Curtis Blais is Cybera’s Shared Chief Information Security Officer (CISO), an author, and a Harvard Cyber Risk Management Program alumnus. Through Cybera and his work with CANARIE’s National Cybersecurity Assessment initiative, he supports organizations across Canada’s research and education sector in strengthening cybersecurity governance, managing risk, and enabling secure collaboration and innovation.
Curtis sees most cybersecurity failures as people, process, or decision failures long before they become technology failures. His view shapes how he works: at least 70% of his time goes to governance, risk, strategy, and relationships, and every recommendation his team makes has to connect to a business, operational, or research outcome. Curtis’s answers for CISO Tips cover why tools should never be bought to find the problem, how he frames budget requests for the board, and why the first person assigned during an incident should be the one keeping the record.
Complete this sentence: “Before you buy any new security tool, first...”
Make sure you’ve clearly defined the risk you’re trying to reduce. Too many organizations buy tools hoping they’ll reveal the problem they’re supposed to solve.
What’s one rule you enforce on your team that other teams would find strict?
Every security recommendation must be tied to a business, operational, or research outcome. Technical excellence alone isn’t enough if people can’t understand why it matters.
What’s a number or ratio that guides how you allocate budget, headcount, or your own time?
I try to spend at least 70% of my time on governance, risk, strategy, and relationships, and no more than 30% on technology itself. Most cybersecurity failures are people, process, or decision failures long before they’re technology failures.
What’s one line that works when asking the board or CFO for budget?
“I’m not asking you to buy security. I’m asking you to reduce the organization’s exposure to an identified business risk.”
What should a CISO cut from their program tomorrow with zero regret?
Security activities that exist solely to produce reports no one reads or decisions no one makes. Every control, meeting, and metric should have a customer.
What’s your 60-second test for whether a vendor pitch is worth your time?
If they can’t clearly explain what risk they reduce, how they’ll measure success, and why existing controls aren’t sufficient, the meeting is probably over in under a minute.
What’s one meeting, report, or process you eliminated, and what replaced it?
Lengthy security status reports. Replaced them with concise risk-based discussions focused on decisions, ownership, and next actions. Stakeholders care far more about outcomes than activity.
In the first 10 minutes of an incident, what’s the one action teams most often skip?
Assigning someone to document decisions and timelines. During an incident, everyone focuses on technology. After the incident, everyone wishes they had a reliable record of what happened.
What’s one question every CISO should ask their team this week?
“If our most important service was unavailable tomorrow, do we know exactly who would make the first five decisions?”
What’s a phrase or framing you use to translate a technical risk for executives?
“This isn’t primarily a technology risk. It’s a risk to our ability to deliver services, protect trust, and achieve our mission.”
What’s your best tip for surviving the CISO role in exactly five words?
Translate risk. Build trusted relationships.
More tips from the series:
CISO Tips: Dean Navarro on Tying Every Security Dollar to Business Risk
CISO Tips: Jon Murphy on Finding the Signal and Ignoring the Noise
CISO Tips: Merlin Namuth on Earning Trust and Measuring Everything Against Risk
CISO Tips: Samuel Keter on Turning Security Controls Into Business Decisions
CISO Tips: Bryce Austin on Building a Security Program That’s “Secure Enough”