Audit & Beyond 2025 | Rich Marcus, Chief Information Security Officer at AuditBoard

Clips
More from Audit & Beyond 2025

Rich Marcus

Chief Information Security Officer

AuditBoard

No passwords, no problem: How AuditBoard fights credential theft

Attackers want one thing: credentials. To combat threats, enterprises are now looking at cutting the target area entirely, shifting from sign-in models to passwordless security.Artificial intelligence makes phishing cheap to scale and security teams are now reporting surges in social engineering. That is why AuditBoard Inc. chose to remove passwords entirely so there was nothing left to phish, according to Rich Marcus (pictured), chief information security officer at AuditBoard.AuditBoard’s Rich Marcus talks with theCUBE about risk and passwordless security.“Anecdotally, we’ve seen a 400% increase in social engineering threats at AuditBoard

play_circle_outline Rich Marcus discusses evolving priorities amid changing risk management landscapes.

play_circle_outline Mitigating Social Engineering Threats: The Shift to Password-Less Systems for Enhanced Security and User Experience in Businesses

play_circle_outline AI and its governance are crucial for managing emerging risks in organizations.

play_circle_outline Companies struggle with regulatory compliance despite awareness of changing regulations.

Info
Transcript

Rich Marcus, Chief Information Security Officer at AuditBoard

Rich Marcus

Chief Information Security Officer AuditBoard

In this Audit & Beyond conversation, Rich Marcus, chief information security officer at AuditBoard, joins theCUBE’s Rob Strechay and Rebecca Knight to unpack how the role of the CISO is evolving from technical guardian to strategic business partner. Marcus shares why social engineering has surged – citing a 400% increase in attempts at AuditBoard – and explains the company’s push to passwordless authentication to blunt credential-theft attacks that make up 70–80% of what employees face. He outlines the rollout playbook (FIDO2-ready hardware, identity and prov... Read more

explore Keep Exploring

What recent trends and challenges are organizations facing in relation to emerging technologies and threats? add

What has been the impact of social engineering threats at AuditBoard, and what measures have been taken to address them? add

What is AuditBoard's approach to implementing AI while considering security and privacy in their market? add

What are the key considerations for a Chief Information Security Officer (CISO) when addressing the risks associated with AI use in an organization? add

bolt Powered by CUBE AI

Rich Marcus, Chief Information Security Officer at AuditBoard

search

Rebecca Knight

>> Good afternoon everyone, and welcome back to theCUBE's live coverage of AuditBoard's Audit & Beyond. I'm your host Rebecca Knight, alongside Rob Strechay, my co-host and analyst. Rob, let me be the first to wish you a happy cyber security awareness month.

Rob Strechay

>> Well, I think what's funny about that is is like it feels like every month should be cyber security awareness month, to put it mildly. I think it's really just a very important to get a lot of these topics out, especially with everything that's going on.

Rebecca Knight

>> Indeed. And of course, they did choose the spookiest month-

Rob Strechay

>> Of course they did....

Rebecca Knight

>> for cyber security awareness month. With that, I would like to welcome our next guest. He is Rich Marcus, chief information security officer at AuditBoard. Welcome, Rich.

Rich Marcus

>> Thank you so much for having me.

Rebecca Knight

>> And a happy cyber security awareness month to you-

Rich Marcus

>> And to you as well....

Rebecca Knight

>> and all who celebrate. So Rich, why don't you level set a little bit right now and talk about some of the top priorities that you have and about how those priorities are really evolving as the risk management landscape changes too.

Rich Marcus

>> Well, first of all, I'll say it's been a hot topic for discussion here this week. We always get energized. We get our risk practitioners together talking about the emerging threats and risks that we all face. And for us at AuditBoard, just like the rest of the industry, we're responding to a lot of threats that come from emerging technologies like AI. We're dealing a lot with our internationalization efforts and spreading our technology around the globe, and we've been doing a lot of announcements this week. I mean, we're announcing a lot of new products and acquisition this morning, and so we're tracking a lot of attention from social engineering, phishing, spoofing, all of those kinds of threat actors in the marketplace. So it's a pretty active environment right now. A lot to wrap our heads around. But having a great time this week exchanging thoughts with our peers on how to deal with some of these emerging threats.

Rob Strechay

>> I'm glad you brought up the social engineering part of it because to me that's always been one of the hottest topics for the last five years, at least, is, I mean, we were at MGM when that happens to them and we've been to other places when it's happened to them. When you look at that, has that really been one of the impetuses to really go down the password-less direction?

Rich Marcus

>> Yeah, 100%. So I mean, anecdotally, we've seen a 400% increase in social engineering threats at AuditBoard. Part of that is because it's just becoming more prolific in the world. AI is making it easier to launch these types of attacks. We happen to be in the news a little bit more and I think are a more attractive target these days. But more and more we're seeing this at the top of the list in terms of volume for the types of attacks that our employees face. And so we've been really thoughtful about how to mitigate that over the last couple of years. We've done some things around email security and corporate communication security, but we realized that in most of these social engineering attacks, they're after credentials. I think 70 to 80% of the attacks that we see appear to be some form of credential compromise attack. And so knowing that that's what they're after, we finally decided, let's just get rid of them. Let's just not have the credentials and we don't have to worry about it.

