# The CISO Field Guide: Becoming Operator, Strategist, Storyteller with Mark Lynd

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 9 Sep 2025, 18 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17816212-the-ciso-field-guide-becoming-operator-strategist-storyteller-with-mark-lynd.mp3

Send us Fan Mail CISOs wear three hats in 2025: Operator, Strategist, Storyteller. In this ClearTech Loop episode, Jo Peterson sits down with Mark Lynd — Head of Executive Advisory & Strategy at Netsync, globally ranked AI & Security Thought Leader, and author of Cyber War One Scenario. Mark shares a practical field guide for CISOs navigating the complexity of AI adoption: • Operator: Shift SOCs from alert-chasing to question-asking. Measure time-to-decision, not tool count. • Strategist: Stop reinventing governance. Use paved roads with guardrails (NIST, ISO, vendor frameworks). • Storyteller: Boards don’t want tool inventories — they want proof you can protect the business. Translate cyber chaos into ROI and resilience. If you’ve been wondering how to brief the board, govern shadow AI, or actually augment your SOC with AI (without burning out your team), this is your episode. 👉 Watch the full conversation + subscribe to our LinkedIn newsletter here: https://www.linkedin.com/newsletters/7346174860760416256/ Episode Notes 🎧 Listen: \[Buzzsprout embed auto-fills\] 📺 Watch on YouTube: \[insert link\] 📰 Subscribe to ClearTech Loop Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/ 📘 Mark Lynd’s book Cyber War One Scenario: https://www.amazon.com/Cyber-War-Scenario-Mark-Lynd/dp/B0FH41GRHS 🔗 Resources mentioned: • NIST AI RMF • Gartner SOC Efficiency • PwC Digital Trust Insights 2025 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_01: Hi, um we're here today with ClearTech Loop on the move in the know.
[0:13] SPEAKER_01: Thank you so much for joining.
[0:14] SPEAKER_01: I'm Joe Peterson.
[0:15] SPEAKER_01: I am the vice president of cloud and security for Clarify 360 and the chief analyst at ClearTech Research.
[0:22] SPEAKER_01: And I've got an amazing special guest and long-term friend of mine, Mr.
[0:27] SPEAKER_01: Mark Lynn.
[0:28] SPEAKER_01: Hi, Mark.
[0:29] SPEAKER_00: Hi, Joe.
[0:30] SPEAKER_00: Thank you for having me.
[0:31] SPEAKER_01: Thank you for coming.
[0:34] SPEAKER_01: In case you don't know him, and you should, he is head of executive advisory and strategy for NetSync.
[0:41] SPEAKER_01: And Mark leverages his extensive experience in cybersecurity, artificial intelligence, data center, and IoT to provide strategic guidance for C-level interactions.
[0:53] SPEAKER_01: In addition to his role at NetSync, he holds executive board roles.
[0:58] SPEAKER_01: And the gentleman rocks a CISSP, ISSAP, and ISSMP.
[1:04] SPEAKER_01: So in case you were looking for something to do in your free time, I don't think Mark has any free time.
[1:10] SPEAKER_01: I'm fairly sure he does it.
[1:12] SPEAKER_01: He's a girl dad too.
[1:14] SPEAKER_01: So he's busy.
[1:19] SPEAKER_01: So let's get down to our questions then.
[1:21] SPEAKER_00: Okay.
[1:23] SPEAKER_01: How can cybersecurity professionals leverage generative AI to break out of the traditional sort of that tool and tech mindset and drive more innovative thinking and execution in their security programs?
[1:36] SPEAKER_00: Yeah, you know, I really love this question because spending I spend a lot of time with C-level customers.
[1:42] SPEAKER_00: And one of the things that they're, you know, they they often do is should we approach how do we approach it?
[1:48] SPEAKER_00: And I'm like, look, you cannot approach us like you approached things you did before with IT and that.
[1:53] SPEAKER_00: It's just it's it's a completely different animal.
[1:57] SPEAKER_00: And so some of the things that uh talked to about is make AI a co-pilot layer.
[2:02] SPEAKER_00: Think of it as a layer, right?
[2:04] SPEAKER_00: Because if you look at what Microsoft's doing, if you look at what Cisco's doing, all these others, what they're doing is they're they're offering copilots for all of their products, right?
[2:14] SPEAKER_00: Um, and as part of that, so that's a great way to get some early wins because they ask me, you know, if your board's asking you what's your AI strategy, how are you going to do this?
