Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to The Virtual CISO Moment.

Travis Stein joins us today. He’s a Senior Security Engineer who’s taken an uncommon path through the industry, beginning in IT help desk and systems administration before moving into cloud security, privileged access management, Zero Trust architecture, and security engineering roles with organizations including CyberArk, Delinea, and AHEAD.

Along the way, he’s helped organizations achieve SOC 2 and ISO 27001 compliance while developing a practical philosophy that security must enable the business—not slow it down. He’s passionate about mentoring others entering cybersecurity and writing candidly about what it really takes to run security in a lean environment.

Travis, welcome to The Virtual CISO Moment. Thank you so much for joining us today.

Travis Stein: Hi, Greg. I appreciate you having me on. It’s an honor.

Greg: Well, it’s an honor to have you, sir.

We’d like to start where we always start off. I want to hear your story—how and why you got involved in this really weird field, sometimes it seems like—and just bring us through to where you’re at today.

Travis: Yeah, sure.

My path through the industry started off with, I guess, fairly humble origins, being in IT help desk to start out my career. I got it just kind of by cold applying off the street, back when cold applying was much more successful than it is today.

I did IT help desk and system administration work for probably eight or nine years. I got a lot of really, really good experience during that time, from about 2013 to 2021.

Over the years, even though the experience was good, the burnout became pretty real for me with IT help desk and everything that comes along with that.

I remember thinking, “I’m just kind of going from different jobs, but the burnout is the same. I probably need something different.”

Cybersecurity was something that had always fascinated me. I got into IT because I liked helping people, and I got into cybersecurity because I still liked helping people—but this time by helping protect them from threats, the bad guys, and all of that fun stuff.

Back around 2020, I started networking with people on LinkedIn. I’d ask them if they had twenty minutes for a virtual coffee chat just to talk about what they did.

I’d ask things like, “I noticed you’re in this position. What do you like about it? What don’t you like? Would you mind spending twenty minutes telling me what your day looks like and helping me understand the different areas of cybersecurity?”

One of those conversations ended up being with someone who eventually became my future boss.

He said, “Hey, we might have a Sales Engineer opening at AHEAD. No guarantees, but you’re welcome to interview. I can at least help get your foot in the door.”

From there, the rest was history.

I spent some time at AHEAD, then moved to CyberArk, later Delinea, then most recently Polly. I’ll actually be starting a new job soon, so stay tuned for details on that.

Greg: Well, congratulations on that. That’s certainly an interesting path.

I want to go back to the beginning, where you talked about being in IT help desk.

Is there anything from those days that’s helped you now that you’re in cybersecurity?

Travis: Yeah, absolutely.

I think the biggest thing was bringing an analytical mindset—a troubleshooting mindset.

There are a lot of common skills between IT and cybersecurity that people don’t always realize are transferable.

Being analytical, thinking critically through problems, troubleshooting issues—that served me really well.

Sure, cybersecurity has its own technical skill set, but those troubleshooting abilities absolutely carried over.

Another thing was learning how to research what I don’t know.

There have been plenty of times in cybersecurity where I’ve been completely stumped. I didn’t know the answer.

I had to ask for help.

I had to look things up.

Instead of panicking because I didn’t know something, I tried to lean into it and treat it as an opportunity to grow and become better at my craft.

Greg: I kind of chuckled a little bit when you said asking questions.

I’ve been in this industry for getting close to forty years now, and I still ask questions.

Sometimes I simply forget something, somebody reminds me, and I think, “Oh yeah, that’s right.”

It’s okay to ask questions.

It’s much worse to try to fool your way through it.

Travis: Exactly.

People pick up on that.

There’s certainly a little bit of “fake it until you make it” that happens in every career, but if it’s one hundred percent fake it until you make it, people recognize it pretty quickly.

Most people are willing to help if they can see you’ve already made an effort.

If you can say, “Here’s what I’ve already tried,” people are generally happy to jump in and help.

There really aren’t dumb questions in cybersecurity because we’ve all been there.

Every single one of us has had to phone a friend at some point.

Greg: I still have trouble remembering whether red team is offense or defense.

People who are newer to the field probably think that’s obvious.

But I come from an era where we didn’t have red teams and blue teams.

We just called it troubleshooting.

You have to understand the background someone comes from before judging the question.

I like to call it developing an investigative mindset.

I think everybody in cybersecurity needs that.

Travis: I like that term—investigative mindset.

Curiosity is probably one of the most important traits someone can have.

The moment people stop learning is probably the moment it’s time to retire or change careers.

Being naturally curious is one of the biggest reasons I ended up moving into cybersecurity.

Even though I experienced burnout during those IT years, I don’t regret them at all because they gave me a really solid foundation before entering cybersecurity.

That broad IT experience made the transition much easier.

Curiosity serves people well no matter what profession they’re in.

Whether you’re a nurse, a lawyer, a doctor, someone in IT, or someone in cybersecurity, it’s a skill that transfers everywhere.

Greg: You touched on something that I think is very interesting, and that’s burnout.

Burnout can certainly be a problem in IT, but it’s also a problem in cybersecurity. There are a lot of similarities in how it develops and how we deal with it.

Did you notice any warning signs before you realized you were burning out, or did it just sort of happen gradually?

Travis: It was definitely gradual.

One of the biggest signs was that I’d change jobs every couple of years, but the feeling stayed exactly the same.

I’d think, “Okay, this new job will be different.” Then after a while I’d realize the tickets were still endless, the pace was still relentless, and the satisfaction would slowly fade.

I’m sure there are a lot of IT help desk folks listening who are nodding along right now.

It’s interesting because I genuinely enjoy helping people, but I eventually learned that I have limits.

Cybersecurity still has tickets. You never completely escape them. But a lot more of the work revolves around projects and longer-term initiatives instead of constantly fixing printers, troubleshooting Active Directory accounts, or dealing with day-to-day user issues.

Every time I switched jobs, my satisfaction would come back for a while, then it would fade again.

Eventually I realized the common denominator wasn’t the company. It was the type of work.

That’s when I decided it was time to pursue cybersecurity seriously.

My family and support network agreed. They could see that I wasn’t really happy with where my career was heading, so when the opportunity came to move into cybersecurity, I took it.

Looking back, those years in IT weren’t wasted at all. They gave me a really broad technical foundation that made the transition much easier.

Greg: You also mentioned LinkedIn, and I think that’s one of those platforms where you tend to get out of it what you put into it.

One thing that disappoints me sometimes is seeing people only show up on LinkedIn when they’re looking for a job. They disappear for years, then suddenly they’re active because they need something.

I’ve always believed you should be building and maintaining your professional network continuously.

Since LinkedIn played such an important role in your career, do you have any advice or tips that worked particularly well for you?

After all, getting your foot in the door is often the hardest part. Once you’re in, you’re in control. Before that, you’re at the mercy of applicant tracking systems, bots, fake job postings, and everything else that exists today.

Travis: That’s actually one of the areas where I probably spend more time than almost anything else.

I created my LinkedIn account back when I first started my IT career, but honestly, I didn’t really understand its value until years later when I began posting regularly and engaging with people.

I started noticing something.

People were getting jobs through networking.

They weren’t necessarily getting them because they clicked “Easy Apply.” They were talking to people, building relationships, sharing what they knew, and becoming visible.

That made me realize I should be investing in LinkedIn myself.

I’ve probably landed at least two or three jobs directly because of relationships that started there.

One thing I always encourage people to do is personalize connection requests whenever possible.

Instead of simply clicking “Connect,” I’ll reference something specific from their profile or something they recently posted.

For example, I might say, “I saw your post about AI governance last week. I really enjoyed your perspective. Would you be open to chatting sometime?”

That personal touch makes a huge difference.

People receive hundreds of generic requests. Showing you’ve actually taken the time to read something about them immediately separates you from everyone else.

Networking is also a long game.

You might send two hundred connection requests and only have ten meaningful conversations. Out of those ten, maybe five become valuable relationships.

That’s perfectly fine.

The important thing is continuing to invest in those relationships over time.

Greg: That aligns very closely with my own philosophy.

One thing I absolutely dislike is when someone connects with me and immediately sends a sales pitch.

I’ll happily accept connection requests from people I don’t know if there’s some professional alignment, but that isn’t an invitation to immediately start asking for something.

Let’s build a relationship first.

From my perspective, when I’m looking for consultants for virtual CISO engagements, I don’t advertise those opportunities on job boards.

I simply make a post to my LinkedIn network.

Over the years I’ve built relationships with people, and because of that I already have some sense of who they are.

One of the first things I look at is whether they’ve been active on LinkedIn.

Have they been helping other people?

Have they been sharing knowledge?

Those are the kinds of things that stand out to me because, as you mentioned, many of the best opportunities never get publicly advertised.

They come through relationships.

Travis: Exactly.

Cold applying probably works some of the time, but networking dramatically improves your chances.

Of course, if you’re networking, you’re probably hoping to find a cybersecurity job. There’s nothing wrong with that.

It’s just the way you approach people that matters.

Take time to get to know them.

Show genuine curiosity.

People are much more willing to help when they feel you’re interested in them as a person instead of simply viewing them as someone who might get you a job.

One thing I also look for when people ask me to mentor them or review their résumé is what they’ve already done.

Have they been active on LinkedIn?

Have they been building a portfolio?

Working on home labs?

Posting about what they’re learning?

Those things demonstrate initiative.

Networking has become incredibly important.

It used to almost feel like a secret that relationships helped people find jobs, but today it’s very much true.

It’s still important to know your craft, but it’s also important to know people.

Once you finally get into cybersecurity, staying in the field becomes much easier because you now have actual cybersecurity experience on your résumé.

Every opportunity after that tends to become a little easier to pursue.

Greg: Let’s build on that a little.

Sometimes you land in a position where you’re essentially the security program. You’re the security department.

For someone who finds themselves as a one-person security team, how do you approach that? You start the job on Monday morning, you’re the only security professional there. What do you tackle first? How do you survive?

Travis: Before Polly—and before the opportunity I’m about to start—I had never been the only security person at a company.

I’d always been part of a team of five, ten, or fifteen people.

At Polly, it was really just my boss and me. He oversaw multiple teams, including security, while I was the sole security engineer. In my next role, I’ll again be one of the primary security people.

It’s definitely an adjustment going from being part of a larger team to realizing that, from a security standpoint, the buck stops with you.

There are pros and cons.

One of the biggest challenges is that you have to trust yourself.

If you make a decision that doesn’t work out, there’s nobody else to point to. You’re accountable.

At the same time, that’s also one of the things I’ve really relished over the last couple of years as I’ve had that lead experience.

One of the things I really love about being the sole person on the security team is that I get to influence policy and really shape the security program.

Leading ISO 27001 initiatives, SOC 2 audits, helping define how security operates within the organization—that’s been a lot of fun.

At first I thought being the main security person wouldn’t be all that enjoyable, but it’s actually been quite a bit of fun.

