Nathan Smolenski is a cybersecurity executive and advisor whose career has spanned nearly three decades across financial services, insurance, executive search, and cybersecurity software.
Smolenski began his career in investment technology at SEI Investments before moving into operational risk and information security at Bank Julius Baer. He has since served as CISO at 21st Century Insurance (part of Farmers Insurance), Zurich North America, and Corvus Insurance, as Global CISO and CSO at Spencer Stuart, and as CISO at Cyera, alongside security strategy roles at New York Life and Netskope.
Today, Smolenski is SVP and CISO at Qualys, which he joined in July 2026. He also sits on the Cyber Security Program Advisory Board at Ithaca College, previously advised Rutgers University, and mentors at SixThirty CYBER.
Expert Insights spoke to Smolenski as part of our ongoing series interviewing cybersecurity professionals to bring you their unique insights into cybersecurity, the challenges they are facing, and the realities of what it takes to defend complex global environments.
To kick things off, could you tell us a bit about yourself and your journey into cybersecurity?
I’m Nathan Smolenski, CISO at Qualys. I started my career at SEI Investments, one of the largest administrators of mutual funds in the world, in a technology and business role, and very early on I found myself on the operational side of technology.
I then moved to New York City and worked for a few different companies, where risk management really stood out to me. Banks and finance companies had very well-established risk management programs, and I gravitated towards that.
Just after 9/11, I was Assistant Vice President of Operational Risk Management at Bank Julius Baer in New York, and through a reorganization I ended up underneath the Americas CISO. That’s what opened the door for me. Alongside my risk management responsibilities, I was given a lot of information security work, from building policy to audits and risk assessments, and that launched the career.
From there, it’s been a meandering road. I’ve worked for some really great big companies, like Zurich Insurance and Farmers Insurance, and around 2015 I took on a global CSO role at Spencer Stuart, focused on human security, physical security, and resilience for consultants traveling all over the world.
I moved out of big corporate and into the startup space almost 10 years ago, working at Netskope, then Cyera, and now Qualys. I enjoy being here more than the big corporate world, but I learned a tremendous amount over those years, and I don’t think I’d be here without them.
You joined Qualys as CISO in July. What drew you to the role, and what have your priorities been in the first few months?
Qualys is a brand that’s so well known in the space. We’ve been around for 25 years-ish, and everybody knows us for vulnerability management. From my very first CISO job until now, I’ve been a Qualys customer at almost every single company.
At Cyera, I had a deep relationship with Qualys because we were mutual customers. We were helping Qualys build better data security and data governance, and they were helping me build and structure our vulnerability management and risk management practice, including on the federal side, inside Cyera’s FedRAMP High boundary.
What attracted me most was, first, exposure to the leadership. I had opportunities to spend time with Sumedh Thakar, our CEO, while I was at Cyera. I didn’t realize I was kind of interviewing for the job when I was just meeting with him; I learned that later. He spent some time with me in my boardroom in New York, and at the time I thought, wow, that really wasn’t a CEO conversation. It felt like two practitioners talking about stuff, and that was very attractive.
When I had the chance to have further discussions, the biggest thing was meeting the other people and understanding that the leadership team here was very special. I’m a big people-focused leader, because at this point, if I’m doing all the technical, hands-on stuff, I’m probably not doing my executive role very well. Given what I’d done and the experiences I’d had, I thought I could bring a lot to the table here, have a broad remit and really support my peers on the team.
You have more than 20 years of experience across a full range of industries, including financial services, insurance, management consulting, executive search, managed services, and software. What security lessons have held true across all of them?
The one thing that sticks out is that the fundamentals are still very, very important, and we’re really bad at them.
We talk about AI as a turning point and change agent right now, but we’ve been here before with cloud. At first, every large organization said, “We’re not going to do cloud. We have data centers, why would we want to do that?” But when cloud did arrive, it exposed how bad we were at fundamentals, and if we didn’t fix them, those weaknesses were going to propagate everywhere else.
We’re in a very similar place now with this new accelerant, which is AI. If you have a broken identity problem inside your organization, it’s going to be exacerbated and the risk accelerated by AI, way more than cloud would have done when SaaS and IaaS became change agents.
