PwC’s CISO on AI, Robots & What’s Next for Security

As AI accelerates change across the enterprise, PwC’s James Shira explains why security teams must rethink their approach to risk and adapt their strategies.

James Shira, global CISO and CIO of PwC, has spent more than two decades navigating the evolution of cybersecurity, from its early days as a largely technical function to its continuously growing role in corporate agendas and spending. Shira’s path into the industry was, as he puts it, as “consistent and inconsistent as the paths people follow.” Originally considering a career in law, Shira decided to pivot, more seriously considering pursuing cybersecurity through independent study, and then formal education. Today, he oversees both technology and security at one of the world’s largest professional services firms, giving him a broad perspective on the challenges facing security leaders.

In this episode of Heard It From a CISO with Dark Reading associate editor Kristina Beek, Shira discusses the skills and experience needed to build a career in cybersecurity, including the value of industry certifications, higher education, and on-the-job experience. He also examines the qualities that distinguish effective security teams, the challenges of balancing the CISO and CIO roles, and how security leaders can establish credibility with corporate boards. For Shira, successful leadership comes down to more than technical expertise. It involves building trust, communicating complex issues clearly, and creating an environment where employees can develop.

Shira also shares his thoughts on the topic on everyone’s minds: artificial intelligence. He warns that that rapid adoption is expanding attack surfaces, adding pressure on security teams, but also notes that AI technology will add opportunities for professionals seeking roles in the field. As for what’s ahead, Shira expects significant societal and industry change and shares that this rate of change is likely to be the new standard — it’s best if everyone is prepared to go along for the ride.

This is part of Dark Reading’s ongoing Heard It From a CISO video series, which features frank, exclusive conversations with cybersecurity leaders in the trenches. Check out the entire series here.

Heard It From a CISO With James Shira: Full Transcript

This transcript has been edited for clarity and length by Informa TechTarget’s internal AI assistant. For the full experience, please watch the video.

James Shira: I think there’s a lot of strength in diversity of experience and perspective, and so we try to embrace that. I like people who are self-confident and have their own point of view. It makes for mutual learning and some intense debates at times. But I think that makes for better decisions.

Dark Reading’s Kristina Beek: Hi, everyone. My name is Kristina Beek. I’m an associate editor at Dark Reading, and I’m here for another episode of Heard It From a CISO. Today, I’m joined by James Shira. Thank you so much for joining us. I would love it if you could introduce yourself and talk about your background and your current role as CISO at PwC.

James Shira: Sure. It’s great to be with you today. My name is James. I am the global CISO and CIO for PwC. I’ve been involved in what we used to call IT security since 1999. I became a CISO in the early 2000s, I think 2000 or 2001, really based on an opportunity and happenstance. I’ve been involved in the community since that time, now 25 or 26 years. For the last eight years, I’ve also been operating as our global CIO.

DR’s Kristina Beek: Love to hear that. How did you first get involved specifically in cybersecurity, technology, or security in general? I know there are a lot of different ways people get involved. Some people study computer science, and some come from very alternative backgrounds. What does your path look like?

James Shira: I think my path is probably as consistent and inconsistent as the paths people follow. I was planning on getting a degree to become a lawyer, actually. Then, being a blue-collar kid, I realized I couldn’t afford law school. After two years, I needed to make a change, so I redirected toward business and information systems. That was my undergraduate background.

When I graduated in 1998, there was a bit of a mini-recession, what we often refer to as the dot-com crash. At the time, I used to read the physical Wall Street Journal pretty religiously, and there was a lot of discussion about security. We didn’t call it cyber then. I figured this was a space that needed leaders and leadership. I was very interested in working toward and building an executive career path, and I wasn’t sure — probably like a lot of college graduates — how to go from having no experience to having an opportunity to be in a role like the ones I’m privileged to have today.

I really started by researching, reading, learning, and studying, a lot of self-directed study, including some computer science-based material. I also did a program at Columbia that’s now a master’s program, which was very helpful to me. I was one of the first students when we started. The idea was like an MBA for technologists, and I’m proud to say it’s now a Master of Science degree. I had the opportunity to be a student mentor there for a long time. It was really on a whim that I thought this space was going to be incredibly interesting, and it’s proven to be.

DR’s Kristina Beek: That brings me to my next question: What would you recommend to somebody who wants to go into cybersecurity today? In general, what would your advice be? What insights could you provide in terms of what would be best to study? Should they prioritize certifications or a four-year education? There are a lot of different ways to go into cybersecurity today.

James Shira: For sure. I think the four-year education discussion we’re all having right now is really relevant. I have younger kids, so I’ve got some time before they get there. I think it’s a really relevant conversation because of the cost. Having worked my way through college and taken out loans at the time, those loan amounts look really small compared with what people are confronted with today. I think it’s a very fair question and debate that people should have.

