{"687824":{"#nid":"687824","#data":{"type":"news","title":"Cyber Risk is Business Risk: A Georgia Tech Alum on What Leaders Must Learn in 2026","body":[{"value":"\u003Cp\u003EWhen \u003Cstrong\u003EChristopher Craig\u003C\/strong\u003E arrived at Georgia Tech as an undergraduate in 1995, the campus and the field of cybersecurity looked very different.\u003C\/p\u003E\u003Cp\u003E\u201cIt was the era of look left and look right, and one of you will not be here at graduation,\u201d Craig said.\u003C\/p\u003E\u003Cp\u003ECraig worked hard and graduated with his computer science (CS) bachelor\u2019s degree in 2000, just as the dot-com bubble burst. He returned to Georgia Tech about a year later and has been here ever since.\u003C\/p\u003E\u003Cp\u003ECraig is the enterprise cybersecurity architect in the \u003Ca href=\u0022https:\/\/www.oit.gatech.edu\/\u0022\u003EOffice of Information Technology\u003C\/a\u003E and has spent nearly three decades at Tech as a student, employee, and instructor.\u003C\/p\u003E\u003Cp\u003EAlong the way, he has earned three degrees from the Institute and helped shape how Georgia Tech approaches cybersecurity in an increasingly complex digital landscape.\u003C\/p\u003E\u003Cp\u003ECraig began his career at Tech supporting student registration and other core IT systems. He moved fully into cybersecurity about 15 years ago. His technical background was strong, but he saw a gap in his experience.\u003C\/p\u003E\u003Cp\u003E\u201cI had a lot of technical background and work experience, but not much policy experience,\u201d he said.\u003C\/p\u003E\u003Cp\u003ECraig enrolled in Georgia Tech\u2019s Master of Science in Information Security to fill in this gap. He said his decision to enroll in the policy track was intentional.\u003C\/p\u003E\u003Cp\u003E\u201cIf you\u2019ve been doing the technical work for 10 years, a technical master\u2019s helps some,\u201d Craig said. \u201cBut it is much more useful to study the areas you do not already know well.\u201d\u003C\/p\u003E\u003Cp\u003ECraig moved into management as his GT career progressed. This path led him once again to the classroom. This time, he pursued an MBA from Georgia Tech\u2019s \u003Ca href=\u0022https:\/\/www.scheller.gatech.edu\/index.html\u0022\u003EScheller College of Business\u003C\/a\u003E.\u003C\/p\u003E\u003Cp\u003ECraig believes the combination of cybersecurity and business education is increasingly important for leaders and others.\u003C\/p\u003E\u003Cp\u003E\u201cThere is a big gap in the industry,\u201d he said. \u201cYou need people who understand cybersecurity and the business side, and people in business leadership who understand cybersecurity risk.\u201d\u003C\/p\u003E\u003Cp\u003ECraig is an instructor in the online Master of Science in Cybersecurity program. He teaches incident response and often sees this gap among his students.\u003C\/p\u003E\u003Cp\u003E\u201cMany business professionals do not know how to respond to a cybersecurity incident,\u201d Craig said. \u201cThey are not trained in it. At the same time, many cybersecurity professionals are learning business impacts on the job.\u201d\u003C\/p\u003E\u003Cp\u003ECraig said business knowledge is essential for aspiring chief information security officers.\u003C\/p\u003E\u003Cp\u003E\u201cAt that level, understanding how cybersecurity supports business goals is more important than deep technical detail,\u201d he said. \u201cYou still need the basics, but you also need to talk to the CFO.\u201d\u003C\/p\u003E\u003Cp\u003EAt Georgia Tech, Craig focuses on cybersecurity architecture. His work centers on the design and protection of enterprise systems.\u003C\/p\u003E\u003Cp\u003E\u201cFor example, student information systems have a design,\u201d he said. \u201cWe look at how firewalls and other controls fit into that design to protect the data.\u201d\u003C\/p\u003E\u003Cp\u003EHis role continues to evolve as the Institute\u2019s cybersecurity needs change. That evolution mirrors the field itself, especially with the rise of artificial intelligence (AI).\u003C\/p\u003E\u003Cp\u003E\u201cAI has impacted cybersecurity for longer than people want to admit,\u201d Craig said. \u201cUnderstanding what is unusual is a big part of security, and AI can be very good at that. It can also be very good at avoiding detection.\u201d\u003C\/p\u003E\u003Cp\u003ECraig said AI introduces new architectural risks, particularly around data privacy. Tools that analyze student or employee data must be carefully designed to prevent sensitive information from leaking through training or outputs.