Dr. Sybil Ingram, MBA, Ph.D., c/CISO

Prinicpal, Compliance & Risk

Let's Connect

“Evolve your security with speed & control so you can respond in a “when, not if” world.”

Dr. Ingram Responds to Key Questions

When executives ask, "How much security is enough?" -how do you answer that?

I answer that question with this question: What risks are you willing to take and where?

These questions can also help: How much is your intellectual property worth to you? How much do you value the reputation you’ve built for your company? How important is the trust that your customers and business partners have placed in you to keep their data secure?

The answer often aligns with industry frameworks like NIST’s five-function approach or risk tolerance levels defined in your business continuity planning

What's the biggest cybersecurity myth that's costing organizations money?

The biggest cybersecurity myth that’s costing organizations money is undervaluing continuing cybersecurity education for their staff. Cyber awareness that keeps pace with threats to the business consistently translates into positive return on investment (ROI).

What's the most expensive security mistake you've seen an organization make?

Leaving their shipping and delivery doors open and unsecured all day. Devices and collateral items went missing. When they conducted their asset inventory, many assets could not be found or accounted for. Physical security matters too.

This cost them tens of thousands in missing equipment plus audit findings that delayed their SOC 2 certification for months.

What's changed the most about cybersecurity since you started your career?

Without a doubt – the introduction and adoption of AI in an organization without conducting due diligence activities to assess the ROI as well as the risks.

Organizations are implementing AI tools without understanding data residency, model training on proprietary information, or compliance implications for regulated data like HIPAA or PCI.

What's the first thing you assess when you walk into a new client engagement?

The energy, the quality of the communication, and the level of cooperation between colleagues. This tells me a lot about an organization and it informs how I can help.

What do you wish every CEO understood about cybersecurity?

Cybersecurity isn’t a “one and done” exercise and it requires awareness and cooperation from everyone in the organization – all the way up to the CEO. Organizational leaders need to model the cyber aware behaviors they want others to engage in to protect systems, intellectual property, and customer data.

What do businesses and organizations need to know about AI?

AI will always require human oversight to confirm that the output is suitable for its intended purpose.

Think of AI as a powerful assistant that needs supervision – you wouldn’t let an intern send emails to your board without review. The same principle applies to AI outputs, whether it’s generating reports, making recommendations, or processing sensitive data.

What's the biggest AI mistake you're seeing organizations make right now?

The biggest AI mistake I’m seeing organizations make right now is believing that AI is the solution to all of their business challenges. It’s important to understand where AI can add the most value for an organization.

Meet More Team Members

The 2025 DBIR Paradoxes CISOs Need to Decode

The data tells a story that contradicts conventional wisdom about cybersecurity threats.

Verizon’s 2025 DBIR reveals surprising patterns:

System intrusions surged from 36% to 53%
Social engineering appeared to decline from 22% to 17%
These shifts reflect relative mathematical effects, not reduced threats

What’s really happening: Attackers are exploiting edge devices, chaining vulnerabilities, and using stolen credentials at unprecedented scale. The human element still drives roughly 60% of breaches through credential theft, password reuse, and misconfigurations.

What CISOs must do: Rebalance security roadmaps to address dual-front resilience—strengthening help desk defenses, accelerating patch cadence, and implementing zero-day monitoring alongside traditional awareness training.

What 2024 Taught Us About Cybercrime

2024 marked a decisive pivot in how attackers compromise organizations and the old playbook won’t cut it.

Key findings from FBI IC3, Verizon DBIR, and Mandiant M-Trends:

Stolen credentials: 31% of breaches
Vulnerability exploitation: Up 34% year-over-year
Third-party breaches: Doubled to 30% of incidents
Dwell time: Shortened to 11 days globally
Elder fraud: Victims 60+ lost $4.8 billion

The trust exploitation trifecta:

Human trust: Social engineering, fake recruiters, admin calls
Technical trust: SSO tokens, unpatched appliances
Institutional trust: Call center manipulation, crypto hype

What matters now: Supply chain compromises like Snowflake and MOVEit proved that vendor credential abuse creates enterprise-wide disasters. Organizations must align identity, vulnerability, and fraud strategies while treating resilience as a leadership challenge—not just a technical problem.

