Hold Security's Alex Holden: from threat-intelligence founder to CISO of his own firm

The role as the company describes it

Hold Security's About page lists Alex Holden as founder and Chief Information Security Officer. It says he is the founder and Chief Information Security Officer of Hold Security, LLC. The title sits inside a company that sells security work to others, so the CISO here is both the company's top security leader and the face of its main product line.

The page describes the company as an information security, threat intelligence, penetration testing, risk management and incident response firm. The same page says Holden works with clients on a range of needs, from threat intelligence to penetration testing and critical incident response to full-scale security solutions. In other words, the written scope of his job is the company's whole service catalog, not an internal security function alone.

The page also says that under his direction Hold Security helps businesses of all sizes, including Fortune Global 500 companies. That ties the CISO title to client delivery and company direction at once.

The path before the founder's seat

The page says that before joining the consulting world, Holden worked for over 10 years as the Chief Information Security Officer for a large brokerage firm in the United States. So the CISO title in his case comes after a decade in the seat at an enterprise, followed by a move to consulting.

The biography adds that he has extensive experience in Windows, Unix and network administration along with corporate information security governance. It also says he holds a number of IT certifications, including CISSP. The page says his experience unites leadership positions within corporate information security practice and security consulting.

Research that feeds the title

The About page credits Holden with discovering many high-profile breaches. It names Adobe Systems and JPMorgan, and it names the independent discovery of the Target breach and the Yahoo breaches. These are the company's own claims on its own page, and they are the base on which the CISO title rests in the market.

The company says its edge comes from knowing cyber criminals and working on their turf, the Dark Web. It says it has already profiled thousands of actors. It says it monitors their forum and chat room conversations and even their social media accounts. The page adds that most data gathering and processing is done by native speakers of English, Russian, Ukrainian, Spanish, Portuguese and Mandarin.

The News page shows the same research turning into public findings. On August 11, 2022, the company said it identified a stolen dataset on the Dark Web as likely belonging to AT&T Internet, TV or landline customers. It said the breach occurred in early 2018 and affected more than 20 million customer identities.

Speaking, teaching and media

The About page says Holden regularly voices his expert opinion in mainstream media, naming CNN, the New York Times and the Wall Street Journal. It also says he is a frequent speaker on IT security issues and teaches IT and business security education programs.

The News page shows this outward work in dated entries. On January 26, 2026, it listed an RSA Conference podcast titled "I vs AI" featuring "our CISO, Alex Holden." The listing says the podcast covers how to protect yourself and your company against errors caused by the improper or malicious use of AI.

On January 30, 2026, the page listed an RSAC blog on imposters posing as employees, again featuring Holden. The entry cites a 2025 Gartner survey predicting that one in four candidate profiles worldwide will be fake by 2028.

Other entries use a different label. A Darknet Diaries entry dated October 6, 2026, on the Conti ransomware group describes him as a "cyber threat researcher" alongside investigative journalist Geoff White. An April 13, 2026, Cybernews entry says it features his insight into the events that helped expose and weaken Trickbot and Conti. So the same person appears as CISO in conference settings and as researcher in investigative coverage.

Company work beyond the CISO's own name

The News page shows the firm's activity in a wider set of areas. On March 23, 2022, it announced a new Ukrainian office that would stay virtual for the time of war. It said it would hire and train native Ukrainians in cyber security and threat intelligence skills.

On February 2, 2026, the page listed a major upgrade to the Domain Integrity Service. These entries show that a founder-CISO's public record sits alongside hiring, product and research announcements from the same company.

Webinars: what the documents show

Both pages list Webinars as a section in the site navigation, next to About, Solutions, News and Careers. The two documents do not describe any webinar content, dates or speakers. Any statement about how webinars shape the position would go beyond what these pages say. What they do establish is that Holden's public appearances, named on the News page as podcasts, blog features and interviews, are part of how the company presents its CISO.

What the path shows

The documents describe a sequence: more than 10 years as CISO at a large U.S. brokerage firm, then consulting, then founding Hold Security and holding its CISO title. In that role, the written job covers client services, research findings, media commentary, speaking and teaching. The News page shows the CISO label used for conference-facing work and the researcher label used for investigative coverage of criminal groups. That split is the clearest sign in these documents of how a founder-led CISO role differs from an internal one: the title carries research credibility and public voice as well as security leadership.