At most of the places where I’ve been the sole analyst or engineer, you’re not completely on an island.

Sure, a lot of the security decisions lie with me, but at the same time there are engineers, leadership, vendors, consultants, and peers that I can bounce ideas off of.

Even if folks find themselves owning a security program by themselves in their next role, I’d really encourage them to lean into it and embrace it.

It’s a lot of fun being at the forefront of things.

Being an individual contributor is certainly awesome too. Nobody probably starts out as the sole security person, but if you ever get the opportunity, it’s definitely something I’d encourage.

Greg: So, putting on your mentor hat now…

You’ve got somebody who’s a technical specialist, and they want to move into a leadership-type position like you were just talking about.

What advice would you give them?

Travis: If they want to make the jump from being a more technical specialist or practitioner into a leadership role, I’d say it’s always the “act as if” principle.

If you’re on an individual team and you want that team lead role—or maybe you want a management role someday—start acting as if you’re already preparing for it.

Try to take ownership.

Lead projects.

Show initiative.

If there’s a project that maybe nobody wants to do, volunteer for it.

Take it from beginning to end.

That goes a long way toward demonstrating leadership skills.

Being willing to volunteer for different projects, showing that willingness to learn, the willingness to adapt, and being willing to tackle difficult work are all really important.

Certainly, in cybersecurity, one of the things I’m currently working on myself is the CISSP.

It’s obviously not a first-year certification. You need experience before you can sit for the exam.

But if you’ve got cybersecurity experience and you want to move into a leadership role, that’s a pretty significant checkbox.

It’s not an easy checkbox for HR, but it’s certainly an important one.

That said, you don’t need a certification to prove you’re ready to lead.

Volunteering, showing initiative, and demonstrating leadership qualities early on can go a very long way.

Greg: Absolutely.

But all of this can come with more stress, which is okay because we love our field and we know there’s going to be stress.

We just have to channel that stress and not let it overtake us.

Otherwise, it can lead to exactly what we were talking about earlier—burnout.

I’m a big believer that people should channel that stress in positive ways and find healthy ways to decompress.

What’s one of the things that you do to manage your stress in this wonderful field?

Travis: Yeah, there are a couple of things.

Some of them are actually lessons I carried with me from IT help desk.

I’ve been working predominantly from home for the past four or five years—maybe even longer than five years now.

It’s a different perspective because my office is inside my home.

There’s really no separation between work and home other than the office door behind me.

That can be a little tricky sometimes.

So I try to keep decompression pretty simple.

I’ll go outside for ten or fifteen minutes and sit on the patio.

Sometimes I’ll even bring my laptop with me.

Even just that little change of scenery is surprisingly refreshing.

I’ve got a two-year-old son at home, so I like to step out of the office, play with him for five or ten minutes, then come back to work.

You don’t necessarily need a kid to do that.

If you have a dog or a cat, that’ll work just fine too.

Literally, the old saying about remembering to touch grass.

Getting outside and getting out of the house is really important for me.

Certainly exercise helps too.

I also feel like I’ve got a much better support network now than I did when I was working IT help desk.

I’ve got doctors, a wife, my son, friends, family—I really built those relationships over the years, and they’ve helped tremendously with burnout.

There’s definitely still burnout in cybersecurity.

I think a lot of people would say, “You’re talking about IT burnout. What about cybersecurity burnout?”

Absolutely.

It exists.

There are definitely days where I finish work and think, “I don’t know how I got through today.”

But compared to my years in IT, I have far more days where I’m not burned out than days where I am.

Maybe that’s just learning how to handle things better.

Back in IT, I would work myself to the bone.

I was a pretty competitive person.

I’d tell myself, “I’m not stopping until I close three more tickets.”

Eventually that came back to bite me because I was constantly chasing one more ticket instead of taking care of myself.

Travis: I needed to come up with better techniques.

Having decent mental health support is kind of an underrated thing.

Whether that’s a good family member, a friend, your spouse, a therapist—having people in your corner is really important.

Work can always be stressful, no matter what field you’re in.

Having techniques—even if it’s stretching for five minutes or walking outside for a few minutes—is a reminder that there’s a whole world outside of work.

Work isn’t the end-all, be-all.

I used to get really wrapped up in work as my sole source of identity.

Now it’s much more balanced.

I’m a family man.

I’m a friend.

I’m a father.

I’m a son.

Those are all important roles that I play too.

That perspective definitely helps me a lot.

Honestly, I probably couldn’t have made it into cybersecurity without having a decent support network along the way.

For folks trying to break into cybersecurity—especially with how difficult the job market has been recently—I think having those people around you becomes even more important.

You’re probably going to hear “no” more often than you hear “yes.”

You’re going to have interviews that don’t work out.

You’re going to have applications that never get a response.

Having people around you to remind you to keep going makes a tremendous difference.

Greg: Absolutely.

Work to live.

Don’t live to work.

I think that’s something we all need to remember from time to time.

So, future plans.

I know you mentioned you’re starting a new position, which is certainly exciting.

Beyond that, what else do you have coming up?

Travis: Yeah, definitely starting the new job in a couple of weeks.

That’s probably the biggest thing on the horizon.

Beyond that, my wife and I have a trip planned to the Dominican Republic in a couple of months.

From what I’ve heard, the new company may also be taking us somewhere in Europe for an anniversary celebration, so that’ll be exciting if it works out.

Greg: That’s never a bad way to start a new job.

Join a company and then get to go to Europe a month or two later.

I highly recommend employers that have benefits like that.

Travis: (Laughs.) I certainly won’t complain.

Greg: Well, I have two responses to that.

First, I’m jealous.

Second, for everybody who works with vCISO Services, no—we’re not going to Europe anytime soon.

Sorry.

Travis: (Laughs.) Darn.

Greg: Travis, it’s been wonderful catching up with you.

I really appreciate you taking the time to join us today.

I think there are a lot of valuable lessons here, whether someone is trying to break into cybersecurity, transition from IT, or move from being a technical practitioner into a leadership role.

Congratulations again on the new position.

It sounds like a fantastic opportunity, and I wish you nothing but success.

Travis: Thank you so much, Greg.

I really appreciate you having me on.

It’s truly been an honor.

Greg: And everybody…

Stay secure.

Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to The Virtual CISO Moment. My guest today is Andrew Kalat. He is the owner of Rotation Speed Consulting, an independent security consultant, speaker, writer, and the self-described Lord Losing co-host of the long-running Defensive Security Podcast. He has spent nearly three decades helping organizations solve security challenges with leadership roles spanning Salesloft, U.S. Bank, Elavon, Check Point Software, Acuvant, and many others. Along the way, he’s built security programs, led engineering and operations teams, managed multi-million-dollar security budgets, advised enterprise organizations, and helped translate risk into business decisions.

He’s also a private pilot, which we’ll touch on in a bit because I am as well too, although inactive. He’s an author and one of the more recognizable voices in the cybersecurity podcasting community. We’ll talk about that in a moment as well too. We’ll also talk about his journey through the industry and all sorts of other great, interesting stuff.

Andrew, thank you so much for joining me today.

Andrew Kalat: Thanks, Greg. I need to hire you as my marketing guy. That was amazing.

Greg: You know what? I can subcontract that because my marketing person is ChatGPT.

Andrew: Hey, that works. Thanks so much for having me. Great to be on the show.

Greg: We’d love to start out as we usually do. I want to hear your story about how and why you got started in this really crazy industry and what led you to where you’re at today.

Andrew: Yeah, I appreciate it. It’s been an interesting journey, and it’s been a while since I’ve really reflected. But I started in the early nineties. I’m old enough that I had single-line modems when I started.

Greg: Amen, brother. Me too.

Andrew: Yes. Single-line BBSs.

Greg: Exactly.

Andrew: I remember when U.S. Robotics had a deal for sysops that you could get a faster modem cheaper. So I started my own bulletin board just to get a cheaper modem.

Greg: The U.S. Robotics 56K.

Andrew: Yeah.

Early days, I had no idea what I was doing, man. I was just the weird kid without any friends who discovered a whole community online with bulletin boards, and it changed my life.

I grew up in the Detroit area, and there was a very active BBS scene up there. Then, very slowly, the internet came around. I remember those early days of the internet when we first got on the internet via modems with a piece of software called KA9Q that was built for packet radio data transmission. But later, as I learned about TCP/IP, it made sense. It was TCP/IP packets being used.

So I kind of accidentally fell into this industry.

We talked a little bit about being a pilot. I thought I was going to be an airline pilot growing up. Then I found this amazing world of technology and started tinkering and building computers and selling computers at trade shows. Then I got my first job selling software at Electronics Boutique.

From there, I started working for a small company—what we would now call an MSSP—in Detroit called Netrex, which was a managed firewall provider.

This was back in the days when the way it worked was they had a data center, and they ran serial T1 links, or smaller, out to various customers and brought all of their traffic to our data center, ran it through some Check Point firewalls—back in the version one, version two days—and then out to the internet from there.

That was the early, early days.

It was great. I learned a lot. I learned a lot about troubleshooting and helping customers and all that great stuff that comes from doing help desk-type work.

That company got bought by a company in Atlanta called ISS, which eventually got bought by IBM. That moved me down to Atlanta. I came down to Atlanta in 2000 with that acquisition.

Greg: You’re like me. You’re one of those damn Yankees who moved down South.

Andrew: Yes. Because I came from New York and moved down to Knoxville, Tennessee.

Greg: Back thirty years ago.

Andrew: Well, I think after twenty years you lose the “damn” and then you’re just a Yankee.

Greg: Okay, okay.

Andrew: At least in Atlanta. It could be different rules in Nashville.

So I worked at ISS, which was great. It was a startup. It was the dot-com era. We built data centers. We had this huge MSSP opportunity, and it was an amazing time until the dot-com boom kind of failed.

But I still learned a ton from there.

I went to Check Point and started doing sales engineering management for Check Point because I’d run Check Point firewalls for so long in so many different jobs.

I was there for quite a while and learned how to do the softer side of the business. I learned how to work with customers and traveled around and helped them, which was great.

It really filled in some gaps for me because I was a very poorly socialized introvert. It got me out of my shell and doing more public speaking and forced me to learn how to talk to people, which I found very helpful. I didn’t think so at the time, but it was super helpful.

After Check Point, I started dabbling with startups. I was at a couple that didn’t go anywhere, a couple that were okay, and a couple that failed.

I’ll tell you, my failures taught me probably more than my successes when it comes to business.

Greg: They usually do in business and other aspects of life, right?

Andrew: No kidding.

Then I went to Acuvant—which now is called Optiv—but they were a VAR. It was really interesting going to a VAR from vendors because now I had the whole suite of technologies to talk to customers about and figure out, “Hey, what are you trying to do? What’s good? What’s bad?” and really bring all of that to the table.

Of course, it’s still interesting how much pressure you get to sell certain vendors over others. Maybe not always the best solution, but that’s just the way the game is played sometimes.