Why Your CISO Keeps Pushing for “SIEM” & “SOAR”

Your CISO isn’t padding the budget—they’re trying to keep you from becoming the next headline.

Why SIEM and SOAR matter to your business:

Without modern detection capabilities, organizations don’t discover breaches until operations go dark or their data appears for sale. Attackers typically dwell in systems for 11 days before detection, and without SIEM/SOAR, that extends to weeks or months.

The real cost comparison:

Upfront investment: Licensing, staffing, training
vs.
Cost of doing nothing:
Weeks offline
Millions in losses
Brand reputation damage
Trust that’s nearly impossible to rebuild

What executives need to do now:

Ask your CISO how you’re detecting, not just defending
Fund the talent—tools are only as effective as the teams managing them
Demand metrics on detection speed, incident response times, and reduced impact
Start with SIEM, graduate to SOAR—visibility comes first, then automation

Bottom line: Firewalls won’t save you from compromised credentials or insider threats. SIEM and SOAR surface what traditional controls miss.

Message to Executives: AI Won’t Fix That

Your CISO is thinking “here we go again” when they hear about AI investments and they have good reasons.

Three critical security questions before you invest:

Data provenance: Is customer or employee data being used? Are proprietary or regulated sources protected?
Guardrails: Can AI systems be manipulated? What’s your rollback plan?
Governance: How are outputs stored, logged, and reused?

The reality check: Only 25% of companies see ROI from AI investments, often because they deploy without addressing data quality, volume, and relevance requirements.

Smart organizations assess whether their data infrastructure can support AI securely before procurement—ensuring security leaders are involved early rather than after contracts are signed or data is exposed.

AI is Only as Good as its Data

AI data poisoning is the emerging threat most organizations aren’t prepared for.

What it is: Adversaries intentionally introduce corrupt data into AI training or operational pipelines to manipulate model outputs and influence critical decisions in national defense, healthcare, and finance.

Essential defenses:

Data source validation with input sanitization
Version control for training datasets
Access restrictions to prevent tampering
Anomaly detection for unexpected model behavior
Continuous monitoring for performance degradation

Proactive security measures:

Conduct adversarial testing during AI development
Perform red-team exercises to find vulnerabilities
Use differential privacy techniques
Periodically retrain models with verified datasets

Bottom line: Organizations must implement multi-layered defenses and real-time monitoring before AI systems impact critical operations.

Leveraging the White House’s July 2025 AI Action Plan

The White House wants speed and innovation—but security can’t be an afterthought.

Three pillars with security implications:

Accelerating innovation: Deregulation paired with secure-by-design requirements
Building infrastructure: AI-ISAC for threat intelligence sharing
International diplomacy: Enhanced incident response capabilities

What organizations must do: Navigate the tension between rapid deployment and robust security controls. Focus on real-world risks around data protection, privacy, and operational resilience rather than hypothetical threats.

Strategic opportunities:

Engage with interagency initiatives for early threat intelligence access
Assess AI alignment with national priorities (energy, healthcare, manufacturing, defense)
Build secure infrastructure addressing identity management and third-party risk

Reality check: Companies in priority sectors may gain partnership opportunities while inviting heightened scrutiny. Security governance must support innovation rather than blocking progress.

Smarter Use of AI & Data for State Government Efficiency

State governments are racing to adopt AI—but security challenges threaten to derail modernization efforts.

The opportunity:

58% of states exploring efficiency initiatives
States like Florida, Texas, and Wisconsin now require agencies to leverage AI
Federal initiatives (AI Action Plan, OMB M-25-21) setting expectations for AI-enabled operations

The security reality:

State agencies face significant adoption barriers:

Legacy technology debt limits security capabilities
Cross-agency data silos prevent comprehensive threat visibility
Interconnected dependencies exist without shared resilience
Workforce gaps in AI risk management expertise

What organizations must provide: Help establish governance frameworks enabling secure innovation, implement anomaly detection for AI systems, address workforce readiness, and build capacity that survives administration transitions—all while meeting heightened public expectations for digital-first services.

