Spend vs. debt: what’s the bigger security risk?

With a career built at companies like Visa, Ellie May, and Blackhawk, Selim Aissi, a 2026 CSO hall of fame inductee, understands how boards and executives demand a clear justification for cyber security investment, especially considering today’s difficult economic climate.But getting security leaders to communicate tech debt, operational fragility, and long-term cyber risk in business terms the board can actually act on isn’t always straightforward.

A lot of organizations add tools, and more platforms and controls in response to new threats. Yet that doesn’t necessarily address underlying complexities. Security investment can actually increase operational and strategic risk.

“I think there’s a tipping point once a reasonable depth of defense is in place,” he says. “When there’s a reasonable level of automation of security controls and cross integration of security tools, anything beyond that could potentially be overspend and could potentially add risk to the entire organization.”

So the challenge is to know when an environment exists and functions without the need for a sudden budget spike.

“All of the KRIs and KPIs in place should be able to indicate the level of resiliency,” he adds, “in addition to other controls such as making sure there are processes that would allow for detection of, let’s say, API abuse, cloud-level abuse, and, increasingly these days, AI as it adds yet another threat vector.”

Understanding risk also lies in recognizing the distinction between organizations that are genuinely resilient, and those that appear mature on paper, focused on fine-tuning policies, compliance, governance, and frameworks.

“These are all important but they shouldn’t be the main focus,” he says. “The first step is knowing where the data is and once in transit, how it needs to be protected with the most updated protocols.”

Aissi expands on how organizations unintentionally create risk through tool sprawl and operational complexity, how boards should think about long-term cyber resilience, and why AI and cloud expansion are accelerating security debt faster than many enterprises can manage. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

On resiliency: A security organization that’s mature — and I’ve seen many and have built several — is one that’s architecturally designed to be resilient. But resiliency means different things to different people. To me it means that recoverability is tested often, making sure that in case of an event or breach case of lateral movement, the company can react according to a very clear playbook that’s been thoroughly tested. I also think a resilient organization is one that has the right controls of the right places, and one that also has metrics around them that indicate if there’s an event, and how well the tools work.

An area which I’m really passionate about is data protection. But how do you know the data is protected? A resilient organization doesn’t look at whether the data is encrypted at rest or not. It looks at the entire lifecycle of that PII. Meaning the organization has a very clear discovery mechanism to know exactly where the data is. It could be on laptops, servers, or in a public cloud. It could be in many different places, and it can be structured or unstructured.

On organizational risk: My definition of security debt is the accumulation of risk because of investment in areas where complexity is added, where a lack of automation is exaggerated, and where there’s overcompensation for some controls that aren’t needed. So if an organization spends money without effectively simplifying security controls, and automating more than what needs to be automated, that is tech debt.

Most commonly, tech debt in security is defined as the accumulation of vulnerabilities that aren’t patched, the over complexity of identity exposure management (IEM), and a lack of understanding of where data is. So most significant organizations, especially in fintech, have a huge volume and velocity of PII, and in health tech, PHI and security debt is not knowing where all the data is, or that it’s potentially not protected in some areas. So in addition to the data itself, IEM, and lack of automation and overlaying security tools are other forms of tech debt.

On managing board expectations: The board really wants to understand the risk of cyber security investment, and anything else could potentially be perceived as noise. I see many CISOs taking metrics upon metrics, and dashboards upon dashboards of all sorts of variations of vulnerability management. But what the board really cares about is what the risk is to the business if the most critical systems aren’t patched. Anything else could be perceived as not a concern or a business risk.

CISOs should speak in terms of impact of any real or perceived threat on the business, and be specific. So going back to vulnerability management, let’s say there’s a zero day that was patched or maybe multiple ones that were patched. How do you explain that to the board? You say we patched five zero day vulnerabilities. And honestly, the reaction is probably, who cares. The story should sound like these five vulnerabilities if unpatched, could have put certain systems down for three days, or it would’ve been much easier for an adversary to attack this revenue generating system. That’s what the board cares about, the impact on the revenue. And that’s how CISOs need to speak to them.

On AI: Security didn’t get a seat from the beginning when it comes to AI. So how do we explain to the board that developers might start sharing the company’s source code with Claude and it could potentially leak? This is something we’re all trying to figure out. But we should start speaking from a business perspective about the benefit of AI to the security organization, to the security tooling, to security operations, how it could be more efficient and effective, and at the same time, highlighting some of the risks to the organization — not theoretical risks, but risk related to the organization. If it’s a financial institution and AI agents are deployed in some transactional application, I think the CISO should speak to the board about the business risk of not deploying the necessary security tools to ensure that those AI agents don’t go rogue, that the LLMs are protected. So those are the business terms we need to be speaking about.