“Security should contribute to the value proposition of your organization”

Corence Klop has been CISO at Rabobank since September 2023, but her career did not follow the traditional cybersecurity route. Having worked in areas including innovation, digital transformation and data & analytics, she developed a passion for technology and complex organizational challenges.

That background still shapes how she approaches her role today. “The question is: how do you make an impact in such a complex environment? How do you bring everything together and actually get things done?” As a CISO, that inevitably starts with security risks, Corence says. “I rely heavily on strategy and on knowing what you are trying to achieve. Over the years, I have become better and better at managing risks.”

Cybersecurity as part of the business

At Rabobank, the CISO function sits on the business side of the organization, which is something Corence strongly believes in. “Ultimately, I have to contribute to the strategy of the organization. Of course you manage risks, but our strategy is also about customers trusting the bank and knowing that their money is safe. When you look at it that way, security suddenly aligns very closely with the strategy of the organization.”

It changes the conversation around cybersecurity. Rather than treating security primarily as a collection of controls or a necessary cost, it becomes part of what the organization delivers to its customers. “I would recommend that approach to anyone: security should contribute to the value proposition of your organization. I really believe it works.”

Corence acknowledges that she works in an organization where cybersecurity is taken seriously. “There is no discussion about whether we should invest in security.” But she does not believe that position can simply be taken for granted. A clear mandate and strong relationships with the board and business are essential.

Investing in human relationships

“I have invested enormously in relationships with the business leaders at the top of the organization”, Corence says. “They need to understand what we are doing and why we are doing it. You must become a sparring partner, and you shouldn’t start building that relationship when there is already a crisis.”

Human relationships become particularly important when security requires difficult business decisions. New vulnerabilities continue to emerge, and organizations cannot always resolve every issue immediately. “Sometimes you have to make difficult choices. You’re seeing more and more vulnerabilities, and you can’t always fix them quickly. Sometimes there simply isn’t a solution. Then the question becomes: do you accept the risk, or do you do things differently?”

Determining what is truly critical (and what isn’t)

Corence gives the example of delaying part of a business lending process in the Rabobank app in order to address vulnerabilities first. Decisions like these can have real business consequences. “Sometimes the choice simply costs money.”

That is also why determining what is truly critical cannot start at the moment a vulnerability appears. “You need to map that out beforehand. What is critical? Where can you accept days or weeks of downtime? As a CISO, you need to understand which business processes are so important that they always need to stay online.”

That assessment needs to be made together with the business. “These are decisions you have to make together. The CISO advises, but the business decides.” That discussion is not always straightforward. “Everyone tends to think their own process is the most critical.” Being able to see a customer’s balance, for example, is critical: if that functionality becomes unavailable, it can quickly have wider consequences. A mortgage process may allow for more downtime.

Leadership is about finding the right balance

For Corence, this illustrates why technical expertise alone is not enough to succeed as a CISO. “Technical knowledge isn’t the most important thing. You do need to be analytically strong, but I believe leadership is one of the most important aspects of the role. There are thousands of engineers following the priorities you set. Leadership is crucial.”

For Corence, leadership also means recognizing that not every security challenge can be solved within the boundaries of your own organization. She sees close cooperation with other organizations as an essential part of cybersecurity. “Security isn’t about competing with each other. If you’re the CISO of a large bank, having relationships with the other large banks, for example, is extremely important.”

She describes this as a circle of trust in which organizations share information about concrete incidents and lessons learned, but also discuss emerging developments such as frontier AI. “The threat is changing, so you discuss what you are doing about it, where you are investing and how you are responding.”

For Corence, that collaborative approach ultimately comes back to leadership. The decisions CISOs face are becoming more complex, and technical knowledge alone cannot resolve them. Asked which quality will become most important for CISOs over the next five years – technical expertise, strategic insight or leadership – her answer is clear.

“Leadership. You can always build your technical knowledge. But the decisions you have to make as a CISO are becoming increasingly complex.”