Scott Beale, CEO at ISC2, tells Sean Martin that boards often answer AI's challenges with technology when training and people are the answer. Listeners get a case for human judgment, balanced AI adoption and investing in people.
When AI promises efficiency, leaders often reach for a technology fix to what is really a people problem. That is the tension Sean Martin raises with Scott Beale, CEO at ISC2, in this On Location conversation from ISC2 Security Congress in Denver.
Sean starts with Joseph Carson's talk on employees let go under the guise of downsizing for AI efficiency, and asks what role the business has in helping people learn the tools and use them to support the company. Scott answers that CEOs and boards too often see a technology challenge and assume a technology fix. He calls that "really just a mistake" and ties it to AI not being phased into an organization's culture and training.
From there the conversation turns to cybersecurity, where Scott says human judgment matters even more because AI's recommendations still need checking. Sean shares a similar takeaway from his recent episode on governance, risk and compliance: AI on a flawed program replicates and accelerates the underlying issues. Scott argues that going all in or going zero on AI are both mistakes.
Scott also describes what ISC2 is putting behind the workforce, including AI questions in all nine certifications, a new AI era Cyber Workforce Coalition, the Center for Cyber Safety and Education, chapters and the Cyber Leadership Institute.
He closes with a message for CEOs, CISOs and board members, and a question about where the cybersecurity worker is in public talk about AI's risks.
For business leaders weighing AI spending, it is a case for putting people investment alongside technology investment.
Full ISC2 Coverage | https://www.itspmagazine.com/blog?p=isc2-security-congress-2026-on-location
On Location | https://www.itspmagazine.com/on-location
The Future of Cybersecurity Newsletter, (Sean) | https://itspm.ag/future-of-cybersecurity
Redefining CyberSecurity Podcast (Sean) | https://www.seanmartin.com/redefining-cybersecurity-podcast
An Analog Brain In A Digital Age Newsletter (Marco) | https://www.linkedin.com/newsletters/7079849705156870144/
An Analog Brain In A Digital Age Podcast (Marco) | https://redefiningsocietyandtechnologypodcast.com
An Analog Brain on YouTube (Marco) | https://www.youtube.com/playlist?list=PLnYu0psdcllTUoWMGGQHlGVZA575VtGr9
Sean Martin | https://www.seanmartin.com/
Marco Ciappelli | https://www.marcociappelli.com/
Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/
Marco Ciappelli on LinkedIn | https://www.linkedin.com/in/marco-ciappelli/
Advertise on ITSPmagazine | https://www.itspmagazine.com/advertise
ITSPmagazine on YouTube | https://www.youtube.com/@itspmagazine
Studio C60 | https://www.studioc60.com
On Location schedule | https://www.itspmagazine.com/on-location
What Can Happen In The Next 1,000 Days
Recorded 2026-10-31
With Scott Beale, CEO at ISC2; Sean Martin, Co-Founder & CTO at ITSPmagazine (not confirmed online)
Times are in the published episode: the conversation starts at 00:00:45, after the front bumper.
[00:00:45] Sean Martin: Perfect. All right. No badge on me, Scott.
[00:00:48] Scott Beale: Yes.
[00:00:48] Sean Martin: Here we are.
[00:00:49] Scott Beale: Thank you. We
[00:00:50] Sean Martin: made it. Glad to be
[00:00:51] Scott Beale: here. We made it.
[00:00:51] Sean Martin: Congratulations on your first.
[00:00:53] Scott Beale: Thank you.
[00:00:53] Sean Martin: It's also mine.
[00:00:55] Scott Beale: Indeed.
[00:00:55] Sean Martin: Which is kind of crazy
[00:00:57] Scott Beale: indeed.
[00:00:58] Sean Martin: Yeah. For being involved for so many years. But I'm impressed.
[00:01:02] Scott Beale: I'm glad you're here.
[00:01:03] Sean Martin: I'm glad I'm here too. I'm glad I'm here too. I appreciate the team making it all come together and putting together a great, great conference.
[00:01:11] Scott Beale: Absolutely. It's just an incredible community of folks and being able to hear how many times people have come, whether it's 10 or one and seeing the different ways that they're working in cybersecurity. Coming together to learn and to build community has been really cool to see.
