Rory Alsop is a cybersecurity executive whose career has spanned more than 25 years across consulting, financial services and, most recently, energy.
Rory spent nearly a decade at Ernst & Young, where he built a security team in Scotland, before founding two consultancies and building PwC’s information security service line in Scotland. He went on to hold senior security leadership roles at Royal Bank of Scotland, HSBC, and Tesco Bank.
Today, Rory holds the CISO role at energy technology company Volue and is the Deputy Chair of the Information Security Forum (ISF) Supervisory Board. He co-founded the BSides Scotland security conferences, served on the Scottish Government’s National Cyber Resilience Advisory Board, and chaired the Scottish branch of the Chartered Institute of Information Security (CIISec).
Expert Insights spoke to Rory as part of our ongoing series interviewing cybersecurity professionals to bring you their unique insights into cybersecurity, the challenges they are facing, and the realities of what it takes to defend complex global environments.
To kick things off, could you tell us a bit about yourself and your journey into cybersecurity?
I’ve been in cybersecurity for officially about 26 years now. I came up through a fairly standard technology route, through network administration and doing more and more with security configurations on mid-range computers back last century, and sort of accidentally fell into a lead security role when Ernst & Young wanted to build a security team in Scotland and figured I had the skill set to do it.
I spent 10 years with EY, mostly looking after security for banks. There were some energy companies, but it was largely financial services, as central Scotland is very much a financial services hub. I then left EY to run my own consultancy for a bit, helped PwC set up a security team, and went on to work full time at RBS and HSBC. Up until the end of last year, I was with Tesco Bank, but with the merger with Barclays, several roles weren’t really valid in the new world. So, I looked around and found this very interesting one with Volue, in a slightly different sector.
Energy infrastructure is increasingly in the crosshairs of nation-state actors. As someone who’s recently moved into the sector, what’s surprised you most about the security challenges in energy compared to financial services?
One of the big surprises is how little is different. Energy is still a target of nation-state actors, and yes, the outcomes are potentially different, but a lot of it is still around ransomware and getting the money.
The one difference is that in banking, we treat denial of service attacks as a fact of life. The worst case wasn’t really life threatening, so it was manageable. In the energy industry, the worst-case scenario very much is life threatening, so there’s more of a focus on physical and personal safety, and it’s something the industry does very well.
The energy industry has also always had resilience built in, because you need to know your power is still getting through, whatever happens. In financial services, there’s only really been a determined focus on resilience in the past 10 or so years. I think that comes from how security came into energy. For many years, generation was self-contained, and your security was a fence. Even once the internet started connecting things, the core robustness a power station needed was always there: maintenance schedules, and an understanding of where the failure modes were.
In financial services, security was more of a cost calculation. We budget against it the same way we budget against fraud, assuming there’ll be some amount each year. In power, oil and gas, it’s as close to zero tolerance as possible. It’s like the airline industry. Nobody budgets for 10 planes falling out of the sky a year. The only acceptable number is zero.
The energy industry’s maturity is increasing, and part of that is driven by regulatory pressure. Financial services have been regulated forever, but now there’s NIS2, the EU Cybersecurity Act and the Cyber Resilience Act, coming in to standardize things because everything is so much more interconnected. Some organizations see compliance as the end goal: get the tick in the box and you’re fine. My view is that compliance should be a by-product of doing security well, not the goal itself. If you do everything right, compliance comes out the other end.
A tick box is the cheapest approach, but it’s only cost effective in the short term. The real question is whether you’ve fixed the underlying problem and can monitor it, so you’re still okay next year when things get more challenging.
You describe yourself as a leader recognized for driving people-focused cultural shifts. What does that actually look like in practice, and how do you get an organization to genuinely change its attitude to cyber risk?
I never thought that would be what I’d do. I’m a self-professed geek, and all my hobbies are techie hobbies, so I’d always assumed I would make security and technology work better. But a couple of organizations employed me to fix fairly major problems with cyber governance. There were failures, they didn’t know at top level why they were happening, and the outcomes were very negative.
