{"id":8129,"date":"2026-05-13T09:01:00","date_gmt":"2026-05-13T09:01:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8129"},"modified":"2026-05-13T09:01:00","modified_gmt":"2026-05-13T09:01:00","slug":"2026-cso-award-winners-showcase-business-enabling-cyber-innovation","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8129","title":{"rendered":"2026 CSO Award winners showcase business-enabling cyber innovation"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The annual CSO Awards annually recognize security projects that demonstrate outstanding security leadership and business value.<\/p>\n

For this year\u2019s program, CSO honors 64 security organizations<\/a> whose hard work and innovative approaches have had a significant impact on how their enterprises navigate risks in an increasingly challenging cyber environment.<\/p>\n

These projects showcase the variety of strategies that CISOs and their teams are employing to bolster enterprise security today. Many leverage the principles of zero trust to reduce risk. Others are using AI and automation to better defend their organization. Still others are using gamification and other change management practices to strengthen security awareness and bolster their first line of defense.<\/p>\n

Here, we profile six of these award-winning initiatives that collectively represent the transformative work happening in security today.<\/p>\n

Changing the security culture at Copart<\/h2>\n

Organization:<\/strong> Copart
Project:<\/strong> Making Cybersecurity as Instinctual as Buckling Your Seatbelt
Security leader:<\/strong> Kevin Vuong, CISO<\/p>\n

With social engineering still a central initial attack vector today<\/a>, online car auction company Copart faced a challenge familiar to most CISOs: training workers to automatically incorporate cybersecurity into their daily tasks.<\/p>\n

Security process manager Brittany Little<\/a> says the training and testing strategies that Copart\u2019s security department had been using, such as phishing simulations, weren\u2019t getting the results security leaders wanted to see. And traditional training, which was manual, episodic, and compliance-driven, didn\u2019t match the education needs of a 12,000-member global workforce comprising vastly different role types.<\/p>\n

So the security team set about creating a more efficient, impactful security awareness program<\/a>, Little says, to make cybersecurity behavior as \u201cinstinctual as buckling a seatbelt.\u201d<\/p>\n

So Copart implemented an automated, adaptive security awareness program that continuously delivers role-based phishing simulations and immediate micro-training tied directly to employee actions. That ensures the training \u201cfocuses on the things that matter,\u201d Little says.<\/p>\n

The new program is also more intensive, Little says. Previously, security sent out three or four global simulations per quarter. \u201cWith a more efficient platform that has more automation and relatable content, we have delivered 202,992 simulations in one year \u2014 over 950 of those being unique simulations related to employee\u2019s role, title, behavior analytics in the program,\u201d she notes.<\/p>\n

The revamped awareness program also leans into gamification, with live leaderboards, achievements, and recognition. And it replaced manual analysis with automated reporting and executive scorecards.<\/p>\n

These improvements have increased the security culture at the company. In the two years before new program was introduced, the simulation reporting rates sat between 17% and 24%; with the new program, the report rate is between 55% and 60%.<\/p>\n

\u201cThe gamification has been something that has made the training and awareness different,\u201d Little says, noting that it has been key to worker engagement. Workers now boast about their strong performances and talk with one another as well as with security staffers about what they learned in the gamified training sessions.<\/p>\n

The scorecards have also been instrumental, giving department leaders metrics on the cybersecurity acuity of each of their workers. \u201cWe look at the data, we analyze it, and now we get to go and actually have the conversations that matter,\u201d Little explains. \u201cIt has allowed us to actually change behaviors.\u201d<\/p>\n

Zero trust data governance repositions HMSA\u2019s cyber team as a business enabler<\/h2>\n

Organization:<\/strong> Hawaii Medical Service Association (HMSA)
Project:<\/strong> Zero Trust Data Governance Initiative
Security leader:<\/strong> Sudhakar Gummadi, CISO<\/p>\n

HMSA CISO Sudhakar Gummadi<\/a> says three forces prompted the nonprofit health insurer\u2019s Zero Trust Data Governance Initiative: an intensifying threat landscape targeting the healthcare sector<\/a>; increasing regulations and privacy expectations; and HMSA\u2019s expanding digital footprint.<\/p>\n