Then I ended up at Elavon, which was a smaller, thirty-five-hundred-employee credit card processing company. I started doing security work for them as a principal security architect and moved up into leadership roles there where now we’re dealing with PCI and credit cards and all of that.

That got rolled into U.S. Bank. I ended up there for about five years.

Then I wanted to get back into small-company land and went to a software company called Salesloft, which was just starting to blow up. It was just at the beginning of the COVID era, and it got real big, real fast.

It was building software for sales folks. I came in when there was a two-person team and built that into eight people—a whole huge security department.

Ultimately, they got bought by Vista Private Equity, and I actually just left there a couple of weeks ago to take a breath, decompress, and do some side work and consulting.

Among all that, I started a podcast, wrote some books, did some public speaking—a lot of stuff.

So, probably a long answer to a short question.

Greg: Well, I wish you would find a way to do more stuff. You’ve obviously got a passion in the field.

You and I share something. First of all, I started out—did I read somewhere that at one point in time you were a mechanical engineering student?

Andrew: No.

Greg: Okay. I was reading something else then.

The commonality between us doesn’t have to do with that, but it does have to do with being a private pilot. I believe you got your private pilot license in the early nineties. I did as well.

I’ve often thought that there are significant corollaries between how we approach flying and how we approach information security. I’d like to hear your views on that, and then I’ll add some as well, I’m sure.

Andrew: One hundred percent.

I like to say, “You know how you know when you meet a pilot? They’ll tell you.”

The biggest challenge is when you meet somebody who’s a vegan CrossFit pilot. They don’t know what to tell you first.

Greg: The only way you know they’re vegan CrossFit is because they tell you.

Andrew: Right.

But no, I absolutely agree. If you look at the aviation industry—and I’m not a professional pilot, although I’ve got good buddies who are—they have such a robust, mature risk management culture that we could learn a lot from.

It feels like information security keeps trying to reinvent that wheel.

You look at how aviation accidents occur, and it’s rarely one cause. There’s usually a number of systems in place, especially for larger commercial operations, that have a bunch of checks and balances that typically catch a problem before it results in an accident or incident.

Normally, when you really dig into what causes an accident, it’s a bunch of failures that line up in the worst possible way.

I think the same often applies to InfoSec.

I also think the concepts from aviation make a lot of sense. They care about fatigue. They care about checklists. They care about the best way to do something consistently and routinely. They care about studying incidents and learning from them.

We in InfoSec try to do that, but we also have this push to be very secretive because of legal aspects surrounding breaches.

I do find there are a lot of pilots in information security. I think it scratches the same itch.

There’s a lot you can learn from being thoughtful and systematic.

The one thing that really helped me was learning to be calm in a crisis.

When you’re flying an aircraft on your own—especially the first time, and I’m sure you remember your first solo like I do—that cockpit has never felt bigger.

You realize, “Wow, if I screw this up…”

Greg: I had to retire that pair of underwear, that’s for sure.

Andrew: I think every pilot understands that.

I heard this from a great instructor once: you start with a bucket of luck and an empty bucket of wisdom. Your job is to fill that bucket of wisdom before you run out of the bucket of luck.

I think that applies in information security as well as aviation.

You make mistakes and you learn from them.

Greg: Hopefully you’ve done enough risk management and have enough compensating controls so that your mistakes don’t end up being fatal.

You mentioned the first solo. The only thing I really remember from that—it was in Knoxville at McGhee Tyson, which was a Class C at the time, I believe.

I don’t think they do those classes anymore. It’s been about seventeen years since I’ve flown.

I remember thinking, for the first time I had a chance to stop and think, I went through the checklist, got clearance to take off, took off, established myself in the pattern, and then thought, “Okay, I guess I’m on downwind.”

For those who aren’t pilots, that’s when you’re flying opposite the runway while circling around to land.

That’s when I thought to myself, “I have no choice. I have to land this thing.”

Gravity is going to take me down one way or another.

That was a bit of a freak-out moment.

I think in information security, we have those same moments in the middle of incidents where it’s, “One way or another, this incident is going to resolve, but I have to do all I can with my training to bring it down with as little risk as possible.”

Andrew: Agreed.

You have to stay calm. You can’t panic. You can’t give up. You can’t pull over. You have to get that plane on the ground.

You also can’t start making things up on the fly—no pun intended.

That’s why we practice. That’s why we have checklists. We have engine-out checklists. We have emergency procedures.

Greg: To your earlier point, when you look at aviation accidents, it’s never really one thing that causes it.

The last thing is simply that the airplane impacted the ground in a very unnatural manner.

But how did you get there?

Fuel starvation is a common cause. Flying into IMC as a VFR pilot is another.

I remember hearing a statistic that if a VFR-only pilot flies into instrument meteorological conditions—clouds—they have something like one hundred seventy-eight seconds to live if they have no instrument training.

The question is: what decisions led to that?

Why did you fly when weather conditions suggested that might happen? What was your backup plan?

It’s the same thing in information security. That’s why we have compensating controls. That’s why we have layered security.

Andrew: One hundred percent.

You touched on another really important point.

In aviation, we have pre-thought-out, pre-planned, pre-practiced procedures for most emergency situations.

It’s basically disaster recovery in the air.

We train them extensively—hopefully.

I think that’s one thing we don’t do very well in information security.

We say we have an incident response plan. We say we have a playbook.

But what I often see is that it’s written, updated once a year, and nobody has time to practice it.

It’s not intuitive. That muscle memory isn’t there.

One thing we know from aviation is that stress makes it harder to think objectively.

That’s one reason it makes sense in both aviation and information security to have these pre-planned decision trees and reaction trees.

You’re already under stress. This takes some of that burden away.

We’ve already decided in a peacetime environment what we’re going to do.

We’ve lost the engine? Immediately pitch for best glide. That gives me the most time to figure out what to do.

Find a place to land. Head toward it. Attempt to restart the engine. Work the checklist.

As opposed to, “The engine just quit. What do I do?”

You don’t have time for that.

I’ve seen organizations during incident response where executive leadership, who haven’t bought into the response plan, start making things up on the fly.

Once emotion enters into it, you’ve lost a lot because you’re no longer thinking clearly.

Greg: That’s an excellent point.

Another thing that came to mind as you were talking through the engine-out and best glide scenario is that sometimes we practice things that we never plan to use, but we want to get close enough to the edge to know what it feels like so that we can avoid it.

What I’m thinking about here is spin training—or at least getting close to a spin.

For the non-pilot folks out there, a spin is basically when you enter into an uncontrolled stall. A stall is when you lose lift over the wings. Normally, if you enter into a coordinated stall, meaning you’ve got your rudder set correctly and your ball is centered—for those of us with steam gauges—the airplane loses lift symmetrically and falls forward. Then the airplane flies again.

But if you lose lift asymmetrically, one wing drops and you enter into a spin, which requires additional recovery procedures. You apply opposite rudder, stop the rotation, and then recover.

The reason we practice that isn’t necessarily because we expect to recover from a spin someday. It’s because we want to know what it feels like right before it happens.

The only time you’re typically flying really slow and making turns outside of training is when you’re in the pattern. If you get into a spin in the pattern, you generally don’t have enough altitude to recover.

I think there’s a corollary in information security. If we have enough monitoring in place, we can recognize when we’re getting close to the edge. We know we’ve hit a danger point and need to stop what we’re doing, pull back, and correct the situation.

Andrew: One hundred percent.

You touched on something else too.

When certain failures start stacking up, you may be able to sustain one failure, maybe two failures, but three or four failures can put you in a really bad situation.

I think the same thing applies to InfoSec.

I’ve got this weird incident over here. I’ve got a strange log event. Somebody’s connecting from a weird IP address at a weird time.

You start getting these pre-problem indicators.

If I can see them early enough and react to them early enough, I can probably stop the spin into the ground.

The challenge in information security is that we have so much information coming at us that determining what matters and what doesn’t matter is difficult.

The same thing can happen in aviation.

Pilots can vapor-lock because they’ve got too much information coming at them. You can get information saturation.

I’ve seen that same thing happen with SOC analysts and incident response.

What are the indicators I really care about? Which instrument gauges do I really want to look at to figure out what’s happening?

You mentioned VFR and IMC.

One of the weird things about flying is that we’re built to be on the ground. Gravity normally goes one direction.

In flight, because of the forces involved, you’re fooling with your inner ear. Your body thinks you might be in one attitude or condition while the aircraft is actually in a completely different one.

You’ve got to learn to trust your instruments.

Greg: Absolutely.

Andrew: Not that your gut is wrong, but your gut has to inform strong reasoning for why you’re taking the actions you’re taking.

You have to trust your instruments in aviation, and in InfoSec you have to trust what your telemetry and tools are telling you.

Greg: For our non-pilot friends, one of the things an instructor often does during training is put you under a hood so you can’t see outside and then ask you to close your eyes.

The instructor says, “Just keep the airplane straight and level.”

The instructor then sits there chewing gum, whistling, whatever, for a minute or two.

Eventually the instructor says, “Okay, look at your instruments.”

You’ll often discover you’re in a descending spiral and had absolutely no idea.

The centrifugal force has taken the place of gravity. You still think you’re sitting normally in your seat.

In information security, if you get to the point of complacency—where you aren’t receiving enough inputs and are relying entirely on intuition and gut feel—you can ride that “everything is fine” feeling straight into a major breach.

Andrew: That’s a great point.

Here’s the thing I think is challenging for some of us in information security, especially those of us who are pilots.

In aviation, we always have the option of scrubbing the flight.

If my minimum equipment list isn’t met, or if I lose a key instrument during preflight or run-up, I can turn the plane around, take it back to the hangar, shut it down, and go home.

We don’t often have that choice in business information security.

We still have to do risky things sometimes.

Because human life is involved in aviation, there’s generally more ability to say no to a flight without major consequences.

Although pilots do fight something called “get-home-itis,” where they convince themselves to take risks they shouldn’t because they really want to get somewhere.

That same pressure exists in business, but usually at ten times the level.

Usually lives are not on the line, but often we’re advisors. We’re not pilots in command from an information security perspective.

We don’t have the authority to bring the business to a stop because we think an information security issue is imminent.

Greg: Right.

Andrew: Then it becomes a matter of understanding that you may have to accept risk you’re uncomfortable with.

I think the tough part for us, especially those of us who are pilots, is that when you’re pilot in command, you are the complete final authority over the aircraft.

In business information security, we’re essentially advisors.

Greg: That’s a very good way to put it. I’d never really thought about it that way, but you’re absolutely right.

And it’s tough because you don’t have that control.

One other thing you mentioned, since we’ll finish out this flying analogy, is how aviation does such a good job with postmortems.

Sometimes it’s an actual postmortem, unfortunately.

The National Transportation Safety Board publishes preliminary and final reports on every aviation incident in the United States.

I receive those reports in one of my feeds, and they’re fascinating because you learn from them.

We don’t really have something equivalent in information security.

I understand why. Organizations don’t necessarily want all that information out there.

But it would be useful to have some sort of clearinghouse for publicly available information that is much more thorough than what we have today.

Some elements exist, but certainly nothing as ubiquitous or detailed as NTSB reports.

Andrew: I agree completely.

Sorry again to the non-pilots, but there’s something called a NASA report.

If you’re a pilot and you screw up—fly into the wrong airspace, violate some rule, whatever—you can self-report.

In general, it comes with a degree of amnesty. You’re not likely to have the FAA breathing down your neck.

The problem in information security is that there’s no equivalent “get out of jail free card” that gives us the freedom to share all the details because of the legal liability involved.

I can tell you that last year at Salesloft, I was involved in a massive breach that generated a lot of media coverage.

Someone came in, stole a bunch of OAuth tokens, went into Salesforce, and scraped a bunch of our customers’ data.

That’s all public information, so I can talk about it.

What was really fascinating was being in the middle of it while also reading all the press coverage.

I could see what we were legally allowed to disclose and what we weren’t.

It wasn’t that we were trying to hide anything, but our lawyers had such a stranglehold on what details we could release because of all the legal implications.

The news coverage was accurate, but very limited.

I knew from the inside exactly what happened, where we screwed up, what went wrong, and what we did well.

That’s the kind of information I’d love to see the industry share more openly, but the legal liability makes that very difficult.

Greg: Because with NTSB reports—and NASA reports—there are incredible levels of detail.

This is what happened. These were the maintenance records. This is the flight history.

Everything in aviation is documented.

Well, we could stay in this rabbit hole for quite a while. I really didn’t anticipate spending this much time talking about piloting and InfoSec, but it’s amazing how many parallels there are.

Greg: Let’s pivot a bit.

Piloting—whether you’re a private pilot or a commercial pilot—is a stressful activity. Certainly another parallel is that information security and cybersecurity are stressful as well.

I like to encourage folks to decompress from that stress as healthily as possible.

I’ve been very transparent on this podcast that one of the things I used to do was twelve-ounce curls to decompress. It was never a serious problem, but I could have found healthier outlets.

Based on when we’re recording this—and when this episode is actually going to drop—this will coincide with my third anniversary of being alcohol-free.

So now I do other things. I’m crazy into mountain biking right now. I’ve gotten much more into the fitness side of things to help decompress.

I always love hearing other people’s stories.

What’s one of the things you do to decompress from the stress of cyber—and flying?

Andrew: What’s amazing is that flying actually was a de-stressor for me from InfoSec.

When you’re flying, you have no choice but to focus solely on that event.

Greg: Yes, yes, yes. Now, it brings its own level of stress too, but I totally agree with that.

Andrew: It does.

By the way, if you’re too stressed from your day job, you probably shouldn’t fly.

That creates its own issues.

Particularly if you’ve had a few twelve-ounce curls.

I will tell you right now, I’m fighting a bunch of burnout. So this is a very topical question for me.

I’m trying to get back into fitness. I find, personally, going to the gym and doing forty-five minutes of cardio while watching a movie on the iPad helps a ton.

I play video games.

I like going to the gun range.

I like to travel.

My wife and I are trying to hit every state park in Georgia.

Spending time with her, that kind of stuff.

I read and watch a lot of movies and TV.

I’ve been out of balance. I’ll be very honest.

I’m trying to get back in balance.

For me, a job—especially in a leadership role in InfoSec—can take everything you give.

I got a little too far to the other side, so I’m trying to get back to my hobbies and the things that help me de-stress.

That’s my approach.

Greg: That’s the biggest risk we have.

Particularly because it seems like both InfoSec and piloting draw Type A personalities.

We tend to want to do a very fine job, a complete job, and be at the top of our game all the time.

It’s just not sustainable.

I think that’s great advice—to take a step back and decompress and unwind from burnout.

Because the more burned out you become, the more you have to spool back.

Once you get post-burnout, what future plans have you got?

Andrew: That’s a great question.

I’m doing some consulting work right now.

You, as a pilot, probably understand the play on the name of my consulting company—Rotation Speed Consulting.

Greg: That’s when you reach rotation speed and take off.

Andrew: Exactly.

Plane nerd reference.

Right now, I’m regrouping.

I’m also looking at getting back into the right opportunity when the time is right.

I’m spending time learning AI.

I’m spending time learning all the crazy things surrounding the security of AI.

Ultimately, whether it’s through consulting, small businesses, medium businesses, or whatever, I’m trying to figure out how I can help and use the thirty years or so of experience I’ve accumulated to be useful to an organization.

Ultimately, I’m trying to find a mission worth supporting.

I’m fortunate in my career where money isn’t as big a deal anymore.

What matters is: do I believe in what we’re doing?

I don’t know what that thing is right now.

I’m trying to figure that out again.

I’ve gotten so burned out that I’m trying to find that excitement again.

That’s kind of where I’m at, to be completely honest with you.

Greg: It sounds good. I hope you find that excitement again.

Certainly, if you go down the AI rabbit hole and start learning that, I’ll caution you.

I’ve entered the world of vibe coding myself.

Not just asking Claude to write code for me and regurgitating it.

I’ve been using ChatGPT and Bubble. I wrote an application to help manage my consulting business, which is actually kind of cool.

But now I’ve become a nerd in that area too.

The Type A personality starts kicking in.

“I’ve got to fix this.”

“I’ve got to do that.”

“I’ve got to add this.”

And then suddenly you need to decompress from the thing you were doing to decompress.

Andrew: Exactly.

Greg: Andrew, this has been an absolutely fun conversation.

I love it.

We probably need to schedule another time to chat more about InfoSec and guns.

I wanted to touch on firearms, proper gun safety, and some of the parallels with information security, but we don’t have time for that today.

I’ll be thinking about it.

The next time I’m out at the range, I’ll probably be thinking about this conversation.

Andrew: I’ll be out at the range on Monday, and I’ll be thinking about it too.

Actually, when this podcast drops, I was at the range the day before.

That’s always the funny thing with recording and release schedules.

I’d be happy to chat more anytime. I’d love to.

Greg: Well, I appreciate you being on.

And everybody, stay secure.

Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to The Virtual CISO Moment. I’m so happy—this is my 250th interview for The Virtual CISO Moment.

Today I have Bruno Lecoq. He is the Co-Founder, CEO, and Chief Information Security Officer at BEMO, a company focused on helping small and mid-sized businesses protect their data, strengthen their cybersecurity posture, and navigate increasingly complex compliance requirements.

Bruno brings more than three decades of technology leadership experience, including 19 years at Microsoft before launching BEMO in 2010. Under his leadership, BEMO has grown into an award-winning Microsoft partner serving hundreds of organizations across the United States while achieving certifications and compliance frameworks that include SOC 2, ISO 27001, HIPAA, and CMMC Level 2.

With a unique perspective that spans cloud transformation, cybersecurity compliance, and the realities facing small and mid-sized organizations, Bruno has helped bridge the gap between enterprise-grade security practices and the practical needs of growing businesses.

Bruno, thank you so much for joining us today.

Bruno Lecoq: Thank you for having me. And thank you, ChatGPT, for a wonderful intro.

Greg: Good. Now, Bruno, I’d like to hear, in your words, your background, how and why you got started in technology, and bring us all the way through your Microsoft days, the founding of BEMO, and where you’re at today.

Bruno: I’m from France, and when I was 15 years old, I was crazy about computers. I saw a television show about two young millionaires in the United States. One was Steve Jobs and the second one was Bill Gates. I heard the story of the beginning of Microsoft, and afterward I went and woke up my mom and said, “Mom, I want to go work for a company like Microsoft.”

That became my goal. I eventually came to the United States. I’ve now been in Seattle for 36 years, and I achieved that dream by getting a job at Microsoft.

At Microsoft, I held multiple roles. My first job was as a developer working on MS-DOS, which definitely dates me. Later I worked on Windows NT, moved into hardware, worked on Xbox, and held a variety of different positions.

In 2010, I started BEMO. Originally, BEMO developed a process to deploy Microsoft Project Server and SharePoint Server in about 15 minutes. This was before Office 365 and before Azure existed. Then, in 2018, we shifted our focus into cybersecurity, and that’s where we’ve been ever since.

Greg: Awesome. You were talking about the Windows and MS-DOS days, and this is going to be a weird question because you may not have had any involvement with it whatsoever. Earlier in my career, I remember that TCP/IP wasn’t native in Windows. I think it was during the Windows for Workgroups era. We had to load a third-party stack—we used something called Chameleon.

Why wasn’t TCP/IP native at that time? Was Microsoft still pushing NetBEUI?

Bruno: Yes, exactly. You have to remember that in those days Microsoft was going through a major transformation.

My first products involved working on OS/2. One of my projects involved taking OS/2 components and converting them to DOS and Windows packages. I worked on that for about six months. Then, on the day of the shipping party, Bill Gates came in and announced that the product was being canceled because Microsoft was ending its partnership with IBM on OS/2 and moving forward with Windows NT.

Because of all those transitions and negotiations, there were many moving pieces determining what technologies would be included and in what order. When you’re a developer, you understand some of the technical reasons, but there are also business and partnership decisions happening behind the scenes.

It was a very interesting time.

Greg: I kind of wish OS/2 hadn’t lost out in that battle because, back in the day, it was an amazing operating system—well ahead of its time. But when Windows NT arrived, it was really a game changer.

So, after Microsoft, you decided to do something completely different and start a company helping small and mid-sized businesses.

Bruno: In some ways, it wasn’t completely different. I worked at Microsoft for almost 20 years, and even today BEMO is still 100 percent focused on Microsoft technologies. We don’t do AWS. We don’t do Google.

We’re a Microsoft Partner of the Year, and Microsoft has always been our ecosystem.

Before, I was inside Microsoft helping build products. Now I’m outside Microsoft, but still very connected. I’m based in Seattle, I’m on the Microsoft campus every other week, and I still feel very connected to that world.

Today, we’re heavily involved in Microsoft’s beta programs. Microsoft considers us one of the top cybersecurity firms in its ecosystem. Every January, Microsoft invites us to campus under NDA and shares its roadmap for the next 12 months across security and other product areas. We provide feedback, meet with development teams, and help shape features before they become generally available.

When those features are released, we’re already prepared to deploy them.

Greg: I won’t ask you to tell us what the next 12 months will bring, because I’m sure that’s all under NDA. But I imagine much of that revolves around AI, Copilot protection, and AI governance.

AI seems to be becoming the proverbial Wild West. Would it be fair to say that Microsoft’s general direction is to help organizations manage AI and AI governance?

Bruno: Totally.

Microsoft recently released capabilities around managing AI agents. The idea is that you can manage your agents whether they run on Microsoft, AWS, or Google. Microsoft wants to provide the management plane where organizations can govern all of their AI agents from a single location, regardless of where those agents reside.

I’ve always felt that Microsoft is often two or three years behind in some areas. They’ll release version 1.0, and I typically tell customers to wait for version 2 or 3. But once they reach version 3, things really come together and fit seamlessly into the ecosystem around governance and security.

Greg: So this is probably an extension of Purview then?

Bruno: It includes much more than Purview. It involves Azure, Microsoft 365, and the entire ecosystem working together.

Greg: I’m not going to pretend that I’m a Microsoft 365 administrator. I know just enough to proverbially be dangerous.

I’ve worked with Purview, Entra, and some of the Azure security components. One thing I noticed over the years was that Microsoft seemed to change things frequently, and it could be difficult to find administrative settings that used to be somewhere else.

Today, it feels like the rate of change has slowed down a bit. Am I imagining that?

Bruno: No, you’re actually pretty correct.

Take Entra, for example. Entra isn’t evolving at the same speed it was previously because it’s become fairly mature.

However, when you look at AI-related services, things are changing constantly. Right now, as we’re working on ISO 42001 for AI governance and using Microsoft 365 Copilot, features are changing every other day.

Everything around AI is moving incredibly fast.

Greg: In my world, we work with SMBs through virtual CISO engagements. Managing Microsoft 365 doesn’t usually fall directly to us, but rather to someone within the company or an external IT provider.

Are there strategies from Microsoft designed to help smaller organizations successfully manage Microsoft 365 without getting overwhelmed by all the complexity?

Bruno: Microsoft has always, in my opinion, been built around partners.

Ninety-five percent of Microsoft’s revenue comes through partners. Microsoft trains and enables its partners, and those partners then serve small businesses.

There’s no way that one IT person can realistically know Entra, Purview, data governance, SharePoint, Copilot, and everything else in depth.

Even within BEMO, where Microsoft is all we do, we have specialists because it’s impossible for one person to know everything.

Greg: Many organizations realize they need outside help to successfully manage Microsoft environments, but there are a lot of people out there claiming to be Microsoft experts. Some are excellent, while others are not.

What should a small or mid-sized business look for when trying to find a provider like BEMO?

Bruno: First, ask for referrals. Ask other organizations about their experiences.

Second, look at credentials.

We’re a Microsoft Partner of the Year. That’s important because it demonstrates that Microsoft itself recognizes the depth of our expertise.

We support SMBs across the entire country and work across many industries—from defense contractors to CPA firms and everything in between.

Greg: Since you mentioned defense contractors, let’s talk about CMMC.

I know CMMC requires organizations to properly protect Controlled Unclassified Information. Sometimes I get confused about how all of that translates into the Microsoft ecosystem.

Can you help simplify that?

Bruno: BEMO is one of approximately 50 Managed Security Service Providers in the United States that is currently CMMC Level 2 compliant.

We’re 100 percent Microsoft-based, and I can tell you that you do not need additional platforms or non-Microsoft tools to achieve compliance.

We’ve built our own enclaves, we’ve gone through the C3PAO assessment process ourselves, and we’ve successfully completed the audit.

So yes, it is absolutely possible to become CMMC compliant using a Microsoft-centric approach.

Greg: It sounds complicated to me. It must also be challenging when you’re working with an SMB and trying to explain that they need a specific architecture because they’re handling CUI. How do you sell that concept?

Bruno: Historically, organizations doing business with the Department of Defense completed self-assessments against NIST SP 800-171 and simply attested that they were compliant.

Many organizations checked the box and said, “Yes, we’re compliant.”

Personally, I believe many of them would not actually have passed an independent assessment.

I think the Department of Defense realized that, which is why CMMC was created. Now organizations must go through an independent third-party assessment process.

Fortunately, we don’t have to sell organizations on CMMC. Their prime contractors are doing that for us. Companies like Lockheed Martin are telling suppliers, “If you want to continue doing business with us, you need to achieve CMMC Level 2 compliance.”

Greg: One thing I’ve always found confusing concerns Managed Service Providers and CMMC. How does that work?

Bruno: A company can become CMMC compliant while using an MSP that is not CMMC Level 2 compliant. However, the MSP becomes part of the overall risk picture.

The MSP often has privileged access to systems, infrastructure, and potentially Controlled Unclassified Information. During an assessment, the MSP’s practices can absolutely affect the customer.

So while certification for the MSP isn’t always mandatory, there is definitely additional risk.

Greg: From my perspective, if I were a defense contractor handling CUI, I would certainly prefer to work with an MSP that had already demonstrated CMMC compliance.

Bruno: I would make the same choice.

The challenge is that many organizations don’t fully understand that relationship. They don’t realize that the MSP’s security posture can affect their own assessment.

Greg: This is why I often tell organizations that they must thoroughly vet not only their virtual CISO providers, but also their MSPs and security partners.

Ultimately, responsibility for protecting CUI always remains with the organization itself.

Bruno: Exactly.

One situation we see frequently involves organizations that believe they have been compliant for many years, only to discover they were never truly compliant.

For example, we’ll receive calls from defense contractors who say, “We’ve been handling ITAR-regulated data for 15 years, and now we need help with CMMC.”

Then we discover they’re running in Microsoft Commercial environments when they should have been operating in environments that support ITAR requirements.

Many organizations experience sticker shock because they suddenly realize the level of investment required.

In reality, they were simply receiving a free pass for many years because nobody was independently verifying their compliance.

Greg: Organizations should be suspicious whenever two providers present dramatically different pricing for what is supposedly the same service.

If one proposal costs two or three times as much as another, there is probably a reason.

Bruno: Exactly.

I recently worked with a company in San Diego with about 150 employees. They told us, “You’re three times more expensive than another provider.”

The competing provider was proposing a commercial Microsoft environment that simply would not satisfy their ITAR requirements.

Once we explained the differences and compared apples to apples, the pricing made sense.

Customers are free to choose whichever provider they prefer, but they need to understand the implications of that decision.

Greg: That really comes down to trust.

Although we may sell products or services, what we’re truly selling is trust.

If you begin a relationship by misleading a customer, you’ve damaged that trust from the start.

Bruno: At BEMO, every prospective customer receives a complete total cost of ownership analysis.

We show not only BEMO’s costs, but also all of the other costs associated with achieving compliance—auditors, third-party services, additional tools, and ongoing operational expenses.

We want customers to understand the full picture.

Relationships in cybersecurity are built on trust. If I mislead a customer at the beginning, we won’t have a successful long-term relationship.

Greg: Do you ever discuss potential penalties if organizations choose a non-compliant approach?

Bruno: Not really.

The first thing we determine is whether the prospective customer is genuinely interested in security and compliance, or whether they simply want a certificate.

If someone only wants a piece of paper, we generally don’t take them as a customer.

Greg: Amen. That’s exactly our philosophy as well.

Bruno: I often compare CMMC compliance to having a child.

The day you become compliant is like the day your child is born. It’s only the beginning.

From that point forward, there are activities that must occur weekly, monthly, quarterly, and annually. CMMC is an ongoing process.

Many organizations believe that once they receive the certification, they’re done. In reality, they’ve barely started.

Greg: Achieving certification is just the beginning. You still have to manage the program, maintain the controls, and continuously monitor everything.

Bruno: Exactly.

Many organizations view compliance as simply another expense.

Personally, I view audits and compliance frameworks differently. I see them as an opportunity to have independent experts identify weaknesses in our environment.

I’d much rather have an auditor discover a problem than a threat actor.

Greg: Segment three is always my favorite part of the show because I always hear different stories.

Cybersecurity and entrepreneurship can be stressful. What’s one of the things that you do to decompress?

Bruno: I’m a huge soccer fan.

Perfect timing, actually. My father is flying in from France, and he’s going to spend six weeks with me. We’re going to watch a lot of soccer together and enjoy every minute of it.

Greg: Now wait a second—you called it soccer. Shouldn’t you have called it football?

Bruno: I’ve learned how to speak American.

Greg: If you had said football, my American brain immediately would have gone to the Seahawks.

I have to admit that I’m not the biggest soccer fan. I think part of it is because of how we’re raised. I grew up with American football.

But the more I think about it, the more I wonder if soccer is actually the purer form of the game. In American football, you have a one-hour game that somehow lasts four hours.

Bruno: Growing up in France, soccer was simply part of life.

As kids, we’d go outside with friends, bring a ball, put down two shoes to mark the goals, and start playing.

It’s a sport that costs almost nothing to play.

Greg: Looking ahead, what plans do you have for BEMO and for yourself?

Bruno: For BEMO, we’re continuing to expand our AI security offerings.

We’re deploying security solutions for AI environments, including Microsoft Copilot security, agentic AI security, and AI governance initiatives.

One major focus area for us is ISO 42001 and helping customers establish governance frameworks around AI.

Within BEMO itself, we currently have 46 AI agents running internally.

Everything is accelerating. The speed of change around AI is extraordinary.

Greg: The pace really is incredible.

I’ve occasionally thought about retirement and what that might look like for me. But honestly, I enjoy this field so much that it’s hard to imagine stepping away.

Being able to witness and participate in all of these technological shifts has been a lot of fun.

Bruno: I completely agree.

I feel fortunate because I’ve experienced several major technology revolutions during my career.

There was the personal computer revolution, then the internet revolution, then cloud computing, and now AI.

The AI revolution is moving faster than anything I’ve ever seen.

It’s exciting to still be part of it.

Greg: Well, Bruno, I hope you and your father have a wonderful time together watching football over the next several weeks.

I really appreciate this conversation. One of the things I love about The Virtual CISO Moment is that I never know exactly where an episode is going to go, and I really enjoyed the organic direction this conversation took.

I learned a lot today, and I appreciate you taking the time to join me.

Bruno: Thank you for having me.

Greg: And everybody, stay secure.

Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to the Virtual CISO Moment. Today, Alan Clinard joins us. He is the founder and principal of Athena vCISO Services.

Alan brings more than two decades of experience in information security, operational risk management, governance, and compliance across financial services, critical infrastructure, and government sectors. Over the course of his career, he has led enterprise information security risk programs for a variety of organizations. He’s also a former U.S. Army officer and holds certifications including CISSP, CRISC—which I think is pronounced “C-Risk,” but I’m not sure—CISA, and the Certified vCISO, which I’m sure we’ll talk about in just a few moments.

Alan, thank you so much for joining us today.

Alan Clinard: Thanks for having me, Greg. Really happy to be here.

Greg: Well, I’m happy you’re here as well. Two apologies if my throat is—my voice is a little bit hoarse. I just got done with a recording of the previous episode right before this as well, but that’s okay. It’s like I wasn’t yelling in the previous episode, so I don’t think I’m going to yell at you or anything.

But I want to start off the way that I always do. I know some of your story, but I’d like to hear how and why you got started in this wonderful field. Just take us through your career and to where you are today.

Alan: Sure. So when folks ask me this, honestly, I really kind of bumbled into it.

My post-Army career career, I wasn’t really sure what I wanted to do with my life. So I ended up taking a role in Washington, D.C., and it was operational risk management consulting. So we had both a services and a software platform that we used to help people measure and manage operational risk. And that started mostly with physical security, and it dovetailed really into information security over time.

