Writing an AI policy is one thing. Turning it into controls, reviews, and decisions that teams actually use is another. The five cyber leaders below, in the United Kingdom, Germany, Italy, Spain, and Norway, are doing that work in different ways: building standards and tools, taking on new mandates, contributing to industry guidance, and bringing legal, risk, and technology teams to the same table.
Vivek Marwah – Director, AIML Security, GSK
Vivek Marwah built an AI agent to help his colleagues assess AI risk. As director of AI and machine learning security at GSK since April 2025, he designed a Copilot agent grounded in a year of reviewer feedback and playbook guidance, so project teams can prepare stronger risk assessments and expert reviewers can focus on judgment and higher-risk decisions. It sits alongside the enterprise-wide AI Controls Standard he led, informed by the NIST AI Risk Management Framework, OWASP guidance, and the EU AI Act, and since rolled out through governance, risk, and assurance processes. He also coordinates AI threat modeling and adversarial testing, including red teaming, and helps define security requirements for AI platforms, agents, and connectors, covering identity and access, data protection, and prompt injection. He came to the role from five years as an audit manager at GSK, where he reviewed AI and machine learning systems, after a career in IT risk and security that began in 1999 at Ranbaxy in India and took in HSBC, Visa, LCH, and Ford.
Romeo Ayemele Djeujo – Group Head of Secure Data & AI Transformation, ZEISS Group
“Not by slowing innovation down. But by making trust, security and responsibility part of how innovation scales.” That is how Dr. Romeo Ayemele Djeujo described his new mandate when he took over as head of secure data and AI transformation for the ZEISS Group globally in August 2026. The role builds on nearly eight years leading cybersecurity at ZEISS, including building its global business information security organization, during which his remit expanded into AI governance and responsible AI, the security of generative and agentic AI, and readiness for post-quantum cryptography. His path into security began in research. After starting as a network engineer in Cameroon, he earned a PhD in electrical engineering and information technology at the University of Siegen, working on applied cryptography and compressive sensing, with research stays at the University of Arizona. He then worked as an information security architect at Daimler TSS on car IT and autonomous driving infrastructure before joining ZEISS.
Andrea Succi – Group CISO, Ferrari Group
Andrea Succi works for the Ferrari that moves high-value goods, not the one that builds cars. As Group CISO of Ferrari Group, the high-value logistics business, since November 2023, he has described a “counterintelligence mindset” for anticipating sophisticated attacks. He is also one of the most active voices on AI security in Italy. In 2023 he founded CISOs4AI, a collective of security leaders focused on AI, and has contributed to the OWASP Top 10 for Large Language Model Applications and its security and governance checklist. More recently, he has written about accountability and evidence when AI agents cause harm. Before Ferrari Group, he was head of global cybersecurity at Amplifon and spent five years at Deloitte, where he worked on automotive cybersecurity. He co-chairs Evanta’s Italy CISO community and runs cybersecurity workshops in secondary schools.
Ángel Pérez Beumala – CISO, Autopistas
What controls and accountability does agentic AI require? Ángel Pérez Beumala has been working on that question as co-director of the artificial intelligence working group at ISMS Forum, Spain’s information security association, where he presented the group’s guidance on agentic AI security at its III AI & Cyber Security Forum. His day job brings the critical infrastructure perspective. As CISO of Autopistas, an Abertis company, since 2011, he leads information security and resilience, including business continuity and crisis management, and sits on the company’s digital transformation committee. He also teaches in master’s programs at the University of Barcelona and UPC School, covering cybersecurity for essential services and AI. His career began as a developer in 1987, and before security he led organizational integration projects across the Abertis group.
Antonio Martiradonna – CISO, Orkla ASA
How do legal, risk, security, data, and product teams turn AI governance principles into real decisions and oversight? Antonio Martiradonna joined a panel on exactly that question at the Global Cyber Conference in September 2026. It reflects the cross-functional nature of his role at Orkla, where he has led information security for most of the past decade, as CISO from 2017 to 2023, then as SVP of information security at Orkla IT, and as CISO again since June 2024. His focus is governance, risk, and compliance, aligning security strategy with business objectives. Before Orkla, he spent years in advisory roles at KPMG Norway, EY, and DNV, after early work in Italy as a security consultant and service desk manager. He works across four languages: Italian, Norwegian, Spanish, and English.
Five Ways In
Marwah built a standard and an AI agent to support it. Djeujo took on a mandate dedicated to secure data and AI. Succi built a community and contributed to industry guidance, Pérez Beumala helped produce guidance on agentic AI security, and Martiradonna works on the cross-functional decisions that governance depends on. Each has found a different way to make secure AI adoption practical.
Discover more CISOs securing their organizations:
-
- Everyday Services, Secured: The Adriatic and Western Balkans CISOs to Watch
- One Strategy, Many Flags: Europe’s Cyber Leaders Securing Across Borders and Brands
- Policies, Payments and Boardrooms: CISOs to Watch in European Finance
- Securing Science: Europe’s Research Infrastructure Cyber Leaders to Watch
- North America’s Cyber Leaders With a Wider Mandate
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.