The Buyer's Seat w/ Aysha Khan. Inside the mind of CISOs and CIOs Buying in the AI Era

Okay, we are recording. Aisha, I hear you're allergic to a lot of things. What are you allergic to?

A lot of things actually I'm allergic to one thing and that one thing is BS.

shots fired. Shots fired right at the start of the interview. Wow. Aisha, it's such a

Yes. I have to say that. I say that with complete medical certainty. Twenty five years in this industry and I feel like it has gotten worse. And because it has gotten worse, now I have zero tolerance and zero apologies.

my God. This is going to this this is going to be one of the epic explosive interviews. Aisha, it's such a it's such a such an honor to have you on Noister Signal interview series. You've been in the technology executive for over 25 years. most recently as the CISO and CIO at Treasure Data. And the thing that comes to mind is when I when I when I read your writing, it feels like

You write like a monk, but then you are an operator, like you you work as a CISO. You're almost like a monk that operates like a CISO. And my sense is this has been a long journey for you to get to the point where you are, the way that you see yourself, the way you frame yourself, the way you ex express yourself. My question is, how did this process start?

about twenty five year years ago and what has been going on in that process.

Yeah, so many things come to my mind. The process has been quite simple in my mind, but I've come to that clarity pretty recently, I would say in the last seven, eight years. I've always been the misfit. When I speak about the misfit, meaning I ask a lot of questions. Even when I was a kid, I used to ask questions to my parents, to my teachers, and often I didn't get the answers that would satisfy that.

Curiosity. so over the years, what I've realized that I care about clarity a lot and of work, non-work, that clarity leads to asking the right question, which is often the why behind the why. So in yeah.

So in so in that context, you're kind of in a wrong business because there is just too much noise in your industry. Getting clarity a in your line of business, being a CIO, being a C SO, is a difficult job because there you probably get pitched hundreds of times by vendors, in terms of selling their products. In the years in these twenty five years, how has the industry changed from your perspective, or maybe it has not changed at all?

all in all the twenty five years you've been evaluating products for cybersecurity.

Actually, let me answer two things here. Number one, I feel like, and I think I I told you reached out to me on subsex long time back. You're like, tell me if you are a monk, you are an operator, or you're a therapist. And I said, I be all, right? Why pick one when I can be all? Coming back to the point, I was talking to another CISO friend of mine recently, and I he was telling me the same thing. You happen to be the spiritual CISO.

Yes, this is like it is.

And here's how I see it. I don't think I'm in the wrong industry. I feel like I am put in the right industry for the right reason. Here is why. There is so much noise to what you said. And exactly to reduce that noise to signal, which happened to be your podcast name as well, which I love. I think that's why I'm here. but the journey has been: first I need to get clear with myself: who am I? Why am I doing it? What is the bigger purpose?

I often say I describe myself in six word, which is living intentionally, passionately, fearlessly every day. And that clarity has given me a backbone to say meho that I am I'm not as scared to speak the truth. And my goal for the rest of my life is bring clarity to everything that I do. And why look at the question that you're asking?

What has changed in 25 years? What hasn't changed in 25 years is the same nonsense that we deal with. Look, we all operators are not operators for the namesake. We have a real job to do. We are sitting with real budgets, real problem statements. I think when you were demoing your product, what did I tell you? I said in 2010, I used to run SAS, DAST, OS scanning. In 2025, the exact same process.

But what are we doing? And when I ask my team these questions, they are also like lack of solutioning out there. Everyone is trying to sell single point solution. So we have real problems to solve. Founders are also passionate about solving what they want to be solving, but I think there is a lot of noise and distraction and lack of clarity. So my goal is to just help people get clear with what matters and just build in that

Build with that clarity so that we get help and they build what they are passionate about. I hope it helps.

I thought the I thought the tagline of a spiritual CISO is a very appropriate tagline. It's a very appropriate tagline for you. My question is, was this was this a recent development? Because you did not show up on my radar until a few months ago and you started your Substack channel, inward to outward, and the writing was very clear, very precise. You use fewer words to express profound points of view.

My my question is like why w what was the reason behind starting the Substack, the inward to outward channel and then expressing your point of view? Because I don't think you were very public before. Or maybe you are, maybe you just didn't show up on the radar. But that's the Substack, the Substack channel was the was the was the point where I started to read more about how you are thinking about the process.

Yeah. I would say as I said, it's a process. Process has been, I was first busy with my own experimentation for the last 15, 16 years or so. And then after that, the last 10 years have been more, I'm going more inward. So my journey, what I write on Substack, it's not random stuff. It's been my own journey, seeing how I became clear and how it helped me become the leader that I have become.

So now what I want to do is offer that clarity to the rest of the world. why I write, I see the suffering of the world, and the suffering of the world, I often say it is self-inflicted suffering. People comparing themselves and they are building for the sake of building, founders having no clarity why they are solving the problems that they are solving. And I feel like it's a gift that I can offer and share my perspective on how to get clear with yourself. I often say my home.

we need to learn to lead ourselves first. Our leadership journey is directly proportional to our inner work. The more we are clear, the more we are intentional, the more we understand our own triggers, that's how we show up in the world.

so that's what I've been doing. But the main thing is when I started reading, I'm I'm an avid reader, I love reading articles, I love watching meaningful content. But what I noticed that thought leadership was polished for the most part, but empty. The truth was missing. So that was the trigger for me.

You're breaking up. You're breaking up.

Hmm.

number one, write something that is useful and true. And number two, help people understand that no matter what they are looking outside will not happen. You know, like people talking about impact and titles and recognition. Those are the wrong questions to ask. Rather than saying what is next, ask what is true. And then from that truth, you figure out how can I create the impact playing to my strengths.

And that's what I enjoyed.

Do you do you write with the mindset? Do you write with the mindset that, you know, the wisdom that you impart outlives you? Is that part of your thinking where your you know, whatever you write, whatever you share outlives you? Is that a core thinking behind what you're doing?

I'll answer it this way. I am not like thinking I want to be remembered or people, you know, like put me on pedestal, none of that. I see myself as someone who has sort of decoded the code how to live joyfully and with clarity and impact. And I want to impart that wisdom on others so that everyone has the opportunity to live the same way. and if my frameworks, wisdom, can help people, that's the goal. And

Whatever I share, I want to make sure that even when I'm not here on this planet, that information, wisdom serves others.

Awesome. Awesome. Aisha, one of your one of your finest pieces of work is the buyer seed, apart from your spiritual writings that you write on Substand. One of your and that is that is in some ways one is it was an inspiration for Noise to Sign Signal, the interview series, because this is truly the signal that founders and sellers need in terms of how are buyers like you thinking about buying software because we are most

In most cases we are mindlessly selling without understanding how the buyers are buying, right?

Thank you for being here.

