Security Confidential S18 E0 Maman Ibrahim

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security’s Security Confidential. We’re approaching episode 200, and today’s guest is another phenomenal cybersecurity leader. Before I introduce him, please hit the like and subscribe button—it makes a real difference. We all work for algorithms, and every click helps us continue bringing top cybersecurity minds to your feeds, cars, or wherever you listen.

Our guest today is Mamon Ibrahim, joining us from the United Kingdom. Mamon is a digital risk leader with over 20 years of experience transforming cybersecurity from a compliance burden into a strategic advantage. He’s a principal partner at Eugene Zonda, founder of Ginkgo Resilience, and has led secure digital transformations across industries like pharmaceuticals, manufacturing, and business services—saving companies over £150 million through effective risk management and third-party oversight. He’s also a contributor to the OWASP Top 10 Agentic AI Risks and works with the World Economic Forum’s Cyber Resilience Compass. Mamon, thank you for joining us—especially this late in the evening for you.

Mamon Ibrahim: Thank you, Manoj. When I hear you introduce me like that, it’s kind of mind-blowing. I’m just one of the guys!

Manoj Tandon: Don’t underestimate yourself—you’ve got an incredible background and have helped organizations save massive amounts through smart cybersecurity strategy. Before we get into your approach, tell us a bit about your journey. How did you get here?

Mamon Ibrahim: It’s a long story. I was born in Niger, in West Africa—raised in the Sahara Desert. Growing up there taught me two big lessons. First, never go out alone. The desert plays tricks on your eyes—mirages make you see things that aren’t there, and you can get lost easily. You learn to rely on others. Second, you learn resilience. The environment is harsh, so people help each other to survive. Respect and cooperation are not optional—they’re life-saving.

I was good in math and physics, so I studied engineering and became a radio communications engineer. My first job was maintaining a radio transmitter built in 1924—one of the oldest in Africa. Later, I moved to France to continue my studies and did research in optronics—light emissions and lasers—and published early work using artificial neural networks for telecommunications. That was 30 years ago! From radio to telecom, to networks, to innovation management—it was a natural evolution as technology became digital.

Eventually, I joined large enterprises like Michelin and worked on digital transformations. Six years ago, my wife and I moved to the UK for a new challenge. Adjusting to daily life—driving on the other side of the road and grocery shopping—was harder than I expected! But that’s how you grow.

Manoj Tandon: Your English is excellent, by the way!

Mamon Ibrahim: Thank you! I learned it in school, though I still use Google Translate in the supermarket sometimes.

Manoj Tandon: You mentioned early work with neural networks. At that time, computing power was extremely limited, right?

Mamon Ibrahim: Yes, the biggest system we had had 128 megabytes of memory. We’d send our computations overnight to a Cray supercomputer and get the results the next morning.

Manoj Tandon: I remember the Cray XMP! To our younger audience, that thing took up half a room and used more power than a small village—and your iPhone today is far more powerful.

Mamon Ibrahim: Exactly! Back then, the challenge was computing power. Today, it’s managing the abundance of data. The problems have shifted, but they never go away—they just change shape.

Manoj Tandon: You’ve talked about transforming cybersecurity from a compliance exercise into a strategic advantage. How do you get business leaders to see that?

Mamon Ibrahim: The key is remembering that cybersecurity exists to support business—not itself. Many experts forget that. Companies often respond to problems by adding tools, but more tools mean duplication, waste, and complexity. I once worked on a merger where the new company was suffering constant incidents. We discovered they had nearly 60% duplication across security tools. Once we simplified and removed overlaps, half their problems disappeared. Security isn’t about quantity—it’s about coherence.

Manoj Tandon: So true. Why do companies keep making the same mistakes?

Mamon Ibrahim: Because we don’t manage risk well. Risk management is still immature in cybersecurity. Technical teams chase shiny tools; business leaders don’t understand the risks; and both sides speak different languages. The result is confusion and waste.

Manoj Tandon: I like how you said it—it’s not about tools, it’s about coherence. But then, how do we make cybersecurity a true business advantage?

Mamon Ibrahim: Start by identifying critical assets—the systems, processes, or people that, if compromised, could stop your business. Focus resources there. Not every asset deserves the same level of protection. If you protect your critical assets well, you protect your business value.

