Fewer than 200 people make up the entire cybersecurity program at Intercontinental Exchange (ICE), the company behind the New York Stock Exchange. Within it, an eight-person red team runs more than 100 campaigns a year, and about 30 AppSec practitioners support roughly 3,000 developers. Ryan Hebert, Head of Information Security Assurance at ICE, walked through how those numbers work on the AI Native Cybersecurity Podcast.
The show is hosted by Shahar Peled, co-founder and CEO of Terra Security, and the conversation centered on how AI can amplify a small, highly skilled team rather than replace it. Hebert oversees GRC, AppSec, and the red team across about 80 business units, giving him a clear view of where automation adds value and where human judgment remains essential. His answers offer a practical model for any security organization trying to do more with a focused group of specialists.
Running Lean by Design
Hebert takes pride in the program’s size. “We’re a really small shop,” he said, adding that he is proud of running the entire company’s cybersecurity with fewer than 200 people. He credits the lean structure to a security-first culture that dates to ICE’s founding, where offense-minded leadership plans ahead rather than reacting to each new budget cycle. That culture, combined with consistent support from senior leadership, lets a compact team focus on the risks that matter most to the business instead of spreading itself thin.
Eight Red Teamers, 100-Plus Campaigns
The red team’s workload is substantial. “I have a really strong red team, but it’s eight people in a cloud of dust,” Hebert said. With more than 100 campaigns a year, he saw continuous agentic testing as a natural supplement. It learns from ICE’s source code, runs continuously, and reinforces both the bug bounty program and the team’s broader strategy. Peled framed the goal well: “Let’s not replace them. Let’s just make sure every second of their time deals with the mission critical stuff that we can’t yet leverage with AI.”
AI That Amplifies the Team
Hebert describes AI’s impact plainly. “From a cybersecurity perspective, it is definitely a force multiplier,” he said. It also creates more findings to triage, which is why skilled people remain at the center. ICE’s internal team builds harnesses and microagents that direct the AI toward chaining attack vectors. AppSec and red team specialists bring institutional knowledge, the GRC team scores residual risk, and automation specialists connect findings to show how a real attack path could unfold. Each validation step, Hebert noted, helps the team “build the harness to make the model better anyway.”
The 100-to-One Ratio
With one AppSec practitioner for every 100 developers, discipline is essential. Hebert explained that any finding raised as critical, whether from an analyst’s pen test or an autonomous agent, must reflect a clear understanding of the controls that could mitigate it. When a finding truly warrants it, the team goes all hands on deck. The alternative erodes credibility quickly. “If you’re constantly lobbying raw CVE scores as critical over the fence to development, you lose the room,” he said. Careful curation has built lasting trust between ICE’s CTO and CISO.
Context as the Multiplier’s Fuel
Hebert sees context as the ingredient that makes AI testing valuable: knowing where every source repository lives, what each application does, and what configuration requirements apply. Continuous testing trained on source code supplies much of that context automatically, freeing the human team to focus on validating and scoring. Peled agreed that sending every theoretical vulnerability to developers wastes trust and resources, since the vast majority are not exploitable. The real value, he said, lies in pinpointing the issues that are exploitable and carry genuine business impact.
Small Team, High Morale
The lean model also benefits the people in it. Hebert said a small, capable team earns him the budget and freedom to request tokens for building new applications, including tools aimed at automatic remediation. It also keeps the team supported, focused, and able to enjoy life outside work. His philosophy on retention is simple and personal, shaped by the support he has received throughout his 17 years at ICE. “Our people don’t leave jobs, they leave leadership,” he said, and his team’s strong retention rate reflects that approach.
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.