Starting as a young hacker provides a solid grounding in how to defend. Ryan Davis, now CISO at New Charter Technologies, successfully made the transition.
The journey
Ryan Davis became interested in computers at an early age, before the internet changed the world. As a child, his mother ran a secretarial college from the family home in the 1980s. “We had six personal computers in the house, and I had plenty of time to tinker with them at a formative age. There was no internet, so I had to learn what to do by trial and error. As I grew older, that desire for tinkering grew into a desire to explore beyond the intended confines of the system and make it do something that was never intended.”
Davis is now a CISO, but he started as a hacker. “I did some things that, in retrospect, would probably be considered illegal,” he admits. But he never did anything with malice or malintent. “It was always to see how far I could go. Could I get the system to do something that wasn’t intended? Could I gain access to something that was supposedly a secure system or supposedly isolated in some way?”
As the internet became available, he began spending time on forums and message boards, learning how systems worked or could be reworked. “But never,” he says, “with any personal gain in mind. It wasn’t to get something to sell, to dox somebody, or gain some advantage; it was always just to see how far I could get. It was more like a personal competition.”
He could have done stuff to benefit himself, but he didn’t. He thinks the defining moment in this was while still in high school. He found vulnerabilities in the school network. He took the moral high ground and reported these findings to the school’s sys admin. “I said, ‘Hey, you probably want to lock these things down because here’s all of the things that I can do.’ I was met with shock that turned to gratitude, and I got a high off that gratitude.”
But he doesn’t think he turned to the light; he just doesn’t think he deviated from his natural path. He believes that people are born with a natural morality: “We have a desire to seek the approval of other people, although bad habits can be learned in our upbringing. We see this in different parts of society where kids learn a dubious set of values; but I think we are innately born with a good moral compass.”
A career in cybersecurity was the natural step: from a child who learned about computers to a youth who knew how to hack into them, to the young adult who wished to stop them from being hacked.
After high school, Davis went to Champlain College in Burlington, Vermont. “I chose it because it offered the closest thing I could find to a security degree. It was a course in computer networking but with elements that included firewalls and securing Windows 2000. While I was there, the college introduced a new program: something called Information Security. I ended up doing a dual bachelor’s program and graduated in four years with two degrees. From there, I was recruited directly out of school into MIT.”
The career
Ryan Davis started his professional career with MIT Lincoln Laboratory at Lexington, Massachusetts. Its core purpose is to apply advanced technology to solve critical national security problems, and cybersecurity is one of its focuses. In his own words, “developing new technologies and prototypes that we think we might need in a couple of decades from now.” There he got immersed in the world of information assurance and internal audit, and stayed with MIT for five years.
“Then I pivoted to the software security company Veracode, starting in 2012 as a security program manager working in application security and managing enterprise programs.” He was the senior security program manager by 2014, and was promoted to security program architect in the same year.
“As my career matured, I sat down and had conversations with our internal CISO at Veracode. I told him, ‘I want to be sitting where you’re sitting one day.’ He said, ‘Well, what are you doing about it?’ and I thought, ‘Yeah, what am I doing about it?’ Those conversations ultimately led to me managing the information security program at Veracode in 2016. I started with a team of one and built it into a team of 15. From there, following a series of separate events that were well beyond my control, including two acquisitions and a divestiture, I ended up in the CISO seat at Veracode in 2019.”
He was with Veracode for almost a decade and grew its cybersecurity during that time.
He moved on from Veracode to be CISO at NS1 in 2020, where he stayed for five years. (During this time, NS1 was acquired by IBM in 2023 and rebranded as NS1, an IBM Company.) In 2025 he moved on to be CISO at New Charter Technologies, where he remains today.
New Charter is a Denver-based group, backed by private equity, that acquires managed service providers across North America and runs them as semi-autonomous operating companies.
The CISO
The title of chief information security officer is a misnomer. The function is less to protect information per se, and more to protect the business that owns and uses the information. Protecting the business can be achieved even if some of the data is damaged or lost, provided the business can be made resilient to that loss. The role is closer to protecting business continuity than protecting information.
So, is it more important for the head of security today to be a technician or a businessperson? “I think you have to be both,” says Davis. “A CISO who doesn’t understand the business and the business drivers will have a harder time than the CISO who is well-versed in the business.”
This aligns with the modern view that a CISO is a business enabler rather than simply an information protector and needs to be both tech- and business-savvy to achieve this. CISOs must be technicians to know how to protect data, and businesspeople to know what data to protect most heavily. It also requires that the CISO can explain the technical issues to the business leaders in a way they can understand.
“In the ten years I’ve been a CISO,” he says, “I have learned that if you can’t speak the business language, you’re going to end up speaking over the heads of the rest of the executive team”
Being a leader
The CISO must be a leader, but there is no pre-packaged definition of leadership suitable for all individuals across all organizations. The most common view is that it’s a quality that can be learned while doing the job. Davis, however, believes people either have a natural disposition toward leading or they don’t. But he also has his own view of leadership and believes people can be successful managers or executives without being traditional leaders. It’s all down to style.
“When I talk about a leader,” he explains, “I think about somebody who has the ability to influence without being overpowering – somebody who can affect the will of others in a way that makes them feel they’re joining something bigger than themselves, and want to align with that bigger purpose for the benefit of everyone. To me, a leader is somebody who invests in their people more than they invest in themselves, and ultimately everyone gains from that investment.”
This somewhat unusual idea of what makes a leader is what explains his view that leadership is a quality more inherent to the person than learnable from the environment. It is more personality- than rules-driven.
The team
It’s a common axiom that leaders are only as good as the team around them. Even those CISOs who inherit a security team will need to replace team member churn with new members. So, whether a CISO builds a new team or simply reshapes an existing one, team building is an essential aspect of being a successful CISO.
