Cybersecurity has evolved substantially over the past decade. It tackles complex systems and also safeguards business continuity while nurturing long-term trust. A forward-looking cybersecurity leader understands that resilience must be embedded across the organization. This demands a clear view of emerging threats and the ability to translate risk into decisive business action. Nick Bellette, Director of Information Security and Risk at Custom Fleet, is a strong leader who builds security cultures where accountability becomes part of everyday operations. As digital ecosystems grow more complex, leaders must anticipate vulnerabilities before they become disruptions. The impact extends beyond defense, strengthening confidence among customers, employees, and stakeholders while positioning the organization to innovate securely.
Cybersecurity Leadership Impact
A seasoned cybersecurity and risk executive, he brings a strong business lens to information security. He leads efforts to strengthen enterprise resilience. His expertise spans cybersecurity, governance, technology, and risk management. He focuses on aligning security with business priorities. His approach emphasizes practical risk management and informed decision-making. He has held leadership roles across technology and financial services. He also holds leading industry certifications, including CCISO, CISM, CRISC, and CCSP. His leadership reflects a clear focus on resilience, trust, and sustainable business growth.
Cybersecurity Leadership Mandate
Nick Bellette observes that cybersecurity has shifted from a technical IT function to a board-level strategic priority. He stresses that the change became evident when the business impact of cyber incidents was undeniable. It resulted in operations being halted, customers disrupted, sensitive data exposed, and trust eroded. Breaches at Optus and Medibank made this reality clear in Australia. He notes regulation accelerated the transition. CPS 234 placed boards of APRA‑regulated entities directly accountable for information security, with sharper expectations around assurance, control testing, and oversight. Nick was closely involved in meeting those obligations within the mutual banking sector. The Security of Critical Infrastructure Act has driven similar boardroom discussions elsewhere.
Nick Bellette argues boards do not struggle due to indifference. The challenge lies in how risk is framed. When conversations focus on vulnerabilities, alerts, patching rates, or tool requests, the issue remains technical. Executives require clarity on which services could fail, who or what would be affected, the obligations involved, the scale of risk, and the decisions required. He adds that cost pressure intensifies the challenge.
Across organisations, security investment must be balanced with customer initiatives, operational priorities, and legacy technology for limited resources. Without a mature risk framework, trade‑offs often default into silent risk acceptance, leaving exposures unacknowledged. Nick considers the role of a security leader to be making these choices visible. He translates technical risk into business consequences, clarifies ownership of exposures, and presents practical options for resolution.
Trust Capital
Nick Bellette has long championed the decoding of complex cyber risks into decisions that matter at the boardroom table. He concedes that early in his career he misjudged the balance, relying on metrics useful to security teams but of little consequence to those charged with governance. The decisive shift, he explains, was recognising that a common language is not about cybersecurity itself, but about the priorities the enterprise already values: continuity of critical services, the trust of customers and partners, fulfilment of obligations, and the ability to pursue strategy without incurring unacceptable risk.
The mandate is clear: security leaders must convert technical conditions into business exposure. Boards do not need a vulnerability count; they need to understand which services or assets are exposed, the plausible consequences, whether the exposure aligns with risk tolerance, and whether decisions or investments are required. He anchors board discussions around a disciplined set of questions: Are critical services operating within tolerance?
- Where is material risk concentrated?
- Are treatments progressing as agreed?
- Do recurring control failures persist?
- Are third parties creating risk concentrations?
- And most importantly, what decisions are required from management or the board?
He illustrates this with patching. A percentage alone conveys little. What matters is which systems are overdue, which business services depend on them, the consequence of compromise, whether operational constraints exist, and who has accepted the exposure. This transforms a technical metric into a business conversation.
Nick applies the same principle to articulating the value of security.
He asserts, “Resilience is about our ability to continue delivering critical services when something goes wrong. Trust is about giving customers, partners and regulators confidence that we can protect what they entrust to us.”
Competitive advantage arises when risk is understood and managed, enabling adoption of new technology, entry into markets, and formation of partnerships with greater confidence.
He also underscores the importance of transparency in uncertainty. Effective risk reporting should not manufacture certainty but should expose assumptions, exposures, and unknowns so leaders can make informed decisions. When security leaders consistently frame cyber in these terms, the dialogue shifts. Cybersecurity ceases to be a collection of technical controls or a cost centre and becomes integral to how the organisation safeguards performance, earns trust, and builds the confidence to advance.
Risk Principles
Effective cybersecurity strategy must be tailored to the way an organization operates, generates revenue, serves customers, and fulfils obligations. He emphasizes that while the foundational disciplines remain consistent across industries, the priorities diverge sharply depending on sector. In the financial sector, prudential regulation, payment integrity, service availability, and member trust dominate the agenda.
