Qualys CISO Nathan Smolenski Says AI Governance Needs a Rethink

Hey everyone. Welcome back to our live coverage of Qualys's Rock On here in Austin 2026. My next guest is Nathan Smolenski.

Nathan is the CISO, Chief Information Security Officer here at Qualys, and as you're going to hear, he has quite a charge comes with that title. But let's welcome Nathan. Nathan, welcome.

Thank you for having me. It's your first time on Textron TV. I hope it won't be your last.

No, looking forward to it. We always enjoy having the Qualys CISO and the Qualys team here. Well, we come to the Qualys conference every year.

Sure. But throughout the year, whether it's RSA or Black Hat or whatever, or if just there's news coming out, right? We always stay in touch with our friends at Qualys.

Nathan, you're fairly new to the role, right? You're here about a quarter or so. Yeah, it's almost exactly a quarter.

I'll be doing my second board meeting, in November. I did my first board meeting on day two, which was a very easy one because I could say look- Can't say much. Yeah, not much I can say.

" Right. Give us a sense of how you got here. What have you done before?

Sure. So I started in security, I would say 2001, at Bank Julius Baer in New York City. I was the operational risk manager there, but with a strong technology background.

And through reorganization, I started working for the CISO. And really the- Was there a CISO there back then? There was.

There was an American CISO there at that time. Big Swiss private bank, so need security. Yeah.

So we kind of handled a lot of the risk management and security at the bank. And then from that point forward, that was my career trajectory, and I've spent most of my career in big corporate. Worked for a lot of insurance companies, New York Life.

I was the America CISO for Zurich North America. Uh-huh. And spent time at Spencer Stuart as their CISO, of that global consulting organization.

And then kind of pivoted to the startup world, and did an insurance- The dark side. Yeah. I did an insurance startup called Corvus Insurance that got acquired by Travelers and spent about five and a half, six years at Netskope in various roles.

Sure. And then most recently, at Cyera as their CISO and head of advanced services. Great company too.

Yeah. I know Cyera's a great company. Yotam and the team.

So here we are at Qualys. You bring a wealth of knowledge. Actually, it's funny, my last security company that I started, we actually started in 2001.

I had been doing some security before that at other companies I helped found, but that was the last one. I look back, that's why I asked if there was a CISO then. Yeah.

Because CISO were rare then, right? Yeah. They were glorified security architects for the most part.

Sure. Or IT people with extra responsibility. Exactly.

Sometimes, though, they came from the CFO side of the house. Mm-hmm. Or at least they answered to that side of the house, right?

Mm-hmm. Truly risk management. Yeah.

The world has changed, the security world's changed, and now most recently with AI and changes, and what was a great little cottage industry, and we had some great people in security all these years, has now we're front page. Yep. We're front and center too, and got a big target on our backs, our chest, our heads.

You're actually doing two panels here today. Yep, I did one earlier. Yeah.

And I wanted to kind of bring them together if we can. Sure. The first panel, well, I'm going to let you describe the first panel and then I'll jump in.

What was your first panel about? Sure. The first panel brought together different CXO personas, so CISO, CEO, CIO, and then a consultant advisor to those same personas- Mm-hmm ...

in the industry. And our goal was really to talk about the inflection point of agentic and generative AI and what the impact is on things like vulnerability management, exposure management, and all of the things that we've always kind of tried to get better at, but we've been very poor at execution on. And really talk about- Because.

Yes. Talk about sort of what the impact is of kind of turning all that work on its head. Because we did make progress, but- Yes ...

I think that that progress has been stunted a bit. So I'm going to tell you, and like you, I've been in security a long time. When I look back to those days, 1999, 2001- Yeah ...

2005, 2006 or so, the cloud, Cloud Security Alliance, we have made a lot of progress. Absolutely. Right?

Security has grown up. Unfortunately, the mission has grown. Absolutely.

And the strength of our adversaries, they've grown as well. Sure. And so it's easy, I know for some people to say, "We still have a lot of breaches.

" There's been progress made. I would say it's harder to break into things now than it was in 2001 or 2004. As your panel kind of, I think, hit the nail on the head, AI, both generative and agentic have had a huge effect on this, right?

Right. I call it AI scale, right? It's not that it's doing things that were not possible to do before, it's the speed and breadth of it- Of course ...

that is outstripping us, our abilities to do it. I think your panel pulled a very interesting angle, though. I remember presenting at RSA Conference, it's got to be 12, 15 years ago, about should the CISO dumb down his presentation for the board and C level because they don't understand- Right ...

what it is. Technical stuff, right. In your panel today, have we made any progress?

I think so. " Right. Using the crisis methodology- Right ...

and hoping and praying. Right. " Right.

And I think that's the hard question that we now have to be able to address in a more effective way in business terms. And I think that's still hard for many, because many of us are tinkerers. We have strong IT backgrounds.

Sure. We get hands-on. But you have to really spend time knowing your business at this level now, to the point where we need to be able to talk about cyber risk as any other business risk and understand the monetary value and impact that it has on business.

Like, where's the cash register? How do we protect it? What manufacturing process makes all of our stuff and can't stop?

You don't know those things, then how are you... It's like the old inventory challenge. If you don't know what you have, you don't know how to protect it.

Yeah, exactly. But here's the thing. What's a little interesting now is when we talk about AI, boards, C-level folks, they're cuckoo for AI, right?

Right. "We use more AI. Figure out how to use AI.

We've got to use AI. " Okay, so now we're using AI, but so are the bad guys. 100%.

And we live in a post-Mythos world where AI is making vulnerability discovery table stakes. Sure. Right?

How is that affecting the different voices, the personas that you have here? Yeah. I think one of the things that we talked about on the panel today was it definitely is having an impact, to your point.

