In this episode, Liz Morton, Field CISO at Axonius, shares her 25-year journey through IT and cybersecurity, including nearly a decade at the Intercontinental Exchange that looks after the New York Stock Exchange. She discusses the transition from practitioner to Field CISO, the persistent challenges of visibility and asset management and the reality behind the “cyber confidence gap.” Liz explains why remediation remains slow despite rapid detection, why fundamentals like MFA and patching still matter and how AI is reshaping security operations. The conversation explores cultural change, regulatory pressure and the importance of maximising existing investments before chasing new tools.
Takeaways
- Liz Morton’s career spans critical infrastructure, finance, and security leadership.
- Axonius helps organisations achieve visibility across assets, identities, and security controls.
- The “cyber confidence gap” reflects a disconnect between perceived and actual security posture.
- Fundamentals like MFA, patching, and identity hygiene remain the biggest vulnerabilities.
- Many organisations underutilise existing tools, leading to wasted spend and blind spots.
- AI offers speed and pattern recognition, but cannot replace core security processes.
- Cultural change is required at board and C-suite level to address risk realistically.
- Tool consolidation and efficiency are increasingly necessary as budgets tighten.
- Deepfakes and AI-powered attacks heighten the urgency of visibility and verification.
- The future of defence will focus on speed of detection, containment, and response.
Sound bites
“Everybody’s doing their best, but the fundamentals are still being missed.”
“You cannot secure what you cannot see.”
“AI is great at correlation, but it doesn’t excuse poor cyber hygiene.”
Chapters
00:00 – Introduction to Liz Morton and Axonius
02:20 – Transition from ICE to Field CISO role
05:30 – Common challenges across industries and budgets
09:00 – Visibility, asset management, and the Axonius platform
13:20 – Underutilised tools and the cost of tool sprawl
18:30 – Data noise, consolidation, and pragmatic cyber strategies
21:40 – Visibility in action: misconfigurations, zero days, and ROI
26:00 – Regulatory pressure and the return to fundamentals
30:00 – The persistence of basic attack vectors
32:30 – Identity, insider threats, and cultural change
36:00 – AI-powered attacks and deepfakes: new challenges
41:30 – The future of AI in security operations
46:00 – Closing thoughts and Liz’s upcoming visit to Australia