A single failure can restrict access to funds, disrupt essential services, and trigger immediate regulatory scrutiny, with boards expecting a higher level of formal assurance.
He adds, “Retail and online marketplaces have a different mix of pressures. Customer identity, seller access, transactions, fraud, cloud services and frequent product releases all shape the programme.”
Controls dependent on lengthy manual reviews are unsustainable in environments where teams deploy continuously. Fleet management presents its own operating environment. Operational continuity, driver and client information, supplier dependencies, connected technologies, and longoperating lives all require a risk-based approach that balances security, resilience and service continuity. He stresses that scale is equally critical. Smaller organizations cannot replicate the model of a major bank and expect success. Controls must address risk but remain sustainable within available resources. Across every sector he has led, he identifies enduring principles: leadership support is indispensable, risk must have a genuine business owner, identity must be controlled, systems must be engineered and operated securely, and organizations must be able to detect and recover from material events. He cautions against the common mistake of assuming another organization’s control set is automatically the right one. Cybersecurity strategy must be industry‑specific in execution yet universal in principle.
Governance Advantage
Regulatory mandates such as CPS 234 and international standards like ISO 27001 have redefined the expectations placed on corporate cyber governance. Nick acknowledges that a true executive imperative is the cultivation of a disciplined risk culture that positions governance as a strategic enabler rather than a regulatory burden. The strength of CPS 234 and ISO/IEC 27001 lies in their ability to impose structure on risk evaluation, accountability, and decision-making. The shift occurs when leadership reframes the dialogue from ‘How do we comply’ to ‘What does this reveal about our risk exposure, our tolerance, and the corrective actions required?’
At Defence Bank, he applied ISO/IEC 27001 as a guiding framework in building the information security management system without pursuing certification. This approach provided a structured foundation for governance, risk assessment, controls, and continuous improvement. CPS 234 reinforced the necessity of validating control effectiveness in practice rather than relying on documentation alone.
Leadership behaviour does embed culture. When controls fail, the critical conversation must extend beyond compliance implications to address business exposure, alignment with risk appetite, ownership of that exposure, and the need for change. These discussions belong in executive forums, investment decisions, project governance, procurement, third-party oversight, and board reporting. Accountability must remain distributed across the enterprise.
Technology, procurement, project, and operational teams should own the risks and controls within their remit. Security provides frameworks, expertise, challenge, and assurance. Frameworks sharpen strategic decision-making. By identifying which capabilities and controls are essential to the resilience of critical services, organizations can make informed choices about investment priorities, risk acceptance, simplification, and whether proposed changes introduce unacceptable exposure. Over time, this approach transforms the executive conversation. Compliance becomes the natural consequence of disciplined risk management rather than the objective. The framework evolves into a mechanism for decision-making, resource allocation, and accountability. This ultimately converts regulatory obligation into a stronger, enduring risk culture.
Integrated Governance with Resilience
Nick Bellette’s experience at Defence Bank demonstrates that building an enduring information security programme requires far more than technology. It demands governance, cultural alignment, executive confidence, and organizational accountability. The true measure of resilience is the consistency to thrive long after its inception.
One of the most pivotal achievements was ensuring that security did not rely on the security team to drive every conversation. Establishing the foundations was essential: a clear information security strategy, governance and board reporting, a management framework, formal risk processes, supplier assurance, testing, incident exercises, and detection capability. A team was assembled to bridge both technical security and governance, risk, and compliance. It ensures breadth and depth of capability.
He adds, “Enterprise Risk became an important partner, and so did the rest of IT and the broader business. The people operating systems, choosing suppliers, delivering projects and running services needed to understand what they owned.”
Those responsible for operating systems, selecting suppliers, delivering projects, and managing services needed to recognize their ownership of risk. Security could provide direction, challenge, and assurance.
He reminds us about the importance of rhythm in operations. Risks are reviewed, controls tested, suppliers assessed, exercises conducted, and progress reported to executives and the board. Over time, these practices embed themselves into the cadence of normal management, shifting security from a programme that requires constant advocacy to a discipline woven into organisational life.
Culture is revealed in ordinary behaviours. He finds answers to questions like:
- Do individuals raise issues before they escalate?
- Can someone admit a control failure without fear of reprisal?
- Does the person accepting a risk fully grasp the implications of that decision?
These moments reveal more about resilience than any written policy ever could.
His outlook reframes resilience as a leadership responsibility. Security endures when accountability is distributed, rhythm is institutionalised, and culture empowers transparency. That is the hallmark of a programme designed not merely to withstand threats, but to evolve as a strategic asset.
