CIBC CISO mandates near real-time vulnerability remediation from vendors

Joe LoBianco, Executive Vice-President and CISO at CIBC, stated that the accelerating pace of AI has fundamentally changed corporate cybersecurity risk management. Historically, large enterprises could focus resources on high-severity vulnerabilities, leaving lower-risk issues in remediation queues. LoBianco argues that AI is now adept at chaining these seemingly minor weaknesses together into significant high-risk exposure, making the older triage approach obsolete.

Consequently, CIBC is shifting its defensive strategy to address lower-severity issues more rapidly and embedding security earlier in product design. This internal shift raises the bar for external technology vendors seeking entry into major financial institutions. LoBianco emphasized that seamless integration with a bank's existing systems and investigative workflows often outweighs marginal gains in product performance; if adoption is difficult, its effectiveness does not matter.

This constraint is amplified by new expectations around speed. CIBC now requires near real-time turnaround for vulnerability remediation in sensitive environments, a significant departure from past practices where fixes could wait days or weeks. This mandate impacts the entire sales cycle and product development timeline for security founders.

past technical performance, market realities dictate that technology vendors must account for complex purchasing decisions involving numerous stakeholders at large banks. Sean Duffy, Managing Director at CIBC Innovation Banking, noted that selling solutions to major financial institutions can take years. Founders seeking capital or defining go-to-market strategies must factor in this extended timeline while simultaneously proving their ability to maintain required levels of data protection throughout the relationship.