[2:23] SPEAKER_00: If you're getting questions from your employees, leadership, customers, it's a great way to get in there thinking about this co-pilot layer to make your people more effective, more efficient, um, and start to augment them because that's really what we're talking about, right?
[2:37] SPEAKER_00: It's kind of the it's kind of the uh the piece you see with Jensen, uh the CEO for um uh NVIDIA.
[2:45] SPEAKER_00: He says, you're not gonna be replaced by AI, you're gonna be replaced by somebody who's really good at AI.
[2:50] SPEAKER_00: Um, so so you know, you think about that from a copilot layer, you can make your employees better at what they're doing, make them more effective, more efficient.
[2:59] SPEAKER_00: And that's a good, solid early wins, doesn't require huge investments and all that.
[3:04] SPEAKER_00: And then, you know, one of the things also is you've got to think about putting in a framework, right?
[3:10] SPEAKER_00: How are we gonna do this?
[3:12] SPEAKER_00: Um, so we can make better decisions, better buying decisions, right?
[3:15] SPEAKER_00: But this isn't about better controls like a lot of the previous products are.
[3:19] SPEAKER_00: This is about better decisions because this augments and enhances your decision for your employees, for you, for you know, your peers, et cetera.
[3:27] SPEAKER_00: And it has great benefit to your customers.
[3:29] SPEAKER_00: So maybe an example, Joe, of that would be is uh hypothesis-driven threat hunting.
[3:36] SPEAKER_00: So in the past, threat hunting, you had to dig through the details, right?
[3:41] SPEAKER_00: And they you may have a product that bubbles it up, uh, a couple.
[3:46] SPEAKER_00: Maybe they look at a hundred thousand and they bubble up 10 or 15 for you to look at.
[3:51] SPEAKER_00: But wouldn't it where we're going to is you'll be able to ask questions.
[3:56] SPEAKER_00: Which one is the most you know, problematic for us?
[4:01] SPEAKER_00: Which one uh might skirt around our security controls, um, things like that, and then let it automaterialize using these queries and levers.
[4:11] SPEAKER_00: So you move from alert chasing to question asking.
[4:14] SPEAKER_00: And I I and we talk about this with our customers all the time because we sell a lot of security and do a lot of security uh for a lot of customers.
[4:22] SPEAKER_00: So if you truly believe, uh and I do, um, that LLMs and you know, generative AI and this predictive part of the AI is that piece, then that move from alert chasing to question asking is a really wonderful example on how this uh can really benefit, right?
[4:42] SPEAKER_00: Because if you're more secure, that means your customers' data is more secure.
[4:45] SPEAKER_00: If your people are able to work on other projects because you made them more efficient and effective, you know, you're getting that.
[4:51] SPEAKER_00: So those are some really good ones.
[4:53] SPEAKER_00: And you also then the last element of that um is measure time to decision, not tool count, which directly goes against what you asked me, right?
[5:04] SPEAKER_00: Before it was like, well, you know, nobody ever got fired for buying Cisco, right?
[5:09] SPEAKER_00: Or, you know, we have 17 security products and da-da-da-da, and five integrations, etc.
[5:15] SPEAKER_00: No, measure time to decision, right?
[5:18] SPEAKER_00: Because a lot of times going and having to look at six or seven consoles, trying to figure out where what information is where, and then trying to make those align with each other so that you can make a good informed decision.
[5:31] SPEAKER_00: It's so difficult.
[5:32] SPEAKER_00: But with LLMs, you can look at a wide variety of data sets in a data lake or even even outside of that by loading it or using and using uh you know a rag, you can do that.
[5:45] SPEAKER_00: Um, and so now you can measure your time to decision, not how many tools I had to go to to collect all this information and get all this.
[5:52] SPEAKER_00: Even though there is a verification element of that that some may appreciate, if you do it right in the LM, you can get that as well.
[6:02] SPEAKER_01: I love that answer because it was so layered.
[6:04] SPEAKER_01: And one of the things I heard you say is you know, we need to teach our newer security folks to ask better questions.
[6:16] SPEAKER_01: Yeah, we have to teach them to ask better questions because we're gonna, you know, somebody, some CISO somewhere is buying some fancy tool and it expects you to ask it questions.
[6:28] SPEAKER_00: Well, it's funny.
[6:29] SPEAKER_00: The um uh I do an AI tabletop, right?
[6:32] SPEAKER_00: And we do that for the the C-suite.
