“Just because something can be automated doesn't mean it should be, especially without a human in the loop.”
When a vendor promises AI that can act without an analyst, Andy Ulrich wants three answers before it goes anywhere near production: what the system can do, what happens when it gets something wrong, and where a person remains responsible for reviewing the results. As CISO of Vonage, he is optimistic that AI will eventually give defenders the speed and agility to counter fast-evolving, AI-enabled threats, but only once such tools are configured to be reasonably trusted and reliable. Speed alone, he says, doesn't make a response effective. People still have to assess the findings and decide what to do.
Ulrich brings 20 years of cybersecurity leadership across the military and highly regulated industries, and he starts every problem with the mission. In this conversation, he explains why risk emerges wherever systems connect or data moves, how AI helps attackers combine weaknesses into a path to critical systems, and why a security basics gap can't be fixed by advanced tools. He also describes how he prepares for incidents that turn a communications outage into an operational crisis, why trust depends on being open with customers even before every answer is known, and why a buying committee should be able to state the problem before it compares a single vendor.
You’ve led security across telecommunications, financial services, government, and the U.S. Army. How has that breadth shaped your approach to securing a communications business like Vonage?
Twenty years of leading cybersecurity across military and highly regulated industries has taught me to always start with the mission. Whether it’s protecting financial transactions, military operations, or a global communications network, I focus on deeply understanding the way the organization operates, building strong relationships with the people supporting the mission, and being practical about where to accept risk.
Vonage brings together cloud communications, APIs, customer data, applications, and integrations. Where do you see the most critical security risks emerging across this ecosystem?
Risk can emerge wherever systems connect or data moves. Fraud actors can aim to abuse bulk messaging to reach people at scale, while nation-state groups may target communications providers for their information and access. Today, AI has raised the stakes by helping attackers find and combine vulnerabilities more quickly. That makes it important to understand how weaknesses could create a path to critical systems and to address the most significant risks first.
My role is protecting the trust that customers place in us by mitigating those risks and staying a step ahead in our defenses.
When communications become embedded in business-critical workflows, a cyber incident can quickly become an operational crisis. Which scenarios concern you most as Vonage’s CISO?
As a SaaS company whose products are, by necessity, continuously exposed to the internet, I’m most concerned about scenarios where services that customers rely on could be disrupted, undermining their confidence. Reliable communication is the heart of business, so any impact can be felt deeply, most especially in sectors where service interruptions affect health, safety, and essential operations.
We prepare rigorously for those potential scenarios because we believe building and earning trust with customers demands thoughtful responses that address recovery and customer communication together.
You describe yourself as someone who bridges the boardroom, IT, and security. Where is that balance hardest to maintain at Vonage, particularly when security requirements compete with business agility?
It can be difficult when teams feel pressure to adopt new technology quickly, especially when the headlines make it hard to separate a real risk from a dramatic one. AI deserves attention because it can help attackers find vulnerabilities and make social engineering attempts more convincing. It can also help defenders find weaknesses sooner.
The first step is to make sure the basics are covered; basic cybersecurity hygiene is equally important against every potential threat. It’s also critical to understand the risks, whether they are new and emerging or more traditional. Advanced tools can help with advanced threats, but they cannot make up for gaps in fundamentals such as managing devices, limiting unapproved software, and educating employees.
If a major compromise affected communications, data, and availability simultaneously, what are the hardest decisions to prepare for across technical recovery, business continuity, and customer trust?
A major incident can require teams to make decisions quickly while they are still working to understand what happened. They need to assess what systems or information may be affected, what steps could limit further harm, and how the incident could affect all relevant stakeholders. An effective team, built on strong technical skills and inspired by trusted leaders, will always work on the right things in the right order without guidance or oversight.
Being prepared also means being ready to communicate honestly. We will not always have every answer right away, but trust depends on being as open with customers as the situation allows and continuing to share accurate information as it becomes available.
Imagine a vendor promises AI-driven automation that can take action without analyst intervention. What would you want to understand about its failure modes, guardrails, and accountability before allowing it into a production security workflow?
I would want to understand what the system can do, how it identifies a problem, and what happens when it gets something wrong. I’d also want to know what data and systems it can access, what limits or built-in governance are in place, and where a person remains responsible for reviewing the results. Just because something can be automated doesn’t mean it should be, especially without a human in the loop.
For example, AI can help defenders identify vulnerabilities more quickly, including combinations of weaknesses that could form an attack path. But speed alone does not make a response effective. People still need to assess the findings and decide what action to take.
I do believe that the emergence of such products, once we configure them to be reasonably trusted and reliable, will give defenders the speed and agility they need to protect their systems from rapidly evolving AI-enabled threats.
A vendor’s roadmap promises capabilities you may need 12–18 months from now. How much should future potential matter compared with proven value today?
I would start with the problem we need to solve and the value the product can show today. Future plans can be part of the discussion, but I would want to understand what is available now and how it would help address the risk we have identified. I’m not confident I, or anyone, can predict what the cybersecurity landscape will look like in 18 months, so I will naturally be biased towards the present. I would definitely also consider the vendor’s track record for being able to solve future problems.
It’s also important to look at how the product fits with the organization’s existing controls and processes. New tools can help, but they should support sound security practices.
If the buying committee cannot agree on what problem a security product is actually solving, would you pause the evaluation? How important is problem definition before vendor comparison begins?
Yes. The group should be able to explain what risk or gap it is trying to address before comparing products. Without that shared understanding, it is hard to know what evidence to look for or whether the product is helping.
A clear problem statement also helps teams focus on the risks that matter most, rather than reacting to every finding or headline with the same level of urgency.
Across your experience, what is one cybersecurity assumption organizations still get wrong, and what will separate secure, resilient, and operationally agile communications businesses from the rest?
One assumption I would challenge is that the most alarming headlines always describe the most likely or immediate risk. AI is changing the threat landscape, but it also gives defenders ways to find and remediate vulnerabilities sooner. The basics still matter. Cyber hygiene measures like endpoint protection and employee education can help prevent attacks that begin with a convincing message or a request for access.
Organizations also need to look beyond individual flaws and ask whether weaknesses can be combined into a path to a critical system. That kind of assessment helps teams decide where to focus. Staying educated and looking beyond the headline can help people make more practical decisions about the threats they face.
