AttackIQ Taps Veteran Derek Whigham to Steer CTEM Strategy in AI Era

SANTA CLARA, CA – February 18, 2026 – AttackIQ, a leading platform in the Continuous Threat Exposure Management (CTEM) space, has appointed cybersecurity veteran Derek Whigham as a Senior Advisor to its Advisory Board. The move signals a significant strategic effort to fuse deep, practitioner-level experience with its technology as organizations globally grapple with an increasingly complex and automated threat landscape.

Whigham, who brings over 30 years of experience, will collaborate with the company’s leadership to enhance how organizations measure and validate their cyber defenses. The appointment comes at a critical juncture for the industry, as the shift from periodic, assumption-based security testing to a model of continuous, evidence-based validation becomes a C-suite imperative.

A Strategic Play for a Threat-Informed Future

Derek Whigham’s extensive background makes him a uniquely strategic addition to AttackIQ. He most recently served as Chief Product Owner within the Chief Security Office at Lloyds Banking Group, one of the world's most complex financial environments. There, he was responsible for leading security strategy and operations, overseeing everything from operational cyber defense and e-crime to managing over 30 product owners across transformation programs in cloud security, cryptography, and threat intelligence. This hands-on experience in a high-stakes, highly regulated sector provides a real-world perspective on the immense pressure security teams face.

His influence extends across the industry. Whigham serves on the Advisory Council for the MITRE Center for Threat-Informed Defense (CTID), an organization where AttackIQ is a founding research partner. This shared connection to MITRE’s work, which is dedicated to advancing adversary-focused defense strategies, underscores a common philosophy. In a recent article, Whigham articulated this view, stating that for modern cyber defense, “Assumptions and occasional testing are not enough.” He advocates for cybersecurity to evolve into a “decision science” rooted in adversary behavior.

Carl Wright, Chief Commercial Officer at AttackIQ, echoed the value of this perspective. “Derek is a respected leader and innovator in cybersecurity,” Wright said in the company’s announcement. “He understands firsthand the challenge of making confident security decisions in complex, fast-moving environments where measurable outcomes matter. Derek’s experience across financial services, emerging technologies and threat-informed defense will help accelerate our mission.”

The Industry's Pivot from Assumption to Evidence

Whigham’s appointment is emblematic of a broader industry transformation. For years, many organizations relied on annual penetration tests and static vulnerability scans—snapshots in time that quickly become outdated. The rise of sophisticated, fast-moving adversaries has rendered this approach insufficient. This has fueled the growth of the CTEM market, a category defined by industry analyst firm Gartner, which champions a proactive cycle of scoping, discovery, prioritization, validation, and mobilization.

CTEM platforms, with Breach and Attack Simulation (BAS) as a core component, offer a fundamentally different approach. Instead of assuming security controls work as configured, they continuously and safely test them against the known tactics, techniques, and procedures of real-world adversaries. This provides security leaders with empirical data on where their defenses are strong and, more importantly, where they are likely to fail.

AttackIQ is a prominent player in this competitive space, contending with firms like Cymulate and Picus Security. The company differentiates itself through its deep integration with the MITRE ATT&CK framework and its focus on providing evidence-based reports that translate technical findings into business risk.

Whigham’s own words capture the essence of this shift. “I’ve known the AttackIQ team for years, and we share a clear belief about where cybersecurity must go,” he stated. “Defenders need continuous evidence of how they will perform against real adversaries. AttackIQ is making that possible, and I’m excited to help expand its impact globally.”

Navigating the Double-Edged Sword of AI and Quantum

The need for continuous validation is being amplified by the rapid emergence of new technologies. Artificial intelligence, particularly generative AI, can be used by attackers to create highly convincing phishing campaigns, automate exploit development, and generate adaptive malware that evades traditional signature-based defenses. This dramatically shortens the time from vulnerability disclosure to widespread exploitation, putting immense pressure on defenders.

Concurrently, the long-term threat of quantum computing looms. A sufficiently powerful quantum computer could break much of the public-key encryption that underpins digital communication and data security today. This creates a “harvest now, decrypt later” scenario where adversaries can steal encrypted data with the confidence that they will be able to decrypt it in the future.

Whigham's expertise is particularly relevant here. In his role as Research Director for AI and Quantum Computing at ISACA, he is responsible for developing C-suite guidance on these very topics. His appointment brings this forward-looking perspective directly into AttackIQ’s product strategy. CTEM platforms are uniquely positioned to help organizations prepare for these challenges. They can simulate AI-driven attack techniques to test the resilience of current defenses and, in the future, can be used to validate the implementation and effectiveness of post-quantum cryptographic standards as organizations begin their migration.

The Power of an Evidence-Based Approach

By adding Whigham to its advisory board, AttackIQ is reinforcing its commitment to a threat-informed, evidence-based security model. The company's platform moves beyond simply identifying isolated vulnerabilities. It focuses on connecting exposures—across vulnerabilities, configurations, identities, and detections—into adversary-validated attack paths. This allows organizations to quantify the likelihood of attacker movement and potential impact, enabling them to prioritize remediation efforts on what matters most.

This approach is validated by the company's long-standing partnership with the MITRE Center for Threat-Informed Defense. This collaboration ensures its platform is grounded in a globally recognized, data-driven understanding of adversary behavior. As enterprises face increasing pressure to adopt new technologies responsibly while demonstrating that their defenses can withstand real-world attacks, the ability to continuously measure, validate, and improve becomes a cornerstone of modern resilience. The fusion of seasoned leadership from the front lines of cyber defense with advanced validation technology represents a critical step toward building a more secure and threat-informed posture for organizations worldwide.