The player-coach CISO: how AI rewrote the security leader's job in eighteen months
Three senior UK security leaders rated the change in their roles at eight, eight, and nine out of ten. The job description has been rewritten — has yours?
The first 200 words are free. The full 3,300-word breakdown — the player-coach reframe, the Claude Code bypass anecdote, the AI governance playbook in three acts, and the falsifiable predictive judgement on AISPM and the death of ISO 27001 as the dominant due-diligence question — sits behind the paywall.
Subscribe to read the full piece and the rest of the *Trust Is the Growth Engine* series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.
On the afternoon of 7 May 2026, on the second-stage panel at VantaCon UK, a Vanta moderator opened by asking three of the most senior security leaders in the Global technology ecosystem a deceptively simple question. On a scale from one to ten, where ten means your job is completely different, what is your number?
The answers came back fast. Thibault Candebat, Chief Information Security Officer at Intercom, said eight. Martin Tschammer, Head of Security at Synthesia, said “eight, nine, maybe even ten”. Joanna Chen, CISO of Dashlane, gave the most analytically precise answer of the three — a six or seven on the enablement and operations side, but only a two or three on the defender side, because the fundamentals of protecting a company against attack have not changed; only the timeline has compressed.
I want to label this exchange as the most operationally significant moment of the entire conference, and I want to label that as my analytical reading. Three CISOs of three companies that ship at the leading edge of Technology all said, in three different ways, that the job they were doing eighteen months ago is not the job they are doing now.
