 just weeks away, we caught up with Timothy Youngblood, CISO in Residence at Astrix Security and former CISO at McDonald's and T-Mobile, to discuss today's most pressing cybersecurity challenges. Don’t miss the chance to hear more from Timothy and other industry leaders—

A. I started my career as a developer and then transitioned from development into Local Area Network (LAN) and Wide Area Network (WAN) deployments, meaning I helped organizations ensure seamless communication between localized resources and geographically dispersed locations.

I advanced into leadership roles by delivering successful IT projects. This opened the door to joining a Big 4 consulting firm, where I led formal audit assessments, security reviews, and controls. Through this role I worked with 40 – 50 organizations per year and became very passionate about safeguarding organizations. After moving back into operations focused on security, I became the first Chief Information Security Officer (CISO) of Dell Inc. where my program won many industry awards. I was also on the Dell patent committee assessing new technology for the company.

Innovation has been at the forefront of my career as I took on CISO/CSO roles at Kimberly Clark Corporation, McDonald's and T-Mobile. To this day, I am extremely passionate about empowering organizations to safeguard their assets and drive sustainable growth.

Q. Your upcoming session in Diligent's 2025 cyber risk summit will cover emerging threats. How have the types of cyber risks shifted over the past few years, and what trends do you think will define the next decade in cybersecurity? 

A. Interestingly, despite how technology has evolved, many of the same issues that plagued cybersecurity 10 years ago are still significant problems today. Think about the source of most data breaches today — there is still a lack of patching, poor passwords, and misconfigurations. Now enterprises have moved to the cloud, and we're still dealing with those same problems.

The difference is these risks are now intensified due to exposed generative AI large language models (LLMs), the emergence of non-human identities and vulnerable data models that leave organizations exposed to breaches or data corruption. In the future, these trends will persist and evolve with increasing automation, leading to more agent-based ecosystems that make decisions and choices traditionally made by humans.

Q. AI is both a powerful tool and a potential vulnerability in cybersecurity. How do you see AI transforming the threat landscape, and how can organizations leverage AI to strengthen their defenses? 

A. At this stage artificial intelligence (AI) remains a passive tool in security, primarily serving as an assistant in research. There is great potential for it to be used as a more proactive tool, capable of self-healing vulnerabilities and exposures. Today, nearly every new security solution on the market has AI capabilities built into it, signaling the growing importance of AI in defense. 

Tools that can autonomously defend themselves are becoming increasingly feasible. At the same time, attackers will also automate attacks via AI, so the future will depend on who can develop the best models. To safeguard tomorrow's networks, entirely new skill sets will be required.

Q. How might emerging cyber regulations shape the architecture and priorities of enterprise cybersecurity stacks in the future?

A. Regulation has always been a step behind technology, and I don't see that changing anytime soon or in the future. It takes a major event to move the industry to change, like the Enron scandal did for audit requirements. If significant targeted supply chain attacks continue to impact global economies, swift changes will follow. Until that time, regulation will be incremental at best and depend on the political parties in power at the time. In the meantime, companies must remain proactive in their cyber defense strategies, driven by investor expectations, risk management, and the need to protect their reputation and bottom line.

Q. How can companies cultivate a culture of security that empowers employees to be proactive in defending against cyber threats?

A. Security leaders are pushing for more effective approaches in security awareness training. While traditional models and phishing studies have shown limited success, there is growing recognition that moving toward persona-based education is key. By understanding how individuals perform their roles and integrating security into their daily tasks, security can become a more natural part of their workflow. Additionally, adapting to the current generation's preferred way of consuming information—such as short, engaging, bite-sized content—can make a lasting impact.

Diligent Q&A – Timothy Youngblood on emerging cybersecurity threats, the future of AI in security, and the need for cybersecurity education reform 

This edition of the Diligent Minute, written by Amanda Carty, General Manager, Compliance at Diligent, highlights three compliance areas that have garnered board attention.

Diligent has the unique benefit of gathering insights from over 700,000 board members globally, as well as top executives from various industries. Our discussions have often focused on the evolving compliance landscape, driven by a shifting technological landscape and new regulations.

Boards have identified the following key compliance concerns for 2025:

Climate, environmental issues, and DE&I (diversity, equity and inclusion)

Supply chain management, anti-bribery measures and corruption prevention

Let's take a closer look at each of these areas.

Technological progress represents an area of opportunity for managing compliance risk. AI and data analytics enhance compliance processes by analyzing large datasets and identifying issues and potential vulnerabilities. Unified compliance platforms streamline operations, reduce redundancy and ensure consistency. These technologies improve efficiency and help organizations stay agile amid regulatory changes.