\u201cWe recognized that incremental remediation would not meaningfully reduce risk,\u201d Gummadi says. \u201cWhat was required was a deliberate transformation in how we think about trust, data usage, and accountability across the enterprise.\u201d<\/p>\n

HMSA embarked on its Zero Trust Data Governance Initiative in 2024 as part of that transformation.<\/strong><\/p>\n

In addition to implementing and maturing numerous zero-trust principles<\/a>, HMSA sought to ensure no confidential member information (CMI) left its production zone.<\/p>\n

That goal went against traditional healthcare industry practice, where copies of real-life production data existed for use in nonproduction environments to ensure system functionality and fidelity.<\/p>\n

That practice, while operationally convenient, significantly increases enterprise exposure to data privacy and cybersecurity risks, Gummadi says, noting that many nonproduction systems don\u2019t have the same security controls as in the production zone.<\/p>\n

As such, the initiative\u2019s biggest challenge was the change management<\/a> component.<\/p>\n

\u201cWe were asking teams to rethink long\u2011standing practices around how data is used in nonproduction environments,\u201d Gummadi says. \u201cWe addressed this through sustained executive support, transparent communication, and a focus on early wins that demonstrated value \u2014 both to the business and to members whose trust we are responsible for protecting.\u201d<\/p>\n

In addition to eliminating CMI from all nonproduction environments, HMSA\u2019s initiative sought to protect member data privacy and reduce exposure risk\u202facross the entire technology ecosystem; mitigate cybersecurity vulnerabilities\u202fassociated with nonproduction environments; standardize and modernize data governance practices; and implement a scalable, sustainable, and automated masking framework.<\/p>\n

To do that while ensuring operational continuity, HMSA\u2019s security team opted to use high-fidelity, functionally equivalent data\u202ffor development, testing, and analytics \u2014 a significant task, as HMSA had more than 50 terabytes of CMI\u202fresiding\u202facross heterogeneous platforms, diverse data models, and inconsistent data governance processes.<\/p>\n

HMSA used an AI-enabled automated data masking suite from Perforce Delphix to identify CMI and apply algorithmically consistent masking rules. That enabled HMSA to fully de-identify CMI in the nonproduction environment.<\/p>\n

To ensure long-term sustainability, HMSA\u2019s data governance team\u202festablished\u202fstandardized process flows, controls, and a responsibility assignment matrix, enabling automated masked data refreshes and ongoing compliance as systems evolve.<\/p>\n

\u201cTrust is foundational to HMSA\u2019s mission. Protecting member information is not simply a compliance requirement; it is a core business imperative,\u201d Gummadi adds. \u201cThis initiative strengthened our ability to safeguard that trust at scale, while also improving operational efficiency and enabling more informed decision\u2011making. It repositioned cybersecurity as a strategic enabler rather than a downstream control.\u201d<\/p>\n

Hensel Phelps takes a team approach to automating away cyber drudgework<\/h2>\n

Organization:<\/strong> Hensel Phelps Construction
Project:<\/strong> Project SAM
Security leader:<\/strong> Dustin Morris, director of cybersecurity and compliance<\/p>\n

Dustin Morris<\/a>, director of cybersecurity and compliance of Hensel Phelps, faces a scenario common for security leaders: defending against an ever-expanding threat environment with resources that don\u2019t grow as much or as fast.<\/p>\n

Starting in 2024, Morris focused on using automation to build capacity, setting out to automate 1,250 hours of manual tasks, effectively replicating a full-time employee\u2019s functions.<\/p>\n

\u201cThe vision was to really reduce the day-to-day monotonous tasks we have in cybersecurity operations,\u201d says Morris, who took a methodical and enlisted his five-person team.<\/p>\n

Together they identified tasks to automate, calculated how much time that automation would save them, and laid the groundwork for automation.<\/p>\n

Morris then scheduled an \u201cautomation week,\u201d during which the entire team came together to automate those identified tasks. In some cases, they implemented automation capabilities offered within their existing security software, while in other cases they built their own.<\/p>\n

Automation work has been ongoing, including a second \u201cautomation week\u201d in 2025 \u2014 at which point the project was dubbed SAM for \u201cSecurity Automation Member.\u201d<\/p>\n