[00:01:26] Sean Martin: Yep. So it's your first 'cause you're new in the role.
[00:01:29] Scott Beale: Yes.
[00:01:29] Sean Martin: So maybe a few words about who Scott Beale is and your journey to ISC2. I was joking earlier. I still like to call it ISC2. I think we joked about that. We did
[00:01:39] Scott Beale: joke about
[00:01:39] Sean Martin: it in New York when you came into town.
[00:01:41] Scott Beale: ISC2 definitely has a nice ring to it, but I'm trying to [00:01:00] stick with the ISC2, to
[00:01:46] Sean Martin: keep my job. All right. We'll go with ISC2. So new at the roll, you're keeping that. Stable, but
[00:01:51] Scott Beale: absolutely.
[00:01:52] Sean Martin: You're moving a bunch of other stuff forward, which we're gonna talk about, but talk about your role now.
[00:01:55] Scott Beale: Sure. You know, I've been in the role of 10 months now and it's been an incredible journey. The first part of this year, really listening to members all around the world in the second half of this year, trying to roll out some new certifications, programs, some ways forward, which we can discuss. But before I came to this role, in some ways it was an unlikely path having worked most recently running global operations for the Peace Corps. And before that, having led a global nonprofit called Atlas Corps, which was a really a workforce development program for civil society leaders, where we brought nonprofit leaders all over the world to volunteer in the United States. It was a nonprofit. I had started and grew over 15 years, over a thousand leaders from over a hundred countries. Prior to that, I was a US diplomat. I served in the White House. I served on Capitol Hill, so I've kind of gone in between government and nonprofit jobs. Often with a little bit of international angle to it, but really the main through line has been about leading mission-driven teams who are trying to address critical issues in society. So when this opportunity came up to even just apply for this role at ISC2, I really jumped at the opportunity. Yeah, it cybersecurity strikes me as one of the most important social societal issues of our time. And not only do I wanna be working in that space. The way I like working in these spaces is by developing and strengthening the leaders and the profession to be more effective at what they're doing to advance the more safe and secure
[00:03:22] Sean Martin: Yeah. And it's probably as a practitioner who holds a cert, as people look in and see that it's a certification organization, they might forget the.org piece
[00:03:33] Scott Beale: Indeed.
[00:03:34] Sean Martin: That, that it is about helping and contributing and giving back. We're gonna touch on a lot of that. Good. I want, I'm gonna start with this.. Because ultimately you're serving, and you said this many times in your keynote this morning that the member is at the center. Absolutely. I think even rebranding the center to actually refocus the memory. Yeah. Put people in the center. The people in the center. A lot has changed for people in terms of their roles, their jobs, the technologies they have access to, the technologies they're not allowed to use.. What's the kind of the current state of the union, if you will, for the members at large and kind of where the role's headed?
[00:04:20] Scott Beale: Absolutely,
[00:04:21] Sean Martin: yeah.
[00:04:21] Scott Beale: Let me add one bit about kind of where my focus is. Okay. And then answer the question about the State of the Union. It is absolutely the case that the board, the staff, myself, are extremely focused on the member, making sure that there's a member value that people can feel, touch and experience. Through the lifecycle of their careers in cybersecurity. But to be totally transparent, the way I really try to approach it is by staying focused on the mission, which is to advance more safe and secure world. And then our space in that mission, which is to strengthen the cybersecurity workforce. There are initiatives and work that we do that actually help all cybersecurity workers, whether they're members or not, right? And I'm okay with that because that's the way we advance the mission. I also think it's a way that we bring more people into the association and into the membership. When they see that there's a strength in the collective action and work beyond just being a great test, a great certification body it really is an association that's advancing the profession. So it, the order that you focus on things, whether it's. Vision, vision, workforce member, or test it doesn't matter too much, but really in how we make decisions with the board and with the team is always focused with that, with that vision, which is important because we are living in complicated times not just for the workforce with the uncertainty of jobs, whether there be more jobs, will there be less jobs? Will you need new skills? Will you need different skills? But also just in society itself as the speed of AI adoption. In our companies, in our communities, in our countries, and the way it's exposing vulnerabilities from softwares to other, other aspects of technology there's a lot of work to do in the cybersecurity space. So, on one hand, I think while there's a lot of a fear about how AI is gonna change the roles and when you, when you pull members, when you pull cybersecurity workers overwhelmingly they are seeking additional training, additional professional development. They need more learning how to advance their careers and their skills. So there's uncertainty and a desire for those additional skills. The fact is, all of these vulnerabilities that are being exposed, I think is gonna create even more of a focus, even more of an investment in cybersecurity. So there's gonna be a lot of opportunities in the near horizon for the cybersecurity profession, especially if they continue to develop their skills and. Know how best to tackle the uncertainty that AI is creating.
