The internet has changed quite a bit since Ankit Verma, a certified PMP and CISM professional, began his career in the cybersecurity and infrastructure space over 15 years ago. Today, the industry is not made up of “silos of data centers,” but rather a collection of worldwide networks, in every industry, that need to be connected securely. Verma has led successful cybersecurity and infrastructure programs for a variety of industries including healthcare, fintech, and government.
Notable organizations that Ankit Verma has led initiatives for include the NBA, Abbott Laboratories, and New York City’s Metropolitan Transportation Authority. In this interview, Verma discusses what it means for cyber risk to be “ever shifting” in the modern era, how the Zero Trust architecture has transformed the enterprise, and why the future of cybersecurity is as much about how we talk to each other as how we write code.
You’ve worked across healthcare, fintech, and government sectors. What are some of the biggest cybersecurity challenges you’ve seen emerge in these industries over the past decade?
Well, if I had to distill it down, the core challenge across all sectors has been this: Our attack surfaces exploded faster than our defenses could evolve.
In healthcare, it’s been a triple threat: First, the explosion of connected medical devices-from insulin pumps to MRI machines-created thousands of un-patchable entry points for attackers. Second, ransomware evolved from just locking systems to stealing and threatening to publish sensitive patient records. And third, the business pressure to monetize health data for research created new privacy versus innovation conflicts.
In fintech, the revolution came through APIs and cryptocurrency. We built incredible digital banking services, but the APIs that power them became our biggest vulnerability. Meanwhile, cryptocurrency created a perfect, untraceable payment system for ransomware gangs, fundamentally changing the economics of cybercrime.
For government, the problems were legacy and trust. We discovered that critical infrastructure-from water systems to benefits portals-runs on software that literally cannot be patched. And the SolarWinds attack showed us that we can’t even trust our own software suppliers anymore.
The universal thread? The corporate perimeter vanished. When everyone works from anywhere, and everything connects to the cloud, identity becomes the new battlefield. A single phished password now gives attackers the keys to the kingdom, regardless of what industry you’re in.
How do you balance the need for airtight security with the push for innovation and speed in enterprise technology?
Great question. I fundamentally reject the premise that it’s a choice between speed and security. In fact, I’ve found that the ‘slow down for security’ argument is a losing one. The real goal is to make security the enabler of speed.
We do this by shifting from being gatekeepers to being platform engineers. Instead of saying ‘no’ at the end of a development cycle, we build secure, reusable patterns and ‘paved roads’ that developers can use to build fast and securely from the start.
For example, we don’t just mandate multi-factor authentication. We provide a simple, API-driven identity service that developers can plug into their new app with five lines of code. It’s easier to use our secure service than to build their own. That’s the win.
It comes down to three principles:
- Shift Left, But Don’t Stop There: We embed security tools directly into the developer’s CI/CD pipeline-code scanning, dependency checks, container security. This catches issues early when they’re cheap to fix. But we also ‘shift right’ by implementing runtime protections like ZTNA, which contains the blast radius if something does slip through. This safety net actually allows developers to move faster because they know the system has resilience built in.
- Secure by Design, Not by Bolt-On: We work with product teams during the design phase. We ask, ‘What are you trying to achieve?’ and then help architect the security into the product’s foundation. This is far more effective than trying to inspect in security at the end, which is where that classic friction occurs.
- Measure What Matters: We’ve stopped measuring success by how many vulnerabilities we find. We now measure how quickly development teams can deploy a secure product. When we streamline a process or provide a secure pattern that cuts their development time, that’s a win for us. We align our success metrics with the business’s goals.
So, the balance isn’t found in slowing down innovation. It’s found in building security that is invisible, automated, and ultimately, accelerates the entire enterprise.
You’ve led complex transformations, including secure cloud migrations and air-gapped federal systems. Can you share a project that you found particularly defining for your career?
Absolutely. The most defining project was ‘Project ZTNA’-the implementation of a full Zero Trust architecture for a high-growth fintech. This wasn’t just a technology upgrade; it was a complete strategic pivot in how the company viewed security.
The catalyst was a painful paradox: the business needed to move faster than ever, but its legacy VPN and perimeter-based security were actively slowing it down. We were trying to secure a cloud-native, globally distributed workforce with a model designed for a single office building. The result was a fragile network, frustrated employees, and an ever-expanding attack surface.
Project ZTNA was our answer. We replaced the ‘trust-by-location’ model with a simple, powerful principle: ‘Verify explicitly, grant access minimally.’ We started by making all internal applications invisible to the public internet. Then, we granted access dynamically based on a strict verification of user identity, device compliance, and the specific context of the request.