\u003C\/p\u003E\u003Cp\u003E\u201cYou have to understand the inputs and outputs,\u201d he said. \u201cOtherwise, you can accidentally release data you really care about.\u201d\u003C\/p\u003E\u003Cp\u003EPrivacy has been a recurring theme throughout Craig\u2019s career. He credits courses such as the privacy policy class taught by Professor \u003Ca href=\u0022https:\/\/peterswire.net\/\u0022\u003E\u003Cstrong\u003EPeter Swire\u003C\/strong\u003E\u003C\/a\u003E, the J.Z. Liang Chair in the \u003Ca href=\u0022https:\/\/scp.cc.gatech.edu\/\u0022\u003ESchool of Cybersecurity and Privacy\u003C\/a\u003E, with shaping his thinking.\u003C\/p\u003E\u003Cp\u003E\u201cSo much of security is about personal data,\u201d Craig said. \u201cUnderstanding what actually makes data anonymous or not is critical.\u201d\u003C\/p\u003E\u003Cp\u003ECraig believes that privacy protection depends on training and system design within an institution as large and decentralized as Georgia Tech.\u003C\/p\u003E\u003Cp\u003E\u201cTraining can only get you so far,\u201d Craig said. \u201cPeople make mistakes. Strong processes limit exposure even when human error happens.\u201d\u003C\/p\u003E\u003Cp\u003ELooking back, Craig describes his time at Georgia Tech as one of constant growth.\u003C\/p\u003E\u003Cp\u003E\u201cThe industry has massively changed,\u201d he said. \u201cWhat you learn becomes outdated quickly. You have to keep growing.\u201d\u003C\/p\u003E\u003Cp\u003EFrom undergraduate student to cybersecurity leader, Craig\u2019s career reflects both the evolution of Georgia Tech and the fast-changing world of cybersecurity. For him, the learning never stops.\u003C\/p\u003E","summary":"","format":"limited_html"}],"field_subtitle":"","field_summary":[{"value":"\u003Cp\u003EGeorgia Tech alum Christopher Craig\u2019s nearly three-decade journey as a student, employee, and instructor shows how combining cybersecurity, policy, and business education is essential for leaders navigating evolving risks\u2014from incident response to AI and data privacy\u2014in an increasingly complex digital landscape.\u003C\/p\u003E","format":"limited_html"}],"field_summary_sentence":[{"value":"Georgia Tech alum Christopher Craig\u2019s nearly three-decade journey as a student, employee, and instructor shows how combining cybersecurity, policy, and business education is essential for leaders navigating evolving risks\u2014from incident response to AI and "}],"uid":"36253","created_gmt":"2026-01-29 16:39:45","changed_gmt":"2026-02-19 15:53:07","author":"John Popham","boilerplate_text":"","field_publication":"","field_article_url":"","location":"Atlanta, GA","dateline":{"date":"2026-01-28T00:00:00-05:00","iso_date":"2026-01-28T00:00:00-05:00","tz":"America\/New_York"},"extras":[],"hg_media":{"679126":{"id":"679126","type":"image","title":"Christopher-Craig_1.jpg","body":null,"created":"1769704813","gmt_created":"2026-01-29 16:40:13","changed":"1769704813","gmt_changed":"2026-01-29 16:40:13","alt":"A man looks up from his laptop computer and into a camera. There is a whiteboard with illegible writing on it behind him. ","file":{"fid":"263247","name":"Christopher-Craig_1.jpg","image_path":"\/sites\/default\/files\/2026\/01\/29\/Christopher-Craig_1.jpg","image_full_path":"http:\/\/hg.gatech.edu\/\/sites\/default\/files\/2026\/01\/29\/Christopher-Craig_1.jpg","mime":"image\/jpeg","size":1938873,"path_740":"http:\/\/hg.gatech.edu\/sites\/default\/files\/styles\/740xx_scale\/public\/2026\/01\/29\/Christopher-Craig_1.jpg?itok=FFcaJWfX"}}},"media_ids":["679126"],"groups":[{"id":"47223","name":"College of Computing"},{"id":"660367","name":"School of Cybersecurity and Privacy"}],"categories":[{"id":"130","name":"Alumni"},{"id":"153","name":"Computer Science\/Information Technology and Security"},{"id":"129","name":"Institute and Campus"}],"keywords":[],"core_research_areas":[{"id":"145171","name":"Cybersecurity"}],"news_room_topics":[{"id":"71871","name":"Campus and Community"}],"event_categories":[],"invited_audience":[],"affiliations":[],"classification":[],"areas_of_expertise":[],"news_and_recent_appearances":[],"phone":[],"contact":[{"value":"\u003Cp\u003E\u003Ca href=\u0022mailto:jpopham3@gatech.edu\u0022\u003EJohn Popham\u003C\/a\u003E\u003Cbr\u003ECommunications Officer II\u0026nbsp;\u003Cbr\u003ESchool of Cybersecurity and Privacy\u0026nbsp;\u003C\/p\u003E","format":"limited_html"}],"email":[],"slides":[],"orientation":[],"userdata":""}}}