Manoj Tandon: That’s a powerful message—defense in depth, but prioritized.

Mamon Ibrahim: Exactly. And leaders must understand that when cybersecurity works, nothing happens. That’s the paradox—success is invisible. So when CISOs ask for more budget, leadership asks, “Why? Nothing went wrong.” That’s why CISOs need to evolve from being tech managers to business leaders. They must connect cybersecurity directly to operations, revenue, and reputation.

Manoj Tandon: The challenge, though, is structural. Many CISOs report to CIOs, creating conflicts of interest.

Mamon Ibrahim: True. The best setup I’ve seen is when the CISO reports to the head of asset protection, independent from IT. In one company, that structure worked brilliantly because cybersecurity was discussed in the same breath as protecting people, facilities, and operations. It became part of business continuity—not just technology.

Manoj Tandon: Fascinating. I’ve never heard it framed that way, but it makes perfect sense.

Mamon Ibrahim: It worked because it shifted cybersecurity from “IT’s problem” to “everyone’s responsibility.”

Manoj Tandon: Let’s talk about third-party risk. Many major breaches—from Target in the U.S. to Jaguar Land Rover in the UK—came from vendors. How do organizations manage that?

Mamon Ibrahim: The problem starts with procurement. Companies focus on cost savings instead of resilience costs. Every procurement-led saving has a resilience cost. Procurement teams are rewarded for cutting costs, not for maintaining resilience. That needs to change. If you outsource cybersecurity or IT to save money, you often concentrate risk into a few vendors—creating systemic vulnerabilities. One small vendor can take down multiple global enterprises.

Manoj Tandon: But procurement will argue they’re doing their job—they’re measured on savings.

Mamon Ibrahim: That’s why it must come from the top. The CEO must mandate that procurement savings cannot compromise resilience. True savings come from eliminating redundancies, not from cutting critical safeguards.

Manoj Tandon: That’s a cultural change—it has to start at the board level.

Mamon Ibrahim: Exactly. Resilience is everyone’s responsibility, but accountability starts with leadership.

Manoj Tandon: Let’s switch gears to AI—specifically agentic AI risks, something you’ve worked on with OWASP. What are the main concerns you’re seeing?

Mamon Ibrahim: Most people focus on what AI produces, but we must also focus on how AI learns. That’s where the biggest risks lie. There are three dimensions: ethics (fairness, transparency), technology (models, algorithms, accuracy), and governance (oversight and accountability).

Two major technical risks are data poisoning and model drift. Data poisoning happens when corrupted or biased data feeds the model—garbage in, garbage out. Model drift happens silently—the model performs well at first, then slowly deteriorates as data changes, often unnoticed until damage is done. The solution? Regular testing, monitoring, and empowering engineers to intervene.

Another risk is adversarial manipulation—where attackers subtly alter data or prompts to mislead models while keeping them seemingly normal. Query injection is one example.

Finally, there’s bias. I recently wrote a paper called “AI Bias Beyond Gender and Race.” When I tested voice-recognition software years ago, it couldn’t understand my accent. That’s bias by design—entire groups excluded from technology. The same risks now extend to healthcare, finance, and other areas where biased AI can cause real harm.

Manoj Tandon: That’s an incredibly important point. The risks aren’t theoretical—they affect people directly.

Mamon Ibrahim: Exactly. If we don’t monitor our models, they drift into inequity. AI can empower or exclude, depending on how responsibly we design and govern it.

Manoj Tandon: Mamon, we’ve barely scratched the surface. When your papers are published, we’ll have to bring you back to discuss them in depth. Before we wrap up, is there anything you’d like our audience to know or follow?

Mamon Ibrahim: I publish regularly on CIO.com, CSO Online, and ISACA’s website. Beyond that, I’m dedicating more time to mentoring and coaching cybersecurity professionals—something I’ve done informally for years. Knowledge sharing is a fair trade: when you teach, you learn even more.

Manoj Tandon: That’s beautifully said—and a great note to end on. Mamon, thank you so much for joining us and sharing your wisdom.

Mamon Ibrahim: Thank you, Manoj. It was a pleasure.

Manoj Tandon: And thank you to our audience for tuning in. We’ll see you next time on Dark Rhino Security’s Security Confidential.