Balancing AI Benefits and Risks as Your Next CISO Could be Artificial Intelligence

Evan McHenry, VP and CISO at Robinhood Markets, leads Security and Corporate Engineering to ensure secure and scalable operations. He previously served as Deputy CISO, driving security initiatives and aligning IT infrastructure with growth, and has over 20 years in security and IT, including work at Aetna and Beebe Healthcare focusing on identity management, infrastructure, and HITRUST. At Google, he held leadership roles in Corporate Engineering, securing COVID-19 response and Future of Work initiatives. The text addresses growing identity risk due to excessive access and a lack of control, highlighting MFA fatigue and credential abuse, while emphasizing the challenge of fixing this without adding friction. A panel is scheduled for the Identity Virtual Cybersecurity Summit on September 30th. Furthermore, security spending growth is uneven, as most CISOs do not see corresponding budget increases. The narrative also explores the potential role of Artificial Intelligence in cybersecurity leadership and examines how AI's neutrality impacts psychological safety within organizations. Finally, a gap exists in U.S. defenses against sophisticated Chinese hacking apparatuses, prompting calls for shared visibility and enhanced network resilience.

The narrative presents several simultaneous challenges: managing identity risk under increasing complexity, navigating evolving spending dynamics, and grappling with the integration of advanced technology like AI alongside organizational psychology and geopolitical threats. The connection drawn between identity management failures and the need for psychological safety suggests a pattern where technical control inherently intersects with human trust. When organizations face external pressure—such as state-sponsored cyber capabilities or rapid technological shifts—the focus often defaults to technical countermeasures, potentially overlooking the underlying cultural responses. The discussion around AI as a potential CISO reflects an attempt to institutionalize security functions, but the pivot to psychological safety suggests that the efficacy of any security system is ultimately mediated by organizational acceptance and communication structures, not just technical controls. The juxtaposition of expert experience (McHenry's background) with systemic gaps (the China threat) points toward a tension between mitigating immediate technical threats and establishing long-term geopolitical and cultural resilience. What assumptions about AI neutrality and psychological safety are being prioritized over tangible risk management in these high-stakes scenarios? What structural accountability mechanisms must be established to ensure that security leadership addresses both the observable risks and the perceived organizational reality simultaneously?