[00:06:52] Sean Martin: I want to touch on that. I was talking to a gentleman, Joseph Carson, I dunno know if you know. Mm-hmm. Because he's focused a lot. He's speaking here, I think on kind of the role of an employee that may have lost our position right. Under the guise of we're downsizing for
[00:07:09] Scott Beale: efficiency. Did ai
[00:07:10] Sean Martin: Yeah. And I believe his talks kind of how you move. Prepare for that and perhaps even move on from that. As he was describing that, the thing that came to mind, I want your thoughts on this, is kind of the business's role in ensuring that people can gain this, the understanding of the tool set, and use the tool set to gain the skills to actually support the business.
[00:07:36] Scott Beale: Right.
[00:07:36] Sean Martin: Versus a hard we're gonna as soon as we get things running, you're, you're out of, out of that role.
[00:07:43] Scott Beale: Absolutely. I think. [00:07:00] Way too often, CEOs, boards, businesses will see a technological challenge and assume the right answer to that is a technological fix. Or they'll see a new technology, which they think creates a bottom line efficiency, and then they jump right to that step. And it's really just a mistake. And you're even seeing it recently in the news about companies saying that while AI is getting more powerful efficiency within companies is not. And it's because it's not properly being, I think, phased in and it's not properly being incorporated into like the culture and the training of an organization. This is especially true in cybersecurity where human judgment matters even more now than ever. The ethics, the experience, the perspective of an experienced cybersecurity professional is just only more critical now because AI is making recommendations. That still need to be checked. Yeah. That are not always right. And so while attacks are coming at machine speed and the most effective cybersecurity worker is gonna be the one who's been trained and invested in, understand how to use similar technology to protect against that technology, you still need the human in the loop. You still need the trained experience, cybersecurity professional, who has the knowledge, skills, and ability to succeed in those roles. And companies and nonprofits and governments need to invest in those individuals. To make sure that they can really fully utilize all their capabilities.
[00:09:11] Sean Martin: Yeah, I just put out an episode on around GRC governance risk and compliance and leveraging AI for that. And the takeaway was true for pretty much any program. I think that's trying to throw the AI fire on something is it can spread faster,
[00:09:30] Scott Beale: right?
[00:09:31] Sean Martin: But it's just gonna replicate and accelerate the underlying issues. So. This is where I think the human with mindset of what are we really trying to do as a business, fiscally feasible, and the right thing [00:09:00] to do for the shareholders and the business. And society.
[00:09:47] Scott Beale: Exactly.
[00:09:48] Sean Martin: A lot of those things get lost in building agents and prompting stuff and automating workflows.
[00:09:55] Scott Beale: Exactly.
[00:09:55] Sean Martin: Because it's just running. So,
[00:09:57] Scott Beale: you know, I think it's, it's myopic or it's a, it's, it's foolish for companies to go. All in with ai. Mm-hmm. Or to go zero in with ai. Like it's, it is a hard balance to really get the right amount of adoption and governance and investment and training so that you're properly using the technology to keep your company and your system safe. And if you put the gas on too strong, or you, or you're not trying it at all if you don't do it at all, you have the risk of your team using shadow AI in different ways that are gonna expose things even more. And if you try to go full speed and get rid of staff and start deploying all these agents and hope that it'll, it'll make you more safe, you're gonna quickly find out that's not the right way to go either.
[00:10:44] Sean Martin: [00:10:00] Yeah. So here's an opportunity to kind of broaden out beyond just the member.