So, whether it’s cloud or AI, the one thing that holds true is that you have to be really good at fundamentals, and not just from a process perspective, but thinking about how you innovate in that space. There’s not a lot of value in people doing all kinds of manual work if you can automate things, take some of those burdensome processes out of day-to-day operations, and allow people to do more interesting stuff.
There’s always going to be room for error. So cyber hygiene and fundamental security controls are critical now, and we have to rethink how they function in the world of AI.
If the fundamentals are so important, why do organizations keep falling short on them?
The challenge is how you balance being really good at those fundamentals with the challenges of staffing. When things were very manual in the past, it was always a question of having the staff to do it and weighing the risk of doing this versus not doing it.
A lot of the time, organizations just aren’t structured in a way that allows them to not only understand and operationalize what has to be done, but also communicate how bad it is that they’re not doing those things. Some organizations are aware of this and just choose to move forward without focusing on some of those things, or they focus on what they believe is the bare minimum to get by. But the pressure continues to mount in those scenarios, and it creates challenges for them from a business perspective.
AI is highlighting it again. It’s like a very bright flashlight in a dark room with lots of bugs. You’re like, oh, wow, there they are. We start to see them in a hyper-focused way, because you’ve now multiplied your staff with agents, and the agents do not have the ability to reason the way a human can. They’re going to do what they’ve been directed to do, regardless of what might be in the way. That has accelerated the reason why we need to focus on the fundamentals.
As for why it’s historically been a problem, there are a lot of reasons. Some people just say, “I’m not going to fund that,” because it doesn’t seem like something they need to do. There’s a disconnect between communicating the technical side of the risk and the business side of the risk, and that’s been a gap for a long time.
You’ve said that governance “can provide essential policy and direction for safe AI adoption, but it cannot physically stop the rising tide.” How much visibility do most CISOs have across the full lifecycle of AI deployment and use in their organizations, and what tends to catch them out when that visibility has gaps?
Visibility has been a problem for a lot of different reasons over the years, but now the gap is considerable. That’s very much evidenced if you go to RSA or Black Hat and see how many products are saying, “I can get you visibility into what the agent is doing,” or “I can understand intent.” That’s just a sign that there’s a gap. Even if it’s a niche gap compared to the products you already have, those niche gaps are growing as AI and innovation continue to accelerate.
I think a lot of CISOs would admit, “I have no idea what’s going on with all the agents.” Or they have a limited idea. They have an acceptable use policy that says you can only use these tools, they might have monitoring, and they might be able to respond to an event. They might have built some technology harnesses and other capabilities inside the organization to ring-fence agentic use cases. But that’s all cobbling things together. There’s no one unified way to do this consistently, and everybody’s trying to see what’s going to stick.
From a product perspective, I’ve looked at dozens and dozens of technologies in this space over the last couple of years, and honestly, so much of it is either vaporware, because they’re trying to generate interest to build a future product that will solve the problem, or it’s stuff you could probably vibe code on a weekend if you were inclined to solve a problem yourself. The market is saying the same thing we are: there are lots of issues, and we’re all trying to figure out which of these products is really going to stick and drive that outcome. We’ll start to see who rises to the top soon. Until then, it’s a big and very confusing space.
I also don’t think businesses really understood the risks initially, though they’re coming around to it. I remember sitting on a panel about AI at an event in Philadelphia a couple of years ago. One of the CIOs on the panel said their CEO had been invited by a very large technology company to sit down and talk about its new AI capabilities. While the CEO was there, they signed an agreement to move all of the company’s data from its existing platform onto this one and start using AI tools on it, without ever saying anything to anyone in the business, thinking it would be really exciting for them. Then the CIO came back, learned what had happened, and said, “You did what?”
To the CEO, it was, “Wow, I can accelerate my business and take advantage of all this scale and opportunity.” They were looking at it purely from a business perspective, without thinking about all the other stuff nobody really wants to think about. And that’s exactly how visibility gaps start.
Once AI tools are enabled across the business, how do you make that adoption sustainable?
When we enabled Claude at my last organization, we did it organization-wide, not in a silo, and we knew early on that building structure and sustainability into what the business wanted to do was going to be critical.
