The CISO's AI Firewall
A CISO's Guide to Securing, Governing, and Deploying Artificial Intelligence
A practical executive framework for securing, governing and deploying enterprise AI.
Skip to contentCYBERSECURITYLINKBook a confidential strategy session
About / Author HubAuthor Hub: the published work of Steve Sharma
I write about the gap between deploying AI and owning the risk.
Books, research and talks: my own work on AI governance, AI security and accountability.
ASD-endorsed IRAP Assessor · CISSP · CISM · 18+ years across government, defence and financial services
Steve Sharma · Founder & Principal
6Books publishedSix published titles on AI security, governance, identity and DevSecOps.Read the books →18 yrsIn practiceGovernment, defence, financial services, telecommunications and critical infrastructure.Read the record →
If you're a director: start with the board briefing (no technical knowledge assumed) or the talk written for boards.
About
Eighteen years of being the person who signs off.
I'm Steve Sharma, a CISO, Principal Cybersecurity Architect and the Founder & Principal of Cybersecurity Link. For more than 18 years I've worked inside government, defence, financial services, telecommunications and critical infrastructure organisations, including four major banks.
I've led enterprise-scale security programmes, designed Zero Trust architectures, implemented identity governance platforms and secured cloud-native environments. I hold CISSP, CISM, SABSA, TOGAF, ISO/IEC 27001 Lead Auditor and CREST certifications, and I'm an ASD-endorsed IRAP Assessor. I write and speak on AI security, digital identity, Zero Trust and cyber governance, and I've published six books.
Career timelineKeep scrolling to explore
The through-line
What I keep arguing, book to briefing to board room.
01
Governing AI is not the same as securing it.
Policy frameworks tell you what should happen. They don't tell you whether your retrieval pipeline leaks, whether your agent can be redirected, or whether your model can be made to reveal its instructions. A governance programme that can't be tested is a document.
Argued in The CISO's AI Firewall →
02
The accountability gap is an org-chart problem before it is a technology problem.
Almost every organisation now runs on AI. Very few have named a person accountable for it. Security leaders inherited the responsibility without the budget, the headcount or the mandate, and they carry the personal exposure.
Argued in The CISO's AI Firewall →
03
Single-framework compliance will not survive the decade.
Baselines evolve, AI regimes disagree with each other, and the timelines themselves keep moving. Build to the strictest standard you touch and certify to that, rather than chasing each instrument as it lands.
Argued in The CISO's AI Firewall →
What I've changed my mind about. In 2024 I argued that certification against a formal AI management standard would stay voluntary for most organisations for several more years. That was wrong. Enterprise procurement moved faster than I expected, and by 2026 it was appearing in supplier requirements.
Books
Books
Six published. Every one connects back to the arguments in What I keep arguing.
Free
Get the briefingWho's accountable for AI?
A 🚩[N]-page briefing for boards. No technical knowledge assumed.
Research
Research & whitepapers
None of it is sponsored, and every piece carries an “as at” date. Check it before you cite.
Displaying 3 research pieces
Index #012026-07-28
Board briefing
Who's accountable for AI?
A 🚩[N]-page briefing for boards. No technical knowledge assumed.
Index #022026-07-14
Analysis
Governing AI without securing it is half an answer.
Why AI governance programmes that stop at policy, and never reach the security architecture, fail the first real incident.
Index #032026-08-05
Living document
Australia's Essential Eight is evolving. What organisations need to know.
Australia: tracking ASD's consultation on the Essentials series and what it means for current Essential Eight reporting.
Speaking
Speaking
I speak because an argument is easier to test in a room than on a page. The talks are practical, not motivational, and I'd rather be argued with than applauded.
01
Who's accountable for AI?
For boards & executive teams
- Where AI risk lands under governance expectations
- The four questions a board should ask management this quarter
- What good reporting looks like, with an example
02
Governing what you can't test
For security and risk practitioners
- Control families with no test procedure
- How retrieval, agents and prompts fail in production
- One governance system, mapped to several standards
03
When rules move
For compliance & GRC 🚩[confirm]
- Why framework-specific programmes age badly
- Building to the strictest standard you touch
- What to do when a baseline you've certified against changes
See a talk
🚩[video] Talk recording to supply, with title, event, date and running time.
Upcoming
🚩[Event name, format]
🚩[City]🚩[date]
🚩[City]🚩[date]
🚩[Event name, format]
🚩[City]🚩[date]
🚩[City]🚩[date]
Previously spoken at
🚩[Event name, format]
🚩[City]🚩[date]
🚩[City]🚩[date]
🚩[Event name, format]
🚩[City]🚩[date]
🚩[City]🚩[date]
🚩[N] stages since 🚩[year]. This list shows the most recent.
