“If organizations don’t defend against cyberthreats collectively, eventually they will lose”

Nikolaus brings a wealth of experience in cybersecurity. He previously served as CISO at Brussels Airlines, Corporate CISO at Rentschler Biopharma and Head of Security Operations at Giesecke+Devrient. He also held security roles at organisations including Siemens Financial Services and SITA. It is a diverse career, but with one important common thread: every sector Nikolaus has worked in is highly regulated.

“What I have learned most during my career so far is to take regulations and turn them into human change management,” says Nikolaus. His new role as Field CISO at Rapid7 is a natural fit. “I get to relate to our partners and customers daily, and exchange ideas with them. Out of every conversation, I take something with me. My main goal is to optimize our products and services for the current needs in the market.”

Cybersecurity is a team sport

Nikolaus compares his work with Rapid7 customers to his past as an ice hockey goalkeeper. “The goalkeeper is crucial; a good save can mean the difference between winning and losing. But the goalkeeper can’t defend on his own.”

The entire team has to defend, and it is up to the goalkeeper to make sure that defense is properly organized, he explains. “Just as a CISO needs to organize the organization properly to defend against cyberthreats.”

Together with Rapid7’s customers, Nikolaus approaches cybersecurity the same way: as a collective responsibility. “If we don’t defend against cyberthreats collectively, eventually we will lose. It’s the simple truth for any organization today.”

As Field CISO, he therefore spends much of his time building strategic partnerships based on mutual trust. “I want to understand our customers so that we at Rapid7 can be as customer centric as possible. This role enables me to take bits and pieces from my career and re-use them for the benefit of everyone.”

Cooperation is the key, Nikolaus emphasises. “I wasn’t spoon-fed wisdom and I don’t try to spoon-feed it to anyone. The key is to build a trusting relationship and go from there.”

Use regulation to raise awareness

In his conversations with organizations, Nikolaus often finds that they underestimate their own cyber exposure. He therefore sees the growing amount of cybersecurity legislation and regulation as a positive development.

“CISOs are often told by the board: security is your problem, not mine. Well, regulations like NIS2 make it a collective effort. The entire organization has a responsibility; the regulation clearly states that.”

Of course, CISOs need to avoid a familiar pitfall: ticking boxes until the organization is compliant while its cybersecurity is still not where it needs to be. “My take is: use regulations to your advantage. Let them help you raise awareness. Policymakers will continue to regulate even more in the future; this creates windows of opportunity for CISOs.”

The role of the CISO, Nikolaus believes, is to look beyond the letter of the legislation itself. “Address it seriously: what does this regulation aim to achieve? Implement regulations with that in mind. That prevents you from having to redo it later on. As I’ve told many organizations in the past: you will get audited, so you’d better implement this properly instead of just ticking the boxes.”

CISOs evolving into change managers

To raise awareness throughout the organization as effectively as possible, CISOs increasingly need to act as change managers, says Nikolaus. Reflecting on his experience in the aviation industry, he says: “I used to view myself as a policeman for the computer, but I changed my approach.”

“Instead of telling people about our cyber policy, through awareness campaigns for instance, I moved to showing what happens when you have a security breach. I made people within the organisation understand why we had those policies in the first place.”

This approach led to a dramatic decline in policy violations, Nikolaus explains. “We weren't simply instructing people on how to behave, but we were involving them. We used, for instance, gamification to show people how hackers tried to attack our company. Initiatives like that raised awareness more than any instruction manual could have ever achieved.”

Where Nikolaus once saw himself as a “policeman for the computer”, his experience across highly regulated sectors has fundamentally changed the way he views the CISO role. “I now see myself as a kind of risk appetite dietician for the board. I moved from factual management to people management.”

His main advice to CISOs today? “Always involve the people you require. Cybersecurity is never built by the CISO alone; you need people to understand it, support it and build it.”