Black Hat USA 2025 | Liz Morton, Axonius

Clips
More from Black Hat USA 2025

Liz Morton

Field CISO

Axonius

pause_circle_outline Jackie McGuire introduces Liz Morton, Field CISO at Axonius, highlighting their friendship and commonalities.

play_circle_outline Liz shares her background in cybersecurity, previously leading security at Intercontinental Exchange.

play_circle_outline Conversations with customers are increasingly focused on budget constraints and resource allocation.

play_circle_outline Suggests connecting with Liz for insights on budgeting and security strategy.

Info
Transcript

Liz Morton, Axonius

Liz Morton

Field CISO Axonius

At Black Hat USA 2025, Liz Morton, field CISO at Axonius, joins theCUBE’s Jackie McGuire for a candid discussion on how economic realities are reshaping security conversations and purchasing decisions. Morton draws from her 30-year career, including leading cybersecurity at Intercontinental Exchange, to share how her role has shifted from internal program leadership to influencing customer outcomes as a sales-facing executive. She explains how Axonius’s asset intelligence platform is helping practitioners and executives alike align budgets, risk reduction and... Read more

explore Keep Exploring

What was the nature of the relationship between Jackie McGuire and Liz Morton when they first met? add

What is your professional background and current role? add

What challenges are teams facing when trying to secure budget for new cyber security solutions? add

What advice was given regarding connecting with Liz Morton? add

bolt Powered by CUBE AI

Liz Morton, Axonius

search

Jackie McGuire

>> Welcome back to Black Hat 2025 at the Mandalay Bay in beautiful Las Vegas, Nevada. I'm Jackie McGuire, Practice Lead, Principal Analyst, favorite media host for security, and I am here with not just one of my best friends, but one of the smartest people in security I know, Liz Morton.

Liz Morton

>> Wow.

Jackie McGuire

>> Field CISO from Axonius.

Liz Morton

>> Thank you.

Jackie McGuire

>> The day we met, I was like, "Oh my gosh, we're the same person."

Liz Morton

>> Oh yeah, we have a lot in common. I remember that day really well.

Jackie McGuire

>> Oh yeah, me too. It was amazing, and nothing has changed.

Liz Morton

>> Instant bond.

Jackie McGuire

>> Yeah, nothing has changed. So you have run security at some insanely large, critical places. Can you introduce yourself and give-

Liz Morton

>> One in particular, yeah.

Jackie McGuire

>> Yeah, give our audience a little bit of your background.

Liz Morton

>> Sure. So right now, I'm field CISO as you know for Axonius. But before that I ran cybersecurity for a company called the Intercontinental Exchange. They are known as ICE, but not that one.

Jackie McGuire

>> Not that ICE, we promise.

Liz Morton

>> That's their trading symbol. So it makes it complicated to talk about them sometimes. But they are best known, they're financial services based in Atlanta where I live, and they're best known for owning the New York Stock Exchange.

Jackie McGuire

>> Oh. Little start up.

Liz Morton

>> Little something. Little start up, yeah, called the New York Stock Exchange. I worked for them for many years in a couple of different capacities. First in IT and then in cyber and fabulous, wonderful organization. I tell people that I got my PhD in getting stuff done at ICE.

Jackie McGuire

>> Yeah. When we were just talking before we started, I remember interviewing you at Axonius, and you had just joined and you were so excited because you get to talk more with customers and help them.

Liz Morton

>> This is a great job, yes.

Jackie McGuire

>> Yeah. So what do you like about your role and now that you're months into it, what do you think?

Liz Morton

>> Yeah, so I've been a field CISO now for about eight months, which means I've been a sales-facing, customer-facing person for the first time in my career because I go back about not quite 30 years.

Jackie McGuire

>> As much as you can sell to security people, we're not super easy to sell to.

Liz Morton

>> No, and what's funny is sometimes I think, especially when I'm dealing with a tough customer, not that any of our customers are tough, we love our customers, but sometimes I run into a me and I'm like, "Oh."