🚩 Organiser quote to supply: name, title and event, with written permission.
🚩 Permission pending
Speaking FAQ / 6
Questions organisers ask me
Direct answers, kept short enough to quote and forward.
Do you adapt the talk?
Yes, I adapt every talk to its audience. I'll ask who's in the room, their level, and what they should do next. Then we agree the title and takeaways together. I'd rather give a narrower talk that fits than a general one that doesn't.
Can you pitch it to a non-technical audience?
Yes, I often pitch talks to non-technical audiences. Talk 01 assumes no technical knowledge at all. Talk 02 goes the other way: it's written for practitioners and doesn't translate down.
In person or virtual?
I speak in person and online. Keynotes, panels and workshops suit both. Tell me which.
What does it cost?
I don't charge a speaking fee. If your event needs travel, I'll ask you to cover travel and accommodation. We agree that before booking.
Will you do a call before we commit?
Yes, I'll do a call before you commit. I'd encourage it. We should both be confident it fits before it's on a programme.
Our event is three weeks away. Too late?
Often not. Ask. If I'm free, yes.
Invite me
Invite me to speak at your next board meeting or conference
Tell me about the event and the audience. I read and reply to every message myself.
I reply personally, usually within one business day.
Or email me directly: hello@cybersecuritylink.com.au
Speaker one-page summary (PDF), for your programme committee🚩[link]Media & press
Media & press
Bios and assets for editors and producers, ready to use with no approval loop.
Short bio (40 words)
Steve Sharma is Founder & Principal of Cybersecurity Link and author of six books, including The CISO's AI Firewall. He has 18+ years across government, defence, financial services and critical infrastructure, and is an ASD-endorsed IRAP Assessor, CISSP and CISM.
Long bio (87 words)
Steve Sharma is Founder & Principal of Cybersecurity Link, an enterprise AI security and cybersecurity advisory, and a Principal Cybersecurity Architect. For more than 18 years he has worked across government, defence, four major banks, telecommunications and critical infrastructure. He holds CISSP, CISM, SABSA, TOGAF, ISO/IEC 27001 Lead Auditor and CREST certifications and is an ASD-endorsed IRAP Assessor. He writes and speaks on AI security, digital identity, Zero Trust and cyber governance, and is the author of six books, including The CISO's AI Firewall and Identity First.
Steve Sharma headshot800×800
Steve Sharma headshot
JPG · 800×800 · 98 KB
Download
Book cover, high-res1024×1536
Book cover, high-res
PNG · 1024×1536 · 2.5 MB
DownloadOne-page bio & fact sheet2 pages
One-page bio & fact sheet
PDF · 2 pages · 🚩[size]
DownloadOn the record
- AI governance under ISO/IEC 42001 and the NIST AI RMF
- AI security: red teaming, agent security and LLM-specific risk
- Security assurance, certification readiness and the assessor's role
- Board and director accountability for cyber and AI risk
Off the table
- Any client engagement, past or present
- Named vendors' products, positively or negatively
- Legal interpretation: I'll point you to counsel who can
Media & speaking enquirieshello@cybersecuritylink.com.au
Based in Australia (AEST). I reply personally, usually within one business day.
Coverage
Coverage
Coverage is listed here with an outlet, date and link for each item. 🚩 Entries to supply.
Currently tracking
🚩[N] items
Articles & interviews
🚩 Outlet, journalist, headline and date to supply for each article.
🚩[N] items
Podcasts & broadcast
🚩 Show, episode title, date and link to supply for each appearance.
🚩[N] items
Book reviews
🚩 Publication, reviewer, date and link to supply for each book review.
Journalists and producers: use the contact details above. I reply personally, usually within one business day.
Stay with the thinking
New research and speaking dates, when there is something worth sending.
One email every few weeks: what changed, what I've published and what I got wrong. No promotion.
This page is one person's work. The practice is not.
Everything above is Steve's own work. We assign every engagement a named senior executive before it begins; additional specialists are named in the proposal, subject to your approval.
Executive AdvisoryVirtual CISO (vCISO) and Virtual Chief AI Officer (vCAIO) leadership under one mandate.Explore the model Academy Learning HubThe frameworks in The CISO's AI Firewall, taught as courses, playbooks and certifications.See the catalogue Talk to Steve SharmaSpeaking, media or an Executive Advisory conversation: one inbox, one person.Write to Steve