I’m a big proponent of certification on our security team. We really encourage people to do it, and we sponsor some of them. I’m not going to name them because we’d be here for a long time, but I think it’s a very smart strategy.

The way I describe it to our folks is that I talk about the concepts of internal equity and external equity. Your internal equity when you come out of college is zero. You’re new; you’re coming into the industry. You build that up over time with your employer. Obviously, you want to pick the right place to work, as best you can. In the early days, experience in and of itself is the value you’re pursuing.

The second piece, external equity, is something you can drive as hard as you want. As a young person without a lot of experience, you can pursue certifications. Some require years of work, but there’s a lot out there. The most successful people I’ve had the privilege to mentor start out with a high degree of emphasis on certifications. Then, after five to seven years of experience, they make a choice about whether they’re going to pursue a management track or a higher-end technical director or subject-matter-expert track.

On your question about a four-year education versus certifications, my personal view is that if you want to be in a role similar to mine, or the same as mine, you’re going to want that four-year degree. You may even want a master’s eventually. If that’s your intended path, I would encourage you, notwithstanding the loans, to complete your undergraduate degree. There are a lot of great schools with programs that can be helpful. If you look at that and say to yourself, ‘That’s a significant debt burden, and I don’t think it makes sense. I’m not sure I want to pursue being an executive,’ then I think you should do the certifications and work on getting as much experience as you can.

DR’s Kristina Beek: That’s great insight. You talked about building equity and how, when you’re fresh out of college, that really depends on your employer and the company you choose to work for. Moving back to PwC, what interested you in the company? Why did you choose to work there, and what has it been like being CISO?

James Shira: When I was coming out of Zurich Financial Services, now Zurich Insurance Group — which was also a great time in my career — I was interested in finding the right CISO challenge at a similar or bigger scale. What interested me about PwC at that time was that it was a 160-plus-year-old institution. I had never worked in professional services; I had only worked in financial services. So a different industry interested me.

I think the organization’s values here at PwC were very consistent with mine, and it’s been a privilege to be here. It sounds clichéd, but it’s really a great place. The quality of people, on average, in my experience, has been really high. People have a desire to do the right thing, and as a CISO, that’s incredibly helpful. A lot of our security strategy is culturally centered on employee behavior and training, so those things were very consistent and have been very helpful.

I know some CISOs drive programs through cultures that are less amenable. This culture was incredibly amenable to moving its security program to the next level. Nobody’s program is perfect, but that was helpful. Lastly, I had the opportunity to bring a lot of my colleagues with me. I have the privilege of sitting in these roles, but it’s not something I did on my own. It’s something we’ve done collectively as a team. Given the scale of the mission here, I had the opportunity to bring some colleagues from my previous employer over, and it’s been awesome to see their careers flourish here as well. In short, it’s a great place to work.

DR’s Kristina Beek: That brings me to a follow-up question. When it comes to a team, whether it’s business-oriented or security-focused, what makes a great team? What kinds of people are you looking for, whether in terms of personality or skills?

James Shira: I’m going to answer your question in reverse order. The people I like to work with don’t come in a common package. I think there’s a lot of strength in diversity of experience and perspective, and so we try to embrace that. I like people who are self-confident and have their own point of view. It makes for mutual learning and some intense debates at times, but I think that makes for better decisions.

The people I’m looking for don’t have to have gone to a specific school. They don’t necessarily need a traditional profile, but they definitely need to be self-confident and self-directed. I talk to the team a lot about emotional resiliency. I think it’s a really important concept in the security industry because, when I got started, security was past the mailroom, past the bathrooms, in the basement somewhere, and rarely in the boardroom. Now, people coming into the field wouldn’t even recognize that, because security is such a central, strategically critical issue for companies. I need that confidence in our employees so that, when they become the leaders they can be, they can flourish based on that confidence. It’s hard to build a great team without that.

The second piece I think is incredibly important is transparency. It’s something I work diligently to practice when I’m speaking in front of the thousands of colleagues I have the privilege of leading: being as brutally transparent as possible about whatever we’re trying to do. It’s uncomfortable at times, and it can be challenging to answer the questions you get, but I think it provokes the kind of cultural engagement that makes for a great team.

The one thing I’ll say lastly is that I don’t think mediocrity, as a rule, fits in high-performing teams. You have to embrace your high performers, try to elevate and promote them, and create an environment where they can be as self-directed and successful as they can be.

DR’s Kristina Beek: Absolutely. When you were answering that, one of the things you talked about was how the CISO role and cybersecurity in general are now in the boardroom. I see a lot of articles about how to communicate with C-suite members as a CISO, how to deal with friction, and how to get your board to believe you. What would you say about communicating your needs as a CISO to the rest of the board? Do you encounter friction in your experience, and how do you deal with that?

James Shira: I think it’s a great question. I’m going to offer a point of view. I’ll start by saying I’ve gotten it wrong. I don’t have all the answers, but I’ve learned through mistakes and by having great mentors.

I think credibility with a board starts, frankly, through delivery. The first thing you have to do is build a track record as best you can. That might sound counterintuitive: don’t I need the board’s buy-in before I deliver? Somewhat, but I think conversations with our various boards here, and the conversations I’ve had previously, show that over time, through delivery of the program and driving the change you’re advocating for, you can build a lot of credibility.

The second of my three points is that you have to find your own authentic voice. Personally, I’m not a natural. I kind of joke with the team at times that I’m a radio guy, not a TV guy, and I’ve had to work at being a TV guy. You have to find your own authenticity through your own style. A lot of times, those of us who get the privilege of being in these C-level jobs receive a lot of advice and pressure about how to present and who to be. I would encourage people listening to find their own style and approach that works best for them. Obviously, measure it against how effective it is, but embrace the style that’s authentic to you. For me, I just try to be myself with our board.

The last thing I’d say, and I think it’s maybe the most important point, is that you have to bring the expertise to the board, not try to drag the board to your expertise. In our domain, don’t underestimate how intimidating it can be for the people listening. It’s security. They see the headlines. Maybe an issue has occurred in that business. As board members, they feel responsible for providing oversight over management, and they’re under tremendous pressure to do so. Don’t underestimate that.

If you come at them with a high degree of expertise, terms, acronyms, and things they don’t understand, I’ve found that doesn’t work. That would be one of the mistakes I’ve made in the past. What’s worked well for me is not to dumb it down, but to simplify it. If you have enough mastery of a topic, you can describe it in a way that doesn’t make the other person feel intimidated and helps them say, ‘Okay, I get that.’ One suggestion I would offer is to use storytelling. That’s what I’ve done, and it has worked well for me.

DR’s Kristina Beek: While you’re obviously CISO, you’re also CIO, so you have two perspectives. What is it like balancing the responsibilities of both roles?

James Shira: The good news is that, over the last eight years I’ve had the privilege of being in these roles, there’s been a tremendous amount of harmonization between the technology transformation of large enterprises and the need to get the cyber piece right. Therefore, unlike when I started, when security was past the mailroom and in the basement, it’s now such a primary issue for organizations that it’s really on the CIO’s agenda. I think having both of those skill sets is a very critical thing in this day and age.

The one difference I’d acknowledge for the audience, because otherwise anybody watching would think I missed it, is that at times the CIO role can be inherently more political than the CISO role. Let me explain briefly. As a CISO, you objectively know what good looks like: don’t have a breach, don’t have an incident, improve your audit posture, drive good risk management, and so on. What good looks like in the CIO world can sometimes be less black and white and more gray. It can change in a way that a traditional CISO might find challenging to navigate.

I, for one, never anticipated the amount of passion and energy that debating different HR or finance platforms might bring. I’ve learned how to spend a lot of time with CFOs and COOs in our businesses. That’s made me not only better professionally, but also more sympathetic to the issues they have, especially in some of the smaller businesses where a decision we might make from a CIO perspective has a significant material impact on their cost basis. There are differences, but in summary, it’s a very complementary experience for me. The biggest challenge is time management and moving time between the different things.

DR’s Kristina Beek: Absolutely. AI is, of course, always part of the conversation. It’s changing how attackers work, and it’s also changing how organizations operate. What do you see as the biggest cybersecurity opportunity or risk associated with AI right now?

James Shira: I think the most important issue with AI, straight down the middle, is how it changes, evolves, and increases an organization’s attack surface. The second issue is the rate of change it brings: how fast it moves and how fast systems have to move. Those are the two dynamics.

What happens to the size of your attack surface? AI can really explode it. At the same time, AI puts pressure on the pace of change across the whole security function. For us specifically, that means dealing with the amount of patching, vulnerability management, inbound requests, and client requests. You have to manage those two dynamics.

On the technology front, in my career — which some people in this audience might think is long, while others might think it’s not that long yet — I’ve never seen anything move as fast. In a short period of time, we’ve gone from a nascent technology that we’re all excited about to actually operationalizing it. At least in my career, I haven’t seen anything cross that divide so quickly. Therefore, I think it’s ultimately the biggest change-management exercise, maybe ever. That’s really where leaders need to center and focus their time.

DR’s Kristina Beek: A lot of people are coming out of college or going into college with the expectation of going into cybersecurity or computer science. AI is changing the field very rapidly. A lot of people are scared that they may not even have a job or that there may not be a place for them in this field. What would you say to that, with the rise of AI?

James Shira: I understand where people get that. I understand how people get that. I think it’s understandable, but I think it’s wrong. The amount of change across society and industries is significant. It’s very difficult for me to chart a course in my head for what isn’t going to change. Therefore, I think the opportunity for young professionals is to be the change agents — to deliver the change.

