Arve Kjoelen, CISO of Barracuda, tests the company’s own security products within Barracuda itself first. He discusses how he approaches AI and why a larger budget does not necessarily result in hiring people faster.
In a security company like Barracuda, one might expect every employee to have above-average knowledge of security and that management does not need to be convinced of its importance. The job of Arve Kjoelen, CISO of Barracuda since February 2026, is therefore far from ordinary.
Kjoelen brought decades of experience in top security roles with him earlier this year. He previously served as global CISO at companies including McAfee. ITdaily spoke with Kjoelen after his keynote at the Barracuda TechSummit in Alpbach, Austria. In his daily work, he tries to bridge the gap between scientific research into software vulnerabilities and security in practice.
ITdaily: What does the IT environment you are responsible for look like?
Kjoelen: “About eighty percent of my role is internally focused: keeping Barracuda itself secure. Additionally, I speak with customers and partners. We place a strong focus on customer zero. We use our own products and provide feedback to product managers. What we learn from that, we pass on to our customers. I used to be on the customer side myself. Back then, I had no connection with my supplier’s security people.”
“We have made a transition to the cloud, but we still have on-premises applications. We primarily build new products in the cloud. There is a lot of remote work at our company, and no one is required to come to the office. What we tell our customers, therefore, also applies to ourselves.”
What are your main priorities at the moment?
Kjoelen: “Securing our code and our products. We have been working for several months on integrating scanning with LLMs so that we can fix vulnerabilities faster. Today, that can still be a long process. Our work with OpenAI will enable us to accelerate that. If we see threats faster, it reduces the risk for everyone.”
Does the rest of the organization sufficiently understand the IT challenges? Are IT and business aligned?
Kjoelen: “In that regard, we are structured slightly differently than the typical organization. I am part of the CTO organization, while daily IT management falls under a different branch. Since September, Siroui Mushegian has held the role of CIO. We are a software and security company, so it is logical that we are closely connected for product development.
“From my perspective as CISO, I can say that management never knows enough. If things go wrong, it is our responsibility. It is therefore up to us to educate.”
Does the IT department have access to enough people and resources to successfully complete the challenges?
Kjoelen: “The way I look at it: you can ask for more resources, or you can deploy the resources you have differently. For example, you can use AI to go through questionnaires so that no one has to retype answers anymore. Many companies use multiple tools that do the same thing. First, do a major cleanup so you can work more efficiently, and only then ask for more if it is truly necessary.”
“Furthermore, you can only recruit as fast as resources become available. I can ask for five million euros, but that doesn’t necessarily mean I’ll hire people any faster. That takes months, and in the meantime, people might leave. Then you have to start all over again.”
You can ask for five million euros, but that doesn’t necessarily mean you’ll hire people any faster.
Is the future of the IT environment in the cloud, on-premises, or a combination of both?
Kjoelen: “There is still some disagreement in the organization about that. I don’t see a shift back to on-premises happening, but I also don’t see a complete move to the cloud. Some organizations are moving to the cloud less quickly because on-premises offers a certain level of security.”
“If you believe that everything is going to or must go to the cloud, you have to ask yourself why we are still developing on-premises solutions. We often think a trend will last forever, but that is rarely the case.”
What impact do regulations such as NIS2 have on IT policy?
Kjoelen: “That varies from legislation to legislation. For the CRA, the Cyber Resilience Act, incident reporting is a serious matter. We work with our legal team to understand and implement the obligations. We are setting up mechanisms to be able to register. The first report must be made within 24 hours. That is fast, especially if an incident occurs on a Friday. Rules are rules; we have to see how we deal with them.”
How is your organization handling the AI hype?
Kjoelen: “Even before I started here, there was already an AI Council, including the legal and financial departments. The principle is that all AI applications in the organization must go through a single gateway. We have blocked open access. That gives us control: we know that no company data can go to the models because everything runs in a controlled environment.”
“We also use our own security products for this, which makes management easier. We are pushing hard, and that is good, because otherwise you fall behind. That applies to both control and adoption. It is good if everyone within the organization, including financial experts for example, becomes an AI expert to some extent.”
Finally, what major trends are you following with an eye on the coming years?
Kjoelen: “AI is the generic answer, but I follow other things as well. What interests me is how AI improves the interaction between software and what happens when attackers see that. Attackers see which companies are using AI, and that leads to interesting questions. For example, you might wonder what an attack costs for a state-sponsored hacker. I find that interaction fascinating, and I am curious to see how hackers will react.”
“In addition, I follow research into vulnerabilities and how security frameworks are interconnected. Techniques and vulnerabilities are linked, and as an industry, we can do more to understand how that interaction works. If I implement something, am I secure? Am I ninety percent covered, or a hundred? There is still a lot of ‘boring’ scientific work to be done. That work tells you what to implement first and how to achieve a fully secured environment.”
As an industry, we should do more with the ‘boring’ scientific work.
“AI is changing every area of our business, including outside of security. On a professional level, I am optimistic that it will lead to good things. We just don’t know yet what changes it will lead to on an economic level, or if there will be a new tech bubble. It might become less stable, comparable to the internet bubble and the banking crisis.”