Rob Strechay

>> How's it going? How's the rollout going?

Rich Marcus

>> It's going pretty well. It is an emerging strategy. So we had to work with a number of our vendors to get them aligned to the approach and get it working end to end. But it's something that our employees really like. And the surprise, I think, twist to this implementation has been IT really likes it too. So if you think about it, if you don't have a password, you can't forget it.

Rob Strechay

>> I was going to say that's nobody wants the 18,000 letter number combination thing anyways.

Rich Marcus

>> Yeah. You can do away with the password complexity concerns. You can do away with password resets. And so it's been much easier for IT to onboard employees without use of passwords and the end user experience is just better. It's easier. So those are really the best wins in security when you can do something that benefits productivity, your employee and user sentiment, and you get a security benefit on top, it's just win-win-win all around.

Rob Strechay

>> Yeah. Before we, one thing because we always talk about a lot of it is also the education. And given it's cyber security awareness month, say that 10 times fast, how did you bring the organization along from that education standpoint and partner up with them?

Rich Marcus

>> Yeah, education and awareness is a big part of any security solution rollout that we might pursue. We started with our counterparts in IT, looking at our tech stack. To implement password-less, you got to have the right hardware, you got to have those FIDO2 compliant chips in all the hardware. You got to make sure that your identity platform support it. All of your provisioning systems support it. You got to train IT on how to set up password authentication methods for end users. So it's a little bit of retooling that you have to go through, a little bit of upfront investment. And then of course you can roll it out. We started with new hires first. So they're coming in the door, they're getting access to new systems anyway. They have to be trained. And then we just went department by department, and we found that really the cost to migrate's pretty low. People are pretty used to using biometrics, the fingerprint to sign into things, and they were happy to adopt it. It didn't take much convincing to get folks to jump on board.

Rebecca Knight

>> And adoption is often one of the biggest challenges that CISOs face in an organization. Talk a little bit about your role. Because the role of CISO has changed dramatically even from just five years ago. How do you describe what it means to be an effective CISO in organizations today?

Rich Marcus

>> Yeah, great question. I think legacy CISOs were expected to be jack of all trades when it came to technology. They had to be prepared to understand and defend the technical decisions that an organization may need to make, all the risks and threats that those assets face. But more and more, they're being called upon to be strategic business partners, and to advise and consult the leadership on where do we go as a company to navigate around some of these tricky risks and threats. And so I think to be an effective CISO today, you have to be really aligned with your leadership team, understand where the business is going. Like Wayne Gretzky said, you want to skate to where the puck is going, and help them navigate around some of the rocks in the water. And if you can bring technology solutions to bear to de-risk those plans, you keep getting invited back to the conversation, the strategic conversations that really propel the business forward.

Rob Strechay

>> Yeah. I think that makes so much sense in the fact that, again, partnering up, continuing with that theme, AI has really just been everywhere. I mean, for the last couple of years since the ChatGPT moment. I mean AI was there, more traditional AI, but now with the large language models and everything else that's going on, how do you see what you're doing? Because you're usually in the non-specific AuditBoard place, you would be a customer and partner of Audit. How do you see your experience being inside AuditBoard, helping other customers and things to understand governance, especially when it comes to things like AI?

Rich Marcus

>> Right, right. Yeah. At AuditBoard, we're really bullish on AI. We're implementing a ton of capability in our product that's AI powered, and we're boosting productivity of our employees with all different kinds of AI tools internally at AuditBoard. But we know we operate in a really security and privacy conscious market space. So we were really thoughtful also about how do we help our customers get comfortable with making this leap with us and undergoing this transformation. It really starts with visibility. So AI governance really starts with understanding all of the use cases and tools and models that you might use, doing risk assessments against those use cases, identifying the key controls to protect your use case of those. And we really found it's not all that dissimilar from other emerging technologies that have come in the past, like the cloud transformation, for example. So as we started to develop some of these capabilities for ourselves at AuditBoard, we realized we could actually bring a lot of these capabilities to the market and help our customers with these same challenges.

Rebecca Knight

>> In terms of the recent AI governance report though, I know that AuditBoard showed that most companies are aware of the new regulations, but only a fraction of implemented programs related to them. What do you think, what is behind this chasm here? Because that's concerning.

Rich Marcus

>> Yeah, it's really a connected risk problem. AI is something that's popping its head up in all corners of the business. So it starts with having the relationships with the right stakeholder groups in your organization and understanding where those use cases are emerging and really inventorying all the tools and use cases that are being pursued. Regulations, you're right, are top of mind for a lot of security leaders, but do they have the relationships? Are they really connected in the right spaces? Legal, procurements, working with your internal audit partners and your risk partners to get a good sense of what that landscape looks like so you can really get in there and do proper assessment and control it.

Rob Strechay

>> So just taking a step back, you're CISO for AuditBoard. So that means that a lot of the compliance that you have to meet operating around the world, very large companies and organizations, to smaller companies, but no less need that same security, you guys, are you SOC 2, is it SOC 1, SOC 2?