I think one thing we don’t always do well for our young professionals, but need to, is tell them the truth about the adversity of change management. It’s hard. It’s hard, and it’s going to be hard for them. Do I think AI is a job-elimination technology? I don’t. But I understand and respect how people might reach that conclusion.

If you’re doing highly repetitive, data-centric activities, that’s not, frankly, what you go to college for. Some of us had to do that coming out of college, earning our stripes, but that’s not generally what you go to college for. That probably gets changed a lot by AI. Of course. I don’t think it’s a displacement strategy.

DR’s Kristina Beek: Going back to what you said about how AI is changing things so rapidly, what do you think cybersecurity leaders will spend the most time thinking about three to five years from now? I know that’s hard because things are changing so quickly, but what do you see for the future?

James Shira: I think the constants I would expect not to go away are the rate of change, the pace, and the pressure. Therefore, I think you have to find consistency in process and strategic principles, meaning how you manage your strategy shouldn’t change. You should find the things in executing the strategy and operationalizing it that don’t need to change, because so much around you will be changing.

In our history, and in at least my part of the 20-year history of IT security and cybersecurity, when there’s been a technical change — think cloud, client-server, mobile, or whatever — we’ve effectively changed every aspect of how we implemented security controls. I’m hoping and working diligently to avoid repeating that pattern in the AI space because I think it just adds too much volume to an already high-intensity, high-volume situation.

Three to five years from now, I’m hoping AI can be a much more consistent enabler of delivering secure outcomes, but we’re still learning how to fully operationalize it. Then there’s the issue of token costs, which we’re not going to get into today, but that has a high degree of relationship to driving the overall security budget, which we’re figuring out as we go.

Secondly, I don’t think most companies will have enough money to build a security program the way we’ve historically done it, at the size and scale that AI could imply would be required. Third, I think organizations are going to have to shrink their digital footprint as they transform. The good news is that — obviously, hope is not a strategy — AI will hopefully allow us to interact with our systems of state much more efficiently than building applications as the recurring front door to all of our systems, as we’ve done for the last 10 or 20 years. That ought to have a great benefit in reducing the attack surface, too. I think that’s what companies need to do, and I think that’s what will look so different in three to five years.

Lastly, I’d say I’m expecting significant societal and industry change, especially in a five-year window. I’m not sure I’m going to have a robot at home, but maybe some of us will. I think physical AI is going to place a significant premium on investment capacity, both on the hardware side and on the adoption and implementation side.

There are Orwellian views of that, where you could see the doom and gloom. I think there’s also a tremendous opportunity. Some countries are not having the birth rates we need. Frankly, there isn’t enough reproduction to maintain the numbers of people in society. So robots in some places in the world are going to be incredibly helpful in allowing us to deliver the things people need in society.

But I’m excited by it. I’ll summarize by saying I think the big fundamental choice you have to make every morning when you wake up is to embrace the change, both in yourself and in how you do the job, because the change is almost— I joked with a colleague the other day, and she’s a really capable runner while I am not, that this is kind of like being on the treadmill at the speed Annie would go at, not the speed James would go at. Some days I feel like I’m hanging in there, and other days I feel like I’m about to fall off the back of the treadmill. I think everybody just needs to say that’s part of this.

DR’s Kristina Beek: Absolutely. That’s great to hear. Normally, I end these interviews by asking what the future of cybersecurity looks like to you, but we’ve already touched on that. So I’d rather end with a different question: You’ve spent a lot of time in tech and security and have seen how it’s evolved. What has been the most rewarding part of that work, and what do you think will continue to challenge or motivate you, especially in a field where the risks are sometimes really high?

James Shira: Sure. It’s an easy answer for me: it’s the people part. It’s the team. Every success I’ve had the privilege of being part of is not a James thing. I had a role, sure, but it’s a team thing.

When you see someone — we have a number of people in our organization who started as interns at my previous employer. One colleague started as an intern and is now an executive. Another colleague, Annie, whom I mentioned, is now a partner. Those are the things that lift me back up when I have a bad day, which happens. It’s when we see people building and shining in their own way, self-actualizing. That’s pretty cool, and I think that’s the right way things should work.

Look, it doesn’t always work that way. There are probably people on the team who don’t feel they got a fair chance, or who feel something didn’t go perfectly. That’s the challenge of working in teams of people, because people — me, you, all of us — are not perfect.

But the best days for me are when I see colleagues rise, shine, and do great things, and even leave the organization and go do great things somewhere else. That’s pretty awesome. I think that’s our opportunity with AI and security. We have to embrace it, try to see the positive in it, and grow through it.

DR’s Kristina Beek:Absolutely. I so enjoyed this conversation. Thank you so much for joining me today.

James Shira:Me too. Thanks for your time.