[6:34] SPEAKER_00: Um, you have to put it in very uh measurable or simple terms, right?
[6:39] SPEAKER_00: Um, so I say stop buying blinky boxes, start buying better questions.
[6:44] SPEAKER_00: And that is an actual sound bite from our quote from from the AI tabletop.
[6:50] SPEAKER_01: That's so good.
[6:51] SPEAKER_01: That is that is so good, right?
[6:53] SPEAKER_01: Is and I, you know, but it's a different way of thinking.
[6:58] SPEAKER_01: It is like part of the different way of thinking is you know, you're an ex-military guy, cybersecurity is very rule-bound, right?
[7:07] SPEAKER_01: If this, then that, right?
[7:10] SPEAKER_01: AI doesn't behave that way.
[7:12] SPEAKER_00: No, it doesn't.
[7:13] SPEAKER_01: So it's a different way to look at, you know, um he's rolling crazy ball in some instances, right?
[7:19] SPEAKER_01: And you have to think differently to lock down those attack vectors.
[7:25] SPEAKER_00: Um so you know, to that point, you think about this.
[7:29] SPEAKER_00: One of the ways to augment that and to do that and think that different way is like if you're thinking about purple teams, right?
[7:37] SPEAKER_00: Yeah, so purple team loops, how about AI AI augmented purple team loops?
[7:42] SPEAKER_00: So if you use LLM agents and agent, genic AI is the big rage right now, right?
[7:47] SPEAKER_00: But if you're able to do that, to script you know, adversary behaviors like phishing lures, uh prompt injection strings, you know, data poisoning, et cetera, et cetera.
[7:57] SPEAKER_00: So that every every exercise hardens both systems and staff, right?
[8:01] SPEAKER_00: And then maybe you I don't know, maybe you anchor that to uh MITRE Atlas tactics to model how attackers target AI.
[8:09] SPEAKER_00: That's a that's a really great way, you know, how you and I are talking about using questions and and using it in a different taking a different approach to an age-old problem.
[8:22] SPEAKER_01: Um are you listening, venture capital people?
[8:26] SPEAKER_01: You need to call this man because he's got a great idea here.
[8:30] SPEAKER_01: Just call him.
[8:33] SPEAKER_00: Remember, purple team loose.
[8:36] SPEAKER_01: I love it.
[8:37] SPEAKER_01: That it's such a good idea though, because you're using AI to outsmart itself.
[8:42] SPEAKER_00: Yeah, I mean, you think about it, you and I both spend a lot of time with customers.
[8:46] SPEAKER_00: And one of the ones that we always hear is we need to do more with less, right?
[8:52] SPEAKER_00: I may not have the exact budget, I may not have the headcount, I may not be able to get great people, enough of them, right?
[8:58] SPEAKER_00: And and you're always in this struggle where you're trying to make get get one or the other.
[9:03] SPEAKER_00: So a way to do that is to truly take what the LLM provides you, this augmentation, right?
[9:10] SPEAKER_00: And then, you know, apply it to given problems.
[9:13] SPEAKER_00: And that purple team loop, I've heard that issue.
[9:16] SPEAKER_00: They didn't call it a loop, but I've heard it sounds like a circle to me.
[9:19] SPEAKER_00: I hear it all the time.
[9:20] SPEAKER_00: When you get down there with engineers, with their leadership, and you start to talk about maybe it's an instant response tabletop, maybe you're talking about um, you know, purchasing a new product or tool or whatever it may be, and these questions come up.
[9:36] SPEAKER_00: And I've heard the purple team one a bunch of times.
[9:39] SPEAKER_00: I've still not seen anybody solve it.
[9:42] SPEAKER_01: That's a great one.
[9:42] SPEAKER_01: It really is.
[9:44] SPEAKER_01: And speaking about, you know, sort of balancing things, how can organizations embed security and privacy controls into AI model development without slowing down innovation?
[9:57] SPEAKER_00: Yeah, you know, um, I love this one too, because I have to kind of take a weird angle on this one.
[10:04] SPEAKER_00: I always think, you know, having been the CIO and CISO several times, and you know, it was me on the line and my my team.
[10:15] SPEAKER_00: I like to give teams a fast paved road with guardrails.
[10:19] SPEAKER_00: That's my angle, right?
[10:21] SPEAKER_00: And what I mean by that is, you know, governance that ships.
[10:25] SPEAKER_00: Maybe it's so so don't go out and try to create some governance on your own.