But I think the impact in a lot of ways is just highlighting our deficiencies of the past in fundamentals, but also in how we speak to the board about it. And ultimately at the end of the day, you can't use AI to automate accountability, right? " So- Having your cake and eating it too ...

we can't, those two things are drawing at very opposite poles. Yeah. Agreed.

And so I think, being able to, as IT and security leaders, we have to do the thing to set up the opportunity to measure on enablement. And if we don't provide the guardrails or the expectations, it's like giving a toddler or a teenager a credit card and saying, "Yeah, go buy yourself a Ferrari- Yeah ... and then let me know- Yeah ...

" It can be very scary, but I think a lot of us kind of through experimentation said, "Let it go and see what happens," but now it's really hard to put the genie back in the bottle. And that's very true, right? Because we can't go back to pre-Mythos.

No. We can't go back to the bad guys, adversarial folks, not using AI- Of course ... up their game.

So the only way forward is, damn the torpedoes, full speed ahead. Yep. And we have to, I think in a lot of cases, we're building the plane as it's flying, because we have to, because the business wants to consume and not lose the potential competitive edge that they have or do have.

That drives this whole thing. Yeah. But that's a business risk problem.

It's like trying to build a building in an earthquake-ridden area, or build a building or an office in an area where there's floods and hurricanes. We have to figure out what those risk mitigation strategies are and determine how to do it. Yeah.

Get on with it. Agreed. Hey, let's turn to your panel this afternoon.

Yep. Tell us a little about that one. Sure.

That panel is going to be focused on a similar topic, but really to kind of do a retroactive on how we, at Cyera, when I was there, Lamont Orange, the chief trust officer, and I built the governance model, and we worked with our partners across engineering and in all of the business lines to not only enable AI in each of those areas, but to build the guardrails and the structure to make that enablement successful. So we're going to talk about that, but we're going to bring in two additional folks to give their opinions. One, a CTO, who's local here, and has an emerging AI technology company that's focused on kind of providing some of those guardrails.

Okay. So he's going to give his opinion. And then we have another cybersecurity executive who's also going to weigh in on that.

And I think it'll be a great conversation. It'll be nice to kind of recap what we did, but it'll be great to just dig into if we knew what we know now, would we have done things different, right? There's always that nice retroactive after action.

There is. I'm a firm believer in fate, knowing things happen for a reason. Of course.

And you know what? Name me one technology where we decided maybe we should go slow, right? It's always full speed ahead- Yeah ...

damn the torpedoes. And so it is what it is, and I think we've got to get our heads around it. I think the issue is governance is always there.

Governance is always a requisite. " Right. Analysis paralysis.

Right. " Your CEO's not. Certainly not.

The bad guys certainly aren't. They could care less. They want you to do that.

Your customers are not. Right. Put on your big boy pants and let's rock and roll.

Yeah. I don't know if you'll say that up on the stage, but if you do, just give me credit. I will.

Happy to. It would be nice if I heard you say that. But seriously, this is the issue.

At the same time, I really think when it comes to governance, we are kind of making it up as we go. Yes. I think the interesting part is there's an opportunity because technology is changing so quick.

Uh-huh. That we have an opportunity to also transform the traditional governance models that we use. Got you.

The frameworks are great, and they're emerging and changing and evolving with the technology, but we can't take what we've been doing and think that it's going to be applicable because then when you try to take the paper governance and the expectations we have for people- You got to be able to manage the expectations ... and try to turn it into a technology control, it's like, well, these two things are not, there's a horse of a different color. Well, I was going to say, one was written for a horse and buggy era, and one is self-driving Tesla cars.

100%. Right? So I think a lot of that, there's an opportunity to go back and rethink maybe how we've been doing it.

It might not be wholesale transformation, but I think in a lot of cases it is, especially for larger, older, mature organizations. I think you're going to see two paths. One is this evolutionary route where it's not wholesale changes, it's small steps.

Yep. Incrementalism. Yep.

Right? But I don't think we've seen the killer AppSec of AI yet, right? No.

There's still time. Or the killer uses of it. We're dealing with toddlers now.

Right. I do think some organizations are going to skip the incrementalism and go right to revolution, right? Instead of building on top, they're going to tear up the paper and- Start over ...

and build something for today and tomorrow. Yeah. They'll be met with skepticism.

" But like I said, we've never stopped innovating. We've never stopped pushing. 100%.

Yeah, we said we were never going to do cloud in many organizations, right? Like that was- Same as last week ... obvious that we had so many conversations.

Well, because of cloud security, that's what's stopping us. And I remember early days- Anyone ever stops for security, but go ahead. Yeah.

" Well, you bought Salesforce. Well, that's a SaaS application. All the SaaS.

You know? Or you're running VMware. Yeah.

Right? What's different here? It's not elastic enough for you?

Okay. Right. I think that was kind of the aha moment on the business side where they realized that what they were actually doing was adopting it.

And in many cases, we could go back to the analogy of when we were building resilience into our data centers, we leveraged organizations like Sungard. It's like, this is like a Sungard, but this is just operating all the time. Agreed.

It's independent of us. It has all of our data. And it's smarter.

Yeah, and it's smarter. We're not relying on people with big tubs of manuals that we had to go- Back in the day. Yeah ...

stand up a VPN in four or 14 hours to get your RPO and RTO right. Yes. Good days, those were.

Yes. Anyway, Nathan, I want to first of all welcome to Qualys. Thank you.

As I said in the beginning, I hope you'll be a regular here on Techstrong TV. I'd love it. It's been a great conversation.

Always is, usually. Hey man. Good luck.

Good luck this afternoon on your panel. Thank you. Appreciate it.

All right, Nathan Smolenski. Yeah, you got it. CISO here at Qualys.

We're on live at Techstrong TV. We'll be back in just a minute.