Matthew Browning is an information security, GRC, and data privacy executive whose cybersecurity career has spanned more than 15 years across consulting, financial services, and high-growth technology.
Browning began his security career as a Senior Security Engineer and PCI Qualified Security Assessor (QSA) in Dallas, before joining Gemserv in London as a Principal Security Consultant. He then spent more than six years at Direct Line Group, where his roles included Head of Third Party Oversight and Head of Cyber Oversight, before leading security at Feeld as Director of Security.
Today, Browning is Director and Fractional CISO at Annansec, where he advises boards and senior leadership on cyber maturity, regulatory exposure and third-party risk.
Expert Insights spoke to Browning as part of our ongoing series interviewing cybersecurity professionals to bring you their unique insights into cybersecurity today, the challenges they are facing, and the realities of what it takes to defend complex global environments.
To kick things off, could you tell us a bit about yourself and your journey into cybersecurity?
My journey into cybersecurity is an interesting one. I started out in the cinema industry as director of technology, building up cinema companies in the early days of technology, when cybersecurity wasn’t at the forefront of thinking.
Toward the end of my time there, I was working with a really good security group and saw the new wave of security, regulation, and data privacy coming in, so I moved into the cybersecurity sector.
I built a career in consulting and PCI compliance. I ultimately moved into leadership roles at Direct Line Group and then Feeld. Finally, seeing the need in the virtual or fractional CISO world, I started my own company at the beginning of this year.
You’re currently Director and Fractional CISO at Annansec. For organizations weighing up a fractional CISO against a full-time hire, when does the fractional model work best?
There are a couple of places where it works really well. One is the startup and scale-up world, where you’re not yet in a position to justify a full-time hire. Your investors are looking to you to build the business with a product-first focus, but having a security voice in the room early, just as you would for operations or IT, makes perfect sense as you build and scale.
It equally makes sense for small to mid-market organizations going through a transformation, whether that’s a pending sale, growth, or an acquisition. They may already have an IT manager or a security analyst doing the day-to-day operations, but that person doesn’t have the skill set or depth of knowledge to step up into a strategic view and look holistically across the organization.
As a fractional CISO, you’ve carried out rapid cyber maturity assessments for boards and senior leadership. When you walk into an organization for the first time, what do you look at first to understand its real security posture?
The first thing, and it’s really telling, is talking to leadership across the organization to understand their knowledge, buy-in, and focus around security: what it means to the organization and how it materializes in the group. You can learn a lot from those conversations about whether they’re bought in, whether they’re invested, and whether they understand their obligations. Then I talk to the delivery teams at the coal face about what they’re struggling with.
At Feeld, you led security for a platform built around relationships, where the threats to users can include romance scams and sextortion. What did that teach you about protecting customers, not just the business, and what can other security leaders take from it?
I’ve always delivered security programs with this in mind. Protecting the business is ultimately one of the goals we’re here for, but especially in an organization like Feeld, and even at Direct Line Group, you have to think about the potential real-world harms that could come if there’s a gap in our mandate to protect customer data.
You’re creating a safe space for people to come and find connections, so you want to make sure you’re doing everything you can to follow through on the trust your members give you.
You can look at historical data breaches at large retail organizations or telecom groups where they’ve broken that trust, and the consumer base quickly comes right back. They’re very forgiving. In an environment like Feeld, or any online dating app, there’s so much trust built in. That’s basically the contract you enter into with your customer, so it’s much more impactful if it’s broken.
Feeld users also share some of the most personal information there is (their sexuality, relationship preferences and private messages). How does protecting data that sensitive change the way you approach security, and what should other organizations holding sensitive personal data learn from it?
With the obligation to protect that sensitive data comes a greater focus on the internal control landscape. What protections do you have to prevent insider threats, and to let the business operate on a just-in-time basis, only seeing the information needed to serve a particular customer or business need?
Many organizations are fairly open with customer and business information, and where the data isn’t as personal or sensitive as Feeld’s, that may be fine. But in an organization like Feeld, or anybody holding highly sensitive personal information, you really have to be on top of your game, limiting access to that data to only the systems, services and people that need to know it, for only as long as they need to know it.
It’s also about being transparent with users about what’s happening with their data, so they have confidence that they understand it and keep a level of control and autonomy over what they’re sharing and how it’s being shared.
Third-party risk has been a thread through your career, including four years as Head of Third-Party Oversight at Direct Line Group. What do most organizations still get wrong about managing supplier risk?
Oh, we could be here for hours on that one. There are a couple of big things. One is not doing ongoing oversight and assurance of your supply chain, not just the initial due diligence. The other is not understanding how supply chain risk spreads throughout the ecosystem. Very few organizations really understand how interconnected their supply chain is, and what dependencies they have not just on their third parties, but on fourth or fifth parties.
That matters even more today, with how fast a Software-as-a-Service (SaaS) company can spring up with AI and rapid development cycles. You can bring on a relatively young vendor with a very long-tail supply chain behind the service you’re getting, and without going through a proper depth of assessment, that can lead to some unfortunate circumstances.
You describe your leadership philosophy as “positioning cybersecurity as a business enabler, rather than merely a control function.” What does that look like in practice, particularly when you’re presenting risk to the board or investors?
