As Global CISO at internationally recognized sportswear brand Under Armour, Alex Attumalil is responsible for ensuring the organization’s cybersecurity strategy can support both today's business priorities and tomorrow's challenges.

As AI adoption accelerates, his role extends to helping the business manage technological change at scale.

During GISEC Global 2026 in Dubai, Attumalil shared how cybersecurity leaders can build stronger alignment with the wider organization by framing cyber risk in business terms rather than technical ones. For Attumalil, effective security leadership is as much about building trust with executives and the wider workforce as it is about defending against threats.

In a one-to-one interview with Infosecurity in Dubai, Attumalil reflected on his five-year tenure as CISO at Under Armour and the time required to turn a long-term security vision into reality.

He also discussed how he is managing AI-driven transformation across the business and what it takes to secure lasting support from senior leadership.

Infosecurity Magazine: What are your cybersecurity priorities today?

Alex Attumalil: I have two big priorities. One is how do we use AI to enable the business – and that’s not just a priority for us, that’s something everyone is doing.

If you’re not using AI, you’re falling behind because your competitors are doing it, the world is doing it.

You have to take advantage of what AI can do for you as an organization. Security teams need to define what protections need to be put in place and how fast to do it. You want to ensure the business doesn’t deploy something now that you need to yank back.

The second side is AI enabling the threat actors. They have exponentially increased their capability and capacity so now you have to defend at scale. You need to deploy AI-capable defenses.

The silver lining in all of this is you’re going to find a lot of bugs with AI security initiatives like Anthropic’s Project GlassWing and Mythos.

Eventually, as defenders or app developers, you will have the same capability to reduce the number of bugs before you push software out.

Over time this is going to level out a bit, but until then there’s going to be some pain, you’ve got to act fast and patch quickly.

IM: How do you ensure you get buy-in from the business and executive leadership when it comes to the secure deployment of AI within the enterprise?

AA: When I think about AI, it's another capability, another technology that enables the business. Just because it is so new and security is not yet sure of its impact, that doesn’t mean you’re going to be able to stand in the way of enabling your business.

You have to quickly understand how AI impacts your business and come up with strategies to deal with it.

If I were to think about three things that AI gives me heartache about, one is the identity that AI uses, two is the data that is it going to work on and third is how do I get visibility around what AI is doing as it makes its reasoning into making a decision. Those are the three things that matter from a security practitioner standpoint.

The challenge is how do you manage those things at scale. AI is going to be running 24/7 because these tools don’t stop. Second, it will be looking at massive datasets, because that’s the entire idea behind these models.

So, it’s about scaling, looking at the big data analytics and then ultimately defending against any attacks that target AI.

IM: How are you looking to integrate AI into cybersecurity operations?

AA: The biggest impact AI is going to have in cybersecurity is looking at large data sets and understanding what happened. If a human were to look at that data, it's going to take a long time.

If we think about the normal flow of a cyber-attack, something goes bang, by the time you know there’s a bang and you realize what happened, that’s when you can defend. That's where the time is, because once the bang happens, someone may then be doing stuff that you don't know about, but if you don't know exactly what happened then how can you get to it quickly? That's the time that the bad guys get to do whatever they want.

If you know what to do quickly then you can defend quickly as well. That’s where AI comes into play, providing you with information. AI can figure out exactly what happened and put mitigations in place.

You’re not going to be able to do that as a human because it’s no longer one or two attacks coming at you, it’s coming at scale in different places and scenarios. If you’re able to let the AI solution see that data and act, then that’s the scale that’s going to help you.

IM: With employees ranging from board members and corporate staff to store and manufacturing workers, how do you build trust in cybersecurity across such a diverse workforce?

AA: I don’t really make a distinction between the CEO, the board and other employees when it comes to cyber incidents. At the end of the day, they’re all humans and they’re all going to fall for things. The training I give to my executives is the same level of training I give everyone else.

In fact, I need to think more about individual users because they have more access to critical systems than my CEO would.

Therefore, the training needs to be democratic, I need to make sure that everyone is trained at the same level. Just because it's a CEO or it's the executive leadership team, they're not excluded.

It’s very interesting to see how some of them react to it. They might forward me the phishing test email and say ‘you can’t catch me out today!’ So, they’re joking about it, but they also understand the urgency around this stuff.

IM: You seem to have a good relationship with executive level. How do you nurture that relationship as a CISO?

AA: At the end of the day, we’re all humans and we build relationships. I do not expect them to receive an email from me and just follow the directions.

When I see people say that a CISO only lasts within a company for 18 months to two years, that’s very little time to build a relationship. If you want to build a security program and build trust with your leadership, it's going to take you more than a couple of years. It’s not an overnight thing.

It all comes with conversations; you need to go and meet with them.

Also, remember they’re reading the newspapers and understand that when big companies come into the news because of a cyber-attack, they don’t want to be there.

They have a vested interest in providing you with support. When you don’t have answers, they look for someone to give them the assurance that things are ok. So, for example, you can send them articles and say we are defending this so they know they have a security team that is looking at this stuff.

It’s all about ensuring the security team has a continuous presence so that leadership feel comfortable that you are handling the cyber side while they handle the business.

IM: What is the biggest cybersecurity challenge you’re facing today?

AA: It’s how do I manage my legacy ecosystem in this new AI environment. All of us deploy solutions from providers like Microsoft and Cisco that use legacy systems that haven’t had a core change in a long time. There's embedded code that is going to get dug up by AI,  and there is so much of it. Things are going to be hard. That's not just a me problem, that is a problem for everyone.

IM: What’s one success in cybersecurity you think is a positive for our industry?

AA: Education is super important and adjusting and adapting to the realities that our teammates are facing is important. The success story is that we can educate them on the changes that are happening. It's not going to be 100%, but I feel like that is one of those success stories that anybody can talk about: educating our users to the realities of the new world that we are living in.

IM: What is your top advice for fellow CISOs?

AA: Build relationships with your executive leadership team. Don't show up one day, expecting them to do magic for you. Trust is earned and it’s going to take a long time to build. Always think that two or three years is not enough time. It takes five plus years to make sure that you have your program in a good spot.