James Shira | What Your CIO Wants to Tell You But Won't | Principal, Global CIO and Global CISO, PwC

0:00The CMO Confidential Podcast is a proud member of the I Hear Everything Podcast Network. Looking to launch or scale your podcast? I Hear Everything delivers podcast production, growth, and monetization solutions that transform your words into profit. Ready to give your brand a voice? Then visit IHearEverything.com. Welcome to CMO Confidential, the podcast that takes you inside the drama, decisions, and choices that go with being the head of marketing. Hosted by five-time CMO Mike Linton. When is the last time you researched something on a website? If you're like most people, AI did that work for you.

0:42And that raises a question. If AI is doing the work, what is your website really for? This behavioral shift means AI bots are becoming your most important new visitors. A challenge our sponsor, Scrunch, is taking head on. Scrunch is the customer experience platform that helps you understand how AI agents experience your site, when and why they show up, and what's blocking them from being retrieved, trusted, or recommended. Scrunch shows you the content and citation gaps and technical blockers and helps you fix them so your brand shows up when consumers start with AI, because your most important site visitor might not be a human.

1:28For our listeners, Scrunch is providing a free website audit that uncovers how AI sees your site and how you're showing up in AI versus the competition. Run your site through it at scrunch.com slash CMO. Welcome marketers, advertisers, and those who love them, the Chief Marketing Officer Confidential. CMO Confidential is a program that takes you inside the drama, the decisions, and the politics that go with being the head of marketing at any company in what is one of the most scrutinized jobs in the executive suite. I'm Mike Linton, the former chief marketing officer of Best Buy, eBay, Farmers Insurance, and Ancestry.com, here today with my guest, James Shura.

2:15Today's topic, what your CIO wants to tell you but won't. James currently serves as the global and U.S. CIO and global CISO of PWC. He has one of the longest business cards probably out there. Previously, he was the chief information security officer of Zurich Insurance. Full disclosure, we worked together when I was at Farmers, as Zurich owned a significant portion of Farmers Insurance. We thought he would be a great guest to share perspective on the CIO role in general, the importance of the chief information security officer, and how those roles interface with the company, consumers, and marketing.

3:00Welcome, James. Hey, Mike. Good to see you. Nice to see you again. First question. Hey, give us an overview of what is going on in the technology and information marketplace. You see probably more than almost anybody given your seat. Tell us what's going on. Well, Mike, I mean, to state the obvious, we're in unprecedented times of change. And I think since the starting gun sounded on the agentic AI era and race, it's been, frankly, nothing like any time I've ever seen before in terms of pace and rate of change, in terms of complexity and options and choices in the landscape, in terms of inbound pressure and expectations from stakeholders.

3:50So it's an exciting, obviously, but also obviously challenging time, right, to sit in the C-suite working on technology. And how do you even think about it? Because unlike some of the other revolutions like digital and mobile and, you know, dot-com, The infrastructure was required for the technology to expand with the technology expands with or without the consumer at all. And you have all this money going in infrastructure. How do you even manage and advise clients on that and manage, you know, all all the businesses you have to manage? How do you think about it? Well, I mean, first thing to say is I don't know.

4:31I don't have all the answers. I think it's really important to approach this topic, especially from a place of humility, right? And I think I haven't seen anybody absent some tech companies who act like they have all the answers, right? I mean, I think most of us acknowledge that we don't. So I think you have to start from there. Secondly, I think you have to really, and this is always important, but I think in this case, it's actually required. You have to understand your own environment because to your point, the scaling of AI is going to be, you know, I thought about like, what's a great analogy for it?

5:07And there just frankly isn't one because all the different eras that you just got done describing mobile, cloud, PC, if we want to go way back, mainframe, all of them had, I would say, a much slower rate of change. And I think companies could kind of decide when they wanted to opt in. And even if you were a little late in any of these, it wasn't something that might exclude you from future opportunities. Whereas in the case of AI, frankly, being too late is not okay. So to your question, the way we advise clients, of course, is specific to client needs, but also with a degree of humility and care, understanding what their needs are, but specific to us.