One of the things that I took from my Army career that has really helped me along—my first assignment was as a tank platoon leader. So I was in a tank battalion. I had four tanks that I was leading and their tank crews, and it really helped me understand the basics of maneuver warfare.

I then transitioned to the intelligence world, and having that experience as that leader at a maneuver unit really helped me do my job as an intel officer better because I had that perspective. I really was able to take that mindset and frame of reference and then apply it in my civilian career.

So when I supported a client, I really wanted to understand what they were trying to accomplish, what outcomes they were looking for, and understand a little bit of the inside baseball of their organizations—like how things get done—and then go about saying, “Okay, based on all this, here’s what I think is the best way to support and develop your information security risk management program.”

So I started out supporting federal customers: the Air Force, Department of Homeland Security, the Navy. And after several years there, I met my now wife in the D.C. area. We decided that the D.C. area probably wasn’t a great place to raise kids and have a family.

So she was originally from Minnesota. We moved out here, and I started working at U.S. Bank. Again, supporting those front revenue-generating business lines from an information security perspective, it really helped me to have that mindset and perspective of what do I need to know about the business and how they do things to be able to support them better.

So understanding, okay, what are the business outcomes? And from an information security perspective, how do I make them better at what they do?

And what that really was is taking a lot of the information security-related tasks that a manager was responsible for in a revenue-generating business line and starting to document those and basically take them off their plate. Having things that produced consistent, repeatable results—checklists and so on and so forth—so that they don’t have to have the expertise and experience that I do. They can just rely on the instructions and procedures that I’ve put together, which help them, A, be secure and, B, demonstrate compliance in a very highly regulated environment.

So I took that experience supporting revenue-generating business lines and moved into the information security function itself. I had a number of both technical and governance-related positions there. Again, same mindset, but instead of an individual revenue-generating business unit, it was the entire bank.

So really understanding, for instance, on the insider threat team, what were my responsibilities and how do I engage and leverage the HR function and the managers to create a path of, “Hey, here’s the thing we found that this particular employee did that we’re concerned about.”

I’m not going to explain it in technical language. I’m going to tell you, “Hey, this is what they did. Here’s why it’s bad.” And we’re going to leave it up to you to deal with that employee in whatever shape, form, or fashion.

So again, having this understanding of how the business operates to be able to better support them.

My next role, I worked in the critical infrastructure world. Again, very highly regulated. I was part of a company that helped manage the electrical grid. There, again, much the same story—understanding what it was we were doing, what it was we were responsible for from a regulatory perspective, and then saying, “Okay, how do we do both good security and do it in such a way where we can then evidence the fact that we’re compliant with the regulations?”

And so that was my last role before founding Athena vCISO Services. So it kind of brings us up to date.

Greg: Well, I love the fact that—well, first of all, you made it a little bit easy for me because I often ask folks that were prior military, “What did you bring from the military that has helped you in your career?” And you answered that.

You also do something that I think is a big gap in those offering virtual CISO services and just those who are security folks in general. That is the importance of understanding the business. If you understand the business, you can help the clients better, to use your words.

But there are a lot of folks out there that seem to miss on that. They start wanting to jump into aligning folks with frameworks and controls. They’re going more on a check-the-box thing, and they think they’re doing the right thing, but they don’t really dig into understanding the company.

What is one thing that you think could help them better understand the importance of doing it the way you’re doing it, as opposed to starting with the framework and checking the boxes?

Alan: I think there are a couple of things.

So I’m a big Stephen Covey fan, and whenever I get the opportunity, I throw out, “Begin with the end in mind.” We have to ask ourselves, what is the end?

For a small or medium-sized business, the end is being profitable and delivering a good service. I think that dovetails into the other thing, which is a little bit of humility.

Someone very early on in my career at the bank made the point of saying, “We’re not here to do security. We are here to make a profit and return money back to our shareholders and do good things for our customers.”

So having that understanding that everything that anybody in the organization does, to include information security services, supports that objective. It’s not about your expertise. It is about your ability to work as a member of the team to achieve that goal.

So having that mindset and that humility walking in, I think, is really important. Those are not technical skills.

Greg: No, not at all.

And I think that’s one of the things that makes it difficult for folks that are trying to move up. The humility angle is so powerful. When people finally realize the goal of the company is not to be secure. The goal of the company is to make money. I mean, that’s it. There is no other goal.

How do you not make money? You have a bad security program. That’s one way to not make money—to have really bad losses. That’s how it dovetails in.

But there are so many people in our field that automatically think, “No, security has to be the number one priority.” That’s why they can’t talk risk to the C-suite and the board of directors because they’re already starting off on an “I’m more important than you are” type of footing.

Alan: Yeah. You really do have to speak their language to be able to have a seat at that table.

The protect-revenue piece that you alluded to there is important, but also, how do I help you expand into a new market or offer a new product in a safe and secure manner?

Now you’re not only being that firefighter, if you will, but you are also being that proactive business leader to say, “Hey, here’s a really smart way that we can get into this new market or offer this new product to a new set of customers.”

Greg: Let’s dive down that just a little bit further.

You often talk about cyber translation, to use your words—translating technical risk into business language. We’ve just talked about the importance of that, but why do we struggle with that as security professionals?

What is it in our brains or in our background? Is it because we focus too much just on our own world? We diminish the importance of it? We don’t understand the importance of it? Maybe a combination of all that? Or maybe something else?

Alan: I think all of that.

We really like the ones and zeros. That’s what we’re passionate about.

I don’t know that we do a good job as an industry—the information security, CISO, virtual CISO industry—of teaching basic business concepts.

That’s one of the things that I had to learn about running my own business. What is a balance sheet telling me? What is my P&L telling me? What is my cash flow report telling me, and why is it important?

Those are things that I had to pick up on my own, and we just don’t teach them as part of maturing out of that very technical role into this idea of being a business leader.

It’s a whole different lexicon. It’s a whole new alphabet, if you will. Instead of threats, vulnerabilities, controls, firewalls, switches, et cetera, it’s profit, loss, revenue, expense, marketing, sales.

Greg: Yeah, and I totally agree.

Being a small business owner yourself gives you a different perspective. Particularly in the virtual CISO field, almost by definition, the clients that we’ll work with fall into the small and midsized business category because if they’re any larger, they’re going to have somebody on full-time.

That’s why I say almost by definition.

Making that jump into being an entrepreneur is a difficult jump. But I think some folks have the misconception that it’s very easy. They think, “I’m suddenly going to hang my virtual shingle, and the clients will be screaming and knocking down my virtual door.”

That’s what I thought, honestly, when I first started. I thought, “I’m just going to put it out there. I’ll do maybe one Google ad and have clients out the wazoo.”

It doesn’t work that way.

It’s kind of a scary thing to do because you’re now responsible for the entire business. You’re responsible for everything. The things you talked about—the back-office stuff, the finance stuff—but you’re also responsible for the marketing, the sales, the billing, the invoicing, and all that stuff.

It’s a crazy world to get into.

So why did you jump into it?

Alan: I think the biggest thing for me is I just wasn’t a good fit for the corporate world.

We talk about trying during an interview to help people see you as a fit in their organization. There is precious little about helping you understand, “Is the organization a fit for me?”

Through many years of following the normal track where everybody does a nine-to-five type of role, I learned that that kind of environment is not a good fit for me.

So that is the first thing.

The second thing is I really wanted to have the flexibility to be able to pick my daughters up after school at three o’clock and spend the rest of the afternoon with them.

Greg: Oh yeah. There’s a huge lifestyle component with it. No doubt.

Alan: Yep.

And I think the third thing is the challenge of adding value on every day, every interaction, every engagement that I have with my clients, and then being able to move the ball forward for them big-picture.

Stepping outside of the everyday, “Oh, we’ve got an exam coming up,” or “We need to do this policy review,” and helping them chart a course in a bigger-picture kind of way.

Helping them understand, okay, how do we break down a business goal that this organization has, and how do we communicate how the information security function helps the business reach that goal?

Along the way, as part of that challenge, it is one of the things that I love to do professionally speaking, which is teach and mentor.

I always tell my clients, “I am going to work myself out of a job. I am going to train you in such a way where, in whatever period of time—maybe it’s six months if I do a really great job, maybe it’s two years—you are no longer going to need my services because you can do this for yourself.”

We’ve built that institutional knowledge and that security culture in this organization where you’re going to say, “All right, we’re good. We’d love to keep in touch with you, but we can do this ourselves now.”

That has been a real unexpected piece of satisfaction that I’ve gotten out of that challenge piece.

Greg: Yeah, I think that’s a wonderful thing to do.

It’s such an honest approach because there are so many organizations—and I don’t like to normally badmouth organizations, but I will speak in generalities—that provide virtual CISO services and other services that are more self-serving than others, or are less experienced.

From the self-serving standpoint, particularly those that are pressured to look at the bottom line, the margins, the recurring revenue, they don’t want to do that. They’re like, “No, you’ve got to do everything you can to make sure that the client is sticky.”

Yet what you just said is completely opposite of that, but provides a better service.

I’ve always been of the opinion that if you have a heart of a servant, you’re always going to be successful. Something or another is going to be fine with it. It’s okay to lose a client in that manner because you’ve done something good.

So I applaud you for that.

Alan: Yeah.

And when I was a manager, there was always this fear and anxiety around losing a good employee or losing an employee because they decided to go somewhere else.

I just disagree with that perspective because—good for them. They’ve got a great new opportunity to go and grow. I don’t know why we wouldn’t be happy about that.

And yes, I have to replace that person, so I have somebody else that I can bring in that I can now mentor and teach and help grow.

The best part of all of that is that person B is not the same as person A.

So I now have to understand where that person is at. I have to meet them where they are. I have to ever so slightly—or maybe completely—rearrange how I manage that individual.

I think the same thing applies with losing a client.

It’s like, okay, now I have the space to bring somebody else on who’s in a different position. Maybe they have an exam coming up or an audit coming up or they’ve got an MRA that they need to deal with.

That’s great for me because now I have a whole new set of problems to help them solve, and I have a whole new cast of characters to help train and mentor and do all the things that I love to do.

Greg: That reminds me of a conversation I had on last week’s episode. n full transparency, I can say it’s last week’s episode from the airing perspective. But from my perspective of recording, it was about an hour ago, so it’s fresh in my mind.

We were talking about—and I know you work with financial institutions a lot—the challenge of institutions where they are fine with where their security program is because the auditors are fine with it or the examiners are fine with it.

Us sitting in the position as virtual CISOs for those types of organizations—and it doesn’t just have to be financial services, but financial services is so heavily regulated—you don’t really have examiners in any other field for the most part. It becomes a little bit of a frustration where we’re like, “You can do better with your security program. We have a way to get you there.”

But they only seem interested in staying at this level, which is not a bad thing. Don’t get me wrong. You have to be compliant with FFIEC guidelines and this and that, but that should be the minimum. You should strive above that.

