EP277: CISO as CFO, From Citi to Celery, It's All about the Cabbage

Key takeaways

AI is central to retail operations, driving efficiency in inventory, logistics, and pricing.
Security benefits from AI through improved threat detection, reduced alert fatigue, and continuous testing, even with limited budgets.
Quantitative metrics demonstrate significant improvements in vendor risk management and security responsiveness due to AI.
Addressing AI hallucinations and ensuring accountability remains critical, requiring human oversight and clear identity management for agents.
Resilience strategies include layered fallback options, human intervention, and leveraging cloud infrastructure for high availability.
Security leadership in low-margin environments must adopt a business-centric approach, balancing innovation with cost control.
IoT and OT security are expanding attack surfaces, requiring dedicated monitoring and the convergence of IT and operational security.

Summary

Introduction and Context Setting

The hosts introduce the episode from Google Cloud Next 2026, with Tim Peacock, Anton Chivak, and guest Arvind Bonsal, CISO at CNS Wholesale Grocers. The discussion begins with Arvind sharing insights into the grocery industry's unique physical and supply chain challenges, emphasizing the importance of product safety, stable logistics, and consistent retail presence. The conversation sets the stage for exploring how a traditionally physical goods-focused industry is adopting advanced digital and security technologies.

AI and Security in Retail and Supply Chain

Arvind discusses how AI is integral to core business operations in retail, improving inventory management, logistics, and dynamic pricing. The conversation shifts to how AI is also used for security, highlighting that even with limited budgets, grocery companies leverage AI to enhance detection, protection, and incident response capabilities. AI helps reduce alert fatigue and automates third-party risk management, enabling continuous security testing, which significantly enhances overall security posture.

Security Metrics and AI Effectiveness

The episode details quantitative benefits of AI deployment, such as a 150% increase in vendor coverage and a 90% reduction in questionnaire review times, leading to more efficient and proactive security processes. Arvind emphasizes the importance of metrics in measuring AI's impact and discusses how ongoing testing and automation improve threat detection and response.

Concerns about AI Hallucinations and Accountability

The conversation addresses concerns about AI-driven responses, especially in vendor security assessments, where hallucinations or inaccuracies could occur. Arvind and Tim explore accountability, emphasizing that ultimately, human oversight is essential. The discussion points out that establishing clear identity and accountability for AI agents is crucial before fully trusting automated responses.

Resilience and Cloud Strategy

Arvind explains multi-layered resilience strategies, including fallback procedures and human involvement, to mitigate AI or system failures. He highlights Google Cloud's role in providing multi-region availability and innovative resiliency features, ensuring operational continuity even during disruptions. The importance of integrating security resilience with cloud-based infrastructure is stressed.

Shifting Security Mindset in Budget-Constrained Environments

Arvind reflects on how the security mindset changes when operating with leaner budgets compared to large financial institutions. He emphasizes a business-centric approach, balancing cost, risk, and operational impact—similar to a CFO and CEO—focusing on ROI and strategic resource allocation rather than solely on technology deployment.

Security of IoT and Operational Technology (OT) Devices

The episode explores the risks associated with hardware targets as AI enables more accessible software development and code creation. Arvind warns of a growing attack surface involving IoT and OT devices like forklifts and warehouses, stressing the need for monitoring and securing these physical assets and considering the convergence of IT and OT security.

Adapting to a Thinner Margin Environment & Leadership Insights

The discussion concludes with Arvind sharing insights on how security leadership adapts to tighter margins. He advocates for a holistic view that combines business understanding with security strategy, recognizing the importance of agility, prioritization, and decision-making that balances technology, people, and processes.

Show notes

Guest:

Arvin Bansal, CISO, C&S Wholesale Grocers

Topics:

Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Can you produce the receipts for why this isn't a story of dry goods but rather a very meaty topic with beefy adversaries?
How are you as the CISO enabling C&S's journey into AI and LLM driven work? Securing AI is a bit harder than securing classic analytics tools, right?
In addition to securely rolling out AI, how is your defense team using AI to secure C&S? Are you into the era of agentic triage and response? What metrics for AI is your D&R lead surfacing up to you?
You have AI in the business process that - if failed - will leave people hungry. How do you approach AI resilience?
How do you approach resilience in general? Is cloud part of your resilience strategy?
You worked at Citigroup for a long time. What's it like having grocery margin budgets for security instead? How does your thinking change? Does this shift your build/buy/outsource for security?
If your IoT stack falls over, you've got literal ice cream melting in a warehouse. How do you balance your investments in cyber risk with physical operational risk? Should I be scared of forklifts?

Resources: