure that?
[13:38] SPEAKER_01: How are we gonna keep you know those types of autentic AI agents out there from like, you know, stewing in our own juices?
[13:44] SPEAKER_01: And then all of a sudden, you know, you know, Skynet became self-aware, you know, that sort of thing.
[13:50] SPEAKER_01: Right.
[13:50] SPEAKER_01: I mean that's really interesting.
[13:52] SPEAKER_01: I mean, the next couple of years is gonna be fun in this space.
[13:55] SPEAKER_00: It it will be fun in the space.
[13:57] SPEAKER_00: And thank you for the insightful answers.
[14:00] SPEAKER_00: Um, great responses to the to the questions, guys.
[14:03] SPEAKER_00: If you like the series, subscribe, hit like, and we'll see you next time.
[14:09] SPEAKER_00: Thanks, Dan.
[14:10] SPEAKER_01: Yeah, thank you.
[14:11] SPEAKER_01: Dan, appreciate it for having me.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.