The transformation was profound. We shrank our attack surface by nearly 70% overnight. We eliminated the VPN and its associated support overhead, which made our employees happier and more productive. Most importantly, we built a security framework that could scale with the business. Acquiring a new company or launching a new product no longer meant a risky network integration-it was just a matter of defining new access policies.
This project defined my career because it proved that the most powerful security isn’t a constraint; it’s a competitive advantage. Project ZTNA didn’t just protect the business; it accelerated it. It taught me that our role as security leaders is not to build taller walls, but to enable safe and seamless movement within them.
Many organizations struggle to align security goals with business outcomes. How do you ensure cybersecurity is viewed as an enabler rather than a roadblock?
It all comes down to a fundamental shift in language and metrics. We have to stop talking about security in terms of threats and restrictions, and start framing it in terms of business velocity and trust.
I operate on three core principles:
First, speak the language of the business, not the language of fear. I never lead with a discussion about malware or attack vectors in a boardroom. I talk about enabling a secure remote workforce to enter new markets. I talk about building customer trust to gain a competitive edge. I frame Zero Trust not as a complex technical project, but as the foundation for safe M&A and rapid integration of new companies. When you connect security directly to revenue, market share, and agility, you stop being a cost center and start being a strategic partner.
Second, build security into the business process, not on top of it. We achieve this by creating what I call ‘secure by default’ platforms. Instead of a team coming to us for approval on a new cloud project, we provide them with a pre-approved, pre-hardened ‘landing zone’ in the cloud that’s faster and easier to use than building something from scratch. We don’t say ‘you can’t use that.’ We say, ‘here’s a better, faster, and more secure way to do what you need.’ We become the enablers of speed.
Finally, measure what matters to the business. We’ve retired metrics like ‘number of blocked attacks.’ Instead, we track and report on ‘time to deploy a secure product’ or ‘reduction in critical vulnerabilities during development.’ One of our most powerful metrics is ‘time to securely onboard a new acquisition.’ When you can show that your security framework directly cut the integration timeline for a multi-million dollar acquisition from six months to six weeks, you’re no longer a roadblock-you’re a hero.
The ultimate goal is to make robust security an invisible, seamless part of how the business operates, much like quality control in a manufacturing line. It’s not a barrier; it’s the quality standard that allows us to innovate with confidence and at speed.
With cybersecurity threats growing more sophisticated, what key trends or technologies do you believe will shape the future of enterprise defense?
We’re at a pivotal moment where the old playbooks are becoming obsolete. Based on what we’re seeing at the forefront, three key trends will fundamentally reshape enterprise defense.
First, and most significantly, is the rise of AI-Powered Cyber Resilience. We’re moving beyond just using AI for threat detection. The next frontier is autonomous response and self-healing systems. Imagine a security platform that doesn’t just alert you to a ransomware encryption attack in progress, but automatically isolates the affected endpoints, rolls back the encrypted files from a secure snapshot, and re-images the compromised machine-all within minutes and without human intervention. This shifts the paradigm from ‘how fast can we detect’ to ‘how quickly can we recover,’ making resilience the new primary metric.
Second, we’ll see the consolidation of security into a Identity-Centric Security Fabric. The concept of a network perimeter is gone. In a cloud-native world, identity is the only true control plane. The future is about fusing Zero Trust principles with deep behavioral analytics. It’s not enough to authenticate a user; the system will continuously analyze their behavior-their typical access patterns, the data they query, even their typing cadence-to create a real-time ‘trust score.’ Access will become dynamic and contextual, not just a one-time gate. This will finally make the ‘never trust, always verify’ mantra a practical reality.
Finally, the third trend is the strategic shift to Security by Design through Platform Engineering. The biggest vulnerability remains the speed versus security trade-off forced on developers. The solution is for security teams to become platform builders, providing developers with internal, pre-secured ‘golden paths’-templates for code, infrastructure, and pipelines that have security baked in. This eliminates the friction of bolt-on security and makes the secure way the easiest and fastest way to build. This is how we scale defense at the pace of modern business.
In essence, the future is about moving from human-led, reactive defense to an autonomous, identity-aware, and developer-empowered security posture. The goal is to build systems that are not just hard to breach, but inherently resilient and adaptive when an inevitable breach occurs.
You hold both PMP and CISM credentials, which blend project management and security expertise. How have these dual perspectives influenced your leadership approach?
That combination is the cornerstone of my philosophy. It’s the difference between building a fortress and winning a campaign. The CISM ensures we’re building the right defenses, while the PMP ensures we’re building them right.
The CISM gives me the strategic, risk-based lens. It forces me to constantly ask: ‘What are we actually protecting? What is the business impact if we fail?’ This stops us from chasing every shiny new security tool and instead focuses our resources on the crown jewels-the data and systems that truly drive business value. It’s about speaking the language of the boardroom in terms of risk and ROI, not just technical threats.
