You Are The Strongest Link

2026-07-20 · Source: AI Magazine · Field: Technology & Digital — Cybersecurity & Data Privacy, Cloud Computing & IT Infrastructure · Depth: Intermediate, medium

Summary

Mathieu Manalo, CISO at ORIX METRO, advocates for employees as a company's strongest cybersecurity asset, challenging the "weakest link" perception. He highlights human error as a persistent vulnerability, often due to social engineering, but emphasizes that effective training transforms this risk into strength. ORIX METRO, a joint venture between ORIX Corporation and Metrobank, has implemented a multi-faceted strategy. This includes establishing a Managed Security Operations Centre with Antarex for 24/7 monitoring while retaining remediation control, and launching the "ORIX Transformers" initiative to drive digital adoption among 1,200 employees across diverse generations. Furthermore, ORIX METRO sustains awareness through an annual Cybersecurity Awareness Month, internal challenges, and automated, intelligent training via Proofpoint, aligning policies with ISO 27001 and US federal standards for comprehensive, user-friendly security.

Key takeaway

For CISOs or security leaders struggling with human error vulnerabilities, prioritize transforming employees into a "strongest link" through continuous, engaging security awareness. Implement automated, adaptive training like Proofpoint's to address specific user weaknesses, complementing 24/7 monitoring with a managed SOC. Ensure policies, aligned with ISO 27001 and US federal standards, are practical and easy to adopt across all generations, avoiding "compliance theatre" to truly enable secure operations.

Key insights

Effective cybersecurity transforms human vulnerability into strength through continuous, tailored engagement and practical policies.

Principles

• Security should enable business, not block it.
• Maintain "semi-trust" with all external vendors.
• Policies must be practical and easy to follow.

Method

Implement a multi-pronged approach: 24/7 managed security operations, internal digital adoption champions, annual awareness programs, and automated, adaptive training based on individual failure points.

In practice

• Establish a 24/7 Managed Security Operations Centre.
• Automate security training with adaptive content.
• Align policies with ISO 27001 and US federal standards.

Topics

• Cybersecurity Awareness
• Human Factor Security
• Managed Security Operations Centre
• Digital Transformation
• Security Policy Governance
• ISO 27001

Best for: Security Engineer, CTO, Executive

Related on AIssential

• Why People Can Be Digital Security's Strongest Link — Properly trained employees can transform from a security vulnerability into an organization's most robust defense.
• From Zero Trust to the UN: The Cybersecurity Policy Trends Shaping International Relations — Zero Trust is now a national security doctrine and international relations operating philosophy, driven by persistent state-sponsored cyber threats.
• Exploits of public-facing apps are surging. Why? — Cybersecurity threats are evolving with AI, yet basic hygiene and supply chain vulnerabilities remain critical attack vectors.
• Pulse Security Debuts Operational Management Platform Built for Security Leaders — The security industry needs an operational management platform for leaders, not just practitioners, to manage escalating cyber risks effectively.
• Mathieu Manalo, CISO at ORIX METRO on digital security — Effective digital security involves consolidating fragmented solutions, simplifying policies, and engaging employees through awareness training.
• ‘Don’t panic’: AI reality checks dominate major cybersecurity conference — Cybersecurity leaders should prioritize fundamental security practices and human expertise over AI hype.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI Magazine.