Rory has been brought into companies whose cyber governance was failing, with systemic, company-wide problems, in the hope that he could solve it.
“Getting to a very commercial perspective that drives the right culture change is what makes the technical bit happen,” says Rory Alsop, CISO at Volue.
Rory, now CISO at energy technology company Volue, has spent 26 years in security. Over that time he has seen what goes wrong inside security programs, and what it takes to put them right.
He came to the role by a technology heavy route. He started out in network administration, found himself implementing security configurations on mid-range computers and, as he describes it, “falling” into his first lead security role when Ernst & Young set out to build a security team in Scotland using his skill set.
He spent ten years supporting security for banks around central Scotland, a financial services hub. He then left to run his own consultancy, was involved in setting up a security practice for PwC, and took on full-time roles at RBS and HSBC. Then he spent four years with Tesco Bank, leaving to join Volue shortly after the Barclays merger.
Along this road, Rory has learned a lot about the realities of the cyber risk landscape.
Lesson one: The fix isn’t always technical
When Rory went into those failing companies, he expected a technical job. “My initial view was that I’d go in, help implement better controls, and it would be straightforward.”
This prediction proved wrong, because the senior leaders weren’t prioritizing spending money on improving controls. The drivers at senior level “weren’t resilience or sustainability. They were generally short-term profit and market share, and those priorities filter down to everyone below.”
One company Rory was engaged by to check its technical security controls and confirm it held up under attack. The technical controls were excellent. But when he sent people into the building, they could access sensitive areas, and even pick things up and walk out with them.
The fix for that client took only a small part of the remediation budget: a better front door, lanyards, a sign-in process, and no unescorted guests.
“Your person on the ground might want to do the right thing, but if their boss says, ‘No, you’re focusing here,’ that’s what they’ll do.”
At another company, identifying what was broken was the first obstacle to overcome, as there had previously been demotions or firings for admitting failure. Understandably, people were uncomfortable sharing what went wrong, but nothing could be fixed until they did.
Rory’s answer was to normalize vulnerability so others would feel more comfortable around him. Once they were talking, he could take what they said to leadership without naming anyone and say “Here are all the failures. We’re not going to pin them on individuals. It’s processes that have failed. How do we fix that?”
Rory also recommended that security and resilience be written into bonus structures for leadership. “It’s a very blunt instrument, but it works. If a senior leader has a metric around resilience, risk management and risk ownership, they will do it, because their take-home package depends on it.”
“It’s all about the people at the end of the day.”
Lesson two: Communication is key
Rory’s starting point is that cyber risk belongs to the business. The security team’s job is to set out the available controls and what they cost. The business decides how much risk it can carry.
“If the business wants them, great. If not, that’s a business decision, on record with that business leader, even if it’s against the security team’s guidance.”
Boards already do it for everything else. “Executive leadership and boards already understand all the other risks they take, operational, financial, and non-financial. Cyber is the only one that’s a bit complicated because it’s so dynamic. So, to make it easy for them, treat it the same as all the others.”
That only works if the CISO explains the risk in terms a board recognizes. “If you miss that business language, you won’t get taken seriously at leadership level. Boards understand profit, ARR, and so on, not technical detail.”
And it has to be short. “Around 2008, I went into a board meeting with a 15-minute pack and got told I had about 90 seconds.” Rory describes himself as not ‘naturally succinct”, so this was a challenge, but over time he has honed the skill of getting the info he needs to share down to the required time slot.
Lesson three: How to hire the best team
People coming into cybersecurity careers often have their own special interests. “If you really enjoyed penetration testing at university, you might think security is penetration testing. But it’s a million things.”
Because the field is that broad, the first thing Rory looks for is curiosity and the ability to communicate, neither of which is a security specific skill. Some of his best hires have come from non-technical backgrounds: biology and music degrees, no degree at all, and a former branch manager.
“Security isn’t a niche. It’s something everybody needs to be able to do.”
Rory does not believe a CISO necessarily needs deep technical knowledge to be successful. “You definitely can be effective without it, and a better skill set is being able to hire good people you can trust in the areas you need.”
It’s more important to always keep learning. “You always need to want to learn, especially now, with everything changing so quickly with AI. If you’re not learning and updating how you think, you’ll sit in a rut.”
Lesson four: Assume breach
In 2021, before Rory joined, Volue was hit by a ransomware attack. It required a substantial rebuild, so is treated as a significant learning exercise.
What the company does now is practice: crisis exercises, testing recovery time and resilience controls, and Chaos Monkey activities where somebody turns something off to see what happens.
AI will only accelerate this. “AI removes time. It’s an accelerator for everything. Patch schedules have gone from months to weeks to days to minutes for some attacks.”
His team runs AI models internally to help identify vulnerabilities, and the output is significantly greater than scanning tools before AI. The same is true on the attacker’s side, and not only for those with a lot of resource. “AI makes it available to anybody. You can ask Claude or ChatGPT to write you an attack schedule and go off and do it.”
This why his approach is based on the assumption that something, eventually, will get through. In the NIST framework it shifts away from solely focusing on the Identify, Protect and Detect functions, and towards Respond and Recover.
Every process that fails gets added to the playbook. “Unless you practice, you don’t really know.”
