Security culture is a team sport, and AI is raising the stakes

Christopher BurgerChief Information Security Officer | F5

Every October, Cybersecurity Awareness Month gives us a reason to pause and talk about security. But if I have learned one thing as a security leader, it is that awareness cannot be a once-a-year event. It has to be a habit we build every single day.

A principle I come back to often is that deploying new technology is the easy part. Making it work securely, and at scale, is the real challenge. And the hardest part is rarely the technology, but the culture around it.

The strongest defense you have is your people

You can deploy every control available to you and still fall short if the people across your organization are not engaged. The reverse is also true. When your teams are paying attention, when someone pauses before approving an unusual request, or raises their hand because something does not look right, that is your security program working exactly as it should.

Some of the most important moments in security are not technical decisions at all. They are human ones, like a colleague who double-checks before moving money, a peer review that catches a social-engineering attempt before it goes through, or someone who reports the message that felt a little off. Those instincts are built over time, not bought off a shelf, and they are built through culture.

Bringing our security culture to life

That belief is why, this month, we launched a company-wide program at F5 around Cybersecurity Awareness Month. It is about strengthening our culture of security by helping every F5er better understand today's risks, the role each of us plays in protecting the business, and how we work together to keep F5, our customers, and each other safe.

We kicked it off with a company-wide session, and from there the month filled up with opportunities for people to lean in. We are running expert sessions on emerging threats and the impact of AI on security, hearing from colleagues across the business on how security drives trust and resilience, and giving teams hands-on challenges to put good instincts into practice. We are also making room for the fun side of culture, from “Trivia and Tacos” to a security scavenger hunt, because the habits that stick are usually the ones people actually enjoy building together.

The goal is not to check a box for one month out of the year. The goal is to build the muscle, so these behaviors continue long after October ends.

AI is changing the economics on both sides

AI does not just speed up attacks; it collapses the time we have to identify risks and make decisions. Adversaries are already using it to move faster and scale their efforts, and defenders have the same opportunity in front of them, which is to reduce risk, surface systemic weaknesses, and strengthen resilience across the organization.

But getting there takes more than new tools. It takes rethinking how we operate, govern, and make decisions under pressure. It also takes patience. As AI agents take on more of our work and inherit more of our access, we must be deliberate about how we adopt them, so that we can move quickly without giving up the trust our customers count on.

Why this matters beyond our walls

For a company like ours, security is ultimately a trust relationship with customers. That trust is earned in the day-to-day, in how we secure what we build, how we show up when it matters, and how openly we share what we learn with the broader community. No organization solves this alone. Collective defense, shared intelligence, and real collaboration across our industry are how we make it harder and more costly for attackers to succeed.

My challenge to you this month

Do not let Cybersecurity Awareness Month become a box you check. Use it to build the muscle instead. Learn something new about how threats are evolving, talk with your teams about the decisions that matter in the moment, and create an environment where speaking up is the norm rather than the exception.

Security is a team sport, and the right partners matter. To talk through how F5 can help your organization reduce risks, strengthen resilience, and enforce policy across your applications and APIs, reach out to our team.

About the Author

Christopher BurgerChief Information Security Officer | F5

Chris Burger is the Chief Information Security Officer at F5, where he leads cybersecurity strategy, programs, and governance. A pragmatic cybersecurity leader, Chris brings decades of experience in security incident response, operations, and engineering. Prior to F5, he served as Slalom’s first CISO responsible for overseeing the company's security strategy and governance to support its global business and growth. Over the course of his career, Chris has led cybersecurity teams in the highly regulated industries of financial services and telecommunications with roles at Washington Mutual, Corbis, Clearwire, and Russell Investments.

More blogs by Christopher Burger