5:51You know, we're in over 130 countries. Right. Our business looks very different in different places. And so we don't need a one size and nor do we want a one size fits all answer. And therefore, we're highly focused on scale, trying to, frankly, control and manage cost, but also bring the users, right, who we're all here to talk about, bring them the right AI experience where they are that they can consume. Imagine, you know, you're an average person in an organization waking up on a Monday. There's all this new AI stuff coming at you. And it's challenging, right, to kind of figure out where do I meet and receive.

6:30How do you plug that in to all of just even your users, just in your company, much less clients? Like, what do you tell them? And then we've had some guests on the show talking about AI say, basically, hey, look, there's a lot of bets being made now. And it's unclear how those are even going to pay out in the circle of financing and everything else. So how do you get your org even going, given all the choices? We really focus, Mike, on scale. And again, I would just emphasize this point, not to overemphasize this, but I think answers need to be designed based on the individual organization, because your technology ecosystem is not going to look the same here as it's going to look in other large organizations.

7:22There's differences, and those need to be accounted for in the plan. But to answer your question, we're focused aggressively on having an environment that scales, that's secure, and that, frankly, is as ubiquitous around the globe as we can make it. I mean, different countries obviously have different laws, so there's some give and take there. But that's where we're focused, is on that point of scale. And to, therefore, create, if you will, almost like a marketplace environment for these different AI models to live so that they can compete against one another based on the user's experience and the derived value that we see.

7:55We are taking a quick break from our show for a word from our sponsor, Scrunch AI. Over the weekend, I asked AI to do dozens of things for me. Please help me make this dishwasher start working. Settle a debate between me and my partner. Is it safe to sleep at 80 degrees? It's not. Please help me find a robotics kit for a five-year-old operating at a middle school level. and even helped me compare the Scrunch Agent Experience platform with Adobe's LLM Optimizer. In every one of these interactions, I never once visited a website. In this day and age, what's your website actually for? The truth is almost everything on your website is now for AI consumption.

8:40The Scrunch Agent Experience platform helps manage, optimize, and deliver content directly for AI to retrieve.

8:57Now back to our episode. Oh, that is super interesting. So do I have to be one of the big frontier models to even get in? No. No. No. Yeah. No, now I will say though, there's a certain minimum threshold. I don't think it's relevant to this audience to get into, But there is certain like a minimum threshold that we do want to have, you know, from terms of viability, but scale and security and things like that. But no, you don't. In fact, we have over 40 models in our architecture today that we're working with. And yes, the names we're all familiar with predominate, you know, the majority of our users' attention.

9:35But we've also got a bunch of outliers on there and smaller organizations that I'm thrilled are included. So if I'm in your org and I find something, I can come to you and say, hey, we want to plug this into the system. Within reason, yeah. And then ES, you know, CISO, there's, we'll get to the CISO thing in a minute. Yeah, that's the right connection, Mike. That's the right, look, so I made the comment within reason. Because if you have a model that wants to suck up all your data and you can't encrypt it or you can't govern your data outside your organization, well, that would be a no, right?

10:14I mean, obviously, we need to have the ability to create those necessary controls. But we want that experimentation, Mike, because these are the early days of this exciting AI era. And I think choice matters. And I think we want to create an environment that fosters choice. And so we're pretty much looking at everything still. So this is actually super interesting because I remember when you were dealing with just the MarTech stack and everything else. Yeah. There was so many rules to get through. Oh, my God. Yeah. And now what you're saying is if you have your way, which you obviously have, you're creating a marketplace where the models are playing on the field that is your company.

