CybersecurityCIO Pulse

Security a Moving Target CIO Talk Network

CIO Talk Network
CIO Talk Network•Mar 18, 2026

Why It Matters

Security spend directly impacts profit margins; proactive, integrated protection lets firms safeguard revenue while staying agile in a rapidly evolving threat landscape.

Key Takeaways

  • •Security spending balances risk reduction against cost efficiency.
  • •Retail shrinkage benchmark shows 1.5% revenue loss acceptable.
  • •New tech adoption outpaces security, requiring proactive “Security 3.0”.
  • •Enterprises must embed security early without stifling innovation.
  • •Risk assessments prioritize critical assets amid inevitable attack probability.

Summary

The CIO Talk Radio episode frames security as a moving target, emphasizing that organizations must constantly balance the cost of protection against the inevitability of threats. Guest Bethar draws on three decades of experience, comparing modern cyber‑risk to the retail industry’s long‑standing shrinkage problem, where firms accept roughly 1.5% of revenue loss and spend a similar percentage to mitigate it. Key insights include the concept of “Security 3.0,” which urges companies to anticipate security needs alongside emerging technologies rather than reacting after deployment. Real‑world examples—Google’s acquisition of Postini, Microsoft’s delayed Windows security, and enterprises adopting Skype for cost savings—illustrate how security can be both an enabler and a constraint. Bethar stresses that risk is certain (e.g., every internet‑connected system will face attacks), so budgeting must reflect both due‑diligence controls and prioritized investments based on business impact. Notable quotes underscore the analogy to insurance: just as homeowners buy roofs against inevitable rain, firms must allocate security spend against predictable threats. The discussion of retail shrinkage, the TJX breach, and the consumerization of IT highlights how cost‑benefit calculations drive security decisions, and how tools like network access control or virtualization can reconcile user flexibility with protection. The implication for leaders is clear: embed security early in the innovation cycle, use quantitative risk assessments to justify spend, and treat security spend as a strategic cost of doing business rather than an afterthought. Companies that master this balance can protect revenue, maintain customer trust, and sustain competitive advantage.

Original Description

Technology innovation often evolves faster than security frameworks can keep up. As organizations adopt technologies such as virtualization, service-oriented architectures (SOA), and Web 2.0 platforms, new vulnerabilities emerge before security practices fully mature."
In this CIO Talk Network conversation, Sanjog Aul, speaks with John Pescatore, Vice President and Research Fellow at Gartner Research, about why enterprise security must constantly adapt in an environment where technology innovation is always in motion.
The discussion examines how organizations can protect systems and data when architectures, platforms, and digital ecosystems continue to evolve. Rather than relying solely on traditional defenses, enterprises must build adaptive security strategies that manage risk proactively while enabling innovation.
John shares research insights and practical recommendations on how CIOs, CISOs, and enterprise leaders can rethink security in a world where technology is constantly changing.
Topics Covered
00:00 Introduction and welcome
02:05 Why enterprise security is a moving target
05:30 Impact of new technologies on security strategies
09:15 Virtualization and emerging infrastructure vulnerabilities
14:40 Security challenges in service-oriented architectures (SOA)
19:10 Web 2.0 and expanding enterprise attack surfaces
24:50 Why traditional perimeter security is no longer enough
30:20 Managing risk while enabling innovation
36:05 Building adaptive and resilient security frameworks
41:30 Leadership responsibilities in enterprise security
47:10 Practical recommendations for CIOs and CISOs
52:10 Future outlook for enterprise cybersecurity
55:00 Closing thoughts
Watch More CIO Talk Network Conversations
Watch on Vimeo
About CIO Talk Network
CIO Talk Network (CTN) is a global, peer-led platform where enterprise leaders think out loud about technology leadership, innovation, governance, and transformation. Through conversations with CIOs, CISOs, CDOs, and industry experts, CTN explores practical insights, leadership perspectives, and real-world experiences shaping the future of enterprise technology.
#CyberSecurity #EnterpriseSecurity #InformationSecurity #CIOLeadership
#CISOLeadership #TechnologyLeadership #CyberRisk #SecurityStrategy #DigitalTransformation
#CIOTalkNetwork
Connect with us on:
Don’t forget to like, share, and subscribe for more insightful discussions.
In this CIO Talk Network conversation, Seth Starr joins to discuss "security as a moving target," providing insights into the evolving landscape of cybersecurity. The program addresses customer requirements, innovation, and the historical perception of information security. This discussion aims to help organizations navigate cyber threats and strengthen their cyber defense strategies.

Comments

Want to join the conversation?

Loading comments...