The risk compound: Why tech debt is your greatest threat

In this episode of Security Signal, Cloudflare Field CIO Khalid Kark sits down with Mark Hughes, Global Managing Partner of Cybersecurity Services at IBM, to discuss the shifting paradigm of enterprise risk. As attackers trade traditional playbooks for AI-accelerated strikes, the conversation moves beyond simple threat reports to address the strategic challenges facing the C-suite.

Key Discussion Points

• The velocity of AI threats: Mark explains how attackers are using AI not to reinvent the wheel, but to spin it faster. From sophisticated reconnaissance to high-fidelity phishing and rapid malware development, the time-to-attack has shrunk significantly.
• Legacy debt as a business risk: The duo dives into technical debt and how legacy infrastructure creates a dual risk: vulnerability to hackers and availability risk (the danger of systems simply failing due to age).
• The shift to autonomous security: Mark paints a picture of a future defined by "Thin IT" and autonomous security. He describes a world where AI agents collaborate to remediate threats in real-time, moving from reactive reporting to ambient, proactive defense.
• The quantum deadline: With Cloudflare and IBM at the forefront of post-quantum cryptography (PQC), the discussion highlights why crypto-agility is a present-day requirement, not a futuristic goal.
• Governance vs. compliance: A critical distinction is made: CISOs must move from the "compliance" subcommittee to the "risk and strategy" committees to be truly effective.

Learn more about the insights discussed in this episode within our 2026 Cloudflare Security Signals Report .

Participants:

Khalid Kark is a globally recognized technology strategist and Field CIO at Cloudflare, where he works closely with C-suite leaders and board members to shape secure, scalable, and resilient digital strategies. With over two decades of experience at the forefront of technology leadership, Khalid helps organizations navigate the complex intersection of business innovation, cybersecurity, and enterprise transformation. Previously, Khalid led Forrester’s Security & Risk and Technology Leadership practices and served as Global Managing Director of Deloitte’s Technology Leadership Program and chaired Deloitte’s Tech Eminence Council to elevate thought leadership in AI, cybersecurity, and digital innovation. 

Mark Hughes, Global Managing Partner, Cybersecurity Services, leads IBM’s team of thousands of experts in helping organizations transform security into a business enabler and establish cyber resiliency. His role spans the sales and services delivery of threat detection and response, data security, cloud security, IAM, infrastructure, risk management, and ecosystem partnerships. Mark’s cybersecurity career spans over two decades, including recent roles as President of Security at DXC Technology, a fortune 500 global technology services provider, and Chief Executive at BT Security, a leading global telecommunications provider. Mark has served on national boards, including the Cyber Growth Partnership for the United Kingdom, and the World Economic Forum’s (WEF) Global Cybersecurity Board.