Yet sometimes getting clients to understand that being above where the auditors like it or the examiners are okay with it is a good thing can be difficult.

How do you approach that?

Well, I guess there’s two questions there. How do you approach it with the client? And then how do you approach the frustration? Because I know I feel this way. You already talked about having a heart of a mentor and an educator and trying to work yourself out of a job. How do you get there?

Alan: I think that, going back to this idea of having a little bit of humility, every client is different.

I look for the small wins and think long-term and strategically about how do I pile up those small wins with this client so that they are markedly different today—or in six months—than they are right now.

When I lived in D.C., I actually learned how to play polo.

Greg: Polo? Awesome.

Alan: Yeah, it was a ton of fun.

Everybody thinks about polo and imagines people galloping down the field taking these huge swings to hit the ball. What I learned is that polo is really all about the short game.

I have that perspective in my head of, okay, let’s just assume small wins. How do we stack those up strategically so we’ve radically changed how this organization does asset management or radically changed how this organization does business continuity?

I think the second thing is identifying someone who can carry water for you.

Having an idea and planting that idea in that person’s head where it’s their win, not my win. They look good in front of their bosses.

Greg: Oh yeah. And we want to help promote that too.

Alan: Yeah.

I think being a consultant means you’re naturally on the periphery of the organization. Having someone who is part of the organization and part of the culture moving and shifting them and nudging them ultimately helps deal with some of that frustration.

Honestly, it’s more satisfying to me because it’s like this plan that I have in my head and I’m executing on this plan little bit by little bit.

When I see and I’m able to measure how things have changed over the course of time, that is very personally satisfying to me.

Greg: You mentioned being a consultant, which I think there’s a misconception in the security field that it’s very easy.

We kind of talked a little bit about it from the business perspective, but also just from how you work with clients. It’s not easy to jump from being an employed minion at an organization doing your job and then making this shift as a consultant because there are certain other things involved with that.

It’s actually a good segue into what I wanted to talk about—the Certified vCISO program—because that’s where you and I first met.

Which is kind of a stupid way to say it. We first met. No, we met there. It wasn’t like, “Hey, I’m meeting you again for the first time.”

But anyway, I digress. My voice is going because I’m talking stupid right now.

One of the things that I came away with from doing the Certified vCISO program—and I’ve talked about it on the podcast before—is that prior to that, I was more of the opinion that if you’re going to be a virtual CISO, you had to have had the experience of being a CISO or the highest-level information security executive somewhere because you had to have learned that risk management experience.

The Certified vCISO program actually does a very good job, in my opinion, of doing two things beyond the security knowledge. It does a good job of talking about risk management, and it also does a good job of teaching, at least on a basic level, how to be a consultant.

I have openly said that after being skeptical about it before going through it, I think it’s a very positive thing for our industry.

Now, having said that, it’s been a couple of years since you and I both went through it. I think we did it in 2024, something like that?

Alan: Twenty twenty-four.

Greg: Was it 2024? Okay. Time seems to go by so fast sometimes.

What was your takeaway from it? Did you find positivity from it?

Alan: Absolutely.

I think one of the big things that that course helped me with was extinguishing a lot of the fear I had around imposter syndrome.

Before I took that class, I thought, “Nobody’s going to pay me to do this.”

Greg: Yeah.

Alan: I’ve got all of this experience, but nobody’s going to listen to me. I don’t have any authority. Whatever.

But going through the class, it was honestly like I knew everything.

There were some bits and pieces that I didn’t have, and I was grateful for the perspective that Evan and his team shared.

But I realized, “Oh, I’ve been doing this for such a long time, and these other people have made a career out of doing this.”

That really helped me put to rest many of the fears I had about going in and doing this on my own.

Greg: Well, I can relate with a lot of that as well because it’s sort of touching on some of the stuff from the beginning, but also just generally in our field.

This can be a very stressful life.

Security in general—the risk management aspect of it, the governance aspect, trying to build programs for clients that are at various stages—it can be a good challenge, but it can also be frustrating and stressful.

Then you layer on top of it the entrepreneurial side of things, and that can double the stress.

I’m so much of an evangelist on this podcast about emphasizing to folks that you need to decompress. You need to let go of stress in a positive manner. I’ve learned that the hard way over my career.

I think it’s important to remind people of it. Part of how I remind people is asking guests, what’s one of the things that you do to decompress?

Alan: My big thing right now is learning how to cook and make things from scratch.

I’m making butter, bread, just very basic things. I’m trying a new recipe at least once a week.

For me, it’s very Zen because it takes your mind completely off of everything else that’s going on. You have to focus right then and there.

That helps me put everything else down.

It’s also a really great opportunity to laugh at myself for really screwing it up and then thinking through, okay, what did I do wrong there?

I made some really awful chocolate chip cookies because I mixed up—no pun intended—the ratio of baking powder and baking soda.

Greg: Oh, I’ve done that before. That’s not a good thing.

Alan: So that, and I’m looking forward to picking up cabinet tree building.

I have a couple of rental properties that I manage. They’re older homes. They’ve been beat to heck.

There are some built-ins that I want to repair, and there are things I want to add in terms of cabinetry.

So I am going to YouTube University and learning how to build cabinets.

Greg: Oh, that’s awesome. That’s awesome.

Well, that’s part of your future plans, but I definitely want to touch on other future plans you might have for Athena vCISO Services.

I know you focus on financial institutions, but you’re not limited to financial institutions, right?

Alan: No, not limited to financial institutions.

The great thing about working with non-regulated companies is you kind of get to set aside some of the administrivia associated with the regulatory piece, and we really get to focus on the business.

I have one client, and they are anxiously champing at the bit to adopt AI. What I am doing there is identifying, hey, let’s understand what we are implementing AI for and what outcomes do we want from the use of that AI?

Then how do we consolidate that into something that we can apply our change management to, that we can apply our asset management to, our access management, all of our normal information security functions applying to this newfangled thing called AI?

That, I think, is where I am most anxious to take Athena. It’s helping organizations do that good governance around AI and the implementation of AI.

It holds great promise, and I should say it needs to be managed better.

I liken this to what businesses went through when the internet first started to appear and businesses first started to use it. I think AI is going to be as much of a fundamental transformation as that was.

We didn’t manage it one hundred percent right, because the evidence of that is all of these security-related things and all of the downsides of the internet.

I want to hope that we have learned from that and that we can channel our energy and enthusiasm for AI in a much more deliberate, constructive way.

That is, I think, the biggest thing that I’m looking forward to for Athena, being able to have a hand in that.

Greg: So if folks want to get ahold of you, what’s the best way to do it?

Alan: My website, athenavcisoservices.com.

You can also find me on LinkedIn. You can reach out to me personally, or you can go to the Athena vCISO Services page on LinkedIn.

Greg: Awesome.

Alan, it’s been an absolute pleasure. I appreciate having you on.

Alan: Thanks for having me.

Greg: As I always tell my guests before starting, we kind of say fifteen to twenty-five minutes. I don’t like to go above thirty.

As I look at the clock, we’re hitting close to forty right now, but that’s okay. I’m going to have to actually change my write-up for it because I never like to stifle good conversations.

This is an excellent conversation.

I really appreciate you coming on and sharing your wisdom with folks out there. Again, anybody looking for virtual CISO services, check Alan out. He gets it. He’s one of the folks out there who understands and has the experience to back it up.

The why for what he does is, I think, really aligned with the right way to do things.

So again, thank you for joining us, Alan.

Alan: Yeah. Take it easy, Greg. Thank you.

Greg: And everybody, stay secure.

Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to the Virtual CISO Moment.

Cy Sturdivant joins us today. He is a cybersecurity consulting principal with deep experience helping organizations navigate information security, regulatory compliance, and risk management challenges. Cy has spent nearly two decades working across public accounting, financial services, and consulting environments with a strong focus on frameworks and regulations, including lots of letters: GLBA, FFIEC, NIST Cybersecurity Framework, and IT General Controls. He is a Certified Information Systems Auditor and has held leadership roles with Forvis Mazars—hopefully I pronounced that right.

Cy Sturdivant: Mazars.

Greg: Mazars. Thank you. I tripped over that before.

Cy has also worked with BKD and other advisory firms throughout his career, helping organizations mature their cybersecurity and governance programs while balancing operational realities and regulatory expectations.

Thank you, ChatGPT in the office there, for that intro.

Cy, thank you so much for joining us today.

Cy: Absolutely. Good morning. Good to see you.

Greg: Yeah, good to see you again.

Of course, we have known each other for quite some time. I think it goes back to shortly around the time when I first started this wonderful vCISO Services experiment. I appreciate all the advice and counsel that you gave me back then, and we’ve dovetailed on certain things since then.

You were actually one of the earlier guests in Season 4 of the Virtual CISO Moment back four years ago. Why don’t you catch us up on some of the things you’ve done since then and what you’re doing today?

Cy: Yeah, it’s crazy it’s been four years. I’m probably just like most people. It’s like, goodness, what has been happening the past four years?

First and foremost, I would probably say from a life perspective, kids are growing like weeds. From a family perspective, it’s just trying to balance everything there. From a work perspective, it’s been nonstop.

We’ve gone through our own change, just like you were saying, from BKD to a merger to create Forvis and Forvis Mazars and trying to balance that expanded footprint. Obviously COVID had hit when we had originally discussed, but all of that change and shifting and the remote nature of work, and really serving clients all over the nation, has been fantastic.

But it’s also very hard to keep up with questions like: Where am I working this week? Who am I serving? Where am I going? It’s always something.

You and I always share conversations about education. You want to educate. You want to motivate. I’ve really been trying my best to get back in front of people through conferences, breakout sessions, and symposiums, just trying to get out there on the forefront of all the craziness that’s changing.

It’s been a great four years. A lot of change. But if you want to be successful in anything in our line of work, you have to be adaptable to change. You’ve got to lean in, have a positive attitude, and do your best. Learn every chance you get and give up on the idea of trying to stay one step ahead or trying to be caught up. I gave up on that a long time ago. Instead, try to stay close enough to the bleeding edge to stay informed.

For the past four years, I could probably summarize everything by saying: do your best every day. When the day is done, recharge, move on to something else, and do your best tomorrow.

Greg: I think you touched on something so important that often, particularly early in people’s careers, they don’t put as much emphasis on as they should. And that is networking and interacting with people.

When you network, you not only get to hang out with your peers, but you also get to spend time with people who have years of knowledge and experience, such as you, and even dinosaurs such as me.

This gives me a chance to plug that I’m going to be speaking about being an information security consultant at BSides Roanoke this Friday. Then, on June 13, if you happen to be in the Des Moines area—I won’t say “Des Moines”—in the Des Moines area, I’ll be speaking on the same topic there as well.

How important has networking—not the computer side, but the people side—been for your career?

Cy: Oh, it’s exceptionally important. The relationship aspect is critical, especially for somebody like myself.

