The conference room at Dubai’s Hilton Towers, now empty, still held name placards of key businesses from the region. The chairs were pushed back and the coffee cups cleared away. Only a few pens and folded agendas remained, reminders of the executives who had filled the space hours before.
In retrospect, the setting was perfect to reflect on a conversation with Rich Seiersen, Chief Risk Technology Officer at Qualys. Seiersen had just concluded a workshop with Qualys’ customers, and it was unlike a typical vendor session filled with slides and jargon.
It was designed to prompt senior executives and CISOs to step back, question their assumptions and consider security in terms of risk and resilience, rather than focusing on endless lists of threats. When asked how he thinks about cybersecurity, he shared a line that summed up his approach: “If your metric doesn’t change a decision, stop collecting it.”
Direct, unembellished and entirely characteristic of Seiersen.
From accidental beginnings to engineering
In his second stint as the Chief Risk Technology Officer at Qualys, Seiersen explained that his career in technology, like most things in life, was unplanned. While studying for his master’s degree in California more than three decades ago, he landed an internship at a company that handled HR for startups. The General Counsel, “a bit of a nerd,” introduced him to open-source software.
“I didn’t have a background in it, but I got hooked,” he recalled. “Linux, Apache, MySQL, PHP – I became one of the few people who knew it. One of our portfolio companies needed a developer and I landed the job after an interview. From there, it just kept going.”
By 2004, he was working at Qualys as an engineer. Cut to nearly two decades later, when CEO Sumedh Thakar asked him to return as part of a new push to reposition the company around risk. “He said, ‘Rich, we’re going to become a cyber-risk management company. Do you want to be part of it?’ It felt like coming back to the same house by a different road.”
Building, not just guarding
What kept him in the industry was not just career security but the chance to create. “I’ve always been a builder,” he said. “At first it was code, then it was teams, then organisations. What motivated me was making things that actually worked.”
At Kaiser Permanente, where he ran security operations across the United States, he saw the limits of traditional approaches. “We had endless reports and numbers,” he said. “You’d run a scan and get hundreds of millions of vulnerabilities. We were drowning in noise. So what do you do? You can’t fix everything. You have to focus on what matters to the business.”
This shift, from trying to solve everything to focusing on what is most material, remains crucial for CISOs today. With expanding attack surfaces, the ability to prioritise is often the difference between being constantly reactive and steering a clear strategy.
Change, speed and asymmetry
Seiersen had watched the industry adapt through Y2K, the dot-com crash, the rise of cloud computing, the pandemic and now Artificial Intelligence. “AI is not a hobby,” he said.
“Between US$500 billion and a trillion has been invested in it. It enables more people to build faster, which is beneficial for business, but also increases the attack surface. The pattern is the same as the Internet and cloud, but the pace is faster.”
What did not change was the imbalance. “Businesses follow rules. Attackers don’t. That tilts the field. If you try to secure everything, you’ll be weak everywhere. The goal isn’t invulnerability. It’s resilience.”
For today’s CISOs, that reminder is critical. The temptation to chase every new threat is constant, especially with AI accelerating both innovation and exploitation. But as Seiersen stressed, survival depends on narrowing focus to what truly matters.
The boardroom shift
Boards once saw cyber as background noise. That was beginning to shift. “I’ve had board members ask me for the list of metrics they should have,” he said. “It’s a good question, but also risky if it isn’t tied to business outcomes. You can chase numbers all day and never affect your mission.”
He pointed to the NACD’s 2023 Cyber-Risk Handbook as a significant milestone. “It was basically an ode to risk quantification,” he said. “It told board members: think in dollars and cents. That’s a big change.”
For CISOs, this evolution is significant. It means boards are finally starting to value cybersecurity in business terms, which opens the door for more constructive conversations – but it also raises the stakes, since vague reports no longer satisfy directors expecting clarity on financial exposure.
Moneyball for CISOs
To explain the challenge, Seiersen liked to use a baseball analogy from Moneyball. “Billy Beane didn’t ask, ‘Who are the best players?’. He asked, ‘How do we win with the budget we’ve got?’. That’s what CISOs need to do. The job isn’t to stop every breach. It’s to use resources wisely so the business can survive the losses that matter.”
Why it matters: CISOs rarely have unlimited budgets – thinking like Beane forces them to accept constraints and still deliver results. The discipline is not about perfection, but about being efficient enough to survive.
Learning in the room
His workshops made these ideas tangible. Rather than deliver lectures, he asked CISOs to map their organisations’ most critical processes and then identify what losses would be most damaging. The most telling moments often came in the Q&A.
“CISOs are some of the smartest people I meet,” he said. “But they’re under enormous pressure. What gives me hope is how open they are in those sessions. They admit where they’re struggling and they ask for better ways to explain risk to boards. That willingness to learn is the most important resource in the profession right now.”
Workshops matter because they give leaders a safe space to confront blind spots. In a field dominated by compliance and noise, honesty and the tools to act on it can change the way an organisation defends itself.
Advice for CISOs
Seiersen has kept his advice grounded. “Security is about promises,” he said. “It’s about making sure that even under attack, the business can keep its word to customers, employees and stakeholders. That’s what resilience means.”
When asked for advice to CISOs today, he didn’t hesitate. “Focus first on what your business stands to lose. Don’t waste your time trying to cover every threat. Losses will happen. Your job is to make sure they don’t break you.”
This advice matters because it reframes the role of the CISO: not as an enforcer of endless controls, but as a strategist whose job is to preserve Business Continuity under stress.
Learning as the constant
Looking back, he said the thread that ran through his career was learning, often through trial and error. “The reason I can stand in front of people is because I’ve already done the wrong things,” he said. “I’m not here because I’m smarter; I’ve just walked into the walls before. My job is to point them out before you get the bruises.”
For him, security was not about perfection. “Resilience is not just technical,” he said. “It’s the ability to take a punch, stand up and still deliver. That’s the job.”
The empty Hilton Towers conference room captured that message in its own way: the discussion was over, but the importance of it would carry into boardrooms and budgets. For Seiersen, that was the point. Workshops were not the end, but the beginning – a way of ensuring the lessons outlasted the tables, placards, and pens left behind.
As he put it: “Focus first on what the business stands to lose. You’ve been hired not to make the organisation invulnerable – that’s impossible – but to make it resilient. Even if you’ve got multiple attackers at once, your job is to help the business fulfil its obligations.”
