Security budgets are rarely unlimited, and the pressure to show what they deliver keeps growing. Buying another product can feel like progress, but it doesn’t always make an organization safer. The five CISOs below have each thought hard about where security money should go: getting more out of tools already owned, framing risk so executives can act on it, building lasting relationships with vendors, and talking about security in the language of the business.
Kyle Bubp – Global CISO, Avid
“We’re not one tool away from making Avid more secure,” says Kyle Bubp. He first noticed the problem while leading a security practice for a technology reseller, where he saw companies keep buying products they never fully implemented, without a strategy or a way to measure their programs. That led him to co-found Savage Security, which helped organizations improve without defaulting to more technology, and was later acquired. As Global CISO of Avid since June 2025, he oversees both cybersecurity and enterprise IT, which he says lets his team make changes rather than just recommend them. His focus now is on systemic work: configuration management, stronger processes, and hardening against known standards. He compares buying another product to a fad diet; the harder, more effective work is the daily discipline. “There are a lot of things that don’t require a tool,” he says. “It’s just human work that has to be done.” When his team needed help with customer security questionnaires, he challenged a team member to build an internal AI-powered tool rather than buy another platform. A guitarist who used Avid’s Pro Tools long before joining the company, he also serves as a selectman for the Town of Littleton, Massachusetts.
Martin Holzworth – CISO, UnitingCare Queensland
“One of the biggest challenges for the CISO is to show value for money,” Martin Holzworth wrote in 2022, while he was a cybersecurity strategist at VMware. In the piece, he argued that fear-based requests for security budget erode a CISO’s credibility over time, and set out a different approach: educate the board and executives, have the board set the organization’s cyber risk appetite with a clear view of the year-on-year cost of reaching it, map business KPIs to the security capabilities that support them, and report on what security has achieved rather than only what it stopped. “Education immunizes angst,” he wrote. He had applied similar ideas as group CISO of Super Retail Group, where his responsibilities included board cyber risk appetite and board reporting. Since November 2023 he has been CISO of UnitingCare Queensland, leading cybersecurity across its hospitals, aged care, human services, and corporate operations. His career has also included leading cyber security for Fujitsu across Asia Pacific, directing EY’s cyber advisory team in Queensland, and serving as head of technology and CISO at Bank of Queensland.
Tyler Healy – CISO, DigitalOcean
At DigitalOcean, vulnerabilities have been framed as security debt. In 2024 the company published an account of its vulnerability management approach, built on a contextual view of security debt, which it began redesigning in 2022, connecting remediation work to executive reporting. Tyler Healy has led security at DigitalOcean through that period, joining in 2018 as director of security engineering and rising through head of security and VP of security to CISO in 2023. Healy describes the team’s mission as earning customers’ trust as a secure platform for the next generation of developers, and making security part of innovation for engineers and customers. A computer engineer by background, Healy worked in software engineering at Motorola and in security engineering and penetration testing for federal and defense programs at Booz Allen Hamilton, before spending more than five years in security strategy and risk at Accenture. Healy also advises Ansa Capital, pressure-testing cybersecurity ideas against real-world problems.
Billy Norwood – CISO, FFF Enterprises
Billy Norwood has been on both sides of the security purchase. Before becoming CISO of FFF Enterprises in 2020, he worked for security vendors and consultancies, ran his own fractional CISO firm, and served as CISO of security software company Apptega. That experience shapes how he buys. “If you’re good to your vendor, they’ll be good to you,” he said in a 2023 interview, explaining that strong vendor relationships bring early notice of roadmaps and price changes. He has also favored products that are easy to deploy and come with implementation support, to save his team’s time. To make the business case for security, he talks in terms of time saved: catching a vulnerability before production costs developers less than fixing it after. “I try to make sure security is known as the guardrails not the gates for the business,” he said. An MBA with a focus on entrepreneurship, he earlier designed the first wireless networks for Austin-Bergstrom and Seattle-Tacoma airports while at Wayport.
David Stirling – EVP & CISO, Zions Bancorporation
“Be business leaders first,” David Stirling has advised fellow CISOs. “Understand the P&L revenue generation, go to market, and long-term strategy of what you’re defending.” He knows the operational side of that equation well. Before becoming EVP and CISO of Zions Bancorporation in 2017, he ran the bank’s IT infrastructure, leading optimization efforts aimed at dramatic cost reduction and faster time to market, from moving mid-tier UNIX systems to hyperconverged Linux to adopting open source application stacks and optimizing data centers. Earlier, he led Zions’ enterprise architecture, project management, and financial management teams. Today he leads its information security and technology risk management functions. His career began in high-performance computing: at Brigham Young University, he managed supercomputing systems, including three clusters that made the Top500 list.
Spending With Purpose
The CISOs who make security budgets count tend to share a few habits. They push existing tools further before buying new ones, frame risk in terms executives already use, treat vendors as partners rather than one-off purchases, and report on what security delivers for the business, not just what it blocks. None of that requires a bigger budget, just a clearer view of where the money should go.
Discover more CISOs securing their organizations:
-
- Continuing the Mission: The Veteran CISOs to Watch
- When the Business Changes Shape: The Cyber Leaders Securing Deals, Splits and Growth
- Keeping Services Running: Canada’s Cyber Leaders to Watch
- Security Without Shutting the Door: The University CISOs to Watch
- Banking Without a Branch: Europe’s Digital Finance CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.