[00:10:50] Scott Beale: Sure.
[00:10:50] Sean Martin: Where ISC2 is making investments to help the member. 'cause I know you also do a lot of work with small, medium businesses Absolutely. To give them support and in schools to help. Yeah. Education. So kind of paint a big picture of all the investments your organization is making to achieve your mission.
[00:11:11] Scott Beale: Absolutely. Let me give you some of the big picture piece on some of the larger investments we're making for the workforce itself. Some of the social impact investments that we're making, but I also don't wanna forget just some of the internal operation efficiencies that we're making, which actually matter a lot to our members as well. Okay. We're on the same journey as well this year. The board announced the launch of a new AI Security Certification and not a small deal. ISC2 does not jump into certifications quickly. When we build certifications, we build them for decades. We don't build them for new cycles. And, you know, five years ago we did a certification, the CC certification. About 10 years ago we did the cloud certification. So we have a certain we don't jump into these things. Without giving in a lot of thought. Very
[00:11:56] Sean Martin: deliberate.
[00:11:56] Scott Beale: Very deliberate. And not only deliberate, but it's a certification made for the profession by the profession. Nearly 10,000 people have raised their hands. Tell identify what are the jobs this certification should look at? What are the domains? What are the questions? Is the test that we're developing valid? And so we're in that process Now, the beta test is gonna be in December by Q1, maybe even January, late January of next year. This test will be available. We've also done a lot of other investments with regard to workforce development, professional development, especially with regard to AI from workshops and webinars and different certificates to make sure that people can learn these skills more quickly as opposed to waiting for a larger certification or some other, you know, magic bullet or magic pill that's gonna help them get everything right. It takes a lot of investment and time. We've also updated all current of our nine certifications. All nine of those certifications now have AI questions as well. So in whether folks take C-I-S-S-P or CC or any of the others they're gonna have questions that'll measure their AI knowledge. So that's been a big investment to make sure that our members, the workforce more broadly can demonstrate that they have the knowledge, skills, and ability to work in cybersecurity in this new AI era. There's a second big investment that we announced last week. Cool. Wow. We're launching a new AI era Cyber Workforce Coalition, where we're bringing together some of the largest employers of cybersecurity as well as other thought leaders within cybersecurity and ai about how is their profession changing, what are the knowledge and skills and roles that people need to be prepared for? What are the job descriptions? What are toolkits that companies could use to best recruit and hire cybersecurity workers? This isn't about, we're working really closely with NIST NICE and other, other standards. But this is about creating practical tools for companies, for employers, even recruiters, to be able to navigate these changes within cybersecurity that are happening in a way that it's very difficult for people to keep up. Vendor neutral approach. We're gonna ultimately work with academics and lots of different tools and we think this is a way we can support the overall cybersecurity workforce and again, advance more safe and secure world. I could talk about some of those other investments, but I want to also touch on some of the stuff we're doing with the center. The center's now 15 years old. It's very exciting in many ways. It's most well known for the scholarships that they've done, 1100 scholarships since their, their foundation. These are scholarships for people to enter the sector or in some kind, in some cases, to advance their careers or even career switchers. I didn't get a scholarship, but I was a career switcher, so I would've would've appreciated it. Right. Actually I did get a scholarship because the CC. Was free when I, when I took the exam. So ISC2 has a history of investing in the sector and we're really continuing that. The center is doing some really powerful work for this 50 by 50 initiative, right, to really increase the recognition and the voice of women within cybersecurity and really make it a welcoming space for really people of all backgrounds. So I'm really excited about the work at the Center, even some really interesting ways to. Leverage volunteerism within cybersecurity community, which we do around the world, but there's a lot of desire to advance the I am cyber safe curriculum, be it with schools or nonprofits. There's just a lot of risk out there and I know from my own experience in volunteer organizations, when you volunteer and teach other people about cybersecurity or about other issues, not only are you making an impact in ways you can't always really appreciate it often