CMMC Explainer

CMMC is no longer “coming soon”—it’s here, and prime contractors are already asking for proof.

What you need to know:

CMMC (Cybersecurity Maturity Model Certification) is the DoD’s framework for enforcing cybersecurity across 220,000 defense supply chain entities. Final rule became effective December 2024, with Phase 1 beginning September 2025.

Three certification levels:

Level 1: FCI with annual self-assessment
Level 2: CUI requiring third-party assessment
Level 3: Highly sensitive CUI with government-led evaluation

What prepared suppliers are doing RIGHT NOW:

Submitting SPRS scores tied to defensible documentation
Defining where CUI flows in their environments
Validating controls through internal dry-runs
Creating credible Plans of Action & Milestones (POA&M)
Getting leadership buy-in (not treating this as “the CISO’s job”)

Reality check: Prime contractors want SPRS scores, System Security Plans, and verifiable control documentation today—not when the RFP arrives.

How to Work With a CISO Who Always Says No

The “Department of No” isn’t a personality problem—it’s a system problem you can fix.

Why CISOs default to “no”:

Many security leaders were trained for rigor over agility, coming from IT infrastructure or GRC backgrounds. They learned to prevent loss rather than enable innovation. Their cautious behavior is often reinforced by cultures that punish security incidents but rarely reward calculated risk-taking.

How each executive can unlock better partnerships:

CEOs: Reposition security as a strategic lever providing insights that sharpen business decisions—not a final checkpoint.
CFOs: Work with CISOs to quantify risk in terms of loss prevention and cost avoidance instead of viewing security as sunk costs.
CIOs: Align risk appetite early before architecture decisions. Co-create governance so security scales with technology.
COOs: Request frictionless controls that flow with operations rather than blocking them.
CLOs: Ensure CISOs can map security practices to legal risk, not just compliance checklists.

The result: When executives lean in with these approaches, CISOs become strategic partners rather than gatekeepers blocking progress.

The 2025 DBIR Paradoxes CISOs Need to Decode

Attackers are using automation and AI to accelerate breaches and scale credential theft like never before.

The 2025 DBIR shows AI’s impact on attack evolution:

Automated vulnerability scanning drives the surge in system intrusions
AI-enhanced phishing has transformed impersonation attacks
Credential theft operations now run at enterprise scale

The modernization imperative: Organizations must counter AI-enhanced threats with stronger vulnerability intelligence, automated threat detection, and risk-tiered verification systems.

Bottom line: Technical controls must evolve at the same pace as attack automation. Security teams need to balance traditional human-focused defenses with advanced technical acceleration strategies.

What 2024 Taught Us About Cybercrime

Cloud and SaaS became critical blind spots in 2024, with attackers exploiting weak identity controls at scale.

The cloud vulnerability landscape:

39% of cloud intrusions began with phishing
35% involved credential theft paired with SSO abuse
Attackers used customer support calls to reset MFA
Virtual machines deployed for lateral movement

What organizations must do immediately:

Enforce MFA registration change alerts
Disable legacy authentication
Implement comprehensive SaaS logging
Strengthen support desk workflows

The convergence threat: AI-enhanced phishing combined with automated credential stuffing has created faster, more targeted attacks. Security programs must integrate human-centric and exploit-centric defenses, prioritize third-party risk visibility, and implement threat hunting mapped to MITRE ATT&CK.

Why Your CISO Keeps Pushing for “SIEM” & “SOAR”

You can’t stop what you can’t see—and most organizations are flying blind.

The visibility gap: SIEM and SOAR platforms transform scattered technical noise (user logins, network behavior, system alerts) into real-time visibility across your digital ecosystem. This early warning system detects when threat actors are already inside your network, moving laterally, escalating privileges, or quietly exfiltrating data.

The speed imperative: Attackers move faster than legacy processes or overworked analysts can respond. SIEM surfaces meaningful threats quickly, while SOAR automates response playbooks—isolating affected systems, resetting credentials, and notifying responders.