I remember the marketing team telling me, “We built something, but we don’t know what to do with it. It looks cool, and we’d love for the rest of the team to use it.” I asked the gentleman who created it where the source code was, and he said, “I don’t know. I have to ask Claude where the source code is.”
That’s exactly why we built a corporate DevOps function. Once someone has built something from their use cases, tested it and wants to share it with everybody, there needs to be a process for how that happens, with the orchestration behind it. Otherwise, you end up with somebody in a business function who built something on their laptop, everybody uses it for six months, then they leave the company and everything stops working, because nobody realized it was running locally on someone’s machine.
You’ve had broad exposure to internal and external boards and committees. What lessons have you learned about communicating security effectively at board level?
The first thing I learned was what not to do, and that’s probably the best lesson.
At a company I worked for, I went to a meeting to prepare for a board meeting with someone responsible for risk management who reported to me. We’d prepared, we’d talked with regional heads of different areas, and everybody had said, “Yes, this is great, go forward.” But we had this heat map that was hard to understand. It was lots of red, so it looked very negative. Presenting it without the right context, from a pure technical risk perspective, without flipping it upside down and saying, “Here’s the business risk, and here’s why the technical side needs to change,” totally derailed the meeting. We were basically told not to bring a heat map like that back again without being able to fully explain the business side of it.
It was a great lesson. We were speaking two totally different languages. You have to be able to translate a technical risk or decision into business context: how it stops, starts, accelerates or slows something down for the business. If the board says, “What happens if I don’t fund any of this?”, you have to be prepared to answer that. That’s the real business question, and it’s no different from any other risk, like a hurricane or an earthquake, that can be evaluated and managed. Really understanding your business is critical, because that’s what we’re here for.
I think CISOs generally do come into the role with that understanding now. How they execute on it is to be determined, but we’ve been talking about it for a long time, and the kinds of people taking on these roles are different now than 20 years ago, when they were purely technical roles, often filled by people promoted from IT leadership or pure risk management. Today’s role is really a blend of all of those backgrounds, technical, IT leadership, and risk management. You have to understand each of them without trying to be an expert in any one.
A lot of it is about how you build your team, with trusted advisors internally who can give you a different lens. It’s also about really engaging with your board, because if you don’t know your board, it’s really hard to present to them. Getting some level of personal relationship with them, at least understanding their backgrounds and what they care about, makes the conversation so much easier, because you know where not to go.
Not everyone has that access, but it’s worth trying. I had my first board meeting at Qualys on my third day, so I got thrown into the fire, but it was good, because I got to spend time with them at the meeting and over dinner afterwards. The next time I present to them, it’ll be a different conversation, because I already know what to expect.
You’ve served as an advisor to Rutgers University and Ithaca College on their cybersecurity programs. How do you see AI affecting skills and career development in security?
In those roles, it’s important to note that both are continuing education programs, not undergrad programs. They exist because there’s a need. Whether you’re a board member or a senior businessperson who’s never worked in any kind of technology practice and doesn’t have a deep understanding of technology or cyber risk, it’s a way to build baseline knowledge, because cyber is another business risk and business challenge.
As for the impact of AI, there are different opinions on whether cybersecurity has a talent shortage. I think it’s less about a talent shortage and more about talent utilization. AI provides an opportunity to eliminate a lot of operational mess and grinding, because you can enable teams with AI to do the repetitive work that invades the space of individuals trying to develop and learn. That lets you shift career development towards more strategic risk management and higher-order problem solving.
We spent a lot of time on this at Cyera. When I hired a security operations leader, we agreed that as a growing startup, we were never going to have a staff of 100 people. We had a really great program converting interns into analysts and engineers, and we needed to accelerate how long it took them to get up to speed. So, we looked at how we could use AI to automate a lot of the basic work in security operations.
Our security operations leader built a platform that pulled data from all of our various tools. Say an analyst was assigned a ticket to investigate a problem. Instead of logging into all these different tools or going to a SIEM and trying to work out what data belonged together, they could just ask questions through a generative AI layer. That allowed an analyst who understood the basic premise of their job, but maybe didn’t have broader experience, to do that first pass of incident response and determine what the fix might be, before moving it on to someone more senior.
