Cyber Means Business: Timothy Youngblood on Building the AI-enabled Security Team

Yes, AI is beginning to automate some of cybersecurity's traditional entry-level work. The bigger story, longtime security executive Timothy Youngblood argues, is how the technology is reshaping the skills, structures and leadership models security organizations need to succeed. For CISOs, that means rethinking how they develop talent, organize teams and position security to lead AI adoption across the business.

Among the ranks of CISOs, Timothy Youngblood has gained experience as an operations executive, an investor, advisor and educator, giving him a particularly broad view of what artificial intelligence is doing to the cybersecurity profession. And he believes the changes are happening faster than many security organizations realize.

AI is adding another technology to the security stack and beginning to change how security work gets done, which skills organizations need and even how teams should be structured, Youngblood observes. Some of the repetitive work traditionally assigned to junior employees can increasingly be automated. At the same time, organizations need people capable of governing AI, redesigning workflows, integrating new tools and understanding where human judgment remains essential.

“CISOs and other executive leaders are looking at the teams they have today and realizing they need different skill sets,” he says.

Youngblood knows this turf. For close to three decades, he led security organizations for some of the world's most recognizable brands, among them CISO at McDonald’s. He established the first global CISO roles at Dell and Kimberly-Clark. He served most recently as senior vice president, and chief security officer and product security officer for T-Mobile.

Today, Youngblood spends much of his time on the other side of the table. Youngblood is an active angel investor who hears roughly 100 startup pitches a year, advises cybersecurity companies, serves on boards and teaches cybersecurity and cyber resiliency to MBA students at the University of Oklahoma. He has also joined one of his portfolio companies, Onyx Security, as chief strategy officer.

Youngblood has seen security leaders challenge employees to rethink their jobs given the reality of widespread AI adoption. One CISO he knows is asking everyone in the security organization to build an AI agent capable of handling some of the routine aspects of that person's work while the employee manages and directs it.

For Youngblood, that example captures the larger change that is underway. In this conversation for the Cyber Means Business series, he discusses how quickly security organizations can adapt their people and operating models around widespread AI adoption.

Joan Goodchild: How fundamentally is AI changing the people side of cybersecurity?

Timothy Youngblood: It is shifting pretty quickly because AI has become a complete game-changer in how work gets done. CISOs and other executive leaders are looking at the teams they have today and realizing they need different skill sets.

That does not necessarily mean replacing the people they already have. It means helping those people adjust what they are doing and become much more effective and efficient. In some cases, you can achieve the same outcomes much faster. In others, you can achieve completely different outcomes in ways you may never have considered before.

I know one security leader who is focused on having everybody in his organization create a digital twin. They are creating agents that perform aspects of their jobs. The employees are still managing those agents as digital workers, but the goal is to understand how to automate the turnkey, mundane tasks that AI technology can handle today.

What does that mean for traditional cybersecurity roles?

One of the challenges is that a lot of the jobs that traditionally opened the door for interns and new graduates are quickly being automated.

I hear all the time from people whose sons or daughters are about to graduate or have recently graduated and are struggling to break into cybersecurity or technology. Those opportunities are not as plentiful as they used to be.

Traditionally, you might come into a Security Operations Center (SOC) as a junior analyst and spend time crunching numbers, learning processes and assessing lower-level threats while you built your cybersecurity knowledge. Or you might start in compliance, assessing controls, learning test-of-design versus test-of-effectiveness and working with auditors.

Those jobs still exist, but there are fewer of them because organizations are asking how AI can minimize the amount of manual work required.

At the same time, I don't think this is simply a story about jobs disappearing. AI is creating new jobs as well.

Where are those new opportunities emerging?

Organizations are realizing that technology by itself is not enough. You don't simply create a great model, give it a great data set and suddenly get all this productivity and innovation.

Sometimes you have to redesign the process and change the way the business operates. That takes people. You also have to educate the workforce differently, establish governance and understand which use cases produce good outcomes for the company.

