In this episode of Shift to AI presented by Cycode, host Roland Cloutier sits down with Stephen Ward - former CISO, board member, and cybersecurity investor - to unpack what it takes to lead security through the AI generation, and what most leaders are getting wrong about their own legacy.

Stephen has sat in every seat at the table: as an operational CISO rebuilding programs under pressure, as a board member seeing security from the other side of the table, and now as an investor watching the market decide what gets built next. He and Roland dig into what boards actually expect from security leaders that most CISOs still aren't delivering, why storytelling and executive presence now matter as much as technical depth, and why the best leaders are the ones building successors who can replace them - not protecting their own seat.

This isn't a conversation about tools or technology. It's about the leadership system every security executive needs to be building right now, before the next shift arrives.

If you're a security leader thinking about your own legacy - or how to build the next generation of leaders under you - this one's for you.

Alex brings a rare vantage point: defending one of the critical infrastructure systems the U.S. economy runs on, where the stakes go far beyond a single company. He and Roland dig into why vulnerability management is buckling under AI-driven speed, and what it actually takes to secure a software supply chain that now includes models, agents, and prompts as first-class risks.

If you're rethinking how your organization defends critical infrastructure in the age of agentic AI, this one's for you.

*This episode was recorded live at Black Hat USA 2026, so expect some background noise from the event

In this episode of Shift to AI, host Roland Cloutier sits down with Bret Arsenault, CVP, CISO Emeritus and Global Chief Security Advisor at Microsoft, to unpack what happens when the perimeter moves from the app and the endpoint to the software factory itself: prompts, pipelines, MCP servers, and non-human identities.

Together they ask a question every security leader is now facing: what does AppSec actually mean when the entity writing, reviewing, and committing code isn't human? And what does it take to secure a software development lifecycle that never sleeps?

A candid, practitioner-level conversation on the future of application security, software supply chain risk, and agentic development - from two of the industry's most experienced security voices.

🎧 Listen now, and subscribe to Shift to AI for unfiltered conversations with the world's leading CISOs on the shift to agentic security.