And I wanted to dive deeper into the buyer seat. You ro you started this series, I believe end of last year or early this year, and you're your and you made it the like a weekly post. It was a weekly post. You would did, I think, ten of them. You did ten of them. And I thought each one of us each one of them was a banger. Like each one of them was like, Whoa, who is this person? And then

I dive deeper into it. Well, this is this is obviously a CISO who has been through a lot. Right? So I want to dive deeper into the the journey to write the buyer's three. What was you what were you thinking when you were writing the buyer's three?

Thank you for asking me that question. I think that's where the gist of what we need to talk about. Number one, there are two things will come to my mind, but number one was this out of frustration for me. How much time, energy, money personally I was wasting, my team was wasting, whereas network that I know was wasting in finding the right solution. and then seeing how we always talk about, you know, like in our industry, it's sort of like badge of honor, we are burned out.

And I don't take that as a badge of honor. somebody asked me recently and they said, do you do you get stressed out being a season? I'm like, what a stress. I don't I don't invite any stress in my life. And the reason being because I going back to the point I made, clarity. With that clarity, I write, I lead.

I create my strategy, and then the goal is if I have clear problem statements that I understand what I need to be solving. And maybe at any given point, I'm sitting with the budget as well. I have the money and I have the problem statements. What I need are the solutions. And same problem over and over again. We bring vendors, the demo goes great, sales gets closed, and then CSM gets involved.

and then professional services get involved, few things I will unpack as well, but the handoff is broken. I often say, as part of my whole buyer series, if I pick one line, it is we don't have a buying problem, we have a delivery problem. And that's the truth that is not getting fixed. So imagine this business BDRs get involved, then account executive get involved, and then

post sales, post sales gets involved, posts

Yeah, solution engineers and then CSM and then professional services. Now the favorite word, FDEs, O-rated, hype word. Don't even get me started on that. The point I'm making is from my point of view, I've already talked to five people in that one cycle explaining five times what the hell I want to solve. Yes, what the hell I want to solve. And that doesn't get solved.

Same problem.

but there there is a lot of other nonsense. They're gonna talk about everything else and then they will try to upsell and then they will talk about this. Just help me build what I hired you to build. Yeah. I I could you not, we will talk about it. I get emos like, we did this, we did this, we did this. Yes, I see a list of things that you have done, but what is the value you created for me? And nobody understands that. So that was frustration was number one.

Mm, deliver the outcome. Then I deliver the outcome I'm looking for.

Number two was, as I said, I often see if I see a problem that I need to participate in that problem by bringing a solution to surface. And buyer series was my effort to bring buyers and sellers together to say enough is enough. I don't have time to waste, and you should either. So the goal was to really show you guys behind the scene how we think buyers, where the sellers are making assumptions.

How are they not seeing value being created? What ROI actually means? I have so many examples, we'll talk about it, but the whole goal was solve the dime problem, bring the community together, build a playbook that actually works and save a lot of time for you guys to build what matters and for us to solve the problems that we care about.

Super interesting. Aisha, one of the most difficult things for founders and sellers is to find a buyer who has a budget, who's who has the problems, and who's willing to buy. One of the most difficult things to do. And founders do all kinds of crazy things to get the attention of the CISA. I've done a few crazy things in my life as as a founder. I'm curious, you know, given the

hundreds of pictures that you get. how one for two parts a two part question. One is what are some of the examples of people trying to get your attention? That is that is one. And then second is what tricks actually work in terms of getting a CISO's attention?

Yeah. Thank you for asking this interesting question. I'm giggling because there's so many funny examples that I wanna share here.

Go go full ex full blower. Go full bore on this.

Yes, I will try doing justice, but the book will have more examples. but first I have a question for you. Guess how many or how often do I get surprised with goodies?

I would say at least once a week because I I know I like personally know founders who have built companies around doing this contact management experience. And the whole point of this contact management experience is to like deliver flowers, deliver doormats. Like that's the that's the company they have built. So I know like this process deeply, and they have pitched me that hey, we can help deliver doormats.

That's okay. You can cut it out, don't worry. but

Yeah. Okay, good. hold on. This speaker on or no? I am good. No, so start again. so I personally know people who are building companies to do the delivery of these gimmicks to buyers. So I'm curious, somebody who's sitting in that position, what's your experience?

Let me give you the answer to that.

Yeah, I'll give you I'll give you as much data on it as possible. So first of all, to answer on the question that I was asking and you said I get goodies once a week. You have no idea, Mel. On an average weekly basis I'm talking about, I get surprised by at least ten to fifteen times.

And is this like a virtual thing or a physical thing?

All sorts of things. Okay. before I give you examples, and here's what happens to me. again with clarity, with respectful of people's time, being very appreciative of the gesture and want to show gratitude, but at the same time, the emotions that I go through, first that often shows up is obligated. The worst one. I feel like, my god, now I'm obligated to do something. That's one.

Number two, the feeling I get is now I'm being pushed. Pushed like in some shape and form, there are multiple follow-ups. There was one example where somebody actually sent me a trophy after I was nominated for global CISO, like CISO of the year 2024, 2025, and somebody actually put an effort in building a trophy for me. That showed up on my desk and I'm

my god, what do I do with this? And it didn't stop there. First, there was a sweet note saying, appreciate your bringing thought leadership to the world. Good, thank you. Then follow up. How did you like the dropping? I'm like, thankful, grateful. Then follow up. So, how can we get on a call? I'm like, what do you sell? And the not only that I felt obligated, push.

Burdened, frustrated, all these emotions were there. But on top of it, I feel like now if you have got my attention, at least put in some effort. We we're gonna talk about effort as well. When I go see the demo, that demo had nothing to do with what I do in my

So there is no relevancy. So why are you wasting your time, energy, effort in doing something that is not going to solve my problem and I'm not your buyer? So even such things happen. But what type of things come show up on my desk? You mentioned doormats, donuts, cupcakes, candies, champagne, wine, cooch.

Do like them? Do you like the do you like the donuts? I I hope you'll like the cookies, right? Like

No, I'm good. No, I I don't eat junk food. So I'll talk about that as well.

Okay. Maybe so so the the the sellers who are selling send healthy food to Aisha. So at least that if you can get squared around. Keep going.

Well

Yeah. And not only that, then plants and the list goes on. So those are the kind of things show up time to time and I said

What's the weirdest what's the weirdest thing that you've seen come show up on your desk?

Where it is. I saw I gave you this example trophy. I'm like, I wasn't expecting what do I do with this trophy? Even the organization nominated me didn't give me a trophy. You know, so like where is this coming from? But

I I read in one of your series you somebody sh somebody shifted a sh shipped a plant and it said something to the effect, let us grow together or some some random sh shit that came up. So you know, that that I've not seen, but I was I I laughed when I read that.

Yeah.

Yeah, so for that one specifically, I think that was a beautiful gesture. I I'm into sustainability, organic stuff, and I thought that plant was sitting on my desk for a long time. So I thought that was a good, beautiful thing. But do I need it? No. Was it effective to some extent? After that plant showed up, here is the tip for you. The person who shipped the plant didn't tell me anything about their company.