My initial view was that I’d go in, help implement better controls, and it would be easy. It turned out that, certainly for two of those organizations, the drivers at senior level weren’t resilience or sustainability. They were short-term profit and market share, and those priorities filter down to everyone below. Your person on the ground might want to do the right thing, but if their boss says, “No, you’re focusing here,” that’s what they’ll do.
At the first organization, the challenge was getting middle management and below to trust me enough to highlight their issues, in an environment where admitting any failure would previously have got them fired or demoted. There are fairly standard people practices that help, like showing vulnerability so others feel more comfortable around you. Once they trusted me, I could be a voice for them, without naming names, and say to leadership, “Here are all the failures. We’re not going to pin them on individuals. It’s processes that have failed. How do we fix that?”
Another simple fix is to speak to the remuneration committee to change senior leadership’s targets. It’s a very blunt instrument, but it works. If a senior leader has a metric around resilience, risk management and risk ownership, they will do it, because their take-home pay depends on it. Getting to a very commercial perspective that drives the right culture change is what makes the technical bit happen. It’s all about the people at the end of the day.
By the time I finished at that first organization, it was understood that cyber risks are owned by the business areas. They decide how much risk they want to take, and the security team works out what controls could be put in place and what they would cost. If the business wants them, great. If not, that’s a business decision, on record with that business leader, even if it’s against the security team’s guidance. Executive leadership and boards already understand all the other risks they take, operational, financial, and non-financial. Cyber is the only one that’s a bit complicated because it’s so dynamic. So, to make it easy for them, treat it the same as all the others. I didn’t think I’d enjoy the cultural people bit so much, but it turns out I really do.
If you miss that business language, you won’t get taken seriously at leadership level. Boards understand profit, ARR, and margin, not technical detail. Around 2008, I went into a board meeting with a 15-minute pack and got told I had about 90 seconds. You have to be able to speak their language very succinctly. As you can tell, I’m not necessarily succinct, but when it’s needed, I can knock it down to 20 seconds and tell them what I need from them.
You co-founded BSides Scotland, you chaired the Scottish CIISec branch for well over a decade, and you sat on the Scottish Government’s National Cyber Resilience Advisory Board. What’s the state of the cyber community in Scotland, and how has it evolved?
It’s actually pretty amazing. For a country our size, we’re punching well above our weight. A good chunk of that is probably down to central Scotland always having been a financial services core. Outside London, we’re the next one, and that’s meant sponsorship and money coming in, and a lot of people supported through their careers.
The universities have been great. When I was at Ernst & Young, I talked to some of them about their graduates, who had great skills but not much experience. They asked what we’d like in their syllabuses, and they changed them. Napier and Edinburgh University were absolutely on board, Abertay and Heriot-Watt followed suit very quickly, and Robert Gordon’s didn’t hesitate, because their aim is to produce graduates ready to go into the market.
The government has been a strong sponsor too. Scotland is a country of vast numbers of very small businesses, two to five people, alongside some very big ones. So how do you improve the security of Scotland PLC? Before I joined the Cyber Resilience Advisory Board, there was a push to offer Cyber Essentials vouchers to all suppliers to the Scottish Government, including councils and the wider public sector. Cyber Essentials isn’t the highest bar, but it gets everybody thinking about security, and once you’re on that journey, you want to progress.
Scotland also isn’t afraid to learn from similar countries. Estonia has done amazing things with its digital landscape. We know oil will eventually come to an end, and we’ve got renewables, tourism, and whisky, but from a technology perspective, we’re very well placed. Over this whole century, I’ve seen it grow from strength to strength.
You’ve mentored a lot of security professionals over the years. What do people get wrong most often about building a career in security?
When people are first starting out, they often see security from a very niche perspective. If you really enjoyed penetration testing at university, you might think security is penetration testing, but it’s a million things. Some of my greatest hiring successes have been people from pretty much any background: biology or music degrees, no degree at all, someone who’d worked as a branch manager. Security isn’t a niche. It’s something everybody needs to be able to do.
The key is being curious and able to communicate. They’re not security things at all, but without them, it’s very difficult to progress, because you always need to want to learn, especially now, with everything changing so quickly with AI. If you’re not learning and updating how you think, you’ll sit in a rut. I’ve seen people half my age come through and be amazing with this whole new direction.