Speed translates to business outcomes:

Reduced dwell time = less damage
Faster containment = lower recovery costs
Proactive defense = stronger customer and stakeholder trust

The 11-day problem: Once attackers breach systems, it typically takes 11 days before organizations realize they’ve been compromised. Without modern detection capabilities, those 11 days often become weeks or months of undetected access.

Message to Executives: AI Won’t Fix That

AI success starts with business fundamentals, not technology trends.

The smart approach:

Start by evaluating your core offerings, target customers, and differentiation capabilities. AI adds value when it frees teams to focus on judgment, creativity, and relationships by automating repetitive, predictable workflows.

Apply this filter:

Is the outcome business-relevant?
Do you have quality data to support it?
Will this amplify your team’s impact?

The ROI leaders: Companies achieving $3.70 per dollar spent on AI do so by defining clear objectives, ensuring data readiness, starting with scalable use cases, and preparing for organizational change.

Bottom line: Strategic AI deployment supports people rather than replacing them, strengthening human connection while improving operational efficiency.

AI is Only as Good as its Data

Most AI failures happen before the technology is even deployed—because the data foundation is broken.

The three data requirements for AI success:

1. Volume
Most AI models need substantial historical data to learn patterns. Organizations with only dozens of records or limited timeframes will struggle to achieve meaningful results.

2. Quality
Duplicates, inconsistent labeling, and manual entry errors create “garbage in, garbage out” scenarios where AI hallucinates patterns or produces unreliable outputs.

3. Relevance
Even clean data must be the right data for your use case. Wanting to personalize customer emails but only having transaction history won’t work.

The smart approach: Work backward from desired outcomes to identify necessary data sources rather than forcing AI onto existing datasets. Assess your data infrastructure before making technology investments.

Leveraging the White House’s July 2025 AI Action Plan

America’s AI Action Plan reshapes the regulatory landscape—with major implications for compliance.

What changed:

Prior executive orders rescinded as barriers to innovation
NIST AI Risk Management Framework under revision
Funding redirected away from states with restrictive AI laws
OMB M-25-21 provides operational guidance for federal agencies

The global compliance challenge:
U.S. deregulation clashes with stricter international governance:

EU: AI Act with transparency requirements
Canada: AIDA legislation
Brazil: PL 2338/2023

What this means for business: Organizations operating globally must prepare for compliance friction. The Bipartisan House Task Force Report offers 66 findings and 89 recommendations guiding congressional action. Federal modernization around AI adoption, cross-agency data sharing, and digital-first services creates opportunities while introducing new expectations around transparency, accountability, and risk controls.

Leveraging the White House’s July 2025 AI Action Plan

The policy window for AI acceleration is open NOW—but strategic deployment requires more than speed.

Critical decisions business leaders face:

Where can AI evolve our operations?
How do we align ambition with fiscal reality?
Is our workforce ready for what’s next?
Are operations, data, security, and legal teams aligned?

What separates winners from the rest:

Secure the foundation:

Compute resources and infrastructure
Talent pipelines (the shortage is acute)
Identity, data protection, and third-party risk readiness

Build strategically:

Identify AI use cases tied to business outcomes
Protect intellectual property
Create cross-functional playbooks for AI risk and adoption
Engage CISOs and legal leaders early

Bottom line: Organizations that translate strategy into action while protecting mission-critical systems, design governance supporting innovation, and prepare teams for AI integration will achieve resilient and responsible deployment.

Smarter Use of AI & Data for State Government Efficiency

National AI initiatives are driving state modernization—but compliance complexity is exploding.

The compliance landscape:

Federal guidance is accelerating state AI adoption while creating new requirements:

White House AI Action Plan: Priorities for innovation and infrastructure
OMB M-25-21: Transparency requirements for federal agencies
Bipartisan House Task Force: 66 findings and 89 recommendations

State-level actions:

New Mexico, Oklahoma, Texas, Washington: Open access to interagency data systems
New data governance and security requirements
98% of households want modern online technology

Persistent challenges:

Regulatory overlap between federal and state mandates
Decentralized tech environments with inconsistent risk maturity
Political transitions that reset priorities
Pressure to match private sector experiences without equivalent funding

Reality check: Organizations must navigate complex compliance while helping agencies meet evolving obligations across fragmented systems.