It comes down to working with the organization to understand its objectives and values and what the business is trying to achieve, then engaging with them on their terms, and engaging early, so you can bake security in and work through the challenges collaboratively. From a risk perspective, that means helping the organization understand the outcomes of a risk assessment and then guiding them on the options: we can do option A or option B, and here’s what each could cost.
The key is translating security risk into business terms, like financial cost, operational expense, and efficiency, rather than saying “you have to put a control in because a regulation says so”, or that we can’t do something because it’ll break one of our core security obligations.
That’s been one of the keys to being successful in this new era. As a CISO, your ecosystem used to be the CIO and CTO, with a technology operations and delivery focus. Over the last few years, that has evolved dramatically. I now spend more time with legal, risk, compliance, and finance teams, speaking their language and partnering with them. That does two things. It makes sure you understand what the business is actually trying to deliver, and it gives you the insight to reframe how you speak to senior leadership and the board, so the messaging is cohesive. There’s nothing worse than presenting a pack to the board that’s full of risk matrices but doesn’t tie into financial responsibility and how you’re meeting the bottom line.
We’ve become more of a business-focused discipline than a technology-focused one, and it will take time for people to work through that education cycle. But one of the guardrails is that you still have to have a technical understanding. I liken our profession to a General Practitioner (GP): you need that breadth of knowledge to diagnose problems, troubleshoot and work through them. We’re not yet at the point where you can come into the role without the technical understanding to call out when one of the tech teams is doing something it shouldn’t.
You’ve said you aim to promote “practical, secure AI applications.” What does good AI governance look like for organizations adopting AI today?
One part is understanding what you’re trying to achieve with AI. Why are you bringing it into the business? Where will it be useful? And how are you enabling teams to experiment and learn to use it safely?
You can’t go in strictly controlling it, because it’ll come in through the back door, and shadow AI adoption is the worst-case scenario. You need clear operational guidelines and working groups across the business that say, “We’re looking to adopt AI. How can we use it to solve the problems you’re facing?”
You also need to keep humans in the loop on any critical execution paths an AI might take. You don’t want AI agents or systems operating independently on high-value or high-risk transactions. One interesting example was a financial system that brought in an AI solution to handle accounts payable. The AI could look at an invoice, categorize it, and make the payment through to the vendor.
During testing, when a malicious vendor came in, the payment went straight through without any control. The automation had bypassed the internal process that required multiple approvals, including from the CFO, on high-value transactions. Oops. That’s what I mean by AI governance: in critical processes, don’t break your controls just because you’ve put in AI or automation.
What’s the biggest challenge or threat keeping you up at night right now?
It’s twofold. The first is that we’re in a hyper-adoption phase of AI, with businesses using it to optimize workflows and processes and displace parts of the human workforce. As I mentioned, that automation can remove the necessary step of pausing before a decision is made.
The second is the flip side of that. AI absolutely can help accelerate and automate the business. I’m a huge fan of that, with the right controls. But because it’s so good at automating our processes, it’s equally useful for automating threat actors’ processes. How do we close the window between a threat actor attacking a business and us discovering it, reacting, and blocking it? That’s a huge challenge, and something that keeps me constantly on edge.
We’ve moved away from the days of a creative, talented individual sitting around playing, taking three to six months to develop an exploit. Now, as soon as a vulnerability is discovered, it’s weaponized within hours. Even three to six months ago, you only had access to the foundational models from Anthropic, OpenAI, and Google. Now, with the proliferation of open-weight models and hardware becoming much more accessible, threat actors can stand up their own unregulated, uncontrolled models. It’s outstanding how quickly they can leverage those tools.
How do you see the CISO role evolving over the next few years?
Part of that evolution has already started, with the move into a business-facing role. What I see is almost two parallel tracks: the business CISO and the technical CISO. In certain organizations, you’ll have to be that singular person wearing both hats, but we’re already seeing the rise of the business CISO, or BISO, in some organizations, and I think that will continue.
In large enterprises, the BISO will work in tandem with the CISO to relieve the pressure, sitting within the CISO’s structure and facing off to the business, almost like a business consultant and analyst supporting the CISO’s mandate. I know a couple of groups that work that way today. But it’s a role for mature businesses. I don’t think we’ll see organizations deciding to hire either a CISO or a BISO. A BISO only makes sense in a large, mature organization.
We’ll also see more fractional work, and the use of fractional CISOs becoming more legitimized, just as fractional CIO and CFO roles are already well established. The need is there, with both the pace of AI-driven threat actors and a rapidly growing regulatory framework, which isn’t going to stop. Things are only moving faster.
Finally, what advice would you give to CISOs who are early in their careers or just stepping into the role for the first time?
Don’t panic and make sure you’re carrying your towel. That’s a Hitchhiker’s Guide to the Galaxy reference.
But in all seriousness, there are two things. First, be pragmatic and flexible. Something I coach all the time is that just because a security standard, policy, or procedure is in place today doesn’t mean that’s the way it has to be done. Look to the outcomes and objectives you’re trying to achieve.
Second, observe first. Make judgments once you have the full picture, or as much of it as you can, and engage with the wider business. One of the stumbling blocks for early-career CISOs is staying in their silo: “I’m security,” or “I’m in the CIO or CTO’s org.” It doesn’t matter what your reporting line is.
Your mission is to protect the organization from a security perspective, and sometimes from a privacy, risk, and governance perspective too. So, you have to engage with the wider business and be fearless in your challenge. You’re there to hold the business accountable.
