Vercel names Talha Tariq as CTO of Security
Vercel has appointed Talha Tariq to the role of CTO of Security. Tariq joins from IBM, where he served as CTO (Security) after IBM acquired HashiCorp, his previous employer for seven years. At HashiCorp, he held the dual title of CISO and CIO; at IBM, his remit spanned security across all divisions, including software, AI, and post-quantum cryptography.
The move comes as Vercel looks to extend its security work beyond the traditional CISO scope. According to the company, Tariq will lead security research, product R&D, engineering, and trust & safety, with a focus on building security products that developers will actually use. Vercel positions the appointment as part of a broader effort to embed security in the platform itself, which serves billions of requests daily, rather than layering it on after the fact.
Security as a product concern
Tariq's stated philosophy is that security teams should not act as a "department of no." Instead, he argues, the best security organizations solve problems by shipping tools that raise the baseline for everyone—through identity and access controls, secrets management, AI safety, and platform reliability.
"Security needs to move away from being the 'department of no' and be deeply embedded in product development."
Talha Tariq
In practice, that means building security for non-experts, Tariq says. If developers and end users get secure-by-default tooling, he argues, it lifts the entire ecosystem. He also emphasizes the need for more secure products rather than more security products.
The AI security landscape
Tariq sees the current AI era as both a risk and an opportunity. On the risk side, generative AI and LLM technology is maturing quickly, but adoption is still in its early stages. On the opportunity side, he is focused on using AI to tackle security problems that have historically been hard to solve at scale, and on influencing emerging standards such as Model Context Protocol (MCP) and A2A. His goal is to build safeguards into the AI stack and SDKs so developers can implement controls and coverage as part of their normal workflow.
Identity and trust in an AI world
Tariq acknowledges that AI has made human impersonation cheaper and easier, which raises the stakes for identity verification. As human and machine activity become harder to tell apart, he says, collaboration across technology, government, and academia will be necessary to rethink how identity is verified and trust is established. While policy changes take time, he is optimistic that technology can surface emerging risks and offer practical mitigation paths.
Open tools and the web's future
Tariq cited Vercel's role in shaping the open web as a key reason for the move. He says he wanted to work at a company that shares his values around technology, security, and the potential of the open web. While the immediate focus will be on Vercel's ecosystem and its customers, he intends to build security frameworks and tools that are open, transparent, and useful to practitioners more broadly. Vercel points to its Web Application Firewall and platform-level safeguards as existing investments in this direction.
