Why People Can Be Digital Security's Strongest Link

2026-07-23 · Source: AI Magazine · Field: Technology & Digital — Cybersecurity & Data Privacy, Human Resources & Workforce Development, Operations & Process Management · Depth: Intermediate, short

Summary

Mathieu Manalo, CISO at ORIX METRO Leasing and Finance, advocates for employees as digital security's strongest link, challenging the "weakest link" narrative. Joining in July 2025, Manalo aims to position security as a business enabler. He addresses significant adoption challenges within ORIX METRO's 1,200-employee, multi-generational workforce and fragmented infrastructure. Strategies include forming an "ORIX Transformers" team to champion new digital platforms, partnering with Antarex for a Managed SOC while retaining remediation control, and implementing continuous awareness programs. These programs feature weekly quizzes and automated security training via Proofpoint, which assigns targeted content based on employee failures. Manalo also ensures security policies, following ISO 27001 and US federal standards, are practical and easy to follow.

Key takeaway

For CISOs and security leaders aiming to cultivate a resilient security posture, prioritize transforming your workforce into a proactive defense. Focus on continuous, practical training and awareness programs, like automated scenario-based learning, to empower employees. Ensure security policies are user-friendly and align with daily tasks, avoiding "compliance theatre." This approach shifts the perception of security from a blocker to a business enabler, significantly enhancing organizational resilience against evolving threats.

Key insights

Properly trained employees can transform from a security vulnerability into an organization's most robust defense.

Principles

• Employees, when trained, become the strongest security link.
• Security functions best as a business enabler, not a barrier.
• Sustained awareness requires continuous engagement and repetition.

Method

Establish internal "champions" teams to facilitate adoption of new digital platforms and practices across diverse workforces. Implement a Managed SOC, ensuring the organization retains full remediation and decision-making authority over its assets. Automate security training with platforms that deliver targeted content based on specific employee failures.

In practice

• Create an internal "Transformers" team to drive digital platform adoption.
• Partner with a Managed SOC but keep administrative access in-house.
• Use Proofpoint or similar for automated, scenario-based security training.

Topics

• Digital Security
• Employee Training
• Cybersecurity Awareness
• Managed SOC
• Social Engineering
• ISO 27001
• ORIX METRO

Best for: Executive, Security Engineer, IT Professional, Consultant

Related on AIssential

• You Are The Strongest Link — Effective cybersecurity transforms human vulnerability into strength through continuous, tailored engagement and practical policies.
• Enterprises report increasing budgets for security training in AI and other critical topics — Enterprises are prioritizing cybersecurity training, especially for AI skills, despite significant time constraints.
• Five Steps To Protect Your Organisation From Ai Powered Cyber Threats — AI-powered cyber threats necessitate layered defenses, robust fundamentals, and human oversight to protect data.
• Mathieu Manalo, CISO at ORIX METRO on digital security — Effective digital security involves consolidating fragmented solutions, simplifying policies, and engaging employees through awareness training.
• One Month In: My First Steps Into Cybersecurity — Mastering cybersecurity involves embracing initial confusion and iterative problem-solving, shifting from memorization to understanding attacker mindsets.
• How MIT students are helping to prevent cyberattacks — Cybersecurity is a human-centric challenge requiring "defensive social engineering" and organizational capacity building, not just technical fixes.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI Magazine.