There is a difference between AI literacy and AI proficiency. Everybody is going to need some degree of literacy. People need to understand foundational concepts, recognize what a hallucination is and know enough to question a result when something doesn't seem right. They also need to be able to challenge some of the claims coming from the enormous number of AI vendors promising the world.

Proficiency goes further. That can include skills such as prompt engineering, secure API integrations, workflow automation, scripting and model validation. Organizations need people who can actually use these technologies to drive outcomes.

Should CISOs hire AI specialists or train experienced security professionals?

I think you start with people who understand the foundations of whatever they're responsible for, whether that's the SOC, engineering, governance, risk management and compliance, or architecture.

The industry is moving so quickly that colleges and universities are still catching up. There isn't necessarily one established path that says, "This is exactly how you become an AI security professional."

What you want are people who understand their security domain and can also understand which models make sense for that domain, which use cases are appropriate and which AI security tools are available. If you're working in the SOC, for example, you need to understand how the latest iterations of those technologies are taking advantage of AI or integrating with other AI tools.

Data and analysis are also increasingly important. People need to understand what is required to make AI work effectively.

Does AI require security leaders to rethink how their organizations are structured?

I've seen leaders create an entire AI structure within the security organization. In one large financial services enterprise, dedicated AI security people work directly with AI teams in different lines of business.

In some ways, it resembles the business analyst model. You have people who understand a particular business domain and can translate what it means for security and vice versa. Now that model is being applied specifically to AI.

I'm also seeing organizations create teams focused internally on how security itself can become more efficient using AI. They are challenging how assessments are conducted, how quickly teams respond to events and whether they can leapfrog some longstanding problems.

They're even challenging the security stack. If you can develop some of the use cases you need yourself using AI, you may decide you don't need to purchase another off-the-shelf product. That creates an opportunity to rethink where you're spending money as well as how you're working.

How does AI change the CISO's relationship with other parts of the business?

When this evolution was starting, I was the CISO at T-Mobile. People were beginning to use ChatGPT and other tools, and legal was actually the first organization to come to me.

They were concerned about employees putting proprietary company information into open models. I was concerned too. But the question was: Do we want to create a policy that we can't enforce? Because that can create even more risk if you're establishing rules that you have no ability to enforce.

Legal and security worked together to educate the workforce about the guidelines and expectations and then align those expectations with things we could actually enforce using technologies such as data loss prevention  and cloud access security broker.

That relationship evolved because legal was taking a leadership role in the AI space, and together we helped establish the foundations of what AI governance looked like for the company.

What leadership lessons from previous technology shifts still apply in the AI era?

We've been through these cycles before. We saw it when devices started coming into the enterprise. We saw it during the cloud evolution. Now we're in the AI era. In some ways, it's old wine in new bottles.

The company has to leverage these tools to be competitive. At this stage, every company is a technology company. As a security leader, you have to show how you're enabling that.

Security has an opportunity to become the lead partner. Security organizations should be using AI themselves and demonstrating models that work and can be replicated throughout the rest of the organization.

I'm seeing more security leaders lead the way particularly around governance: understanding where AI is being used, identifying the risks associated with that use, establishing the guardrails around what should never happen and defining what is allowed.

Security can even become an informant back to the business and say, "We're not taking advantage of this technology in an area where it could help us." Security sees so much of what happens across an organization that it is uniquely positioned to identify both risk and opportunity.

What should CISOs ultimately be trying to accomplish with AI?

Ownership is extremely important. During major technology evolutions, you often have a lot of people doing a lot of different things and nobody clearly owns anything.

Security has an opportunity to help establish that ownership and identify who is accountable for what.

There is also a financial component. CFOs are worried about the cost of AI, particularly as organizations see token usage and related expenses increase. Security already has monitoring capabilities that can help organizations understand where that usage is occurring, whether the spending makes sense and where expensive activity isn't producing enough benefit.

That's why I think security is in such a unique position right now. The job isn't simply to protect the organization from AI. Security leaders can help the business understand how to use it, where to use it and how to do so responsibly.