Risk Capital
The challenge of cybersecurity investments for executive leaders is different here. Too often, organizations attempt to justify security spending through incidents that never occur. It forces leaders into conventional ROI models that fail to capture the true value of resilience. Meaningful evaluation requires a broader lens. It positions security as a strategic enabler. It forces every initiative into conventional financial return calculations. Nick Bellette shares his opinion that where exposure or value at risk can be quantified, it needs to be. Not every investment lends itself to a clean, revenue-style return. Cybersecurity must not be reduced to loss avoidance alone.
Instead, a thoughtful alignment of security capabilities can be proposed. When organizational strategy depends on winning customers with higher security expectations, entering new markets, accelerating digital delivery, or strengthening trust, investments in security directly enable those outcomes. Some initiatives deliver tangible financial benefits, reducing manual work, eliminating duplicate products, simplifying assurance, or lowering service delivery costs. Others focus on reducing the likelihood or impact of losses that ideally never occur.
The more effective starting point is to define the risk or capability being addressed. Is the concern exposure of customer information, disruption of critical services, known vulnerabilities, recovery timelines beyond tolerance, or constraints on serving customers and launching products safely? The value of an investment lies in how it changes that situation.
He warns against equating technology with capability. Adding a product that generates thousands of findings is not progress if there is no capacity to investigate or remediate them. Before introducing another platform, leaders must ask who will operate it, who will respond, and what will be different as a result. Sometimes the investment is technology; other times it is people, engineering, simplification, or recovery improvement.
Nick Bellette adds, “For me, meaningful resilience is not measured by how many security products an organisation owns. It is whether the organisation is materially better able to prevent, withstand and recover from disruption, and whether its security capabilities enable it to pursue its strategy with greater confidence.”
While some investments are necessary to manage risk or meet obligations, those that remove constraints, enable growth, accelerate delivery, or strengthen trust must have their value recognised explicitly. This perspective elevates cybersecurity investment from a defensive necessity to a strategic lever. It challenges leaders to evaluate resilience not by the absence of incidents, but by the organisation’s ability to pursue its strategy with confidence.
AI Risk Governance
Artificial intelligence is positioned as a transformative force in cyber defense and a catalyst for increasingly sophisticated threats. For executive leaders, the challenge lies in balancing innovation with governance while recognizing where human judgment remains indispensable. Nick highlights that not every use of AI requires the same level of governance. Some approved productivity uses may present lower risk, depending on the tool, the data involved, the purpose and the consequences of an error. By contrast, allowing models to access customer data, review sensitive code, influence decisions or act in production environments demands far stricter oversight.
Nick Bellette adds, “As the potential impact increases, I’d expect the controls to increase with it. The organisation should know which tools are being used, what data they can access, what they are being used for and who is accountable for that use.”
A legitimate framework for lower-risk use is preferable, with governance effort concentrated on areas of material consequence. Governance itself must remain adaptive. Products evolve, capabilities expand, and usage patterns shift. What was approved six months ago may require reassessment today. Across the cybersecurity sector, AI is increasingly used to support analysis, investigations, and repetitive tasks. Attackers are also exploiting thesecapabilities to scale reconnaissance, vulnerability discovery, and social engineering. The critical factor is using AI without becoming overconfident in its outputs.
Certain decisions cannot be delegated. Context, consequence, and accountability demand human oversight. Models may accelerate processes, but responsibility for risk ultimately rests with leaders who understand the broader business implications. In his view, meaningful resilience emerges when organisations integrate AI thoughtfully, leveraging its strengths, governing its risks, and preserving human judgement where accountability cannot be automated.
Embedding Security in Transformation
Digital transformation is framed as a double-edged force. It accelerates innovation, but without resilience, it exposes organizations to new vulnerabilities. He argues that the key to embedding security into transformation lies in timing, integration, and governance that enables rather than obstructs progress. Security becomes a constraint when introduced too late. If architecture, budgets, and delivery schedules are already locked, security input devolves into rework, exceptions, and delays. The decisive moment is during design, when identity, logging, data protection, and hosting choices can be shaped while they remain inexpensive to adjust.
Nick Bellette stresses proportional oversight. A minor internal change should not face the same scrutiny as a new customer platform handling sensitive data. Reusable security patterns provide delivery teams with a clear baseline. It avoids the inefficiency of redesigning controls for every project. Automated testing of code, dependencies, and configurations further embeds resilience by catching issues early.
Nick Bellette asserts, “Where resources allow, I also see value in having dedicated cyber capability embedded into major delivery teams. Those people develop context, answer questions quickly, and help translate security requirements into decisions the project can actually implement.”
Effective governance is defined by clarity and efficiency. It should illuminate the safe path and make it easier to follow. If governance creates queues, bottlenecks, or late surprises, it has failed its purpose. This perspective reframes resilience as a leadership responsibility. Security must be integrated from the outset, scaled to risk, and embedded into delivery rhythms. Done well, governance becomes a catalyst for innovation, ensuring transformation advances with confidence, trust, and durability.