So like what do I do with you? You know, like you got my attention. Now show me some work. And I do this 100% of the time. Good gesture, bad gesture.

Cookies, donuts, all those things, I'm appreciative. I will put it in my kitchen and then people will eat it. But out of curiosity, I will still go on their website. And that's where the test starts. 20 to 30 seconds test that what I say. In 20 to 30 seconds, I will go on your website, I will see your messaging, I will see which category you are in. And if it's not clear, full of love, it feels like you solved the whole world and you're not finished.

World hunger. Yeah, you solve world hunger. Yeah, then you're out. Then you're if you're solving world hunger, you're out.

Then you have lost me. So to answer your question, the second part, you said what works? What always works? Warm introductions. Full stop. That is my number one advice for all the founders. Warm introductions. I will also tell you in our in our industry, there's still a lot of conflict of interest now. Conflict of interest in a sense that

How do I say operators becoming advisors, advisors becoming investors, investors becoming LP. So there's like so much of that going on. And I don't take everyone's words for it. So for example, if a warm introduction is coming from someone who has lived my problem. And this is what I do. Vendors do not realize we talk all the time. So if I have a problem, I pay somebody who I respect, who I admire, who I know that has done work that

speaks for itself. I will ping those people and say, here is my problem, what do you think? Or what are you doing in your world? And if they tell me look into the look look into this product, look into that product, I do. So that's number one. if somebody in my network just reaching out to me, hey, go ahead and look at this product and they're just the advisor or investor, but they haven't lived with that problem, no, I'm not interested. In fact, I'll tell you a funny story. Once I was talking to a VC friend,

And I I was solving this AI AI shadow problem. So I pinged some folks and I said, Hey guys, I'm looking to this space. Can you provide some recommendations? And different network folks reached out with some names. And I asked this question as a follow. I said, How many of how many of you have lived this problem on your own? That's where I come to test operator reality.

Because it's easy to say, go take a look at this company because I'm invested in it. Or my founder is saying I'm awesome. I don't need that. that validation, I need to hear from people who have actually lived with that problem. So even in warm introduction, what I'm saying is it matters who is saying it. And I think I wrote another post on it as well. Operator reality so underrated. So underrated.

People are coming up with examples or throwing name right and left without understanding when I am buying a product, I'm putting my name behind it.

So that's one. What else works? Sharp, short, crisp email with clear messaging. Please be respectful of my time. Respect your own time. Tell me exactly what you are solving. Don't try to tell me that you're solving the world or world hunger problem. authentic networking. When I go meet people, I'm big into energy. I don't need transactional partners. I really want to be.

Present with that person hearing, what are you solving? So I think in in our case, Mehul, when we started talking, it was very natural where you were like, okay, you didn't try to come to me to try selling your product. You talked about you're building something, and you were more curious about how I'm thinking about this space. And then naturally I ask you, what are you solving or building? Mehul, I want to look at that. So

Invest time and energy building authentic relationships so that I am not seeing you just as a transactional partner. I need long-term partnerships.

Asha, after investing so much time, you know, we send you flowers, we send you trees, plants, doormats, donuts, finally close the deal, right? And then what I've seen is a lot of the software becomes shelfware and it don't doesn't get used as much. Renewal comes around and the vendor is like, we don't want this product, you know, renewals don't go as planned.

Why do vendors lose the deals, you know, after they have done all this upfront effort of convincing the buyer, you know, taking them out for steak dinners and doing all this work goes upfront. And then once the deal is closed, you know, it's almost like Tata Bye Bye. Like, you know, see you later at the renewal time. I'm curious, you know, from your perspective, why do vendors deal lose deals at renewals?

Many reasons. Many reasons. the I will talk about that toward the end as what is the biggest differentiator they're not realizing. But I want to start with a few examples. That has happened in my own stack. a few years ago we signed a vendor and they were the biggest name in data space. The deal the sign off was celebrated and then they disappeared.

No follow ups, no check ins, no product updates, just silence until

Question for you. no follow up with you or not with your team also? Like there's one level of follow up with the leader, the CISO, you know, that's probably a quarterly or a yearly thing. But like the team is engaged very deak week daily or weekly.

Nothing. Nothing. No one heard anything. And then just silence until month eleven when they came back with a renewal quote and a sense of surprise that we were already in conversations with their competitors.

Interesting.

And this happens so often. Look, I've been doing it for 25 plus years. There are vendors who will just we see through it. There are vendors who are just checking in for the sake of checking in. Then there are vendors who have no conversations going on. And then there are ones who may not even check, but they're so attentive. We recently had, like I can give you a few examples here. There was one vendor in our stack.

As the AI journey was changing, they were a SaaS play vendor. As the AI journey was changing, and I'm talking about good examples here, these guys were doing things behind the scene, although they didn't talk to us. But when we one morning, when we logged in, we see new features, we see new dashboards. They didn't have to show up or set up a call, they just put in the effort to make sure the product is showing what the trend is, what

The CISOs or the engineers need. So the point I'm making is it's not always that we are asking you guys to put meetings on our calendar. Just do the awesome work so that we can see that in action. Right? So that's one example. The other wonder, let me talk about this specific example.

And it's a problem statement. I'm still looking for a solution. If somebody's listening to this, please reach out. SAST AI portfolio management. We had a vendor. again, big name. We were happy that okay, after the problem statement, and by the way, Mehul, I have a process.

I do not bring in any vendor until my team clearly defines the problem statement. There are success criteria defined. We look at at least three to four competitors. We do a POC and then we pick a vendor. So imagine the vendors I'm talking about were the winners after the bake call. Now this vendor shows up in my ecosystem and

what is it? over promising, under delivering. Classic example. Right after the before the contract was signed, we will give you the the support that you need. We will have the people to guide you through. The minute the deal was closed, nothing.

And then my team is reaching out, asking for training, for integrations. And then everything is like we have two engineers, we are distributed among many customers, you are asking for something custom. We talked about it during our POC. And if you haven't built it as part of that POC and you promise that this is going to be part of our package, then you cannot say after you know the dealers closed that, sorry, this is a custom thing.

So then the conversation is that because it is custom, you have to pay for it. You have to engage our professional services. We have only two engineers who can only prioritize so many different things. And this nonsense gone for like so many months. Then they build something. We lost six months for them to build that integration. They come back and they they make us feel like they have done us a favor, sort of a gift that they have given us.

And then that integration solved the wrong problem. So, not only for the longest time you wasted our time, you wasted your own time, there was no alignment on what to build with us. You built something that you thought we needed. And then upon renewal, they're like the example I talked about. Our product was $100,000. We gave you a 77% discount.

And we built a specific custom integration for you. And I, my response to them was number one, let me just say that. There was no clear communication. You build something for for for the longest time you didn't build. And then when you build something, that solved the wrong problem. And then after that, if your list price is wrong, that's not my problem.