further helps your career and your own knowledge and. And network in ways that can often really, really pay off. And then finally, briefly, we're doing some investments in ISC2's own internal structure. I mean, this may seem silly or micro, but I'm really focused on the fact that uploading CPEs can be difficult on ISC2 or resetting your password or just any number of things where you're like, we're we're, we're a tech nonprofit. We should be able to respond to our members in ways that. That make CPEs, AMFs joining chapters and being a part of local community as easy as possible. In fact, the chapters investment is one that I'm also very excited about as well because that local touchpoint, be it for mentorship or professional networking or local learning, is really something that ISC2 headquarters can never replicate. But our 160 chapters across 50 different countries can be a really important way for people to feel. The impact of ISC2 and be a part of this larger community. 'cause as I said this morning, you know, the work is, is way too hard and it's way too important for folks to try to do it alone. And so we need to create that space to further develop them. And I've got one last one. Yes, please. And I'm also really excited about, so we IAC two has really been focused on developing the leadership skills and capacity of cybersecurity workers more broadly. So much of ISC2, where this space has been focused on the technical skills. Whether again, GRC or the cloud or ai, but actually it's often the leadership skills that people need to be even more effective in their job. Well, 20 years ago, people may have been hired to work in basements to keep networks safe and they did not touch the board or the CEO. That's not the case anymore, right? Because if, whether it's the New York Times or the chair of the board or the CEO, people have questions about what is BGP and why are there multiple vulnerabilities for something that covers 70% of the internet that I don't even know whether our systems are running. And so now the cybersecurity professional needs to not only have the technical skill, but also the communication skills and the ability to influence others and to articulate in clear and concise ways that can move budgets and move organizations to keep those companies, those nonprofits safe. They weren't hired for those skills 20 years ago, but they can be taught and they can be developed. And we have this Cyber Leadership Institute that I'm, that I'm very proud of as well, which is helping further develop those leadership capacities. Of cybersecurity professionals.
[00:18:06] Sean Martin: Yep. Volunteering is critical.
[00:18:09] Scott Beale: Absolutely.
[00:18:10] Sean Martin: Volunteering is critical. Yeah. Maria Galloway, one of the board members, she brought me to the, to the center's event last night.
[00:18:18] Scott Beale: Awesome.
[00:18:18] Sean Martin: And I got, I got hooked into volunteering for some small business stuff, so.
[00:18:23] Scott Beale: Excellent.
[00:18:23] Sean Martin: I'll do that. In addition to the ai, glad she helped you in and did the, in addition to the AI test stuff that all. Gonna contribute to as well. But
[00:18:30] Scott Beale: I mean, I'm a huge believer that often you just need to ask people, yeah. Hey, could you help teach this skill? And you know what? People can always say no busy. Like, I'm too nervous. I don't wanna do that. I could, I could donate instead of, instead of give my time. I'm happy to help mentor one-on-one, but I don't wanna give a speech in front of a group. Like, people will show up in different ways, but sometimes people need to be invited and sometimes people need to raise their hand because together this sector needs to stand up because. What we're seeing happen when you look at the press and the, and society and the news is that there's all this talk about is ai, is there a 10% chance that AI is gonna kill society? And I'm like, where's the cybersecurity worker in this conversation? Right? Where's the cybersecurity professional? This is not a new conversation for people who are in the cybersecurity space. We need to make sure that those perspectives are heard, those experiences are valued. And those people, that our profession, our members are at the table when those decisions are being made because there's no reason to believe that there's a 10% chance society's gonna end because of ai. If we take the steps to keep ourselves safe, if we make the investments to train our teams and to secure our systems. But we need to do that. We need to look to this sector to keep us safe during these incredible period of transition that we're in right now.
[00:19:46] Sean Martin: Yep. Let's talk about that transition. You mentioned a thousand days, a few times a year. Yeah. In your opening remarks. A lot of my audience are CISOs, security leaders, certainly practitioners follow as well. But I get a lot of business leaders who are interested in managing and mitigating risk to enable the business to actually operate safely. Absolutely. And next 1000 days, what's your message to them connected to all the work you're doing with ISC2?
