Guest:

Topics:

You mentioned that centralized security can't work anymore. Can you elaborate on the key changes—driven by cloud, SaaS, and AI—that have made this traditional model unsustainable for a modern organization?
Why do some persist at centralized, top down approach to security, despite that?
What do you mean by "Freedom, Responsibility and distributed security"?
Can you explain the difference between "centralized security" and what you define as "security with distributed ownership"? Is this the same "federated"?
In our conversation you mentioned "cloud and AI- native", what do you mean by this (especially "AI-native") and how is this changing your approach to security?
You introduce the concept of "Security as quality" suggesting that a security-unaware developer is essentially a bad software developer. How do you shift the culture and internal metrics to make security an inherent quality standard, rather than a separate, compliance-driven checklist?
You likened the central security team's new role to a "911 emergency service." Beyond incident response, what stays central no matter what, and how does the central team successfully influence the security posture of the entire organization without being directly responsible for the day-to-day work.

Resources:

EP262 Freedom, Responsibility, and the Federated Guardrails: A New Model for Modern Security

Cloud Security Podcast by Google