Yeah, th from the from their perspective, I guess, you know, they delivered they cut the cost by seventy per seven so seventy seven percent or seventy five percent. From your perspective, there is like zero value.

Exactly. So I have a quote on that as well. Like, they think giving a 77% discount is the value. I'm seeing it, even if I paid $25,000, I got zero value. So the value is zero. And I gave them so many opportunities to tell me how they're gonna fix the problem, how we move forward, what is the plan forward.

And what was missing in that conversation? Accountability, understanding, partnership. We are not hard on vendors and saying, okay, just because you made a mistake, we are not going to continue. We want authenticity, integrity, and accountability.

Is that is that one of the reasons why the the the products fail to deliver from your perspective? Like, you know, you come in, you you know, they don't do the due diligence, they come up at renewal, the products don't deliver whatever they promised in the POC, you come in yearly, that it's not working. And as soon as you threaten, hey, I'm not going to renew renew, discounts come in, the discounts come in and you know all big statements come in. These these are the things we did for you.

Why are you not seeing the value and you are like, I didn't see any value in all the work that you did. Is that how products fail from your perspective?

Yeah.

Absolutely, that's the delivery problem that I'm talking about. Look, as I said, as buyers, we have clear problem statements. We have money. Delivery is again and again. If I can tell you in 25 years, the biggest problems that I see is the delivery problem. Whether it's the hench head-off, handoff is broken. Whether it is the lack of communication, it is the lack of accountability. And one of the things vendors do that.

The hand off

Annoise the hell out of me is send me a list of things. We did this, we did this, we did this, we did this. But whatever you did, how does that translate into value? Nobody talks about that. You want to talk about what works, what good vendors do? As I said, do what matters. If you're really excited, passionate about solving a real problem without even me asking you, see where the trend is going, solve that problem, make it available in my dashboard.

You don't need to do big communication. You don't need there is another vendor that we really love. I don't want to give names because I don't want to favor one vendor or the other, but there is one vendor, they do it so beautifully. They have weekly friends, they don't overpromise, they're not sending quarterly roadmap talking about we're gonna do this, we're gonna do all those things, none of that. What they do is they first ship, they make it available in the product, and then they send an email, simple email.

feature release note here are the new things within the product. Go test it out. No drama. We love that vendor. On top of it.

Interesting. I'm gonna I'm gonna I'm gonna talk I'm going to talk to you about this vendor after this call. after the recording stops. I want to learn more. Aisha, one of the biggest misunderstandings for sellers is that you know when they get invited for a meeting, that's when they think that hey, there is there is an opportunity, let's get in and convince them to buy our product. And the thing that you say is

Yes.

in your writing is the cast is already set before you even take it the first call. The the the buyer has already done a lot of research and you're you're just a cog in the wheel of the process. You know, it's not like you're going to re redefine the process or redefine the RFP. The RFP is already designed, the problem is already defined, the vendors are already picked for analysis and you're just you know showing up for that competition.

Right. I'm curious, what is the thought process behind a you know, when a vendor decides to buy something, how long before the process has started, before the vendor is brought in?

Yeah.

I will talk about my process. I'm not really sure how structured or organized other leaders or organizations are. In my case, structure brings clarity, which is like alignment, alignment of so I do work mostly in fiscal year themes. So for example, we are in fiscal year 27. In fisc for fiscal year 27, our budgeting started in last November.

So most big enterprises do their budgeting around quarter, third quarter. So November, December is when we are doing budgeting. And I am not like setting in stone that we have to know exactly the vendors. The game plan is around November, December time, I asked my entire team. So another

So let me break it down. So I have GRC, I have security operations, security architecture, IT option AI. Five different pillars. Now I have to think about the envelope that I'm getting, I have to distribute in five to six different domains. But five to six different domains have their own major pain points, foundational problems, and emerging trends. And then I see where there is overlap. Like for example, shadow AI. Shadow AI is impacting pretty much everyone.

Continuous monitoring. It's impacting trust and assurance, it's impacting security architecture. So what I do is in around November, December time, I ask my leaders of these pillars, help me understand your pain points, help me understand where the foundational gaps are, the tech, and help me understand which vendors have not performed. That's the time I start the conversation saying if somebody is like a slacker, slacker, we immediately try to get rid of them.

But mostly around that time, my conversations around which vendor is showing up and which vendor isn't. So we get that clarity as well. And then the fourth question I ask is what are the emerging trends? Where the industry is heading? Where do we have gaps in our portfolio that we need to be addressing? Once we understand those, then we start talking about what should be our budget. I don't ever accept a blanket envelope from my CFO.

I have that understanding. That was another post that I wrote. People have a problem getting money from their CFO. My CFO and I have trust. And the trust is I only ask when I need something. And I've been in Treasure Data for seven years. And I can tell you this, Mehul, my experience with my CEO and my CFO, there has never been a time where I've asked for something and they said no.

In fact, my CFO is so proactive about security. That's not the case, maybe generally speaking, but he's so proactive about security and all these AI discussions where he'll be like, what do you need? Is there anything that I can help you with? And I tell him all along, as direct, as truthful as I am, I'm doing my research, I'm looking at the problem statements, I don't have the answers right now, but I will, rest assured, tell you when I know when I need something.

So build that relationship up and down as well. So coming back to the budgeting cycle and when we, you know, like get involved in the vendor evaluation process, once we understand our problem statement and budgeting is defined, in November, December, we have highlighted categories where we will be looking. And that clock starts in April. So meaning the budget becomes available in April to us. Now

June to March is the time when my team is looking. So, what happens in that process as well? Every single leader is responsible for writing a business case, which I personally reveal. Business case will be a problem statement. What does success look like? And then often they ask me: hey, can you reach out to your network and figure out who are the vendors?

Evaluating.

showing up as reliable vendors. And I ask them to do the same because I want them to build their own thought leadership. So I'm like, okay, go meet people, attend conferences, build your own circle. Because my experience is from a CISO CIO level where we get to hear if the product is working or not. But then they are the one in the wait. They need to know at their level if it's meeting operator reality or not, right?

So it goes both ways. So my guys and I come together around Jan February and we are like, okay, here were the problem statements we talked about. In the order of priority, what are we going to be prioritizing? You're not gonna bring, let's say we've we have to bring this year alone. I have replaced so far four to five tooling already. I'm planning to replace four or five another. So again, opportunity, opportunity for anyone who's listening. So there are opportunities. We are replacing those vendors because.

They didn't perform. Not because our problem was solved, they didn't perform. And then there are new emerging threat, threats that we need to address, four or five of new tooling that we will be looking at. But now, from our point of view, we are not doing everything in one go. We have to sequentially see which one should come first because that builds the foundation for the others. Now, with that business case, I bring in, they bring in the names.

Thank you.