[10:29] SPEAKER_00: There's so much out there, right?
[10:30] SPEAKER_00: You got uh NIST, um, you have ISO, uh, Microsoft has their own, Google has their own.
[10:37] SPEAKER_00: I mean, just go down the list.
[10:38] SPEAKER_00: I think there's 11 or 12 the last time I heard.
[10:42] SPEAKER_00: Wow, okay.
[10:43] SPEAKER_00: Yeah.
[10:44] SPEAKER_00: Um, and you know, if you're if you're just purely Microsoft, and there's a lot of shops out there that do a lot of Microsoft or lean heavy on Microsoft, and maybe you want to get the early wins with O365 and their co-pilot.
[10:54] SPEAKER_00: That's a reasonable strategy, right?
[10:57] SPEAKER_00: Um, then you may want to adopt theirs and then maybe uh, you know, position yourself towards NIST further down the path, right?
[11:05] SPEAKER_00: As you start to expand and broaden your horizons around um, you know, generative AI, et cetera.
[11:11] SPEAKER_00: And then, you know, security by default, it'd be we're back to that.
[11:16] SPEAKER_00: Security baked in is always better than bolted on.
[11:19] SPEAKER_00: And we've been saying that for years, right?
[11:22] SPEAKER_00: Well, security by default, to may think of it as a golden path with this LLM, right?
[11:27] SPEAKER_00: You need to look at the model.
[11:29] SPEAKER_00: Um, you need to understand the data sets, the data lake.
[11:32] SPEAKER_00: Uh, you and I have talked about DLP in the past, uh, injections.
[11:37] SPEAKER_00: You know, there's a lot of pieces to this.
[11:39] SPEAKER_00: It isn't just simply, and that's why people are so fearful of shadow AI.
[11:44] SPEAKER_00: It's not just simple bring something up and start loading PDFs and asking questions and giving access to data that may or may not be sensitive.
[11:53] SPEAKER_00: It there, there's a lot of effort to that.
[11:55] SPEAKER_00: So, you know, in my mind, it's gonna have to be done early.
[11:59] SPEAKER_00: You're gonna have to have a good AI strategy, you're gonna have to ensure that you're it's based on some kind of governance and model that pre-exists.
[12:08] SPEAKER_00: Don't try to build your own.
[12:09] SPEAKER_00: I've seen too many customers go down that that that lane and it it just it's fraught with with uh you know all kinds of potholes and and and damaging issues.
[12:19] SPEAKER_00: And you know, do that, and then last but not least, make sure that for your environment, when you give it access to your information, your data, and that you let your the employees know and share with them, right?
[12:34] SPEAKER_00: But bring them along for the ride that you know, sensitive information going in there will be trained on and will become public information more than likely.
[12:43] SPEAKER_01: Right.
[12:44] SPEAKER_01: And and we all have heard the horror stories about people not locking stuff down and the crowd jewels getting into the public domain, and it's sad.
[12:54] SPEAKER_01: Um, so last question how should the CISO be thinking about AI adoption in terms of its use to both secure emerging threats and then from an organizational governance perspective?
[13:07] SPEAKER_00: Yeah, um, this is one that I, you know, I I think about this in kind of a uh an interesting way.
[13:15] SPEAKER_00: It's really, I gotta give all the credit to the customer, and it's a variation of what we just talked about.
[13:20] SPEAKER_00: It's move fast on a paved, well-lit road, right?
[13:24] SPEAKER_00: Uh, if you're if you're gonna look at some kind of um analogy to think about this, is don't go off on your own trying to figure this out, you know, to really think about what you're trying to do, bring others in.
[13:40] SPEAKER_00: You might want to bring third parties in that have done this for others to help them with that.
[13:45] SPEAKER_00: And you and some of the things you can think about, you know, from a CISO perspective, uh, stock augmentation, that's a big win, a really big win, right?
[13:53] SPEAKER_00: Use LLMs to summarize alerts, uh, enrich your ICOs, generate IR drafts, uh, you know, but keep the human in the loop.
[14:02] SPEAKER_00: That's the big thing now.
[14:03] SPEAKER_00: You're we're hearing that from a lot of uh big, even the even the AI manufacturers themselves are saying keep the human in the loop.
[14:10] SPEAKER_00: We're hearing that over and over and over again.
[14:11] SPEAKER_00: And then, you know, another good one is AI threat modeling.
[14:14] SPEAKER_00: Um, we kind of touched on that, you know, it kind of aligns with with MITRE Atlas, with NIST AI 100-2, um, some of those.
