CDW’s Walt Powell on CISO 3.0 and Translating Cyber Risk into Business

https://www.infosecurity-magazine.com/interviews/cdw-walt-powell-field-ciso/

Publish Date: 2026-05-07 02:24:58

Source Domain: www.infosecurity-magazine.com

Summary

Walt Powell, the lead field CISO of CDW, highlights significant changes in the cybersecurity landscape since he began in the field several decades ago. Initially transitioning from a musical career to cybersecurity at CDW, Powell has seen the evolution of the CISO role from a purely technical one focused on tools and compliance to a more strategic and business-oriented position. Powell emphasizes that modern CISOs need to transition from internal firefighting roles to external advisory positions, facilitating peer relationships with client CISOs, and working on industry relevance through eminence activities. Powell created a martial arts-themed belt system to measure and motivate skill development for his CISO team, focusing on technical and business skills. He stresses the importance of quantifying cybersecurity risks to align them with business objectives and secure board buy-in, and advocates using advanced risk quantization methods over basic risk matrices.

Key Points:

The role of a field CISO has evolved to encompass more advisory activities and partnerships with client CISOs focused on enhancing the security strategy and making cybersecurity a business-level initiative.
Powell’s innovative belt system helps to quantify and motivate skill development in his CISO team, emphasizing both technical and strategic skills.
Modern CISOs are increasingly expected to understand and quantify cybersecurity risks in business terms to effectively communicate with C-suite executives and secure necessary budgets.
Significant evolution from a technical to a more business-focused CISO role has led to greater accountability and responsibility, necessitating a blend of technical and business acumen.
To engage with the board effectively, CISOs must quantify cybersecurity risks, demonstrating the potential financial impact and justifying the allocation of resources to mitigate these risks.