We do our own evaluation first. We look at your websites. We look at your messaging. We tap into our network, we get their testimonials, feedback, what worked, what didn't work, and then by the time we knock on your door, there is enough evidence available to us to say they are worth the try.

I get it. I mean, this is something that is not known to many vendors who are trying to sell into your organization. one one one thing I want to touch upon, Aisha, is when you're evaluating these vendors, there's a lot of obviously they're going to come in and pitch you. Hey, our product is better. Look at our ROI for some random company we did. And I've seen this personally where I've seen this personally where

Vendors would hire marketing firms to do an independent ROI analysis, and the marketing research firm will say this vendor provides 500,000 in ROI. They have it a very slick PDF, colorful, looks visually appealing. I personally never understood like who's going to buy this random number that you came up with. So I was always curious how do the buyers think about ROI?

When they're making these ROI decisions, right? so let me start there. How do you evaluate ROI? Do you count on these? I don't want to name names of these market analyst firms, but they come up with these, you know, the paid and paid reports where they are saying ROI, $500,000 in ROI, so that the product is essentially free. love to get your take on it.

I'll give you the good answer.

He said the answer is never. Personally, in my journey, I have not looked at these reports for the main reason. As I know the delivery is the problem. I don't care how great is your ROI.

I have I have one question. I have one sorry to interrupt. I have one question. Do any of your peer networks look at this? Because this has this question has always boggled me where they're looking do people look at these they do they value these ROI reports? Some people look at.

Some do. Some do. Some do. But for me personally, it comes down to me doing a POC. That's why I said we don't bring in any vendor until we do our own POC. I mean, I don't know what's the value of me relying on a report when our environments are so different.

I want to make sure that I bring my okay, the it may be an approach question as well, but my approach has been that I want practical, realistic, informed data. I don't want hypothetical situations. I don't want somebody to vouch for someone. I want to see it myself.

You you would be surprised, Aisha, how much time is invested in calculating these random bullshit ROIs. They organizations literally have ROI calculators on their website where you can go and plug in these numbers and some random number comes out of

Mm.

You know what I call this?

Yeah, I would love to know. I'd love to know.

Mint allownant text.

Misaligned decks.

Missed alignment text.

Debts.

No, no, text, text. So miss. Yeah. Because you're investing your time and energy into something that you don't really know if it's going to work in reality. So that's the missing. And then you're putting text on it by wasting everyone's time, energy, and money. Whereas what I would do is I would rather have my team spend POC one week with that vendor and get to see would it actually work in my environment? Am I close to seeing the ROI that I want?

these are in text, I think. Okay.

Correct. Correct.

Yeah.

I think these people should ask themselves if they have clear success criteria, if they have done a POC, why are they relying on other ROI calculators? They can do it internally quickly, you know?

What is the ROI that you care you that you care about? Like what is that number that you really care about?

It depends on the function. So GRC ROI is a different security operations ROIs are different. So you know, like by domain I go. But I I want to give you an example. recently I had a product and we were talking about renewals, and I said, show me the ROI. And in that case, this is an AI product, and I want you to see how AI is adding value to your bottom line. And I catch you not exact wording.

We have saved you 15 minutes per person in summary documents, transcribe transcriptions, this and this and this. So the math was because we are saving you 15 minutes per person, your ROI is 1.5 million. You know what I said when that email came? I first I laughed. I sent an email back with one line. Nice.

Great fantasy map.

No, but you're this is correct because this is correct in the sense that these maths are fantasy maths. These there is no sense to these maths. Like, you know, we saved X hours, and your full-time employee could be hundred thousand dollars, so you you know, you know, whatever it is, and then they multiply that by the number of hours, and here's the three million dollar number. I don't I don't know who believes those numbers, but then there are vendors who've come up with these numbers. In fact, I've seen vendors putting these ROI metrics in the dashboards of the products.

Huh.

Two million dollars saved, four million dollars saved. I mean, who I mean, where where are these four where is this money? When can I get this money back? Is my question.

The clarity, even if many operators realize this is BS fantasy math, I don't know why many of them are not saying it. Look, I am I I hope you know me enough. I am not someone who is disrespectful or inconsiderate, but my point is I don't have time to waste, so please don't waste my time. You know, so from that intention, when I send that email back, just one line, nice fantasy math.

Sure. Good.

For three days, no reply. With no reply, because I didn't know how to justify that. And I said, We are not having a renewal conversation until you come back with realistic math. Because the ROI you're reporting is not the ROI that I disclose to my board and my CFO. Happy people, 1.5 million saved by 15 minutes does not show up in my report.

Wow.

Let's talk about real numbers, real mover needle movers. And if you don't have that, build with me. So see, Mehul, that's the point I'm making. Don't just randomly come up with things if you don't have it. Partnership is this. Hey, what what ROI for you makes sense? What sorry, what ROI, what makes sense to you? How can I help you build it? Let's work together to figure out what is it that you need to report, you need to track.

There you go

Vendors do not understand this, or they just have to put something for the sake of putting it. Just stop wasting your time and my time.

I would go a step further. If you don't have anything to report, don't report.

Like if there is nothing to report, don't report, don't make up a random number and show this is the ROI because this essentially impacts your credibility. fantastic. I mean, the the next question I have for you, Aisha, is is adoption rate. How do you how do you decide is now is the product getting adopted? You know, you you said you start your process in November, the evaluation starts in January.

How do you assess if this product is successful? Is it it's getting adopted within the company, within getting used by the company and so on?

First of all, good products become viral on their own. We don't have to do a lot of training and adoption. But then there is also a fundamental problem as well. Once the product is in our ecosystem, the minute you know the sign-off happens, somehow vendor thinks now it's our problem. Our problem to train, our problem to integrate, our problem to increase the adoption. And they are only tracking the number of clicks, you know how many people are clicking.

I see.

And that's why I say login frequency is not adoption. Feature clicks are not adoption. Training completion is not adoption. This was another line in there.

That is true. Training completion is not an option. I mean, I have like that is that is so crazy. You have the five step process, everyone has completed the training.

These examples that I talk about, I literally get them as email responses when I ask about ROI. One vendor sent me, we completed five trainings for you. We see number of people clicking on these features. What does that even mean?

I'm not giving that. I'm just giving you a real example. And then these people talk about their QBR and so you know like 73% people logged into this logged in and did what?

Aysha Khan (51:18.321) Намрика.

Logged in and then logged out. That the product doesn't work.

Often logged in, got overwhelmed, cannot make sense of how the data is well, the source of truths are not clean. Garbage in, garbage out is happening. there is no clear sense of like there was one tool that I would log in, fancy reporting. And I would ask my guys, can I take this? and the guy says, No, please don't rely on it because the data is not clean. And I'm What do you mean by that? Like, that's

Product was supposed to give me, you know, like executive spent by department on tooling, the SaaS portfolio one. And the guy says, you cannot trust this data. I'm like, then why the hell do I have this tool if I cannot trust this data? And whose problem is it? Well, the tool is so complex. This is another thing I wanted to highlight. Please, for God's sake, for God's sake, understand we want simple products.

