Securing the Company That Secures Everyone Else | Daniel Chromek, ESET

What does it take to secure a company whose software protects everyone else? In this episode of Trust at Speed, TerraTrue founder and CEO Jad Boutros sits down with Daniel Chromek, Chief Information Security Officer at ESET, to explore the unique pressures of securing a security vendor, how the CISO role is evolving with AI, regulation, and geopolitical risk, and why security is ultimately a business issue, not a technical one. Daniel has built ESET's internal security organization from the ground up over 17 years and counting, bringing a pragmatic, engineering-first approach to enterprise risk, application security, and AI governance. The conversation starts with what makes securing a security company different. ESET's software runs with elevated privileges, so a mistake can affect a huge number of customers. But Daniel also has advantages most CISOs don't: highly technical employees and a leadership team largely made up of people from R&D. He explains why ESET studies every incident that hits other endpoint security vendors, because it's less painful to learn from other companies' mistakes than your own. Daniel also shares why his team aims to be "customer number one" for ESET's own products, testing early versions and feeding security insights back to product, engineering, and UX. And when he does join a sales conversation, the goal isn't to sell the product. It's to sell trust in ESET's internal security practices. From there, Daniel breaks down how management's expectations of security are changing. ESET is acquiring former distributors in countries like the Netherlands and France, AI is showing up in tools across every team, EU regulation like the AI Act keeps expanding, and the war in Ukraine has made business continuity and resilience a priority across Europe. His advice for M&A: checklists are fine, but the real success factor is communicating constantly, because you're buying a company for its people, not its servers. On AI governance, Daniel explains why standards like ISO 42001 cover the framework, but the hard part is the details. There's no single platform to defend. Coding agents, AI built into a CRM, and a customer-facing chatbot each need their own controls, so governance has to happen case by case. He also shares where AI has delivered for security, from malware detection to SOC triage, where it's fallen short, like AI-assisted contract review, and why you simply can't patch fast enough. Instead, he focuses on shrinking the attack surface, triaging the vulnerabilities that actually matter, and automating the boring stuff so his team can focus on the interesting work, like architecture reviews. Topics covered include: The unique pressures of securing a security vendor Learning from other vendors' incidents Being "customer number one" for your own products Selling trust, not products, in CISO-to-CISO conversations How board and leadership expectations of the CISO are evolving Security lessons from M&A, and why people come first EU regulation, the AI Act, and business continuity in Europe Building an AI governance program with ISO 42001 and OWASP Why AI governance has to happen case by case Why security is a business issue, not a technical one Where AI helps security teams, and where it falls short Why you can't patch fast enough, and what to do instead Automating SDLC security without flooding developers Trust at Speed is a TerraTrue podcast about the people navigating AI, security, privacy, and digital risk inside modern organizations, and what it takes to build trust without slowing innovation. Subscribe for more conversations with leaders working at the intersection of technology, risk, governance, and product. Learn more about TerraTrue: https://www.TerraTrueHQ.com Learn more about ESET: https://www.eset.com 00:00 - Introduction: Meet Daniel Chromek 00:45 - Securing a Company That Secures Others 03:11 - Learning from Other Vendors' Mistakes 05:26 - Customer Number One: Testing Your Own Products 07:47 - Selling Trust, Not Products 09:34 - How the CISO Role Is Evolving 14:39 - Security Lessons from M&A 17:02 - Learning from ESET Netherlands 18:29 - Starting an AI Governance Program 22:09 - Why Security Is a Business Issue 23:23 - Where AI Helps Security Teams, and Where It Falls Short 26:52 - You Can't Patch Fast Enough 28:35 - Triaging the Vulnerabilities That Actually Matter 29:44 - Automate the Boring Stuff 33:37 - How to Connect with Daniel Chromek