By early 2026 the security team\u2019s automation efforts eliminated more than 1,250 hours per year of manual effort while improving consistency, reducing human error, and strengthening the company\u2019s security posture. Furthermore, the automation enhanced operational efficiency, optimized license utilization, and improved user experience by reducing downtime and accelerating remediation.<\/p>\n

Additionally, the initiative demonstrated how automation can scale security operations to meet business growth without proportional increases in headcount while increasing work-life balance for cyber employees. Project SAM has also enabled security team members to spend more time on high-value proactive security tasks, such as threat hunting.<\/p>\n

Morris aims to automate another FTE\u2019s worth of work by the end of 2027.<\/p>\n

K&N Engineering shifts left for greater cloud security<\/h2>\n

Organization:<\/strong> K&N Engineering
Project:<\/strong> Code to Cloud Security Transformation
Security leader:<\/strong> Iqbal Rana, CIO<\/p>\n

Manufacturing company K&N Engineering manages its own direct-to-consumer ecommerce environment in AWS. CIO Iqbal Rana<\/a>, who oversees security, has always followed security best practices in the cloud, relying on cloud-native security capabilities and controls implemented by his security team to ensure \u201cwe had all the rights things in place.\u201d<\/p>\n

But an assessment by his cyber insurance company a couple of years ago alerted him to a security vulnerability in the software deployment tool used by his IT workers.<\/p>\n

That alert prompted Rana to immediately address the vulnerability \u2014 and to more aggressively look at the risks within his vendor environment and in IT processes, he says.<\/p>\n

That led to K&N\u2019s Code to Cloud Security Transformation, which tackles vulnerabilities not only in vendor tools but also in the code his team was deploying.<\/p>\n

The initiative involved implementing a code-to-cloud security framework and Wiz technology, which integrated security into every stage of the development lifecycle across K&N\u2019s AWS and Azure environments.<\/p>\n

Now his team can proactively identify and remediate vulnerabilities before deployment, ensuring secure, compliant, and efficient cloud operations.<\/p>\n

\u201cSo we not only fix the deployment risk but also code risk as well,\u201d he says, explaining that the technology prevents code with known vulnerabilities from being inadvertently deployed. \u201cAnd it doesn\u2019t end there. When the code is deployed [and] you\u2019re live in production, at that point it keeps checking on an ongoing basis. So we have a dashboard that will tell us not only any infrastructure vulnerability but also any problem with the code.\u201d<\/p>\n

Rana says the technology enabled a transformative shift-left strategy, as his team can now uncover and remediate hundreds of hidden vulnerabilities. It also gave the team near real-time visibility into risk exposure while strengthening compliance and safeguarding critical revenue streams.<\/p>\n

Security transformation fortifies McDonald\u2019s resilience while reducing risk<\/h2>\n

Organization:<\/strong> McDonald\u2019s
Project:<\/strong> Securing the Arches
Security leader:<\/strong> Mike Gordon, CISO<\/p>\n

McDonald\u2019s has more than 44,000 locations operating in more than 100 countries, serving 69 million-plus customers daily. Approximately 95% of its restaurants are operated by local franchisees.<\/p>\n

The company\u2019s technology stack reflects its size, global reach, and distributed nature. Its cyber risk does, too. For example, its mobile app connects some 250 million consumers to its restaurants.<\/p>\n

\u201cDigital transformation created a much more connected ecosystem at McDonald\u2019s than was ever imagined by Ray Kroc,\u201d says company CISO Mike Gordon<\/a>. \u201cAs such, cyber risk was way higher than it ever was.\u201d<\/p>\n

An assessment of the company\u2019s security posture performed a few years ago confirmed as much, showing tech leadership there was room for improvement. The assessment determined that the company\u2019s maturity on the NIST Cybersecurity Framework trailed industry peers. It also showed that its cybersecurity capabilities, including foundational controls and visibility into threats and vulnerabilities, varied widely across regions.<\/p>\n

As a result, McDonald\u2019s CIO championed a transformation and hired Gordon in early 2024 to execute it.<\/p>\n

The Securing the Arches (STA) program modernized and unified cybersecurity across both the company\u2019s corporate and licensed markets. STA established a consistent foundation for identity controls, vulnerability management, data protection, and threat detection across the company\u2019s 100-plus markets. It also established consistent, enterprise-grade protections through shared services that include a global SOC, secure development pipelines, proactive testing, and systemwide endpoint visibility.<\/p>\n