Cyber isn’t just one little thing. It’s a whole family of things, ranging through risk, physical and personnel security, human security, and safety. There are aspects that are absolutely deep tech, and we’ll always need people there too. But diversity of backgrounds has given me real diversity of thought. It’s not just me looking at something from a pure tech perspective, but asking how it impacts someone sat in front of a screen in a small community center somewhere. It takes a bit of everyone to give you that rounded picture.
I had one client years ago with a very good head of security, who brought me in to do some confirmation penetration testing. After the first week, I said, “Your technical controls are brilliant, but I think I’ve found some issues. I’ll come back in a couple of weeks.” I managed to get a whole slew of people on the premises through different routes, and we picked things up and stole them. In the end, they used only a small amount of their remediation budget: a better front door, and a process that included wearing lanyards, being signed in and no unescorted guests. Really simple, basic hygiene, and it gave them far more security than improving their firewalls would have, because their technical controls were already perfect.
Your career spans deep technical security, including pentesting and incident response, as well as leadership and strategy. How important is that technical grounding for a CISO, and can you be effective without it?
You definitely can be effective without it, and a better skill set is being able to hire good people you can trust in the areas you need. But when you’re establishing yourself in a new company, being able to speak at any level gives people confidence that you know what you’re talking about. My technical teams know they can talk to me about very deep code, which is great, because half the company are developers. Equally, someone can talk to me about whether our data centers are in the right place to withstand flood or fire, and the board knows I understand that.
It helps and smooths the way, but it’s not critical. What is required is being able to take concepts from areas you’re less familiar with, ask the questions to get them articulated properly, and interpret them so you can summarize for senior leadership and understand where the highest risks are.
Alongside security, sustainability is one of the areas your keen to talk about. How do the two connect, and is it something CISOs should be thinking about?
I look at sustainability in two areas. One is sustainability as an organization: what are you doing for the community, and ideally for the world? I’m fairly green by background. I spent a happy summer on the Greenpeace ship, the Rainbow Warrior, so I’m very focused on environmental and community change. Volue is great for that, because it’s focused on helping the world become greener by being more intelligent about how we use different sources of energy.
The other is the link between short-term gain and sustainability. If you go for short-term gain, you’re typically doing it at the expense of something. If instead you accept slightly less profit now, but build more robustly for long-term success and involve your communities, it becomes cheaper to hire. People want to work for you, you get better retention, your staff typically put in more effort, and the community supports you more.
You can see the negative side in the US with AI data centers. Local communities are up in arms, which leads to pushback, higher costs and an increased need for defenses, because there’s sabotage going on. Those organizations are seen as going for short-term gain at the expense of people and communities.
What’s the biggest challenge or threat keeping you up at night right now, and how is AI changing the picture?
AI very much is changing the picture. The key challenge is full visibility of all the different attack vectors. In the old days, you had a big fence and your one server, and you could see everything that could be attacked. Nowadays, everything is pretty much virtual. You’re spinning up cloud services as needed, so it ebbs and flows with demand, and understanding how to protect that can be a challenge. The upside is you can update it very quickly. You don’t have to go around a number of servers with a CD like you used to.
Where you’re using microservices from third parties, it can be tricky to know what updates they’ve made, especially if they’re doing it live, so there’s always a risk of third-party dependencies being the route in for an attacker. Typically, you assess what those third parties have, which takes time, and then decide on your mitigation schedule.
AI removes time. It’s an accelerator for everything. Patch schedules have gone from months to weeks to days to minutes for some attacks. When Mythos and then Fable came out, we ran them internally to test, and you find a lot more things. The good side is that we can fix them, but attackers are going to be doing the same, and not just nation-state and large-scale attackers. AI makes it available to anybody. You can ask Claude or ChatGPT to write you an attack schedule and go off and do it.
So, we need to be very dynamic. I’m putting more emphasis not just on detect and protect, but on respond and recover, and assuming some attacks will get all the way through and take you out. Volue had a ransomware attack in 2021 that took out an awful lot of services and needed a big rebuild, and it learned from that, so I’m quite comfortable that we know what to do. We run crisis management exercises: if this fails, what’s our recovery time objective? Then I’m going to break this, and then I’m going to break this. Organizations that use Chaos Monkey activities, where you go around and turn something off to see what would happen, get huge value from it, because unless you practice, you don’t really know. Every time you find a process that didn’t work, you add it to your playbook.