The platform allowed us to take a group of very eager and hungry analysts coming right out of college and turn some of them into very successful engineers. Some of them have left, which is also a good thing in some ways, because it shows we built them up well enough to go and multiply their income.
What’s the best advice you’ve had from outside the security sector that changed the way you run security, and how did you put it into practice?
The big thing I learned a long time ago was to focus on listening, and to understand the challenges facing the people who deliver the work inside the business.
When I joined one company, the COO I reported to told me, “Don’t give me a 100-day plan. I don’t want to see that, because there’s no way you could know what you’d want to do in 100 days if you didn’t get out and talk to people.” So, I spent a lot of time traveling and meeting with everybody I could. Instead of doing it as a meet and greet, we built some process around it, so it was really an opportunity to do a hands-on business impact assessment and understand the business.
That was super valuable, and I’ve repeated that process in every role I’ve had since. It allows you to sit back, be the observer, and see things. Obviously, there are times where you think right away, “Oh my God, we’ve got to fix that,” but you leave them and keep moving. People tend to be very forthcoming when they hear you’re just there to listen. They’ll tell you all kinds of things you may or may not want to know, but it gives you real insight into where things are broken and why they aren’t working the way they should.
Then you can come back and say, “Here’s how I want to tackle all of this.” It gives context to the people who’ve been in the organization, because you went out and listened. You’re not coming in saying, “I don’t like this technology, I’m buying this one instead,” without being able to say why. It gives you the supporting evidence for the decisions you’ll make down the line.
How do you see the CISO role evolving over the next few years?
The role itself isn’t a predetermined path. The mandate we have is changing all the time, but how the role evolves is going to depend on how we lead right now. There’s an opportunity to build the right operational foundations: trying to solve some of these big, ugly problems around visibility, using AI to help us defend against AI, and all the things a lot of us talk about. We need to keep pushing that forward and help the future CISO evolve.
I think there’s an opportunity to become much more strategic architects of how businesses stay resilient, and that means trying to stay a step ahead of where the ship needs to turn, so you can start to go towards the proper waypoint for your business. If we don’t do that, we’re going to fail, because we’ll still be relying on the legacy playbook and how we’ve done things in the past.
For those of us who’ve been in the role for a long time, we can’t be sedentary. We need to keep evolving our learning. You must be a lifelong learner, and the re-education of old-school CISOs has to continue. We must stay curious and rethink how we’ve been doing things. If we do that, the role will evolve, and the next generation will look back and find something to build on, rather than just saying, “Look how bad everybody did.”
What I want to leave behind is, “Hey, there was some really innovative thinking here that helped set the foundation for the future,” as opposed to, “Boy, these guys all really sucked at what they did, because they did the same things over and over for 30 years.” We’ve learned a lot from where we’ve come from, but many of us are at a point where the handoff to a younger generation is happening, and that’s a good thing. It’s great to have fresh ideas and to take the learnings of the past without forgetting where we came from. But a lot of that is on us, to make sure we’re leading that transition, not just leaving it.
Finally, what advice would you give to CISOs who are early in their careers or just stepping into the role for the first time?
Having mentored a bunch of folks who’ve moved into these roles over the last few years, I think it’s less about your inherent technical knowledge, certifications, or understanding of a technology stack. Curiosity is an important factor: a commitment to learning exactly how a business generates value and what you’re protecting. That requires you to get deeper into things that maybe you don’t want to. Someone who’s been a developer all their life and rises to become a CISO must really get into why they were developing what they were and understand intimately the business they support.
Understanding how people work is another thing that maybe gets overlooked, and I think the focus on people is bigger now than ever before. With everything we’ve talked about with AI, it’s becoming harder to see the person behind the work. Everything starts to blend together. Ultimately, we have to realize there are humans in the loop, hopefully, directing and building a lot of these things.
People leadership is going to become even more critical. It already is, but it gets harder as more of the work runs through AI agents, and as the AI tools we interact with day to day start to feel very human. So, we must get better at connecting with the real people, because that’s what drives their development.
Curiosity, business knowledge, and people leadership are all going to be critical. The most valuable asset isn’t a tool or a framework; it’s using our curiosity to learn the most about our businesses, the challenges we face, and the people we work with, so we can push things forward.