The size and structure of this transformation required strong executive skills.<\/p>\n

\u201cI\u2019m not a CISO of one company; I\u2019m fundamentally the CISO of about 150 companies, of which I actually only have direct control over one,\u201d Gordon explains, saying transformation success meant building relationships and influencing other leaders as well as deploying the right technology and technical skills within the security team.<\/p>\n

STA has strengthened the company\u2019s resilience and reduced risk, thereby providing the security foundation needed to support McDonald\u2019s accelerating digital growth. As the company\u2019s cybersecurity maturity has climbed, Gordon says he\u2019s now enacting Securing the Arches 2.0 with a focus on continually improving the effectiveness of the cybersecurity program. \u201cWe\u2019ll continue to evolve,\u201d he adds.<\/p>\n

MISO brings maturity and metrics to threat action operations<\/h2>\n

Organization:<\/strong> Midcontinent Independent System Operator (MISO)
Project:<\/strong> STRIKE (Strategic Threat Reduction & Intelligence-Driven Knowledge Engine)
Security leader:<\/strong> Eric Miller, VP and CISO<\/p>\n

Like many security departments, MISO\u2019s security team used common tools such as NIST frameworks and other maturity models to score its program and track its maturity improvements.<\/p>\n

\u201cBut from a threat intelligence and a threat hunting perspective, there wasn\u2019t really a particular meaningful metric to indicate how successful our program was,\u201d says David Webb<\/a>, director of MISO\u2019s cyber threat action center.<\/p>\n

As a result, MISO security leaders and other executives weren\u2019t able to clearly track the center\u2019s effectiveness or whether it was maturing. So in 2024 Webb and threat researcher Nate Apperson started the Strategic Threat Reduction & Intelligence-Driven Knowledge Engine, or STRIKE.<\/p>\n

STRIKE transforms cybersecurity risk management by integrating global threat intelligence, MITRE ATT&CK mapping, and NIST frameworks into a unified model. It delivers real-time scoring that quantifies visibility gaps and control effectiveness against real-world adversary tactics. It also prioritizes actions based on threat likelihood and readiness. And it provides a prescriptive path for technical configuration, thereby reducing remediation and analysis cycles to near-instant.<\/p>\n

According to Webb, STRIKE ensures security activities align with threat intel and contribute to advancing the overall cyber security strategy. It also provides metrics for measuring the effectiveness of threat hunting \u2014 a vital benefit.<\/p>\n

\u201cWhen we do a threat hunt or when we complete one, what\u2019s the output? We wanted more than just a check mark on the top of the page saying that we\u2019ve completed the threat hunt,\u201d Webb explains. \u201cWe want to show that we are reducing risk throughout the organization.\u201d<\/p>\n

It\u2019s a common challenge, he says, as traditional risk management relies on siloed frameworks and subjective prioritization. This leaves gaps between threat intelligence, control requirements, and technical remediation.<\/p>\n

To overcome that challenge, STRIKE operationalizes threat intelligence to identify active adversary behaviors and align them to MITRE ATT&CK techniques, thereby ensuring risk decisions are based on real-world threats. STRIKE also creates links between ATT&CK techniques, NIST CSF functions, and NIST SP 800-53 controls, thus clarifying which controls mitigate which adversary behaviors and highlighting gaps across policy, process, and technology. Additionally, Webb says that by incorporating DISA STIGs, STRIKE provides the technical steps to close control gaps.<\/p>\n

Tying it all together is STRIKE\u2019s Detect & Protect Scoring Framework, a quantitative model that measures visibility (detect) and defensive strength (protect) against high-risk techniques with scores weighted by threat likelihood and updated dynamically.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The annual CSO Awards annually recognize security projects that demonstrate outstanding security leadership and business value. For this year\u2019s program, CSO honors 64 security organizations whose hard work and innovative approaches have had a significant impact on how their enterprises navigate risks in an increasingly challenging cyber environment. These projects showcase the variety of strategies […]<\/p>\n","protected":false},"author":0,"featured_media":8130,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8129","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8129"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8129"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8129\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8130"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}