KB sits down with Skip Mann, Lenovo’s Vice President of Enterprise Security Strategy, Assurance and Trust, to talk about how a company working across 180 markets and thousands of suppliers proves it can be trusted.
They start with why nobody at that scale can verify everything, and why Skip says trust has to rest on evidence rather than assumptions. From there they get into why attackers don’t care how security teams are split up, and what customers should ask to see before trusting any vendor.
KB asks how a company with deep roots in China handles government scrutiny, and Skip explains why Lenovo welcomes it, from the EU Cyber Resilience Act to repeated CFIUS reviews by the US government.
They finish on supply chain resilience, how to do due diligence without drowning in scorecard tools, and the new trust questions AI is raising.
About Skip:
Skip Mann, Vice President, Enterprise Security Strategy, Assurance, & Trust Chief Security Office & Chief AI Office, Lenovo
Skip Mann oversees four integrated functions – strategy and alignment, governance and assurance, trust and advocacy, and CSO operations – driving enterprise-wide security outcomes across Lenovo’s cyber, physical, supply chain, product, and responsible AI domains to advance resilience, regulatory alignment, and stakeholder trust.
With more than 34 years in the security profession and 18 years in executive leadership, Skip is recognized as a thought leader in enterprise risk, organizational resilience, and security transformation. He is known for developing high performing teams and advancing converged, risk-informed security programs across global enterprises.
Prior to joining Lenovo, Skip held senior roles within the US Department of Homeland Security and U.S. Department of Defense, including the US Army Headquarters in Washington D.C., United States Africa Command, United States European Command, and the Central United States Registry.
Keywords: trust, assurance, supply chain security, supply chain resilience, third-party risk, due diligence, vendor risk management, GRC, certifications, NIST, ISO, EU Cyber Resilience Act, CRA, ENISA, EU AI Act, CFIUS, national security, geopolitics, converged security, physical security, operational resilience, Secure by Design, CISA, public-private partnership, coordinated vulnerability disclosure, AI governance, responsible AI, Lenovo, CISO, board, KBKast