Jackie McGuire

>> Like, "Is this what I was like to deal with?"

Liz Morton

>> Is this karma? Is this karma, or am I just earning my money now? And I love that actually. I had a meeting with a customer yesterday who was a tough customer and it was really fun. We managed to get to, "Oh yeah, you do see what I have to say about that, and you see the validity there." And I think that's probably my favorite part of the job is I knew my program at ICE backwards and forwards and very proud of it. And I knew ICE backwards and forwards, very proud of that too. But now I get to see the wider world and I think that's one of the amazing things about being a field CISO is I get to do things, influence our product, and talk to our customers what really matters and help them problem solve. It's like I get to go to work at a different company every day, super fun.

Jackie McGuire

>> And for neuro-spicy people like us, the constant change of pace and it's something new.

Liz Morton

>> Yeah, it's always something to think about. Yeah, I've always been pretty comfortable with context switching, which can trip you up when you're trying to do thought work. But the way my brain works, it's actually.

Jackie McGuire

>> There's seven chains going on at the same time.

Liz Morton

>> Yes, and my brain will get tired of one idea and need something else to, and this job is all of that.

Jackie McGuire

>> People keep asking me why I have five jobs and I'm like, "Because I can only do any one thing for half an hour at a time and then I need to switch to something else."

Liz Morton

>> Too funny. You're too funny. Yeah, I get it.

Jackie McGuire

>> If I don't have multiple jobs, it's going to be switching to watching TV and then I'm never going to switch back to the work I was supposed to be doing.

Liz Morton

>> Right. Yeah, you'd get a PhD in Netflix.

Jackie McGuire

>> Yeah. So you were just telling me right before we started filming that the nature of conversations that you're having with customers has pretty deeply changed from just RSA to now. Tell us a little bit about that and what your conversations are like now.

Liz Morton

>> Yeah, RSA, I think is known as the executive conference. That's where you have your CISOs and the conference is about the business of cyber really. It's about a lot of other things too, but I think that's a fair way to distill that event. And at RSA, I was a little younger in my role. Again, I think it's eight months, I was more at four months. Axonius had just done a rebranding, a bunch of stuff so we were really talking about our messaging and getting the word out, and I was talking a lot about product. Now I'm having conversations here I am at Black Hat, which is about more the practitioner. It's less executive facing, it's more about, well, it's more like about us, frankly.

Jackie McGuire

>> Yeah, it's our people.

Liz Morton

>> The practitioners, our people. By the way, this conference has been so fun.

Jackie McGuire

>> It's always like a reunion. You can't walk down one hallway without seeing someone.

Liz Morton

>> Absolutely. I had a very unfortunate incident yesterday where I was supposed to be on stage speaking, and I forgot my badge in my hotel room and I could not get through the crowd because there were a million people, and also everybody I knew. I was like, "Hey, hey, I'm so sorry I'm freaking out. I forgot my badge, I can't get on the floor." So that was hilarious. I was literally at one point trying to crawl around and over people.

Jackie McGuire

>> It was crazy yesterday.

Liz Morton

>> And also giving hugs and high-fives and being like, "I'll talk to you later." Anyway, I digress. Even though this conference is more about the practitioner and I'd like to think a celebration of security in its purest form, I'm having a lot more conversations with our executive customers and practitioners too about we really love your product, great news for Axonius. Messaging is working, but I don't have budget. My budget's cut. We aren't entertaining new spend. We can't. What I love is very often, and this is also great news for Axonius, very often what I'm hearing from CISOs is that their teams love us and really want us and won't leave them alone about buying us, but they can't get the spend. They can't get the buy-in, they have to cut, they have to justify so we're having some, I'm having some pretty sophisticated conversations actually about how to make that happen, how to structure a deal that works, how to get us in the door, how can we look at what are your other projects? We have such a versatile platform and we do so much great stuff that I'm in a catbird seat I suppose, because I can try and help our customers pivot their budget line in a way that lets them actually buy us.