10:57Yeah. I mean, look, there's limits to it, right? I mean, we don't have every single, and this gets complicated, and I don't want to go too deep and lose our audience here, but the reality of it is that the broader a company can cast a net in the current instance and timing, I think the better. Now, you know, somebody may watch this from a vendor that we're not using and say, but what about us, right? We're going to hopefully be able to get everybody into this mix, but conceptually, we want to go down this path as we've been with as much choice as we can. I don't think that persists forever. I do think there becomes a point in time where, and this is where I think we have a lot of work to do as a society still on AI, which is how do we start to demonstrate provable differentiated value?

11:43And that's where I think a lot of CIOs, at least, I'm not speaking for all of us, but I'll generalize. I think we're all still, we have sticker shock, frankly, and we're all still a little bit skeptical on the benefit realization. let's talk about that because the realization also has to be driven by adoption within the company and use cases within the company right use cases that drive outcomes correct how when you look across your landscape do you feel about ai adoption across your company and then all the companies you see where is it really i think i think you have in the first i'm going to generalize right?

12:24Because it's general, we have to, we have to, but I think in the first instance, you've got your early adopters and super users and, and, and God bless those folks because they really help us learn those folks. They, when they heard the words AI, they were, it was like their coffee in the morning they're in, right? Yeah. And that, that is, we have a lot more of those types of people and professional services, frankly, because we live in this environment every day for our clients. So that's a big group of our users. I would say maybe a third. Then we have on the other extreme, the group of users that I would say are in their habitual technology consumption patterns.

12:59And they're looking at AI and they're kind of like, well, what's this going to do for me, right? And then we have the middle group. And I think it's really important that we try to win over that middle group to earn the right to get the last group. And so one of the things that we're doing is we're not requiring, I think that may come later, but we're encouraging using the tools in certain scenarios. And I think we're putting them now into workflows where they'll become, frankly, you mentioned MarStack, right? They'll be in the stack and you won't be able to avoid the consumption in time, right?

13:33That's where we're headed. So this is interesting. So I would like, you know, you see all this, what are some leading practices you could share with our audience where you say, this is a leading thing. And then we'll Also go to lessons learned of things you might not necessarily want to do. So I think leading, and again, acknowledging I don't have all the answers, but I think leading is working with your other C-suite functions and trying to develop a prioritized approach to adoption. You know, this isn't like putting the spreadsheet out in your business 20 years ago. This isn't like giving people the Internet and letting them figure it out 15 years ago.

14:15So this is different. This needs to be point number one needs to be nested with low order value activities and potentially critical quality, high quality needed activities. Can you give me an example of both of those? Yeah, like, well, high, high quality activity could be in relationship to like an audit activity. Like that's one of the things we're really looking at, right, is how will we use AI to further improve a high quality service like the audit that we provide? A low quality but high volume activity could be something like time entry, could be something like meeting administration. One of the activities that I've been doing quite a bit is summarizing meetings, which is, you know, it's been good for me.

15:07It helps me avoid using colorful language by accident. When I see it in a summary, I'm like, I shouldn't use that word there. But those are two examples. But what good looks like to your question is working with the C-suite to prioritize the focus. Because if you can imagine taking AI and just spreading it around the environment, like that's easy, right? The hard part is actually helping the other peers you work with activate a prioritized agenda. I mean, all the old general management things remain true in the AI era. Those haven't gone away. Prioritization, delegation, all those things matter.

15:44So let's talk about some lessons learned of things that haven't gone maybe as well so our listeners can maybe avoid those areas. Lessons learned for me specifically, and I would say I'm still cutting my teeth on some of these, would be around the traditional data security requirements. I think one of the things that I've learned in the last 24 months in the AI era is that I can't look at AI with my CISO hat on. I can't look at it purely through the traditional secure then enable mindset, right? The need for a rapid enablement, the need for innovation, it overweights the need in some ways for near-term security.