I don't know who came up with this idea. I think Mihal, I told you this as well. when VC, founder, advisor relationships are very intimate relationships. Like dating. Make sure you have the right people guiding you. In the industry, one of the things that I'm seeing, my mantra for my organization is being a CIO and C so first simplify, then secure.

Yeah.

Many of these tools are overly complicated. Click here, click that, aggregate this, and then look at this. And I am sitting here thinking, we all are engineers, why did we not learn to unlearn this whole notion of making things complex?

On that topic I have one question for you, Aisha. do people do leaders at your level actually use the tools? Or do you rely on your teams to do you know, do you actually end up using the tooling at all? Or is it because my sense is you're mostly at the business level, looking at the metrics?

Depends, depends on the tool, the program. So for example, SaaS portfolio management, I am actively engaged because I want to see, I want to slice and dice information, figure out where the consolidation opportunities are, which tools are being adopted, which are not being adopted. So that's one category, continuous monitoring. At any given time, I want to get a sense of how the trends are going, whether it's vulnerability, whether it's compliance, those tools I go into, even from like executive point of view.

so I would say this is another thing that vendors have an opportunity. They often think the tool is black and white. Either it is for the executive or it is for, you know, the engineer who's in the tool. Yeah.

The practitioner. Yeah. I mean most you know, very common personas either it's the buyer or it's the user. There are very clear personas in our mind. You know, they we are selling sell the buyer then you know, then care about the user.

Yeah.

But I can tell you

Yeah. So that was a problem in SaaS, but it is becoming more of a problem in AI because now we all are becoming more hands-on. Now, before I would send a question, question will make it to the SME, SME will go log into the tool, the answer will come back up. Now I have the ability to just go query the data. So vendors need to start thinking about how can they make that same data available to execs?

Who slicing and dicing for different purposes, and then engineers who are actually using that to make sure things are compliant, trending down, doing what they need to be doing. That view is missing. We heavily relied in the SaaS era on our engineers to be doing the work and reporting back. What we are saying is we want that reporting visibility immediately.

But do you then get this reporting at like a you know, a BI tool like Domo and this is where do you mostly live in or do you actually go because you know again the problem is the problem is most vendors would have probably have a siloed view of their come you know, if you're using something for cloud, they probably have everything about the cloud. if you're doing web applications, you know, web application tool would have everything about their product.

In whatever they have to report, right? But there's something h else has to happen. Does it then end up in a reporting layer from your perspective?

We're talking about the horizontal layer. Yes, for horizontal layer we have things that we stitch together. Now with AI, things are becoming a lot more easier. It's simple MCP integrations and we are fetching in data there. But what I'm talking about a layer down, even within your own space, whether it's AppSec, whether it's continuous monitoring, whether it's GEMF or whatever.

at least give us enough information for any exec to go and say, how compliant am I with my device controls? Or how am I leveraging usage, adoption of the tool? That information within that space is also missing. So we have to very much rely on other people.

Interesting. And most of these decisions, the the buying decisions that you make, I shiny have talked about this extensively. These are reputation decisions. These are not just financial decisions. Every decision that you're making, it in in some respects it's a CYA. Like, you know, you don't want to like you know, there was a famous quote that nobody got fired for hiring IBM. I don't know if you remember that, right? Like, you know, nobody got fired for hiring by IBM.

So when you're dealing with startups or early stage companies, it's always a reputational risk. You come in, you bring in all this data and most of this data is very sensitive. Security data, it can get leaked, you know, exposed to S3 bucket and so on. what goes in in terms of your repute you know, the these kinds of decisions that are happening that have had a reputation layer?

Vendors have no idea, people who are making constant connections. This is this is what I'm talking about. Misalignment text bleeds into reputational text. Imagine this. If I built an authentic, credible relationship with other stakeholders and I tell them, hey, for example, my SRE team, we are looking into security architecture tooling, and here is the tool that is going to be coming in. If I bring in the wrong tool,

that wastes everyone's time does not deliver the way it should have delivered, whose credibility online? It's mine. Because next time they'll be like, you bring product that don't deliver, how are you doing your due diligence? Why are you wasting our time? And this is what industry has to understand that when operators are putting their name behind something, please deliver.

Yours. Yeah.

Not only that we will stop buying from you in that instant or will not renew, anything that comes out of your mouth for the next five, ten, fifteen years, we will think twice. If this person did not deliver here, why should I take this person's word for something else?

Question for you on that, is this most are these decisions are these decisions singular or are they bottoms up in the sense that, you know, you said you have a process in place where you're relying on your team to do the analysis and so on. So eventually the decision is yours, but then your team has also contributed in that process in terms of in terms of, hey, you know, this is working, this is not working. so is it again, the question is, is this a reputational list for the entire team?

Like these team the for example, the one way to look at this is this leader doesn't know what they are doing. The other team is this team doesn't know what they are doing. They just bought this product and wasted our money.

Yeah, let me do justice to this question. I personally do not make unilateral decisions. From the conversation so far, I think you should make sense of it that I'm very processed and structured person. but this is not only because I'm structured

Was is has that sorry to interrupt, but is that like a is that a thing that that you have developed over a period of time because there were so many failures along the way that you were like this is not working, I need to put a structure in place?

Yeah. But I will tell you is the instinct to answer your question, uni why don't I make unilateral decisions? Because one, I want buy-in, buy-in from people who will be implementing tools. If I come in, this is not I have a favorite saying, authority is not the truth, truth is the authority. Just because I'm the position to come and tell you look at this product or look at that product.

Yeah.

you are the one living in that reality, and I'm talking about my team who understand what will work, what will not work. Me giving you a name is just opening the door for a vendor because it comes from a place that I trust. So just take a look at it. But I do not make unilateral decisions because one, my personalities, I like to be informed. Just because I know a name, I'm gonna tell you, check this out.

However, I want my team to go do their due diligence, come back with information that also helps me. And then I often go back to my peers and say, by the way, the name you recommended will not work because of this, this, and this. So that industry is also getting educated in the process. So these are not unilateral decisions. I want to make sure everyone is involved. And the reason for that is one, we all learn from each other what is working, what is not working, how these vendors are delivering.

The other thing is they are the one who is who are implementing. So if they are involved in the decision making, the buy-in is there, then they are keen on implementing it as well.

Mehul (01:01:03.624) Yeah. True. And this is true, you know, you might think this is applicable to only your space. This is actually applicable to product and engineering as well. So when, you know, for example, when we are building products, we want to make sure that the engineers are involved in the design process so that they own the problem rather than the product manager saying, Build this without understanding the context of why why why they are building what they're building. And it's a very good process because getting the team in, take getting the team to buy in, because otherwise they'll not implement this Aisha told me to do this and I'm doing this and then

You know, y y you put essentially your reputation on the line and the product never delivers.