Jackie McGuire

>> Before we started filming, I was like, "It's because you're a business CISO."

Liz Morton

>> Am I?

Jackie McGuire

>> Well, I think having worked at ICE, that is, could you possibly be more capitalist?

Liz Morton

>> No.

Jackie McGuire

>> And so you think-

Liz Morton

>> Total capitalist....

Jackie McGuire

>> you have to, everything there is tied to dollars and cents, revenue, risk, but not just risk, quantifiable risk.

Liz Morton

>> Correct.

Jackie McGuire

>> Because if you say this is a problem, your CEO is like, "And?" Until you say this is a problem that could cost 6 million a day if we're crippled, that's a big difference.

Liz Morton

>> Yes. Interestingly. Financial services and especially a company like ICE that's highly and has all kinds of auditors and overseers and a very sophisticated, very mature enterprise risk function, boards, all those things. You expect to have conversations about the risk reward, money conversation, the business CISO conversation. You expect to have it there. But I'm having those conversations with guys who are overseeing security in manufacturing, and we're talking about what is the actual loss if you lose an hour a day a site? I think that is a sign of the times that maybe is good for us. For a very long time, I think the perception has been that security has a blank check and unlimited budget from where I used to be. That's how it always seemed. Of course, it wasn't actually like that. Nobody's like, "Yes, you can have whatever you want." We were tough, hard negotiators. That was my job, was to give my vendors a hard time and tell them to sharpen their pencil. That was all about fiduciary duty and just good business, frankly. I think that is starting to become very commonplace for everyone. I'm hearing about, we all know what was happening in the government not that long ago with DOGE, that's been part of the conversation.

Jackie McGuire

>> When anybody who's dependent on any level of federal funding, even national institutes or public health at the NIH.

Liz Morton

>> Correct. Healthcare systems. Absolutely, yes.

Jackie McGuire

>> Yeah. And we're hearing a lot of our budgets are frozen, not out of lack of funding, but out of uncertainty.

Liz Morton

>> Out of uncertainty. 1000%. Nobody seems to know when the right time is. And the unlimited budget blank check thing is not just a fallacy. It's a dangerous way to think about how security really works.

Jackie McGuire

>> You're just a retail therapy.

Liz Morton

>> Yeah, right.

Jackie McGuire

>> Every time something goes wrong, just buy a new tool, add 4,000 more alerts to the SIEM, never configure it, never hire somebody to manage it. It'll be fine.

Liz Morton

>> 100%.

Jackie McGuire

>> And then when the next thing goes wrong, we'll buy a tool for that.

Liz Morton

>> Yes. I was talking about this yesterday on stage when I finally did get a badge and I got on the floor and I do my talk. I talked about the virtuous cycle of cyber where it starts with a scary thing. Brilliant people have built things to solve the problem, now we have to go buy it and learn it and maintain it. My background is really heavily in operations, IT, traditional tech. So I look at that and I'm like, "Hmm, that's a good way to get a whole bunch of mouths to feed and a whole bunch of fragmented data." Of course, I am the field CISO for Axonius, so I've talked about having a single clear picture of your environment is-

Jackie McGuire

>> Single pane in the glass.

Liz Morton

>> I wasn't going to say a pane in the glass, but yeah, a single pane of glass. Yeah, that single glass of pain. I wish I could remember who said that, but someone very smart said that and I think it's funny.

Jackie McGuire

>> Look, I like the idea. I love the idea.

Liz Morton

>> Yes.

Jackie McGuire

>> I think the reality of actually implementing that, are there tools that can be that? Absolutely do 99.99999% of customers commit the resources, the headcount to configure those tools to get all of the, or alternatively, what they really should do is pay for professional services. Because if you just buy a tool and you think that without experts setting it up, monitoring it, maintaining it's just going to work. That's just not how things work.

