PayPal CISO Khalfan argues AI model scale alone does not determine security value

Shaun Khalfan, SVP and Chief Information Security Officer at PayPal, has contributed a bylined opinion piece to PYMNTS, titled Smarter Security Takes More Than a Bigger AI Model, published on 9 November 2026. The piece forms part of a PYMNTS eBook collection called Payments Leaders Rethink What Works in 2026, with the article's framing — as described in a PYMNTS discovery teaser, since the full text was not independently reviewed — centring on what determines the practical value of AI in security environments.

What the Teaser Describes

According to PYMNTS's own characterisation of the piece — the full article text was not independently reviewed for this report — Khalfan's contribution addresses the conditions under which AI delivers meaningful security outcomes, rather than treating model scale alone as a proxy for effectiveness. That framing, it should be noted, reflects PYMNTS's description of the article and cannot be attributed directly to Khalfan's text without access to the full piece.

The opinion article sits within a broader eBook that PYMNTS describes as gathering perspectives from payments industry leaders reassessing strategy in 2026.

According to PYMNTS's characterisation of the piece, the argument centres not on which AI model a security team deploys, but on the operational structure built around it.

PayPal's Security Infrastructure

Khalfan's public profile as PayPal's most senior security executive lends institutional weight to the contribution. His title of SVP, Chief Information Security Officer is confirmed across multiple professional directories and cited in a PayPal corporate release referenced by BankingNewsAI.

PayPal's Information Security Programme operates within a governance framework anchored to the NIST Cybersecurity Framework and ISO standards including ISO 27001, according to the company's 10-K filing dated 4 February 2025, as tracked by Board-Cybersecurity.com and cited by BankingNewsAI. Threat monitoring operates on a continuous basis through the PayPal Cyber Defense Center, the same filing states. At board level, the Risk and Compliance Committee receives quarterly briefings from the CISO, underscoring the degree to which cybersecurity sits within formal executive accountability structures at the company.

Scale and Stakes

The operational context matters. PayPal processed $1.79 trillion in total payment volume in 2025, according to BankingNewsAI citing company disclosures (fiscal year 2025). At that scale, security architecture decisions are not theoretical — they translate directly into the resilience of a payment network used by a substantial share of global digital commerce.

Why This Matters

The eBook framing situates Khalfan's piece within a wider industry conversation about whether the current generation of AI investment in financial services has been calibrated correctly. Payments and security leaders contributing to the PYMNTS collection are, by the publication's own description, revisiting assumptions about what works in 2026 — a signal, in editorial terms, that the consensus view of the previous cycle is under active scrutiny.

For compliance and risk professionals, the governance detail in PayPal's public disclosures is independently notable. A CISO reporting cadence tied to quarterly board committee sessions, combined with a dual-framework security programme referencing both NIST and ISO 27001, represents the kind of documented control environment that regulators across multiple jurisdictions increasingly expect from systemically significant payment institutions.

Whether Khalfan's PYMNTS piece advances specific technical or policy arguments beyond what the teaser suggests cannot be confirmed from retrieved sources. Readers seeking the full argument should consult the original publication directly via the PYMNTS eBook archive.

Sources: PYMNTS eBook tag archive; BankingNewsAI PayPal Cybersecurity and AI Strategy pages; PayPal Holdings 10-K cybersecurity disclosure (filed 4 February 2025) via Board-Cybersecurity.com; Cyber Risk Institute, CISO Spotlights and CISO Tribune profile pages for Shaun Khalfan.