At the same time, that technology itself can increase cyber risk if not managed properly. And regulators are taking notice. Over 60 countries have passed or are in the process of considering over 

, often with global reach. At the same time, 

three quarters of knowledge workers are now using AI at work

, often without the knowledge or approval of employers.

Bitsight, a cybersecurity firm and Diligent partner, shared that key cyber vulnerabilities typically take months to remediate, often exceeding government deadlines.

How can boards help prepare their organizations?

Boards play a crucial role in preparing their organizations for potential data breaches or cyberattacks. They should set clear governance and oversight by establishing robust policies and ensuring regular reviews and updates.

Additionally, boards must foster a culture of cybersecurity awareness, educating both their own board members and their employees about the importance of data protection and the consequences of cyberthreats. Allocating adequate resources, including budget and personnel, is essential to support cybersecurity initiatives.

Boards should regularly monitor and assess the organization’s cybersecurity posture through audits, vulnerability assessments and penetration testing. They should also ensure that comprehensive and well-communicated incident response plans are in place, complete with measurable metrics and clear expectations around downtime costs and regulatory impacts, such as fines, penalties or risks to business licenses.

Lastly, staying informed about the latest threats and compliance standards by engaging with regulators and peers is vital.

Sustainability reporting has grown more rigorous and complex, a pattern anticipated to persist beyond 2025, particularly for major global corporations.

The EU has passed several pieces of broad compliance legislation with global implications. The 

Corporate Sustainability Due Diligence Directive (CSDDD)

 requires companies to manage risks related to human rights and the environment in their operations and supply chains. The 

Corporate Sustainability Reporting Directive (CSRD)

 requires new public reporting standards (ESRS) that range from pollution, water and emissions reductions to disclosures on labor, biodiversity and business conduct. And the EU Whistleblower Directive requires organizations to prove they are listening to and acting on relevant information as it comes in.

As sustainability reporting becomes more rigorous and complex, boards need to ensure their organizations are well-prepared to meet these challenges. Boards should ask leadership the following questions to ensure the right processes and checkpoints are in place:

Are legal, finance and HR leaders actively involved in setting and implementing sustainability objectives and strategies?

 Do we have the necessary technical expertise to address diverse topics such as climate models, supply chain complexities and the legal implications of regulatory updates?

 Are we prepared to meet the new public reporting standards (ESRS) required by the Corporate Sustainability Reporting Directive (CSRD)?

 How are we managing risks related to human rights and the environment in our operations and supply chains, as required by the Corporate Sustainability Due Diligence Directive (CSDDD)?

 How are we ensuring that we are listening to and acting on relevant information as required by the EU Whistleblower Directive?

Boards can create a competent, cross-functional reporting structure that has properly identified the most strategic themes and chosen proper metrics for measurement. Setting up a committee that reviews progress toward goals, targets and compliance deadlines is a good step forward.

Supply chain, anti-bribery and corruption

Governments are increasingly asking companies to publicly share how they are addressing risks to their supply chains, increasing reputational risks. At the same time, supply chain risks themselves are becoming more complex, as companies are including labor practices and environmental impact to traditional 

, and anti-money laundering due diligence.

Enforcement of anti-bribery and anti-corruption rules has been significant, with major fines in the UK and Switzerland for issues in Turkey and Ecuador. And new legislation continues to impact the compliance burden. Australia’s Combatting Foreign Bribery Act can hold companies not only responsible for the actions of their employees, but also their external contractors, agents and third-party affiliates.

What can boards do to address these types of risks?

Make sure there are clearly published policies and procedures to manage labor practices, supply chain and distribution channels — and that these policies are reviewed, updated and published on a regular schedule. Moreover, third-party affiliates should undergo the same ethics and compliance trainings as employees. Contractors should be held to some of the same standards laid out in codes of conduct.

 is continuously optimized around cyber and AI risk, third-party risk management, due diligence, greenhouse gas emissions, compliance and ethics training, and enterprise risk management to ensure companies can stay compliant and operate at an advantage in their markets.

Diligent

Blog

Diligent Q&A – Timothy Youngblood on emerging cybersecurity threats, the future of AI in security, and the need for cybersecurity education reform

Compliance concerns for boards in 2025

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

Diligent Q&A – Timothy Youngblood on emerging cybersecurity threats, the future of AI in security, and the need for cybersecurity education reform

Compliance concerns for boards in 2025

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company