[00:20:17] Scott Beale: You know, I think the biggest thing, the reason why I put out that idea of a thousand days, 'cause I've had people say to me, dude, it's not a thousand days, it's the next like 90 days. I mean, a thousand's way too much. Or other folks saying, how can you possibly imagine where the world's gonna be in a thousand days? So it's, it's, the bigger headline is, it's, it's days, not decades. We don't have forever to adopt this new technology, to build the governance, to train the team, to secure our systems. You know, the cloud technology from. 1999 with Salesforce to about 20 15, 20 16, when we launched our cloud certification every, every few years, a new aspect of cloud was built into technology. People were trained, it was studied in universities, and you're able to secure systems in a way that it evolved over time as quick as that may have felt at the time. With ai, it's just changing so much more quickly. Will quantum computing show up in a thousand days? Probably not. I don't know. Who knows, probably not. But do we need to lock down our systems in a way that are quantum resistant in the next thousand days? Heck, yes, we do. Because otherwise people will steal data. They'll, and they'll, they'll break it later, right? So we can't wait until some date where QA hits us and we didn't really know it was gonna happen. Will a GI or AI systems become so powerful that they can, they can do any task more powerful than a human in the next thousand days? Probably not. Probably not, but our AI systems getting so much more capable in ways that we couldn't have even predicted. When you look at how poorly it did math three years ago to how well it does math now to how poorly it created images three years ago to how powerfully it can do deep fake videos now, like we all you have to do is look backwards a thousand days to really be freaked out about the next thousand days because the next thousand days we're not gonna see the same amount of change we saw in the last thousand days. We're gonna see exponentially more change than we saw in the last thousand days, and that is what we need to prepare for. So we need to have some willingness to move, to not let fear create paralysis, to not let uncertainty create lack of investment. To not assume that a technology solution is gonna fix a technology challenge, when really we have a human investment and human training challenge and a human training.
[00:22:45] Scott Beale: Solution that's a big part of this. And so whether you're a CEO or a CISO or a board member or just trying to understand what's happening around us, there's a real need to invest in people and all this interest in investing in data centers. That's, that, that is what it is. We need to make sure we're investing in people at the same pace that we're investing in technology. Otherwise, we're in a lot of trouble.
[00:23:11] Sean Martin: Cheers to that, my friend.
[00:23:13] Scott Beale: Indeed.
[00:23:13] Sean Martin: Hopefully not that we're in a lot of trouble that we make, we make the proper investments.
[00:23:17] Scott Beale: We you plan for the storm, you plan for the challenges to be able to weather it.
[00:23:22] Sean Martin: Yeah.
[00:23:22] Scott Beale: You don't just fear and hope that it'll, that it'll pass. Yeah. And that's what we're trying to do at ISC2 particularly for our members, but also more broadly for the cybersecurity workforce and really society at whole as we're working with governments and industry and. Academia to really be prepared for the system, the challenges that are coming.
[00:23:41] Sean Martin: Yeah. And I'm gonna close with this because I have the pleasure of speaking with a number of folks presenting here. I have, I'm gonna be chatting with Jaya a little later as day. Oh, great. She's gonna be looking at
[00:23:53] Scott Beale: amazing
[00:23:54] Sean Martin: quantum stuff.
[00:23:54] Scott Beale: Yeah.
[00:23:55] Sean Martin: So the point I'm making is Congress brings the people and the topics together with the community to have the conversations we need over the next. 90 to a thousand days. So
[00:24:07] Scott Beale: it's these conversations, this community it's this collective effort that we need to really be able to rise to the challenge.
[00:24:13] Sean Martin: Yep. Good stuff, Scott.
[00:24:15] Scott Beale: Awesome.
[00:24:16] Sean Martin: Congrats on the roll.
[00:24:18] Scott Beale: Thank you.
[00:24:18] Sean Martin: Have great con Congress this year.
[00:24:20] Scott Beale: Thank you very much.
[00:24:21] Sean Martin: And thanks everybody for catching us here. I'm live from ISC2 Security Congress all week here in Denver. A lot of conversations coming your way. Stay tuned. Thanks Scott.
[00:24:33] Scott Beale: Awesome. Thank you.
[00:24:36] Sean Martin: All right. Good stuff, man.
[00:24:36] Scott Beale: Awesome. Good stuff
[00:24:36] Sean Martin: that all.