Aysha Khan (01:01:36.763) Right, remember I said earlier the process that I have is I want their conviction. Regardless of who is giving you a name, there are going to be three, four names, you have done the POC and I want my team's conviction. Look, I what I am most proud of is not the titles that I have. What I hope that my team remembers me for is me investing in their success. And investing in their success to me simply means they have a say, they are learning, they are growing, they have opinions.

Have opinions, I want them to have opinions. I tell every single leader on my team, if you are in charge of GRC, if you have a problem, I don't only want you to come to me with problems, I want you to come to me with some solutions as well. And in order to have some solutions, they have to go and they have to learn and they have to meet people and figure out what's working, what's not working. And when they come to the table, then they are going to say, Hey, this is what I'm thinking. And I then start grilling, why this? Why not this?

So it's not like my decision or their decision. We all come to the same decision together. And by the time we get there, there's conviction, there is support for each other. And then the journey itself is a lot more fun.

Mehul (01:02:47.082) Aisha, the the journey of buying products has come is completely changing in the age of AI. You know, like you just said, yeah, you you just said where I can now go in myself instead of going to an SME, I can ask the question, get the answer, and get going. This was simply not possible before. Simply not possible before where the executives had to rely on maybe the director or the senior director, the senior director would send it to the

The manager, the manager would send it to the analyst. The analyst is you know, some some kid is sitting in a low cost country running the report and then it goes up the chain again all the way. And by the time you get the report, it's like three days old or four days old. But now you can just jump in. I'm curious, how has the a buyer's mindset changed in the age of AI? How are how are buyers buying in the age of AI?

Aysha Khan (01:03:40.656) A long

Aysha Khan (01:03:44.697) lot has changed. First of all, what comes to my mind, I recently saw there was a like there was a pyramid hierarchy of how information used to flow up. And now in AI, it's a circular flow of information. Everyone is connected to everything and everyone is learning from everyone.

The context that I have is easily available to my engineers. The context engineers have now easily available to me. And in real time, we can make decisions. We don't need a lot more meetings. So that has changed. So the ground has shifted. That's number one. Number two, personally, I'm not looking at SaaS anymore. In fact, what I call is SAS was nothing but a glorified Excel. Data Excel.

Mehul (01:04:26.25) True, true. Yeah. And this is this is this is especially true for MySpace, the vulnerability management products, that it was essentially a glorified Excel sheet. Because even after doing all the work we did in vulnerability management, customers would just download it to an Excel sheet and then work for like the post action was always in an Excel sheet and a pivot table. And I'm we were like doing all this innovation on the product side, and the customers are like, just give me an Excel sheet.

Aysha Khan (01:04:54.097) There was contact lacking misinformation, more mostly hierarchy, either up or down. That the process itself has changed, but now what else is changing is everyone is sort of becoming an IC, even in their own position, right? So forget about titles, but even in my job, the biggest thing has happened. First, I'm gonna start there.

You know, like as a leader, you have years of experience, you have a way of doing things differently, you have been burned along the way, you have had your fair share of you know successes and failures. You learn. So the processes that I've built because of who I've been throughout that journey. But what has happened now is

Back then, I would let's say have an instinct. I would say, I think my instinct tells me that I need to go in this direction, but I would not have data. So I would tell my team and I'd Hey team, can you gather this data for me? I'm a very dear different person. So I would say, once I have the data, my instinct will tell me, like I will get the validation or confirmation of what I'm feeling. AI has solved that problem for me. Instinct was always there, data was delayed.

Now with AI, data is readily available to me. So with instinct and readily available data, now I can quickly make decisions. So AI has accelerated speed not only in building, but fail fast, learn fast, use your data to make decisions that are going to actually move the needle. So that's one aspect. The other thing has changed is the expectation. Look, what is the difference between SaaS and AI? The way I describe it as

In the SaaS, who is going to do the work? Because you have these glorified Excel, people will log in, all the other things that we have talked about. Whether there is adoption or not, at least they go, they log in, they see if the data is organized, clean, and they are not overwhelmed, they're going to do something with it. So the math was mostly about buy tools and then put or throw people on those tools for them to be doing the work. And AI was changing.

Aysha Khan (01:07:09.141) It's how the work gets done. Now the dashboards are giving us not only visibility but aging or a genet capabilities to do the work as well. So what I see is when people talk about AI ROI, the biggest AI ROI that I am shooting for is strategic thinking for my team.

Before my teams were so busy within the tool, trying to grab things, send it in all different directions. Now my team has the ability to rely on the agents, automate many of those things, and then they have time for strategic thinking to think about why it matters. What do I do with this?

How do I solve with this? And the biggest thing that I have seen is with that bandwidth that we have increased, the things look, security is never 100%. There was a big parting loan item of things that we always wanted to get to, but the answer was always bandwidth, bandwidth, bandwidth. We need more people, we need more tooling. Now, what we are doing is with the Gente capabilities, we are pulling more into our backlog and we're saying now we have the

ability and focus to execute on other things to increase our scope for coverage. And that's how our C AI has changed the game.

Mehul (01:08:39.836) I I'm curious, you said something on the lines that the SaaS is dead or something on those lines. I forget the exact term that you said. But my question my question to you is, do you see the value kind of concentrating from your perspective into the AI models and the AI companies, or do you still think the SaaS companies will continue to deliver value for your teams? Would they, as you think about as you think about replacing vendors, bringing on new vendors?

Aysha Khan (01:08:49.681) What?

Mehul (01:09:09.896) Are you then more relying on the AI tools like Claude and Gemini and I guess, you know, rely on them to do the work with the agentic capabilities, or do you think the SaaS vendors can build their agentic tooling and deliver the outcomes that they're looking for? How are you thinking about that?

Aysha Khan (01:09:26.395) First of all, I'll tell you at my whole I'm too linguistic. I don't care if Enthropic is solving that problem or the current vendor in my ecosystem is solving that problem, number one, because if enthropic eventually is going to eat everyone's lunch and do it well, then we'll go in that direction. But right now that's not the reality. But the way I look at it is it's not black and white meho. It's not like SAS is fully dead. Like, okay, let me say it this way.

Even AI need system of record.

And SaaS was system of record. Now the problem is the ones who are still selling SaaS is there is a difference by the way, AI ready, AI enabled, and AI native. You put an agent on top of your record and you're like, okay, now we are AI native. You're not AI native. You are AI ready, you know? So don't fool yourself and don't fool people who know what the difference is.

So the point I'm making is SaaS is transitioning. If you are going to be purely a system of record, but you expect still people to come in, login, and do the things, then you are still purely SaaS. But AI native is you took your SaaS infrastructure, you now have the AI native capabilities on top. Now you empower your customers.

Because not only we need the system of record for things that we need, but now there are agents helping us develop, build, and implement. For the longest time, many things we could not deliver because we were relying on vendors to build integrations, to create implementations, to help my team do things within their tools.