Liz Morton

>> That's right.

Jackie McGuire

>> No two tech stacks are the same.

Liz Morton

>> That's right.

Jackie McGuire

>> So no tool is going to work out of the box, no matter how many agents it has.

Liz Morton

>> Yeah. So I don't know if this is necessarily Axonius's favorite part of what I bring to the table, but because I was a practitioner for so long, as much as our sales folks might be like, "Yeah, the implementation is easy." The first time I heard that, I said, "Hang on a second. It is straightforward, but let's not say easy because easy is a very relative term." And I have to tell you, when I was working at Intercontinental Exchange, it was straightforward to set up our system. It was straightforward to set up most of our systems. Easy becomes a whole different equation whenever you're talking about running security.

Jackie McGuire

>> A 1040 is straightforward.

Liz Morton

>> Correct.

Jackie McGuire

>> I know exactly what goes on my 1040, there's a line that tells you every single thing and where it should go.

Liz Morton

>> Exactly.

Jackie McGuire

>> That still doesn't mean I'm qualified to be sure that every single thing that needed to go in each of those lines is there.

Liz Morton

>> Which is why you need an accountant.

Jackie McGuire

>> Yeah, exactly.

Liz Morton

>> Absolutely.

Jackie McGuire

>> So I don't know why we see security or tools as any different.

Liz Morton

>> No. And I am almost 30 years a practitioner, and I am a builder and a doer at heart. That's just who I am, and so I look at that and I think, well, that is not how we talk about Axonius. We don't, first of all, insult our customers by pretending like we know what their everyday operating life looks like. And we also don't tell our customers that it's a set and forget kind of equation, because we do have maintenance like every tool does. It would be weird and probably make Axonius very ineffective.

Jackie McGuire

>> Ineffective. That's how you end up with a 20-year-old server-

Liz Morton

>> Correct....

Jackie McGuire

>> sitting in a closet that if you turn the light switch off, it turns off. Set and forget.

Liz Morton

>> Oh my God, yeah. So I mean, there's always over-

Jackie McGuire

>> Not that I worked in those offices, but.

Liz Morton

>> I mean, we all have worked in those offices, haven't we? It's how we get to the age we are, and then we go to cocktail parties and tell fun stories.

Jackie McGuire

>> Exactly.

Liz Morton

>> Because of those actually, 100%.

Jackie McGuire

>> How should customers look at Axonius then? It's straightforward, but what do they need to be successful once they've signed on the dotted line?

Liz Morton

>> Yeah, so first of all, I think there is a shift. I think we talk sometimes about the convergence between operational IT and security. I see that happening. I think also, we're starting to see a shift in the way people are looking at their programs. Axonius is great because what it is it's the foundation upon which you can build everything, because it all starts with knowing what you have.

Jackie McGuire

>> Right.

Liz Morton

>> How much do you know about your environment? How much do you know about the real risks that you have, not the ones that you opine on. That's maybe not the thing that we are most excited to talk about, how much we don't know. But a lot of what we combat in security in one way or another is we combat the unknown. Philosophically, you have to be ready to know, and you have to be able to look at your baby, your real baby and say, "Ooh, maybe that's not so great." But unless you do that, unless you look, are not actually really fixing your problem. So we talk about that.

Jackie McGuire

>> It's like, do you remember Most Extreme Elimination Challenge MXC, that show?

Liz Morton

>> Yes.

Jackie McGuire

>> And then it was the one that came from Japan.

Liz Morton

>> That is a deep cut.

Jackie McGuire

>> It was originally called Hiroki's Castle, or Hiroki's Castle came out on, what was it, Spike TV?

Liz Morton

>> I think so, yeah.

Jackie McGuire

>> And then it became Wipeout. There was the one activity they did where you're supposed to try to run through the wall and two-thirds of the walls are paper that you can run through, and a third of the walls are not paper and people just bounce right off of them.

