Q&A: Torq Vice President Usman Gulfaraz Talks Tool Sprawl to AI Outcomes: Rethinking Security Operations

After years of investing in cybersecurity tools, many organizations are finding themselves with larger technology stacks, higher operating costs, and little improvement in operational efficiency. Security leaders are under growing pressure to reduce costs while simultaneously defending against an expanding threat landscape. According to Usman Gulfaraz, Vice President of EMEA Sales at Torq, AI represents an opportunity to fundamentally rethink how security operations are executed—but only if organizations focus on outcomes rather than simply adding another layer of technology.

Gulfaraz explains why traditional security operating models have become unsustainable, how AI is changing expectations for security operations, why organizational buying dynamics are evolving, and why curiosity will become one of the most valuable skills in the AI era.

Q. What are the biggest challenges facing security leaders today?

A. Fundamentally, it's all about doing a lot more now with a lot less. CSOs, security executives, for the last 10 years, have become a victim of their own success. They have an enormous amount of technology that's come in. The idea was, if we get all this technology, we'll be able to integrate it and put it into some nice, great platform and then everything would be seamless.

That was the plan over the last 10 years. And it never really happened that way. You can't find a single CISO that could raise their hand and say, “I'm quicker, better, more efficient, more cost-friendly than I was 10 years ago." In fact, it's quite the opposite. They're a lot fatter, they're a lot slower.

But they also have HR problems because they're hiring people and their people are leaving. An analyst’s average tenure is between 14 to 18 months, so you lose all that intellectual capital every time they go. It's become such a big problem that an entire industry has emerged out of it, which is the MSSP model. It's essentially CISOs raising the white flag, saying, “I give up, I need help."

Q. Why has AI become a catalyst for change?

A. It has truly transformed everything. AI has allowed us to challenge that notion of should we carry on doing things the same way or is there a better way. The pressure from boards is also great. “We’re talking copious amounts of money [for cybersecurity]. We've got huge teams, and we're still having incidents.” Security operations are normally a cost center, and they don't generate any revenue. Now, what they're saying is we're cutting budgets. And security has to figure out a way to not only do exactly what they’re doing now, but they’ve got to tackle a lot more, because the threat spectrum has gotten bigger.

Q. What separates meaningful AI from AI hype?

A. A lot of people talk about AI. It doesn't really mean anything if you just say it. It's not some magic fairy. You can't have a 10-year-old technology and then slap the word AI on top of it and suddenly make it AI. You've got to build it foundationally from the ground up with AI. Focus on what the outcomes are based on what the inputs are that you can get.

What if we could truly automate that entire process from investigation to auto triage into understanding whether it requires a real case then running the case, detecting, remediating and closing it out? We are lucky enough to live in an era now that is focused on outcomes over process.

Q. On that point, how is AI changing expectations for technology?

A. If you go into Gemini or Google right now, you're going to get an answer. What just happened there? You got the outcome. You didn't care about the process. Ninety percent of people today would not care about the process. That's what we call the AI journey.

It's the same thing you're seeing on the security side. We're seeing people care more about the outcomes. But because we're in security, we need to show the process quickly.

Q. How has the pace of cybersecurity changed?

A. It has to be accurate, resonate, and make logical sense. And it has to future proof. In the new era, we have to know what the challenges are today. But we also have to know that the challenges are literally changing every day. So, we have to know where the goalpost is going to be every day. Technology is forcing change on a daily basis now. Ten months is a lifetime. This time last year, we would not be talking about all the AI tools. It's changing at an astronomical rate.

Unfortunately, CISOs and security teams must deal with it. They've got to be ready for it.

Q. What is the next evolution beyond automation?

A. There's not a single CISO that will tell you that they can handle what's coming to them. The base foundation reality is you have to be in the world of automation now. Automation is old. The next step is how well the technology that they depend on know their operation, know what they inherently know as well as the blind spots. Know what they should be thinking about.

The new era of technology keeping security on its toes. It has to protect them from what they don't know. It's one thing to protect them at scale. It's another thing to protect them from something they may not even be aware of. Otherwise, they'll never be ahead of it.

Q. Have technology buying decisions changed?

A. You're seeing a lot of departments within organizations. And there’s a lot more gray in between them. This is what the AI journey is going to cause—a lot of evolution, a lot of change within organizations.

We're talking to people who are not just security, not just IT. We're talking to people that are over layering all that. Chief AI Officer is among the three that we talk to now."

We're looking at teams that are looking at consolidation efforts. Earlier this morning, one of the guys on the finance side said, “Now my CISO reports to me."

We're making a lot of decisions that mean we’ve got to aggregate based on what would encompass a larger spectrum of the story.

Q. What skills will matter most in the AI era?

A. The fluency in cybersecurity is going to be one of those questions. It's not even if you are fluent, it's how up to date are you. A lot of people will use a little bit of AI and think, “well, I know AI." But AI is continuously evolving. The power of computation is largely going to be limited by your own imagination and your curiosity. The more curious you are, you're going to try stuff and find, 'Wow, I didn't know they could do that.'"

The education of AI is going to be a daily thing. The people that are going to lead the charge among AI experts are going to be the curious ones. The more curious you are, the more you become an expert at it.

Q. What advice would you give the next generation?

A. My son had a birthday the other day. My wish to him was, “May you always have more questions than there are answers."

Gulfaraz argues that the cybersecurity industry has reached an inflection point. Years of accumulating tools, expanding teams, and increasing operational complexity have not produced the efficiency or resilience organizations expected. AI presents an opportunity to rethink that model—but only if it is used to deliver meaningful outcomes rather than simply automate existing processes.

Perhaps his most compelling insight is that success in the AI era will depend as much on mindset as technology. Organizations must embrace continuous learning, remain curious, and build systems that help security teams anticipate what they do not yet know. As cybersecurity continues to evolve at unprecedented speed, those who focus on outcomes, adaptability, and curiosity will be best positioned to stay ahead.