Subscribe now

Tarik Ustuner is the Chief Information Security Officer at Bybit TR, where he is responsible for safeguarding the organization’s information systems in a high-stakes, fast-moving financial environment. In his role, Tarik designs and implements robust security protocols, works closely with internal teams to identify and mitigate vulnerabilities, and strengthens compliance with industry standards, driving measurable reductions in security incidents along the way. Known for his pragmatic, action-oriented mindset, Tarik approaches cybersecurity as a living discipline: one that requires a deep understanding of the business, constant awareness of the evolving threat landscape, and the resilience to respond decisively when it matters most.

1. Complete this sentence: “Before you buy any new security tool, first...”

Audit your existing tech stack to see what’s already capable of doing the exact same thing but was never fully deployed. Most security gaps are caused by 20% tool utilization, not a lack of tools.

2. What’s one rule you enforce on your team that other teams would find strict?

We enforce a strict “no manual changes in production” rule. Even during a high-severity incident, no one is allowed to hotfix code or configurations directly on live servers. Everything must go through the CI/CD pipeline and automated checks. Other departments think it slows us down during a crisis, but it prevents a bad situation from becoming a catastrophe.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

The 80/20 rule. I dedicate 80% of my budget and team focus to rock-solid cyber hygiene: patch management, identity protection, and visibility. The remaining 20% goes to advanced tools and proactive threat hunting. There is no point in buying a state-of-the-art security system if your front door doesn’t lock.

4. What’s one line that works when asking the board or CFO for a budget?

“This budget isn’t a guarantee that we will never be breached; it’s an investment to ensure that when a breach happens, our business recovery time drops from three weeks to three hours.”

5. What should a CISO cut from their program tomorrow with zero regret?

Those annual, boring, compliance-driven security awareness videos that everyone mutes. No one ever stopped clicking on a phishing link because of a slide deck. Replace them with real-time, bite-sized, interactive simulation triggers.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

In the first 60 seconds, they need to talk about my specific business problem, not their product features. If the pitch starts with buzzwords like “AI-driven, revolutionary, next-gen paradigm shift,” my clock runs out and the meeting is practically over.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I killed the traditional two-hour Monday status update meeting and replaced it with a 15-minute daily stand-up. I also eliminated the 40-page monthly PDF security report, replacing it with a single, dynamic executive risk dashboard.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Taking a breath and documenting the initial blast radius. Teams usually panic and rush to patch things or kill servers immediately. In doing so, they often destroy vital logs and evidence. The first 10 minutes should strictly be about calm containment and logging what is currently happening.

9. What’s one question every CISO should ask their team this week?

“What is the one control or system we trust the most right now, and when was the last time we actually tried to break it ourselves?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

I strip out the technical jargon and translate it into operational downtime: “This vulnerability doesn’t just mean an unpatched server; it means our primary revenue engine goes dark for 48 hours, costing us roughly fifty thousand dollars an hour.”

11. What’s your best tip for surviving the CISO role in exactly five words?

Own risk management, not risk.

See the other tips shared by other CISOs:

• CISO Tips: Shady Shaker on the 70/30 Rule and Discipline That Scales

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

Subscribe now

Subscribe now

Dr. Adeel Shaikh Muhammad is a cybersecurity leader, author, researcher, and international speaker specializing in AI-driven security operations, cyber risk, governance, and enterprise security strategy. He has advised organizations across the GCC and beyond on SOC transformation, AI governance, security architecture, compliance, and cyber resilience. He is the author of AI-Driven Transformation of the SOC and SecOps and frequently speaks on the intersection of cybersecurity, AI, governance, and leadership.

1. Complete this sentence: “Before you buy any new security tool, first...”

Before you buy any new security tool, first define the exact risk, business outcome, and operating owner it is meant to support. A tool without ownership becomes shelfware very quickly.

2. What’s one rule you enforce on your team that other teams would find strict?

No critical security decision should be based only on a dashboard or vendor score. I expect the team to validate context, business impact, and real exploitability before escalating or closing a risk.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I like to balance security investment across three areas: prevention, detection, and response. If most of the budget is going only into prevention tools, the program usually becomes blind during real incidents.

4. What’s one line that works when asking the board or CFO for a budget?

“This is not a technology expense; it is a risk reduction investment tied to business continuity, regulatory exposure, and customer trust.”

5. What should a CISO cut from their program tomorrow with zero regret?

Any report, meeting, or tool that does not change a decision, reduce a risk, or improve response capability. Security teams are often overloaded by activity that looks productive but does not improve resilience.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

I ask: “What specific risk do you reduce, how do you prove it, and what will my team need to operate it after purchase?” If the answer is only buzzwords, it is not worth the time.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I have replaced long status meetings with risk-based decision updates. Instead of discussing every open item, the focus becomes: what risk changed, what decision is needed, and who owns the next action.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

They often skip assigning a clear incident commander. Without one accountable lead, teams lose time debating actions, duplicating work, or communicating inconsistently.

9. What’s one question every CISO should ask their team this week?

“If this control fails today, how quickly would we know, who would respond, and what evidence would prove it worked?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

I translate technical risk into business impact: “This is the path from a technical weakness to financial loss, operational disruption, regulatory exposure, or reputational damage.”

11. What’s your best tip for surviving the CISO role in exactly five words?

Prioritize risk, people, and clarity.

Subscribe now

For more CISO Tips, read Shady Shaker’s 70/30 Rule and take on discipline.

Subscribe now

Shady Shaker is a Senior Manager in Cyber Security at PwC Egypt, with more than 20 years of experience in cybersecurity, information security, and risk management. He has spent more than seven years supporting CISO functions, leading initiatives across cybersecurity strategy, security programs, governance, risk and compliance (GRC), and regulatory compliance. He helps organizations strengthen cyber resilience, manage emerging risks, and align security programs with business objectives.

1. Complete this sentence: “Before you buy any new security tool, first...”

Conduct cybersecurity due diligence on all prospective vendors offering similar tools, verify their security certifications and the scope of those certifications, ensure the tool’s capabilities directly support the specific compliance requirements and use cases you are targeting, confirm that robust implementation and ongoing support services are available, and require a proof of concept (POC) to validate the tool’s capabilities in your environment.

2. What’s one rule you enforce on your team that other teams would find strict?

• Enforcement against shadow IT and shadow AI, by establishing clear acceptable-use rules that define which AI tools and BYOD devices are approved and permitted, which data can be used, and which business roles may use external AI services.

• No production change or new integration may go live unless it goes through the change management process, including a documented security review and explicit approval from the security team, regardless of who owns the system or how minor the change may appear.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

My usual advice is to keep about 70 percent of budget and headcount focused on keeping current controls effective: monitoring, incident response, patching, compliance operations, and essential tooling. The remaining 30 percent goes to strategic improvements, automation, and innovation.

4. What’s one line that works when asking the board or CFO for a budget?

This isn’t a request for security spend; it’s an investment to prevent or reduce the risk of a quantifiable loss of X and to protect Y% of our revenue-critical operations.

5. What should a CISO cut from their program tomorrow with zero regret?

• Anything, or any control, that doesn’t reduce risk or support compliance.

• Unused or redundant tools.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

If the vendor doesn’t understand the problem, or the tool doesn’t actually address it.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

The most important thing is to maintain a concise security dashboard supported by a brief written update.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Documenting what is actually happening before they start “fixing” things, and communicating the incident.

9. What’s one question every CISO should ask their team this week?

Understand the existing roadblocks to implementing new tools, identify where time-to-value can be shortened by simplifying processes, and pinpoint manual tasks that can be automated.

10. What’s a phrase or framing you use to translate a technical risk for executives?

Translate technical risks into business risks and their financial impact.

11. What’s your best tip for surviving the CISO role in exactly five words?

Watch threats from emerging technologies.

Subscribe now