16:31So what we're working to, and look, within reason, right? We don't want to - This is a fundamental question for the CISO to me, which is I have to guard everything. Yeah. Especially like in certain industries, it's like, it's super, super important. But I also am under enormous pressure to go fast. Yeah. Put us in the seat. Well, what I'll tell you, it's been a long time since our farmers era together, But this goes back to then. I've always viewed security as a business enabler. And when I got into security the first time in 2000, that's dating myself, security was like past the coffee machine in the data center.

17:16Right. I think what we've seen is that security has moved up critically. I would argue prior to AI, security may have been one of the hottest technical topics. So I think what CISOs, the good ones, in my opinion, are doing is they're anticipating the needs of their organization relative to change and innovation. And they're trying to target the must-do security things really to what the must-do things are. And I think that's a judgment call that we need to make in helping organizations, because oftentimes CEOs, COOs, other leaders get presented with this kind of Star Trek, Kobayashi Maru. You remember when Kirk got that test to be captain?

17:56Unpassable, right? A lot of times the CEO gets the no choice, exactly, the no choice option. And I think great CISOs have this opportunity in the Gentic era to facilitate that innovation. It's a huge opportunity. Now, of course, there's a little bit of risk wrapped up in that. And some of that, it will be career risk because leaning into this, not for me, it's a foregone conclusion. One needs to lean into this. Others may view this is something they can manage with policy and controls purely. I disagree with that. But this is, you're talking about a major evolution of many CISO roles from a gatekeeper to a gate opener where you are not just making rules, you are suggesting pass.

18:41Is that right? Yeah. And that's how I think I ended up getting sucked into the CIO world, right? I was the guy that did that. But I think coming back to what's important to the listeners, to me, innovation in the case of AI is going to involve rapid experimentation, failure. You want to get to failure. And then learning and then iterating off the failure. The shorter we can contract that cycle, the faster we can get to what good looks like, the quicker we can differentiate our business, the quicker we can win. If we drag that process out, the opportunity cost and time and money is too high. So let's write the marketer into this story.

19:23Let's. And tell me how the marketers can help the CISO and the CIO do their job in this and how marketers can actually, well, then we can go to adoption and culture. But first, tell me how the marketers can interface way better with their CIOs and CISOs. You know, this has been on our mutual calendars for a number of weeks. So I had some opportunity in my travel and preparation to think that you anticipated, frankly, this question. And to me, there's a couple of things in my 25-year career that I've experienced that I think are relevant when it comes to marketers. I mean, to me, number one, we all know what good marketing looks like when we experience it.

20:09Yeah. To me, the best marketing anticipates my problems. And so my hope would be is that marketers, folks in sales roles, folks that are helping message and messaging. Messaging is art, as you know. They're going to really start by trying to understand those of us sitting in these seats and really anticipating our challenges. And I think challenge number one right now is how to pick. Like, how do you pick in a sea of choice the tech companies? because for most folks, they're not going to want to dance with everybody like I'm trying to do. For most folks, they're going to want to pick a few. I think that's issue one.

20:48I think issue two is how do you deliver into the relationship a message that the customer can then turn and pivot and use as they are your internal champion, right? And so what is the message that that person can then consume and then take to use internally to get the rest of their peers aligned? So if I'm sitting there in marketing, one of the things that almost always happens, and you saw it in the Martech stack, I'm sure you've seen it here, is the marketer will go out and find, they will say, IT is moving too slow, or I got a new personalization tool, or I got this new way of doing it. and then they'll come to IT or the CISO later.

21:33How do you recommend the marketer help navigate what they need with the huge demands on the CIO and the CISO? I think you, so this is going to go a little bit contrary to where most marketers - That's all right. That's all right. We love controversy on the show. But I would say, think about the architectural stack you're living in a little bit. And what I have seen where most CMOs really struggle internally when they want to get the budget they want or they want to drive the tech stack they want is they don't limit themselves in the first instance. So they come in and they say, I'm not going to pick any specific vendor, but they come in and they say, I want a piece of that.

