Why AI changed the threat model for travel technology
In this Help Net Security interview, Devon Bryan, SVP, Global CSO at Booking Holdings, reflects on his path from Air Force network security engineer to global CSO across financial services, hospitality, and travel technology.
He discusses why the travel industry’s interconnected ecosystem of identity, payments, loyalty programs, and third-party integrations creates compounding risk, and how AI has expanded threat modeling beyond traditional infrastructure to include prompt injection, model access, and shadow AI adoption. Bryan also shares his framework for deciding when security should engage on business decisions, and explains why judgement, not technical depth alone, separates strong operators from future enterprise leaders.
Most CSOs come up through either the technical or the compliance track. Which path was yours, and where do you feel the gaps from that path?
My path was technical in the beginning. I started in the Air Force as a network security engineer, where the mindset was very operational: understand the network, understand the mission, understand the adversary, and keep systems running under pressure. From there, I moved through financial services, consulting, critical infrastructure, hospitality, and now global travel technology, which gave me exposure to very different risk environments and operating models.
What the technical foundation gave me was credibility in understanding how systems work, how attacks evolve, and how operational failures cascade across complex environments. But the biggest gap I had to close over time was learning how to think beyond the technically “correct” answer and instead operate in the tension between security, business growth, customer experience, resilience, regulatory expectations, and speed of execution.
Earlier in my career, I probably underestimated how important storytelling, influence, and organizational dynamics were to effective security leadership. At senior levels, people are not just evaluating whether you understand cyber risk. They are evaluating whether you can help the business make durable decisions during uncertainty, align diverse stakeholders, and operate as an enterprise leader rather than simply the head of a technical function. That was one of the biggest mindset shifts for me moving from engineering and operations into global CISO and CSO roles. Ultimately, the role is about helping build an operating model where trust, resilience, and business strategy can scale together.
The travel industry sits at a particularly attractive intersection for threat actors: financial data, identity documents, loyalty point economies, and geopolitical targets all in one place. Which of those attack surfaces keeps you up at night, and why?
What stands out most to me is the interconnectedness of the ecosystem and how quickly risk can propagate across it. Travel brings together identity, payments, loyalty ecosystems, third-party integrations, global operations, and geopolitical considerations all at enormous scale. A disruption in one area can create downstream operational, financial, and reputational impacts across customers, partners, and employees.
Having worked across banking, hospitality, and now travel technology, one thing I’ve learned is that attackers increasingly target trust relationships and operational dependencies, not just individual systems. The attack surface is no longer limited to what you directly own. It includes vendors, APIs, cloud environments, partner ecosystems, and increasingly AI-enabled workflows. That is why resilience matters just as much as prevention. We focus heavily on layered defenses, continuous monitoring, strong identity controls, and operational readiness because in a globally interconnected business, the ability to detect, respond, and recover quickly is just as important as preventing the event itself.
Ultimately, the broader mission is protecting the trust ecosystem that allows millions of people to travel, transact, and move across the world with confidence.
Generative AI is creating new categories of fraud, from hyper-convincing phishing to synthetic identity attacks on your platform. How has your threat model changed in the last 18 months specifically because of AI?
AI has fundamentally changed the threat landscape through speed, scale, accessibility, and sophistication. Threats that once required specialized skills can now be executed more convincingly and at far greater volume. We are seeing phishing, impersonation, fraud, and social engineering become more personalized, multilingual, and operationally scalable because of AI.
What has changed most in the last 18 months is that our threat modeling now extends far beyond traditional infrastructure and application security. We are thinking much more deeply about identity integrity, AI-generated content, machine-to-machine trust, model access, prompt injection, data lineage, third-party AI dependencies, and the growing risks associated with shadow AI adoption across enterprises.
At the same time, AI is also becoming an important defensive capability. We are leveraging AI to improve threat detection, vulnerability prioritization, fraud analytics, and operational efficiency across security workflows. The key is recognizing that AI is simultaneously a force multiplier for both attackers and defenders, which means organizations must approach it with both optimism and discipline.
Security often gets pulled into conversations it did not ask to join, whether that is mergers and acquisitions diligence, product strategy, or regulatory lobbying. How do you decide where to plant your flag and where to step back?
One of the realities of modern security leadership is that security increasingly becomes part of every major business conversation whether that is M&A, AI adoption, product strategy, resilience planning, regulatory discussions, or geopolitical risk management. That is simply the nature of operating in highly digital, globally interconnected businesses.
For me, the decision about where to plant the flag usually comes down to four things: trust, resilience, regulatory exposure, and systemic business impact. If a decision could materially affect customer trust, operational continuity, enterprise risk posture, or our ability to scale securely, then security needs a strong voice early in the process.
At the same time, I’ve learned over the years that security cannot operate as a perpetual veto function. Especially in large, federated organizations, the goal is not centralized control over every decision. It is establishing clear standards, accountability models, escalation paths, and guardrails that allow teams to move quickly while operating within an acceptable risk framework. Maturity in security leadership is often about knowing where not to over-rotate. If security inserts itself too deeply into every operational decision, you create friction and dependency. The best security organizations enable confident decision-making.
Looking at the next generation of security leaders coming up through the ranks, what skill do you think is most undervalued in how we hire and develop them?
One of the most undervalued skills in cybersecurity leadership is judgement. Technical expertise matters, but judgement is what allows leaders to convert technical signals into sound business decisions under pressure and ambiguity. Over the course of my career, I’ve seen many technically brilliant people struggle because they viewed every issue as a technical problem instead of understanding the broader business context around timing, operational realities, customer impact, legal considerations, organizational dynamics, and risk tolerance.
Judgement also shows up in communication. The ability to simplify complexity, communicate risk clearly to different audiences, and build trust across engineering, legal, finance, operations, and the boardroom is increasingly what separates strong operators from future enterprise leaders.
When I look at emerging talent, I pay close attention to curiosity, adaptability, composure under pressure, and whether someone can operate effectively outside their technical comfort zone. The industry is moving toward a world where security leaders will need to navigate AI, geopolitical instability, regulatory expansion, supply chain complexity, and increasingly autonomous systems all at once. The next generation of leaders will need more than technical depth. They will need the judgement, resilience, and enterprise mindset to help organizations make durable decisions in environments that are becoming faster, more interconnected, and more uncertain every year.
Download: The IT and security field guide to AI adoption