“A team is the sum of all its parts,” suggests Davis. “So, when I’m building a team, I’m trying to find a group of individuals with a complementary skill set, where each one brings something to the table that will benefit the whole. If you have a team with a high proportion of introverts who just want to code all day, it’s going to be hard to get that team to interact with other parts of the company.”
Instead, he continues, “What I try to do when I’m building a team is to find individuals that have skills – not just the technical skills, but also the soft skills – that complement one another. Some may have those outgoing extrovert qualities of natural leadership, while others may be more technical, and you know they are perfectly fine diving in for four hours and coding when it’s necessary.”
He also stresses that he is a great believer in diversity. “Having both men and women and people with different backgrounds on the team is important. People approach problems differently, and that can be beneficial; especially in the world of security, where there is rarely simply a single answer. There are many answers, and having people approach problems from different perspectives is highly beneficial. You can iterate on a number of possible solutions, and potentially even start actioning multiple to see which might be best for any given circumstance.”
For Davis, synergy is a synonym for team. “Because that’s where the magic happens.” He’s still the leader, but he aims for consensus decisions where possible. He seeks a balance between his team having been selected for their individual expertise and his own access to the company C-Suite leaders and information unavailable to the team.
“I try really hard to be transparent in such circumstances, so that we’re always building trust. Trust can very quickly erode; and if you erode trust, you erode the sense of team.” So, while the ability to speak security to the business is essential for a CISO, so too is the ability to speak business to security.
It is perhaps no surprise that he considers diplomacy to be a CISO’s most important personality trait.
Burnout
“Any leaders who claim they are not affected by burnout in security are lying to themselves,” he comments. “It’s a very real thing.”
This is the machine age. We have to think and react in terms of machine speed, and that’s incredibly difficult for the human brain to handle – and the result is often burnout.
“I’ve experienced being truly burned out,” he comments. “I was working 80 to 100 hours every week, not sleeping well and not eating right. And this always affects personal relationships outside of work. It’s an incredibly difficult place to be in.” It’s a form of self-perpetuating spiral where the spiral always goes downward.
The prevention and possible cure is, he suggests, ’balance’. “Achieving balance is different every single day. But it’s making sure that you get time with your family and kids and dog and eat well. And time for yourself with decent exercise. But at the same time, you have to stay on top of your work and know what’s going on in your industry.” Balancing your life and staying professional in a stressful job is not easy.
“But if I’ve learned nothing else in my career, it’s that you must strive for some sense of balance because if you don’t, then what are we all doing here? It’s easy to go all-in in a career. It’s not just security, but security is one that is constantly demanding. If I responded to every alert that happened throughout the night, I wouldn’t ever sleep. You have to trust in the systems and the architecture and the team that you put in place, so you don’t need to be in a constantly heightened sense of, oh my gosh, the sky is falling. Ultimately, if you do that, then you’re putting burnout into high gear.”
Mentoring
Mentoring, in the form of advice, is an important part of all CISOs’ careers. On their own journey, they are likely recipients of advice from others who have already trod the same path. If that journey leads to being a CISO, the new CISOs then become mentors for the next generation of travelers, especially from within the team they created.
The best career advice Davis personally received was via the conversation he had with Veracode’s CISO before he became Veracode’s CISO: what are you doing about it; that is, how do you intend to achieve what you want? “It was short for ‘you need a plan to achieve what you want’.” It’s similar to planning a road trip on a map: you need to know the next town you’re aiming at, but you also need to know the town after that, and after that, and each town you need to achieve before you can arrive at the destination you seek.
“For me, that journey isn’t just what is the next job I want on the journey, but what must I do to keep moving forward and growing. Personally, it’s continuous learning, going to conferences, networking, speaking about those things I’m passionate about and having in-depth discussions and debates about key topics. The day you stop learning is the day you become obsolete.” And if you’re obsolete, you no longer have a career.
Now a CISO, the advice he gives his own team members is similar: ‘invest in yourself and never stop learning’. “My core belief, backed by personal experience,” he explains, “is that if you invest in yourself, you’ll reap the rewards. The investment will be different for different people. It may be taking a professional speaking course, or getting a different certification or speaking at a public event. That investment is different for everybody because we’re all different individuals – but personal investment will always pay dividends in the end.”
For Davis this included developing new skills and getting exposure to new technologies and new and unfamiliar disciplines. He doesn’t believe any single process was defining, but that success is the synergistic result of wide experience.
“Constant investment in yourself and finding new ways to grow is the best advice I could give anyone.”
This CISO’s biggest security concern
It’s a cliché, but also a truism, that people have things that keep them awake at night. For Davis, it is the unknown. “It is the unknown that worries me. What I know about, I can secure; but there are always things that are unknowable. The state of shadow AI in my environment. What is the individual who used his own LLM based on an unknown Chinese model being told to do? Those unknowns are so hard to defend against.”
And it’s an ongoing unknowing. “Because as soon as you have a grasp on one set of technologies, there’s always another set of technologies right behind it that becomes the next new thing that proliferates. You cannot secure what you don’t know about, so I spend a part of every day concentrating on getting better visibility into the environment.”
This field of the unknown goes in all directions. It can be not knowing what internal staff are doing, what shadow AI exists where, and even what is novel and different. “Because the unknown,” he says, “is the place where security really meets reality.”
Related: CISO Conversations: Ross McKerchar, CISO at Sophos
Related: CISO Conversations: Keith McCammon, CSO and Co-founder at Red Canary
Related: CISO Conversations: Maarten Van Horenbeeck, SVP & Chief Security Officer at Adobe
Related: CISO Conversations: Tarah Wheeler, Cybersecurity Leader, Thought Leader and Original Thinker