Liz Morton

>> Right off, yep.

Jackie McGuire

>> And I always think that security's like that because there's all these vulnerabilities, but only some of them can you actually run through them. And if you don't even know what you have, how can you even start to figure, started to figure out what kind of walls those are and whether you're going to bounce off of them or crash through?

Liz Morton

>> Look, it's no joke trying to run security for any organization, especially if you're running critical infrastructure, the pressure can be immense. It can be very daunting, I think to really take a look at what you really have and then say, "Okay, today day one, we're going to start a program of continuous improvement. We're going to do the basics. We're not going to buy the fancy whizzbang tool that's getting all the attention on the floor at Black Hat." Not that I'm thinking of anyone in particular, and I'm not, that's really exciting to have all the theater that is cyber sometimes.

Jackie McGuire

>> Maybe hygiene before theater.

Liz Morton

>> Yes, absolutely.

Jackie McGuire

>> Take a shower before you go to the movies.

Liz Morton

>> Yes, please. And certainly name an industry that does anything. I think about the financial, because I've worked in financial services for so long. I think about the CFO, the CFO's not coming to the board going, "We think we have earned about a billion dollars this quarter." It was great.

Jackie McGuire

>> Or not knowing how much money's in the vault.

Liz Morton

>> Correct.

Jackie McGuire

>> I didn't know if somebody steals something out of the vault, you don't know how much money was in there in the first place.

Liz Morton

>> Yeah, but look at us. Look at us as, and this is really how I see it, we are freaking heroes because we've been trying to save the day without really knowing all the things that we needed to know. So we've been working from, not to be dramatic, but we've been working in the dark as an industry for a long time, and it's kind of stupid, and especially when you can just buy some Axonius and solve your problems.

Jackie McGuire

>> And all the lights come on.

Liz Morton

>> Everything's perfect, no.

Jackie McGuire

>> Maybe people are a little ugly when the lights come on like a nightclub.

Liz Morton

>> Yes, it is.

Jackie McGuire

>> But it's better to know that there are ugly things there than to not know that they were there. And then you find out when somebody sends you a picture and says, "Hey, I stole your ugly thing."

Liz Morton

>> Yes, exactly. If you don't find where you are really exposed and you are really in a high-risk problematic situation, someone will eventually find it for you. And that's reactive, and that's the world of DFIR, and that's the world of defenders. And I mean, I love that world. I want those people to focus on this stuff that is really, truly difficult.

Jackie McGuire

>> Right.

Liz Morton

>> And not the stuff where it's like, "Oh, look at that. We got popped because we didn't have EDR on our externally-facing web server."

Jackie McGuire

>> We were managing our keys incorrectly.

Liz Morton

>> Exactly, yes.

Jackie McGuire

>> Absolutely.

Liz Morton

>> Oh, look, this person's had the same password for five years, and it's 123456. I can't believe that those creds got popped. This is not sexy, but it's like doing the reps. It's the difference between, I think being a mature organization that takes your resources time and effort, and focuses it well on the hard stuff and lets the machines do the work for everything else.

Jackie McGuire

>> So note to everybody listening, connect with Liz Morton on LinkedIn. She would be happy to not just be your therapist, as a CISO, but also your business advisor and teach you how to get budget-

Liz Morton

>> I will try....

Jackie McGuire

>> so that you can get Axonius and turn the lights on.

Liz Morton

>> Yes.

Jackie McGuire

>> All right, Liz, thank you so much. I would interview through for six hours if I could.

Liz Morton

>> I know.

Jackie McGuire

>> But you're going to make me stop, so thank you for being here today, really appreciate it.

Liz Morton

>> Thanks for having me, this was so fun. I'm glad we finally got a chance to do it.

Jackie McGuire

>> Yeah. All right, everybody, stay tuned. We'll be back shortly from Black Hat 2025 at the Mandalay Bay in Las Vegas, Nevada, with more great guests, content, and probably a few snarky remarks.