Resilience as a Strategic Imperative
Nick Bellette reframes the debate on cybersecurity’s future by rejecting the false choice between prevention and resilience. He argues that both are indispensable. Preventive measures such as identity controls, secure engineering, patching, and monitoring remain critical because they stop many threats from escalating into business incidents. Yet resilience has become equally vital, as leaders must now assume that even the strongest controls can fail.
This shift in mindset forces organisations to ask different, more strategic questions.
- Which services must remain operational under stress?
- What technologies and suppliers underpin those services?
- What gets restored first?
- Who has authority to act during disruption?
- Have backups been tested and proven reliable?
These are not technical queries alone; they are governance questions that define whether an organisation can withstand uncertainty.
Automation is a growing force in resilience. Already deployed in detection and investigation, automation offers opportunities to extend into containment and recovery. But he cautions against overconfidence. Some actions can be safely automated, while others risk compounding problems if executed without context. Clear boundaries must be established: where human approval is required, how automated actions can be reversed, and how accountability is preserved. Equally important is what happens after an incident or exercise. Disruption nearly always reveals hidden dependencies, unclear decision rights, or recovery processes that fail under pressure. The organisations that thrive act on these insights, embedding improvements rather than treating the exercise itself as the achievement.
Nick Bellette adds, “The useful organisations are the ones that do something with that information rather than treating the exercise itself as the achievement.”
For him, resilience is not a substitute for prevention but its complement. The organizations that succeed will be those that combine strong preventive controls with tested resilience capabilities, automation bounded by governance, and a culture of continuous learning. In this model, resilience becomes a strategic imperative, transforming uncertainty into an opportunity for stronger, more confident execution.
Multidisciplinary Leadership in Cybersecurity
Nick Bellette professional journey spans technology operations, infrastructure, digital transformation, governance, and executive cybersecurity leadership. He explains that this breadth of experience has shaped a leadership philosophy grounded in pragmatism, accountability, and balance between technical certainty and business priorities.
His technical background provides clarity on what ‘good’ looks like, while his operational and digital delivery experience reinforces that recommendations must be workable within the organization receiving them. He is comfortable advocating strongly for controls when risk warrants it. It also equally prepares him to adjust implementation, sequence work differently, or recommend temporary treatments when the technically ideal solution is disproportionate.
Nick Bellette adds, “Security programmes can lose a lot of momentum waiting for the ideal architecture, the perfect control or enough funding to fix everything at once.”
Sometimes reducing a material risk immediately, while being transparent about plans for further improvement, is a better decision than delaying for years in pursuit of an ideal end state. Working across infrastructure, service delivery, transformation, governance, and security has also given Nick an appreciation for those tasked with implementation.
A control may be technically sound yet fail if it imposes unreasonable operational burdens, disregards legacy technology, or cannot be realistically supported by the responsible team. This perspective influences his leadership approach. He seeks to understand business objectives, technical constraints, and risk exposure before making recommendations. Security leaders must provide clear guidance. Executives should be informed of options and consequences, but they should also hear a decisive recommendation and rationale. He acknowledges that decisions will never be made with complete certainty. Leadership, in his view, is about clarity: articulating what is known, what is being accepted, what can be improved now, and what must happen next.
Decision Culture
Nick Bellette recognition through CSO30 2025 and his contributions to Enterprise Security APAC highlight his influence within the cybersecurity profession. He views legacy as impact on people. The true measure of leadership for him is whether those who have worked alongside him leave more confident, more capable, and better prepared for the challenges ahead.
Autonomy and trust are essential. Team members should feel empowered to make decisions, supported in their growth, and equipped to pursue future ambitions. For those aspiring to become CISOs, he hopes their time under his leadership prepares them for the difficult judgment calls that define the role.
Nick Bellette says, “Sometimes saying no is straightforward because the risk is clearly unacceptable. I actually think saying yes can be harder.”
Security leadership is rooted in judgment. Saying no is often straightforward when risk is clearly unacceptable. Saying yes, however, requires discernment. Understanding organisational objectives, identifying which risks truly matter, and finding a path forward without pretending risk has disappeared. He wants future leaders to embrace that ambiguity with confidence.
For Nick Bellette, effective leadership means encouraging people to challenge assumptions, articulate uncertainty, disagree when necessary, and still make recommendations. He cautions against hiding behind frameworks simply because they feel safer than making decisions. The same principle applies to new technology: curiosity must be paired with discipline to recognise when consequences shift. His aspiration is clear. If people leave his teams more confident in making difficult calls when the answer is not obvious, he considers that a meaningful legacy. It is not about accolades or titles, but about shaping leaders who can navigate risk, resilience, and responsible innovation with clarity and conviction.
Also Read :- CIO Times Magazine For More information
