“In an environment like Feeld, or any online dating app, there’s so much trust built in. That’s basically the contract you enter into with your customer, so it’s much more impactful if it’s broken,” says Matthew Browning, Director and Fractional CISO at Annansec.
Matthew Browning has spent over 15 years in the security sector, working in various roles across consulting, financial services, and high-growth technology. He came to security sideways, starting out as a director of technology in the cinema industry, and led security at Feeld before starting Annansec at the beginning of 2026.
The contract with the customer
At Feeld, a dating platform used by over 1.5 million people every month and built around sexuality and relationships, users can be targeted by cybercriminals running highly personal relationship scams and sextortion. Browning says he has always built programs with that real-world harm in mind. “You’re creating a safe space for people to come and find connections, so you want to make sure you’re doing everything you can to follow through on the trust your members give you.”
Not every business experiences the same level of exposure. Browning has seen large retail organizations and telecom groups regain their clients’ trust relatively quickly, while noting that other industries and companies may not have the same room for error.
Data that personal moves the focus to internal controls. The standard he sets is “limiting access to that data to only the systems, services and people that need to know it, for only as long as they need to know it,” while being transparent with users about what’s happening with their data.
What keeps him up at night
Businesses are in a hyper-adoption phase of AI, Browning says, and “that automation can remove the necessary step of pausing before a decision is made.”
The flip side worries him just as much. “Because it’s so good at automating our processes, it’s equally useful for automating threat actors’ processes,” he says. Exploits that once took months to develop are now weaponized within hours, and with open-weight models, “threat actors can stand up their own unregulated, uncontrolled models.”
The supply chain is shifting too. “You can bring on a relatively young vendor with a very long-tail supply chain behind the service you’re getting,” he says, and very few organizations understand their dependencies on fourth or fifth parties.
Don’t break the control to install the automation
Browning wants security to be an enabler rather than a control, but AI is where that can become tricky. “You can’t go in strictly controlling it, because it’ll come in through the back door, and shadow AI adoption is the worst-case scenario.”
What works instead is asking teams what they want it for, through operational guidelines and working groups across the business.
He does, however, draw the line at high-value or high-risk transactions, which he feels no AI should be completing on its own. A human stays in the loop.
Browning describes one financial system that brought in an AI solution to handle accounts payable, where the AI could read an invoice, categorize it and pay the vendor. During testing a malicious vendor came in and the payment went straight through. The automation had routed around an internal process that required multiple approvals on high-value transactions, including the CFO’s.
“That’s what I mean by AI governance. In critical processes, don’t break your controls just because you’ve put in AI or automation.”
Get out of the silo
Browning’s advice for CISOs stepping into the role is to avoid staying in a silo. “It doesn’t matter what your reporting line is. “Browning’s approach begins with knowing the organization’s objectives and getting involved in the important conversations, before decisions are made. Once a risk assessment is done, his goal becomes to explain the possible choices, not simply give instructions. The business can do option A or option B, and here is what each one could cost.
Now that the conversations have changed, the people Browning has them with have also changed. “I now spend more time with legal, risk, compliance, and finance teams, speaking their language and partnering with them.” The payoff is a consistent message for the board. “There’s nothing worse than presenting a pack to the board that’s full of risk matrices but doesn’t tie into financial responsibility and how you’re meeting the bottom line.”
Browning still expects CISOs to have the technical know-how to diagnose a problem, not just put a price on it. He sees the job eventually splitting into “two parallel tracks: the business CISO and the technical CISO.” For large enterprises, that means a business information security officer, or BISO, sitting inside the CISO’s structure. For smaller companies, he expects the fractional CISO to become as established as fractional CIOs and CFOs already are.
Business CISO, technical CISO or fractional, the shape of the job keeps changing. What doesn’t change, Browning says, is the need to “engage with the wider business and be fearless in your challenge. You’re there to hold the business accountable.”