Mehul (01:11:19.665) And one of the one of the biggest challenges I think in the previous era was build versus buy. There are always these discussions, should we build this ourselves? Should we buy a new tool to do this? do you think that that changes now with the build versus buy versus there is something else that comes in place for for somebody like you?

Aysha Khan (01:11:40.059) Yeah. Yeah, it does. My framework is very simple. first of all, build versus buy, I feel like will always be a conversation. But how the conversation changes is now instead of just simply build versus buy, I look at it as build with AI, replace with AI. And now and now let me explain why I that.

Mehul (01:12:01.734) Interesting. Interesting.

Aysha Khan (01:12:08.475) Build wor s build with AI and replace with AI, the lens that I use is the thing that we are building, is it core to who we are? Is it going to scale in the direction we wanna go? If the thing that we are building is supporting our core capabilities, let's build it with AI internally.

But if we are investing our time and energy replicating another CRM, another ERP, another AI platform tooling, which is not core to who we are, we are wasting our time.

So focus again going back to you know this whole conversation noise to signal, the biggest takeaway for everyone is guys, clarity of who you are, playing in your lane, building in that space, and then making bats on AI where AI is going to amplify you. AI is not strategy. AI is a tool to amplify your strategy.

Mehul (01:13:12.531) Are you in some sense buying agency for your team with AI?

Aysha Khan (01:13:16.163) I am. I am possible.

Mehul (01:13:18.021) Is that what you is that is that what you're looking for, you know, as per out of a mandate for tools with AI?

Aysha Khan (01:13:25.477) Yeah. I have changed the whole operating system, the working operating model for my

Mehul (01:13:30.983) Yeah. Very important to clarify that. You know, it's not the window it's not the Windows operating system or the Linux operating system. The working operating system. Very important to clarify that.

Aysha Khan (01:13:33.839) Yeah.

Aysha Khan (01:13:41.125) So, what I have asked the team to do is we are okay, so we have these mandates, you know, keep us out of the limelight, secure the product, assure the customer, enable and accelerate our workforce. These are mandates. The program doesn't change. How we think about those programs and deliver on them changes. One, we want to be tool agnostic. We are still doing some experimentation. We have many different tools, but

I have high hopes by the end of this year. If you come back and re-interview me, I will tell you out of 23 AI tools, I will be down to good five or six of them. And they are going to be the core capability tools for our tax, right? So that's number one. Use AI to amplify how you deliver these programs. Number two, agency in terms of again going back to build with AI.

replaced with AI, there is one vendor that I brought in which is going to give a space to my security operations team to not worry about triaging, remediating, vulnerabilities, you know, like S bombs and AI bombs and all those things. Cause now we have have the space for him to focus on other things while agent is able to do all those things. So yes,

Agency, autonomy, all those things are being amplified with the end.

Mehul (01:15:11.281) You know, you mentioned some things that seem a bit odd to me. you use you mentioned maybe the context was wrong, but that you still rely on dashboards to get insights. Do you think the dashboards would be relevant in the age of AI, or would you just have the agents do the work and let you know that the work has been done? Or would you still rely on these dashboards to visualize the work? Because what you're seeing is you're relying on agents to do the work.

not log in, like not humans to log in the product and check in and what is happening. But then the on the flip side you're saying that I want the agents to do the work in some ways. I want I'm buying agency, right? So do you think dashboards are relevant in the age of AI?

Aysha Khan (01:15:54.041) And thank you for asking this question. So this gives me the opportunity to clarify. What I'm saying is, imagine this. This example that I gave you, security operation agents will be looking at triaging, incidents, level one, level two, remediation, all of it. Right? Agent is actually doing the work. But how do I know Agent is doing the work? So when I'm talking about dashboards, what I'm saying is, I still need

Mehul (01:16:15.849) Yeah.

Aysha Khan (01:16:22.191) The ability, forget about visibility, I still need the ability to know what the hell is this agent doing?

Mehul (01:16:28.401) Correct. Got it. Got it. Yeah. So the the you want to be able to track what the agent has done and accomplished. And maybe that gives you the right ROI eventually. Eventually it solves the ROI problem.

Aysha Khan (01:16:34.309) Yes.

Yeah. Even with mythos. We will Asian will be remediating, triaging, reaching out to engineers, maybe building PR codes and all of that. But how do I know what is the baseline? Like what were we like a month ago and what new is coming? I still have to have some ability to know how the trend is going so that I can also figure out my own

Mehul (01:17:00.519) Visibly.

Aysha Khan (01:17:06.949) Growth factors like where do I need to invest more? Now if if the funding or the budgeting opens again, how do I know where do I need to invest if I don't know or understand the trends over time?

Mehul (01:17:22.077) Aisha, this has been this has been an epic interview. Last question for you. what's next for you? I know you're writing the buyer's seat. you're writing the buyer's seat book. what's what's the next big book that you're writing?

Aysha Khan (01:17:37.815) Right now I'm writing two books and you know it's so funny, Meho, even in my job it is

Mehul (01:17:42.099) So is it like three books? So that is in addition to the buyer's seat or is there something apart from like is the buyer's seat one of the books or is there two more books?

Aysha Khan (01:17:50.423) No. So buyer seats is one book. And the other book that I'm writing is more of a spiritual book. The point I was making is even in my role being a CIO and C so there's constant context switching happening. And I don't know what is it with my life. Even at the same time, I've started these two projects and they're both going at parallel speed. So my focus right now is

Mehul (01:17:54.505) Okay.

Mehul (01:18:06.706) Hmm.

Aysha Khan (01:18:19.835) Finish the buyer's seats first, because I feel like this is what the industry needs right now. And as this book hopefully helps people get clear on what matters, why it matters, how to build, that will free up my own cycles from managing vendors and relationships. And that time that I get back, I will then write other books.

Mehul (01:18:25.181) Mm.

Mehul (01:18:43.367) When does when does the book come out?

Aysha Khan (01:18:47.097) My hope is fall of this year if vendors do not add more to my plate.

A lot of my time goes into managing relationships.

Mehul (01:19:01.403) And then how can viewers sign up to learn more about the book when it is coming out, and subscribe.

Aysha Khan (01:19:12.025) Yes, we have a domain, the buyer seeds.com. Again, the goal is not for me to write a book for the sake of writing a book. I have a lot going on in my life. I have a full life that I love and I'm writing it only with one intention. Hope this brings clarity to our community and we all start building what matters and stop talking about we are being burnt out, we are being depressed, we don't know why we are wasting time cycles. So every

listening this book is for you guys if you are interested please sign up when the book is ready you will get a quiet nudge that it's ready no spam or nothing and at the end of the day if it helps you that's what I want

Mehul (01:19:57.63) Awesome. That's a great place to end the interview. So I'm going to stop recording, Aisha.

Aysha Khan (01:20:04.337) Thank you.