How SaaS and Cloud Platforms Describe Their CISOs: Cornerstone, Q2 and Flock Safety

What the documents cover

The question asks how software and SaaS companies describe their CISOs and what compliance and customer-trust work those leaders take on. Three of the four companies in the working title have documents here: Cornerstone, Q2 and Flock Safety. No document covers Deltek or GoTo, so this page says nothing about them.

The three sources are different kinds of material. Q2 issued an appointment announcement. Cornerstone issued two announcements about certifications and authorizations that quote its CISO. Flock Safety published a blog post written by its own CISO.

Q2: the appointment announcement defines the scope

Q2's announcement of November 13, 2023 names Beth-Anne Bygum as Chief Information Security Officer. It describes her as responsible for the company's global information protection, product and application security, enterprise IT security, cyber defense, and data protection strategy and services.

The release lists her background in application and product security, cyber defense, risk management, information governance, IT compliance, IT training and sales. It says she has more than 30 years of experience.

The release says she reports to the president and is a member of Q2's senior leadership team.

Her quoted statement ties the job to customers. She says cybersecurity "remains a critical challenge in our industry" and that she will contribute to the company's mission while strengthening Q2's and its customers' security posture.

Q2 separated risk from security in the same announcement. It created a Chief Risk Officer position, filled by Blair Williams, that brings together enterprise risk management, regulatory compliance and internal audit. In that structure, regulatory compliance sits under the risk officer, who reports to the Chief Financial Officer, and not under the CISO.

Cornerstone: the CISO speaks for certifications

Cornerstone's documents show the CISO as the executive voice for compliance milestones. The company's announcement dated January 6 says Cornerstone Galaxy achieved ISO/IEC 42001 certification, which it calls the world's first international standard for Artificial Intelligence Management Systems.

Apurva Dhanwantri, identified as SVP, Chief Information Security Officer, is quoted saying the standard provides a structured way to ensure AI is managed responsibly, with clear policies, objectives and processes that protect customers.

The announcement says the company's alignment with the standard gives customers confidence that the AI in its products is designed, managed and deployed in a safe, transparent and accountable manner. An outside analyst quoted in the release says responsible AI governance is becoming a prerequisite for HR technology buyers.

The release carries two dates, January 6, 2026 in the header and January 6, 2025 in the dateline, so the year is unclear from the page itself.

Cornerstone and federal authorization

In a release of March 10, 2026, Cornerstone announced that it received Authority to Operate at Defense Information Systems Agency Impact Level 4. The company says this builds on the DISA Provisional Authorization achieved in 2025.

Dhanwantri, now titled Chief Information Security Officer, is again the quoted executive. He says the authorization reflects readiness to perform in one of the most demanding security environments in the world while meeting rigorous compliance standards.

In both releases, the CISO's statement frames the compliance result as something customers can rely on, and both point readers to the Cornerstone Trust Center.

Flock Safety: the CISO as public explainer

Flock's document is a blog post by CISO Chris Castaldo, published March 27, 2026 according to the page. He says he joined at the end of the previous year and that he wrote the post three months into the job.

The post responds to public claims about hacking and vulnerabilities. Castaldo calls the claims misleading and says there is no evidence of risk to customer data or systems. He writes that vulnerabilities are a normal part of software development and that no company is unhackable.

He lists what buyers should expect from any vendor, including threat modeling in design, code scanning, scanning of applications in production, infrastructure monitoring and penetration tests.

On organization, he says Flock has 10 new headcount positions slated for hiring this year, adding to an existing team of 20+ engineers. He names six teams: Product Security & Privacy, DevSecOps, GRC Engineering, Offensive Security & Vulnerability Operations, Physical Security, and Incident Response & Adversary Pursuit.

Third-party attestations and what the CISO will not promise

Castaldo says customers should expect continuous audits by qualified third-party firms, and that Flock's audits are available to customers on its Trust Center. He lists SOC2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018 and ISO 42001, plus CJIS Insights, CJIS ACE, FedRAMP 20x and NDAA compliance for law enforcement customers. He also says the Miami-Dade Sheriff's Office Cyber Crimes Bureau assessed Flock's license plate reader and found no issues.

On the limits of the role, he writes that no company or CISO can promise that new vulnerabilities won't be found or that a breach can't happen.

Patterns across the documents

• Q2's appointment text defines the CISO by function: information protection, product and application security, IT security, cyber defense and data protection.
• Cornerstone's releases present the CISO as the named executive behind certifications and authorizations that customers can cite.
• Flock's CISO runs the customer-facing explanation himself, covering team structure, audits and incident responses.
• Q2 placed regulatory compliance under a separate risk executive, while Flock places GRC Engineering inside the security organization.