[14:23] SPEAKER_00: Um, and then uh as we move into the future, think about it as deep fakes and fraud uh resilience, right?
[14:30] SPEAKER_00: Is eat resilience.
[14:31] SPEAKER_00: You've got to create a way to battle what AI is gonna be bringing at you.
[14:37] SPEAKER_00: Um, I've I don't know what you're hearing from your customers, but I'm hearing a lot of fear um in certain customers about because they're starting to see this these AI-driven and powered attacks uh happen.
[14:50] SPEAKER_00: And they don't have the personnel, they don't have the cadence, um, and they don't have the determination and capabilities to offset that right now.
[15:00] SPEAKER_00: So they're they're leaning on some of their manufacturers, they're leaning on their partners, and and uh it's really, you know, you're gonna have to make investments.
[15:08] SPEAKER_00: You're gonna have to invest in your team, you're gonna have to invest in your organization, you're gonna have to invest in yourself, and you've really got to come up with kind of this um a way to treat AI as both a control surface and a risk surface, right?
[15:25] SPEAKER_01: Good.
[15:25] SPEAKER_01: I love that way of thinking, control service and a risk service because it is.
[15:30] SPEAKER_00: It is.
[15:31] SPEAKER_00: It is the only difference, the only difference is the blast radius could be infinitely larger, nuclear, potentially.
[15:40] SPEAKER_00: I mean, it is uh it's like you know, um uh in my new book that I have, I I that's what I covered.
[15:48] SPEAKER_00: It's I I use they it's AI, it's AI-powered cyber threats, and that's that's what people truly fear.
[15:55] SPEAKER_00: And there's a reason to fear it, um, but it's not, you know, it's not uncapped.
[16:00] SPEAKER_00: It's just you're gonna have to make those investments.
[16:02] SPEAKER_00: You're gonna have to learn how to augment yourself, your team, your organization with AI, um, and use it to manage both that control surface and that risk surface.
[16:13] SPEAKER_01: Love that.
[16:13] SPEAKER_01: And what is the name of your new book and where can people find it?
[16:17] SPEAKER_00: Oh, I'm sorry.
[16:17] SPEAKER_00: Yeah, uh, it's it's called Cyber, it's called Cyber War, um, one scenario.
[16:23] SPEAKER_00: And it's kind of a mix of uh Annie Jacobson, uh, who's a very famous author who I love, uh, who did Nuclear War and Area 51.
[16:31] SPEAKER_00: Um, and she does narrative uh nonfiction and fiction um in the form of Tom Clancy.
[16:38] SPEAKER_00: So if you if you smash those two together, and some of the early reviews have even commented on that, um uh it's a narrative fiction and it's about a um cyber attack that's AI powered, um, that leads towards uh uh impacting our critical infrastructure both here and abroad, and then turns and uh starts hitting everybody.
[16:59] SPEAKER_00: And uh they soon they have to join together to uh do that.
[17:03] SPEAKER_00: And um it's uh it was fun writing it.
[17:07] SPEAKER_00: Um it's a long read.
[17:08] SPEAKER_00: Uh fairly it's like 307 pages, but a lot of research went into it um and a lot of good customer information went into it.
[17:15] SPEAKER_01: Wow, that sounds cool.
[17:17] SPEAKER_01: I'm gonna need to check that out.
[17:18] SPEAKER_01: So you'll have to send me the link so I can add it in the podcast notes when we send uh when we post the podcast.
[17:25] SPEAKER_00: Yeah, it's on Amazon, Barnes and Noble, uh Kodo, uh Apple Books.
[17:30] SPEAKER_00: Uh I think it's on like 93 platforms.
[17:33] SPEAKER_01: 93.
[17:34] SPEAKER_00: Yeah, there's believe it or not, there's over 300 platforms.
[17:40] SPEAKER_01: There's so many things I don't know.
[17:42] SPEAKER_01: Just so many.
[17:43] SPEAKER_01: Um, it's just a lot.
[17:45] SPEAKER_01: Well, it was a pleasure seeing your face.
[17:47] SPEAKER_01: It was a pleasure hearing your thoughts.
[17:49] SPEAKER_01: Thank you so much for making time out of your day to visit.
[17:52] SPEAKER_01: And thank you guys all for joining.
[17:54] SPEAKER_01: And we'll see you next time.
[17:56] SPEAKER_00: Thank you, Jeff.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.