Rich Marcus

>> Yeah, we've had our SOC 2 report for several years. We're ISO 27001 certified.

Rob Strechay

>> GDPR.

Rich Marcus

>> Oh, yeah. Oh yeah.

Rob Strechay

>> So when you look at this and you're helping AuditBoard understand because now there's data sovereignty, there's all of these different things. Some of the organizations, like if you were operating in France, for instance, where DORA came from and all of this, not the explorer, but the regulations around compliance and VR, how do you see that regulatory landscape, not only impacting you in AuditBoard, but impacting your customers, and what kind of advice are you giving?

Rich Marcus

>> We made two huge announcements this morning to address exactly this problem that faces compliance and regulatory teams around the world. It is a very toilsome and manual process historically to really keep your arms wrapped around all of these distinct requirement sets, trying to rationalize and deduplicate them and approach them in sort of the most efficient way possible. Not to mention version changes, new regs coming in all the time. So this morning we announced a new solution called RegComply. The whole purpose of that product is to basically subscribe to changes in the regulatory landscape, be informed when regulations change, and help you with version changes from one to another, and facilitate it as a more of a streamlined process. It's something that just begs for an AI solution to come in and help make that more efficient. We also announced this morning the acquisition FairNow. And they have deep, deep expertise in this space, specifically around AI governance. So they're bringing all kinds of new content and expertise into the platform to help our customers manage regulations around their use of AI specifically. It's a really exciting time.

Rebecca Knight

>> So one of the things that was so clear when we were talking to your colleagues, Anton Dam and Happy Wang, is that AuditBoard designs for the end user. That they design for the humans who are using these products. And you've been both a CISO and also an end user.

Rich Marcus

>> That's right.

Rebecca Knight

>> How does using AuditBoard internally, and I know people say the dog food, the champagne, whatever.

Rich Marcus

>> I like the Hair Club for Men founder. Do you remember him?

Rebecca Knight

>> Yeah.

Rich Marcus

>> He's not only the founder, but he's also their best customer.

Rebecca Knight

>> He's also a customer. Right. Okay. So you're the Hair Club. How does using it internally influence and shape how you also build the product too?

Rich Marcus

>> We're customer obsessed at AuditBoard. We really pride ourselves on understanding the pain points and the challenges of being a risk practitioner in this day and age, and solving for those challenges really well. So it was one of the things that brought me to AuditBoard. I was the head of global GRC at Verizon Media before AuditBoard. I struggled with a lot of GRC tools and regulatory concerns and problems of scale. And I just knew there was a better mousetrap that we could build. So it excites me. It's what really gets me revved up to come to work every day to solve problems for people that are just trying to do the right thing and manage the risks in their organizations. It's great to be able to design and bring tools to make their lives easier and make them more effective at what they do.

Rob Strechay

>> I mean, to me, just staying on that theme, it would seem like, again, having that background that you have, having been other places and seen it, I know from my personal thing, back in the dark ages when we were using databases, and it was worse than using Excel, so it was like a lot of paper. As you fast-forward to today and where AI is starting to pitch in and help out, do you also see this, I mean, there's been this theme of not being, risk and compliance and GRC, the audit department not being the team of no, but being the team of, yes, let's help you go faster by short-cutting and giving you tools that get you around this. Are you seeing that, even in your past life where this could have helped you in that way because of the fact that, hey, it's now additive, not subtractive to my hours of my day kind of thing?

Rich Marcus

>> Yeah. Unfortunately, I think there's still a lot of toil in what we do. Particularly in compliance and in audit functions, there's a lot of toil, a lot of manual process. And when you've got your heads down working through a lot of those manual processes, you can't really see the forest through the trees. It's harder to provide strategic value to your counterparts in company leadership. And so I think that the best thing we can do for folks in that situation is help them automate some of those manual tasks, free up some more time so they can be more strategic and figure out how they can be a business enabler. I think if you ask any audit, risk, or compliance practitioner, what they really want is to figure out how to manage risks so the business can be successful. They don't want to slow the business down. They don't want to stop the business. They're all on the same team. They want to score points. They want the business to win. And so they're looking for ways to manage risk in a smart way, prevent the things that are going to knock the business off the course that they're trying to get to and help them get there faster and safer.

Rebecca Knight

>> And to have risk management be a real engine for growth.

Rich Marcus

>> Yeah, I like the engine analogy. I've often said to my CEO, my CFO, good brakes actually let the car drive faster, right?

Rebecca Knight

>> More safely. And more safely.

Rich Marcus

>> That's the analogy, right? We can understand where the sort of risk appetite, risk tolerance are, give that level of control to the business so they can really go fast, hug the curves, and get across the finish line safely.

Rebecca Knight

>> Excellent. Well, Rich Marcus, a pleasure having you on theCUBE. A really interesting conversation.

Rich Marcus

>> Pleasure's mine. Thank you for having me.

Rebecca Knight

>> I'm Rebecca Knight, for Rob Strechay, stay tuned for more of theCUBE's live coverage of Audit & Beyond. You're watching theCUBE, the leader in enterprise tech news and analysis.