Smarter Use of AI & Data for State Government Efficiency

State government modernization creates massive opportunities—if you can address the unique operational challenges.

The scale of the challenge:

80%+ of public-sector IT projects overrun schedules
Cost overruns 3x higher than private sector
93% of state CIOs prioritize recruiting and retaining qualified staff

Where organizations can add value:

Define and execute:

Clear AI use cases tied to measurable outcomes
Data readiness assessments (quality, interagency access)
Technical foundations for scaled deployment
Embedded leadership surviving administration changes

Transform constraints into advantages: Address budget cycles misaligned with continuous tech evolution, competing agency priorities overriding enterprise objectives, change resistance from embedded processes, talent retention where public compensation can’t compete with private offers, and complex vendor management.

Bottom line: Success requires accelerating AI adoption with governance frameworks enabling secure innovation while transforming resource constraints into strategic advantages.

Building a Culture of Social Engineering Awareness for Higher Ed.

Universities face a dual challenge: open access to enable research, learning, and knowledge-sharing and high-value data that attracts sophisticated attackers.

Recent attacks reveal the gap:

Harvard, Princeton, and UPenn suffered major phishing breaches in late 2025
Millions of donor, alumni, and student records were compromised
Attackers targeted advancement CRM systems and student information databases

The stakes are higher than perceived: One breach exposes entire donor pipelines, alumni networks, and student financial data to identity theft and fraud. Education ranks among the most-targeted industries, yet most institutions lack corporate-grade security capacity.

What leadership must address: Build social-engineering awareness across all user groups, strengthen incident reporting workflows, implement role-based training for high-risk staff, and deploy technical controls like MFA and email filtering. The human element drives 60% of breaches.

Rising DRAM Prices Are Silently Reshaping Cybersecurity

1. This Is a Visibility Problem.

Rising memory costs quietly reduce security visibility before organizations realize they’ve accepted more risk. The real impact is what teams stop collecting, detecting, and proving.

2. Security Falls Behind AI by Default.

AI and data platforms are refreshed aggressively. Security infrastructure isn’t. That misalignment creates blind spots where new, high-risk workloads run faster than the controls meant to protect them.

3. Cloud Offload Expands Risk Even When Nothing Changes.

Pushing logs to cloud providers to avoid hardware costs often expands third-party and compliance exposure without updating scope, contracts, or evidence expectations. Risk grows quietly while responsibility stays internal.

4. The Real Decision Is Economic.

Organizations will pay either by designing for constrained visibility or by discovering gaps during incidents, audits, or insurance disputes. Treating memory as a security design constraint preserves detection, response, and provability without waiting for budgets to catch up.

What the FedRAMP RFCs Mean for Your Business

This Is a Time-Boxed Advantage

RFC-0023 temporarily removes the agency sponsorship requirement for Rev 5–ready providers — historically the biggest FedRAMP bottleneck
Translation: If you’re close and wait for perfect readiness, you miss the window.

Your Existing Compliance Work Can Compound

RFC-0022 creates a bridge between SOC 2, CMMC, and FedRAMP instead of treating them as silos.
Providers with mature SOC 2 or CMMC programs may leverage that work for temporary Level 1 validation.
The strategic question: Can one control and evidence strategy satisfy SOC 2, CMMC, and FedRAMP 20x at once?

Static Compliance Is Becoming a Liability

RFC-0024 signals the shift to machine-readable security packages, with a grace period ending in 2027.
Static SSPs, spreadsheets, and manual updates don’t scale.
Can your evidence be exported, reused, and validated?

This Is an Economic Decision

The real question is whether delaying federal readiness by 18–24 months costs more than accelerating now. Think about deal pipelines, partner eligibility, and revenue timing.