22:15I want three pieces of this. I want four pieces of that. I want this customized thing over here. And then the CIO in that instance is going, well, crap, how do I make all that stuff fit in our ecosystem? So answer one is invest a little time and hopefully you've got a good IT colleague sitting between the two organizations who helps you with this, but like we have. But advance in the first instance, understanding of your environment. Secondly, if able, try to understand where the overall organization is going from a technical perspective. And then thirdly, enrich the CIO a bit with a little ground game in advance of pushing what you want.

22:53Come in there with some info about the two or three companies you're interested in and why. Most of the time, the CMO just goes over the top of the IT organization. And that can work. But I would do that as a secondary strategy. In the first instance, because I have to advocate, of course, on behalf of my colleagues, I would say, try to work with us. Well, I hear you saying, correct me if I'm wrong, you ought to have a working knowledge of the entire tech stack of the company and then a somewhat deeper knowledge of the MarTech stack. I think so. And then thirdly, an understanding of some of the pressures on the IT group.

23:36Well, and where the broader organization is going, because as I mentioned to you in the opening of our call today, you need to think about context really matters, not only for AI, but for MarTech. Context being, where are we on our cloud journey? Who are our primary technology architectures we're working with? When's our contract up? All those things are really important strategic inputs. What people typically get wrong in technology, and Mike, look, technology, not unlike marketing, I would argue it's a highly subjective discipline. And in its worst cases, in case of IT, when you overly subjectify it, you end up with duplication, non-standardization, and a whole other host of problems.

24:21And you don't want to be the CMO three or four years in where you get indicted for a bunch of investments that aren't paying off technical. You don't want to be that person. So what you want to do is try to take those as inputs, right? Now, let's move to the second scenario, not to overanswer here, but I think it's relevant. No, I think, look, I think you should go deep on this because I think this is one of the fundamental things that can make or break a marketing department. So let's move to the second scenario whereby you're the CMO and you don't feel like you have a dance partner in IT. In that case, the right people to work with are probably the COO and the CFO.

24:58And it goes right back to my earlier advice, which is understanding the investment, the broader CapEx investment agenda of the business, and then making sure that you stack the MarStack priorities aligned with those. And I think if you focus in that case on standardization and the direction of travel you're going, I think you can drive a lot of benefits. So let's bring a real world example to this without mentioning vendor names. There we go. No vendor names. Let's say you're with a given cloud organization. We'll just say it that way. And let's say that cloud organization, maybe they had that, that organization also offers 75 % of the tech in your marketing stack that you want.

25:41But it's not the tool you dream of. It's not the tool, you know, it's not the sexy. Not the high tech stack. You go with that anyway. You go with that anyway, because being able to be viewed, to me, any organization that doesn't manage for efficiency and effectiveness is a stock to short, right? That's not a good long-term horizon. You need to acknowledge as a marketing officer that cost matters. So if you come into the argument saying, listen, I'm going to propose XYZ because it fits with our overall cloud strategy, I think that has much less opportunity for resistance than you will get if you come in and say, here's this unicorn marketing stack that I want.

26:24If you force that through and it doesn't have a huge home run, now you're stuck with that kind of around your neck, right? And I don't want that to happen to CMOs out there. I think this is an important part. And then I also think if I have a company that is not on the front end of IT, has a bunch of legacy systems where I want, and I'm looking at the marketing saying, geez, you know, I want to put in a lot more personalization. I want to put in a bunch of AI tools. How do I know if I'm ready or not? And then how do I partner to help with particularly, you know, some of the legacy systems can be very limiting.

27:06How do I, how do I play in that if I'm on the marketing side? I think you go with an outsource strategy in that instance. And I think you basically, we all, you and I having both changed roles a few times in our careers, when you come in as a new senior executive, you have this three to six month window. And I think it's really critical to use that onboarding time to look at the legacy estate. And if you come back and you determine that the cost to uplift that legacy estate is a massive one-time investment, I would probably go with a sourced strategy in that instance. Now, here's where I think you have to be artful.