Imagine something worse happens and your senior leadership are on holiday or on a plane somewhere. Does the number two have the playbook and the ability to work through it and still make everything work? If not, it can get very damaging very quickly. AI speeds all of that up, because we have to handle the immediate impact while reporting to regulators and customers, then rebuild. What are the minimum products we need up and running to continue to do business? That’s the area that keeps me awake at night.
How do you see the CISO role evolving over the next few years?
In the US, there’s far more legal and punitive impact on CISOs. It’s long been the case that the CISO gets blamed if something goes wrong, but now there’s more regulation that makes it explicit that you could go to prison for a security issue you should have known about.
If we haven’t written the guidance, held the organization to account and assigned ownership correctly, it’s basically our fault when something goes wrong. If we’ve done everything right and the business knows who owns which bits, it’s a much more nuanced conversation. So CISOs will have to be very active in assigning and communicating accountability and responsibility.
They’ll also need to use AI natively to keep up. If I’m honest, I can no longer read everything I want to. I’m an avid reader and like my morning coffee with all the documents and feeds, but I can’t keep up anymore, so I use AI to summarize them and highlight the three or four I need to know about. Especially because regulation is different in every single country, and we have to comply while our customers need to know what we do so they can comply too. That’s going to keep us busy.
I’d also like to think CISOs will be more accepted alongside CIOs, CTOs and the rest of the C-suite. In a lot of organizations, the CISO is still considered one level below. That doesn’t necessarily stop what you do, but sometimes you need to be able to say, “This is a veto,” or “This is what we have to do.” If you report up through a CIO, you might be told, “My focus is on getting these new functions out. Don’t announce this until next quarter.” That’s a bit of a conflict of interest.
CISOs are often held responsible for risk without always having the seniority to match. How do you avoid carrying all of that on your own shoulders?
I try to encourage people not to be precious about the role. Most of the risk is really taken by the areas that produce services, and they should own those decisions. A sales team wants a new function out as soon as possible. Security might want them to be more conservative, but what’s the opportunity cost of releasing six months late because security took too long? It’s like coaching startups through the security journey. If you put too much in too fast, they’ll never be a successful business. You can’t run a business at zero risk, because then it’s just not a business.
The burnout comes from taking it all on your own shoulders and not realizing it shouldn’t be there. There’s overtime and time pressure that can wear you down just because you’re tired. But if you can divest yourself of owning all those risks (because they should sit in various places in the business), you can focus on the ones that actually involve you.
When I talk to my mentees about handling load, I mention my wife, who used to be a cardiothoracic intensive care nurse. Some days she came home having worked with people who had died. My worst day at EY was nowhere near that bad, so even when I felt stressed, I could reframe it. Mostly, we’re sat behind a desk typing on a laptop. You obviously don’t let anything impact other people downstream, but you should be able to take a breath and walk around the garden for five minutes to settle yourself back down.
Finally, what advice would you give to CISOs who are early in their careers or just stepping into the role for the first time?
Learn as much as you can about things outside your core, including what people at senior level are going to be interested in. Years back, I went on an Institute of Directors course on skills for non-executive directors. I was by far the youngest there, and definitely not a non-exec director. I just wanted to understand what they would want. The instructors said they wished more people did that, because usually people only go when they’re already a director, and by then it’s way too late.
Think about where you want to get to and look at what those people do. I’ve volunteered on a number of not-for-profit boards, and they give you experience you’ll want later in your career. If you know what you’re asking when you’re on a board, you know what a board is likely to ask you in future.
Red team is also great fun when you’re young. Working out ways to break things is really good for your brain. It trains you in problem solving in general, and that stays with you wherever you go. I’m a huge fan of solving problems. I buy puzzles and solve them wherever I go. Coming into a new organization, I look at where the strengths and weaknesses are: if I were an attacker, what would I try, and how can I block that? It’s that curiosity that helps. You’re not just following what compliance or a standard says. You’re asking how this organization lives and breathes, and how you can make it better.
