Member Contribution - Weekly CISO Podcast Pick
This Week's Pick by David B. Cross (CISO, Atlassian)
Series curated by the CISO Platform community, sharing practical security leadership resources recommended by experienced CISOs and senior practitioners.
Cyber Smokehouse: How AI Is Reshaping Cybersecurity
David's recommendation is an episode of the Cyber Smokehouse podcast in which he discusses how artificial intelligence is changing the cybersecurity landscape. AI is lowering barriers for attackers, accelerating the pace of risk, and forcing security teams to adapt their operating models.
His central point is practical: defenders cannot respond to AI-enabled threats only with more manual work. Security leaders need to use AI deliberately inside defensive operations while keeping human accountability around judgment, risk, and response.
Focus: AI-enabled threats, defensive AI, security operations, workforce adaptation, leadership accountability
Why this matters to CISOs
- AI reduces the time and expertise needed to research targets, create convincing content, analyze code, and scale attacks. Existing controls may face more attempts at higher speed.
- Security teams cannot match machine-speed activity with ticket queues and manual investigation alone. Defensive workflows need safe automation and clear escalation paths.
- Adopting AI is an operating-model decision, not just a tooling decision. CISOs need to define approved data, accountable owners, validation requirements, and measurable outcomes.
- Human judgment remains essential where context, business impact, and risk appetite matter. The goal is to increase analyst leverage without automating accountability away.
Copy-paste takeaways for your team
- Use AI first for bounded, reviewable tasks such as alert enrichment, case summarization, query drafting, and repetitive evidence collection.
- Require source evidence and analyst confirmation before AI-generated conclusions change severity, containment, or remediation decisions.
- Track where AI reduces investigation time and where it introduces rework, false confidence, sensitive-data exposure, or access risk.
- Threat-model the AI workflow itself: prompts, connected tools, identities, retrieved data, outputs, logs, and failure modes.
- Train teams to challenge AI output, preserve evidence, and escalate uncertainty instead of treating fluent answers as verified analysis.
Standout ideas
- AI changes attack economics by making previously expensive work cheaper and easier to repeat.
- Defensive advantage comes from integrating AI into disciplined workflows, not from adding an isolated assistant to every analyst's desktop.
- The most useful AI security measures connect adoption to operational outcomes: faster triage, better coverage, lower backlog, and more consistent decisions.
- Adaptation is continuous. Models, attacker techniques, internal use cases, and control assumptions all need recurring review.
Try this in the next 7 days
- Choose one high-volume security workflow and measure its current cycle time, analyst effort, and error rate.
- Identify one bounded step that AI could assist without making the final risk decision.
- Document the data boundary, tool permissions, required human review, logging, and rollback path for a small pilot.
- Review results with analysts after one week and decide whether the pilot improved speed and quality without adding unacceptable risk.
About David B. Cross
David is CISO at Atlassian and a long-time community member at CISO Platform. His weekly picks are short-listed for practical signal: conversations that sharpen how security leaders guide teams, govern emerging technology, and make better risk decisions.
Share this with your team
Use this episode to ask one concrete question: which defensive workflow should AI accelerate now, and what human review must remain non-negotiable?
Comments