The PMP, on the other hand, provides the operational engine. It brings discipline, structure, and a relentless focus on outcomes. In cybersecurity, a perfectly secure project that never ships is a failure. The PMP mindset ensures we break down complex security transformations-like implementing a Zero Trust architecture-into manageable, measurable phases with clear deliverables, owners, and deadlines. It’s about creating predictability and accountability in a field often defined by chaos.
Where they truly fuse is in my daily leadership. For example, when a new critical vulnerability is announced, the CISM in me immediately assesses the risk: ‘Is this exploitable? What’s our exposure?’ The PMP in me then takes over: ‘What are the precise steps to remediate? Who owns them? What’s our timeline for 100% compliance?’ This prevents a panic-driven response and instead executes a measured, effective campaign.
Ultimately, this blend allows me to translate a strategic security vision into a tangible, delivered project. I’m not just the architect of the security plan; I’m the general contractor who makes sure it’s built on time, on budget, and actually protects the people inside.
Cybersecurity often demands both technical precision and strong communication. How do you bridge the gap between engineering teams and executive decision-makers?
I see my role as that of a translator, but not just of language-of context and consequence. The bridge isn’t built on a single conversation; it’s built on a framework of trust and relevance.
It starts with a fundamental rule: I never bring a problem to the board without a business-focused solution. An engineer might tell me, ‘We have 15,000 unpatched CVEs with a CVSS score above 7.’ My job is to translate that into an executive’s reality: ‘We have a critical vulnerability in our public-facing payment system that, if exploited, could lead to a 48-hour outage of our core transaction platform and direct financial loss. Here are three mitigation options, with the cost, timeline, and residual risk for each. I recommend Option B.’
I use a simple, three-part framework:
From Technical to Financial: I convert technical metrics into business impacts. Instead of ‘lateral movement risk,’ I talk about ‘operational downtime’ and ‘regulatory fines.’ I replace ‘mean time to detect’ with ‘potential revenue at risk per hour of downtime.’
Provide a Balanced Menu of Options: Executives are paid to make strategic trade-offs. I don’t give them one demand. I present a clear set of choices: ‘We can accept the risk, mitigate it with a temporary control for $50,000, or fix it permanently for $200,000. Here is the risk and cost associated with each path.’
Build a Narrative of Assurance: Finally, I ensure the conversation isn’t only about fear. It’s about confidence. I brief them on the major threats we’ve successfully defended against and how our investments are paying off. This builds the trust needed for when I have to walk in and ask for a significant, unplanned investment.
Ultimately, the goal is to ensure that when the engineering team says ‘This is critical,’ the board understands exactly why and what they need to decide. It’s about making cybersecurity a manageable business decision, not a technical panic.
Looking ahead, what drives your professional vision? Are there particular challenges or opportunities in cybersecurity that you’re most excited to tackle next?
My vision is anchored in a single, driving belief: the next frontier of cybersecurity isn’t just about building stronger defenses; it’s about building more resilient and inherently trustworthy digital ecosystems. The old model of perpetually fighting threats at the perimeter is a losing battle. I’m excited to help pioneer the shift from pure protection to guaranteed operational integrity.
The challenge that captivates me most is what I call the ‘Autonomy vs. Assurance’ paradox. As we rush to embed AI and autonomous systems into every facet of business-from self-healing networks to algorithmic trading-we’re creating a new class of risks that traditional security models can’t comprehend. How do you conduct a forensic investigation on a decision made by an AI? How do you patch a vulnerability in a continuously learning system?
This isn’t just a technical problem; it’s a foundational one. I’m driven to help build the next-generation security frameworks that can provide verifiable trust in these autonomous environments. This means moving beyond monitoring for malicious activity to actively verifying that systems are behaving as intended, even as they adapt and learn. It’s about creating the digital equivalent of a flight data recorder for AI, ensuring we can always audit, understand, and trust the decisions being made.
Ultimately, my goal is to help businesses innovate with confidence, not fear. The opportunity is to transform cybersecurity from the department of ‘no’ into the engine of ‘go’-ensuring that the next wave of technological progress is built on a foundation of security that is as dynamic and intelligent as the threats it faces. That is the problem worth solving.
From the editor….
Ankit Verma’s professional journey exemplifies the potential of cybersecurity as a platform for career progression, not as a limiting factor. His approach to security encapsulates the belief that technical proficiency must be complemented by strategic vision: that the true value of security lies in enabling the enterprise to operate with speed and confidence, despite the uncertainties of the digital landscape.