If you’re working inside a bank, credit union, mortgage company, insurance company—regardless of where you’re working—networking with your peers and your team is extremely important. You have to lean on one another. You have to delegate. You have to gain insights. You need somebody on your side when you’re communicating with leadership.

But for my role, and your role too, if people don’t know who you are, why you’re doing this, what your purpose is, or what you do, then they have no way of understanding your passion, your curiosity, and your interest in the work. Nobody gets exposure to that if you don’t network, build relationships, and create friendships.

It’s a two-way street. You want to share, but you also have to consume and listen.

Greg: Absolutely.

I figured that out a long time ago because I’m not the sharpest pencil in the toolbox. I’m not the smartest person in the room. But I do have intelligence, I do have interest, and I’ll use those to the best of my ability.

I love conversations. I love meeting new people. I love getting out. I’m an extrovert, so I get a lot of my energy from people. That side of it always connected well for me.

But honestly, in the early days, I didn’t realize how important networking was. Looking back, absolutely. The relationships. Who you know. Who you help. Who you listen to. Who you connect with and share your time with. It absolutely matters.

Cy: Relationships are probably the most important thing you have, personally and professionally.

Greg: So building off of that, I’ll ask: why are you doing this? You spent a lot of your career in financial institutions, regulated organizations, and environments like that. What originally drew you into this crazy world?

Cy: Yeah. To keep it short and sweet, my grandpa.

I always tell this story. My grandfather sold life insurance, but through his relationships with families and individuals, he also had a very close relationship with our small local bank in the little town where I grew up.

As a little kid, I’d be downtown by the flashing red light—we didn’t even have stoplights—and he’d say, “Hey, I’ve got to go to the bank. Want to come?” It didn’t matter what was going on. He always seemed to have a reason to stop by the bank.

So I’d go with him. And for whatever reason, I always thought the bank was this really cool concept. That stuck with me.

As I went through high school and college, I just wanted to work in banking. So I got an accounting degree and a finance degree and landed my first job in banking.

It wasn’t in IT. It wasn’t in security. It wasn’t in cyberspace. This was back in 2005, so cybersecurity wasn’t really a buzzword back then. Information security definitely was, but cybersecurity wasn’t what it is today.

I tried a variety of things, and honestly, I didn’t like most of them.

There’s that old phrase, “Know thyself.” I don’t know the Latin version, but I knew I wasn’t enjoying what I was doing. So I started asking questions.

I asked if there was anything else in the trainee program that I could get exposure to.

Luckily, the risk management officer said, “Actually, we just got written up. We don’t have an IT auditor. We don’t have an IT specialist in this division. Would you like to take a shot at it?”

I loved technology. Computers and the internet were really starting to take off, and I wanted to learn more.

It was strange how everything came together. The business background, the banking background, the love of banking, and then the technology overlay. It created this perfect recipe.

It’s hard to keep my attention, but things were changing so quickly and there were so many interesting things happening that I dove right in and loved every second of it.

Literally, that one lucky happenstance conversation turned into twenty-plus years.

Greg: I love that story.

You didn’t necessarily have a plan that said, “This is exactly where I’m going to end up.” You just kind of let opportunities happen and stayed open to them.

I heard something recently that stuck with me. I don’t remember where I heard it, but it was, “Do you know what makes God laugh? When you make a plan.”

Cy: Maybe we heard that at the same place.

Greg: Maybe so.

My story is similar. My undergraduate degree is in mechanical engineering. I got involved in technology because I was a part-time student assistant doing network work.

Now, thirty-six—actually, thirty-seven—years later, I’m still doing it.

One of the things I always like to tell people who are trying to get into the field is that it’s okay if you don’t know exactly where you’re headed yet.

Try different things.

Figure out what you like.

Figure out what you don’t like.

Because you don’t want to spend the next thirty or forty years doing something you hate.

Cy: Agreed.

Even if you’re really good at something, if you don’t enjoy it, you’re never going to be engaged. You’re never going to lean in. You’re never going to have that consistent energy.

That perfect formula of doing what you love and doing what you’re really good at—that’s the secret sauce.

Greg: A lot of things change in our field, which is one of the reasons it stays interesting. But there are also things that haven’t changed despite all the technology changes.

What are some of the things you’ve seen throughout your career that have remained consistent?

Cy: This may not be where you were expecting me to go, but I’d say being positive, being helpful, and looking for ways every day to do your best.

That mindset of no matter what happens, I’m going to look for the bright side.

Greg: That’s interesting because it literally happened this morning.

There’s a guy down the hall from me. My office is in a coworking space that’s sort of an incubator environment for startups and small businesses. We all share common facilities like the concierge, printers, and things like that.

There’s a gentleman down the hall I always wave to because every time I walk toward the kitchen area, I’m looking right at him.

A few days ago, I noticed he was moving things out of his office. I didn’t get a chance to talk to him then, but I saw him this morning.

I asked, “Hey, what’s up?”

He said, “We had to shut down the company.”

The offshore company they were affiliated with apparently went under.

And it’s exactly what you were talking about. I tried to be positive. I tried to be supportive. I tried to be a resource if he needed one.

That actually leads into something you and I talked about before: TEA.

Cy: Oh, yeah.

Greg: Let’s jump into that. First, though, we probably need to explain what TEA stands for.

Cy: Yeah. So it goes back to what you were saying about what’s changed over the last four years. The demands of life, career, family—everything just seems more intense.

TEA stands for Time, Energy, and Attention.

I’ve become extremely focused on the fact that we’re all given the same amount of time every day. We all get twenty-four hours. A big portion of that is spent sleeping, so the question becomes: how intentional are you going to be with the time you have left?

Success, at least for me, isn’t just about career success. It’s about family. It’s about happiness. It’s about fulfillment. It’s about being tired at the end of the day because you gave everything you had to the things that matter most.

That’s where the Time, Energy, and Attention concept came from.

I also happen to love tea. I drink green tea two or three times a day. During the winter it’s even more because it’s cold outside. Every morning when I make a cup of tea, it’s a reminder. I ask myself: How am I going to protect my time? How am I going to protect my energy? How am I going to protect my attention?

If you do those three things exceptionally well, you’ll accomplish tremendous things. And by tremendous things, I mean the things that are important to you. That’s the key.

Because if you’re great at time management, you’re taking care of your energy, you’re limiting distractions, and you’re incredibly productive—but you don’t have clear goals—you’ll be tremendously successful accomplishing somebody else’s goals.

That’s the trap.

Over the past several years, I’ve become much more aware of it because everything is on screens now. I started noticing this energy drain at the end of the day that I had never really experienced before.

I kept asking myself, “What’s going on? Am I just getting old?”

I’m forty-three years old. I expected that feeling maybe at fifty, not now.

So I started reading books and paying attention to what was causing it.

Greg: He says that to a fifty-eight-year-old, so I should be dead by now.

I saw a funny meme recently. It said something like every hour you’re on a Zoom call reduces your life expectancy. Based on my calculations, I should have died sometime around 1844.

Cy: It was so good. And honestly, it feels true some days.

But that’s why I think Time, Energy, and Attention are all equally important.

Greg: They are.

Although when I’m talking to people externally, I often focus on time first because time is the one resource that’s truly non-renewable.

If you give someone your time, that’s a meaningful gift because you can never get it back.

One of the things that always bothers me is when somebody reaches out completely out of the blue and says, “Can I have fifteen or thirty minutes to pick your brain?”

I generally have to say no.

Part of it is that I’d rather have a relationship with someone first. But part of it is practical. If I said yes to everyone, I’d spend all of my time, energy, and attention helping other people achieve goals that aren’t aligned with my own priorities.

The challenge is that I’m a people pleaser by nature. I like helping people. So sometimes I struggle with where to draw that line.

In my information security consulting presentation, I tell people that they have to ruthlessly protect their time.

How do you do that?

Cy: Any time I hear a concept like that, I try to create a visual picture in my head.

I think it was Brian Tracy who talked about viewing time as your most valuable asset.

Imagine protecting that asset.

A lot of people think of protection as building a wall, but a wall is impenetrable. Nobody can get in and nobody can get out.

Instead, I think of it as a locked door. The door isn’t permanently closed. I can open it whenever I choose. But I’m the one deciding when it opens.

Whenever somebody asks for my time, I run it through the same filter:

Does this support what I’m trying to accomplish?

Sometimes what I’m trying to accomplish includes helping other people grow and succeed. Conversations like this are a great example.

If somebody reaches out and it aligns with those goals, I’ll often say yes. But I may not say yes today. I might say, “Absolutely. I’d love to help. Can we do it next Thursday at three o’clock?”

What I constantly evaluate is this: What is the most important thing I need to accomplish today Usually I know that answer several days in advance.

If I have capacity and somebody says, “Hey, I’m struggling with something and would love your perspective over lunch,” that’s often an easy yes. But if saying yes creates consequences elsewhere, then I need to think harder about it. That’s where one of my favorite concepts comes in:

Every yes is a no to something else.

If I unexpectedly say yes to one thing, what am I saying no to? Am I saying no to a commitment I’ve already made? Am I saying no to something that’s more important? Am I saying no to something that’s more urgent?

That’s why I like thinking about the Eisenhower Matrix. The important-versus-urgent framework is a great way to evaluate these decisions. Sometimes something is absolutely worth doing. It just isn’t worth doing today.

And that’s okay.

Greg: That’s a great way to think about it.

I know your time is valuable, so I appreciate you spending some of it with us today. Now that I’ve picked your brain about TEA, let’s pick your brain about something else. Let’s talk about community banks and financial institutions.

You work with community banks, credit unions, mortgage companies—the whole spectrum. The environments differ, but today what are the most common gaps you’re seeing in security programs? And have things matured over the last four years, or are you seeing many of the same challenges?

Cy: That’s a tough question because we work with a significant number of institutions across the country, so it’s hard to make a blanket statement.

I’d probably split them into two groups. The first group took the biggest bag of lemons that COVID handed everybody and made some really good lemonade out of it. They were able to recruit exceptional talent, build strong cultures, and become much more proactive.

More importantly, they care. I don’t know a better way to say it than that. They genuinely care about protecting their institutions and protecting their customers. They want to provide great services while still maintaining strong security. Those organizations have matured significantly and have done exceptionally well.

Then there’s the second group. They’re still very reactive. The conversation tends to go something like, “Cy, thanks for your time. Thanks for the report. We’ll get those findings addressed. See you next year.”

Greg: So it’s more about maintaining compliance than continuously building and improving a security program?

Cy: That’s actually a great way to phrase it.

The organizations that really mature don’t wait for a regulator, an auditor, or a penetration test to tell them what to do. Those things happen once a year—maybe a couple of weeks out of the year if you’re lucky.

The organizations that are successful have a true security mindset. They’re constantly looking for ways to improve. They’re not necessarily trying to become Fort Knox and add endless layers of controls. Instead, they’re asking, “What resources do we have? What risks do we face? What changes are coming? How do we layer controls together effectively?”

The creative organizations that stay engaged and think strategically do really well. Unfortunately, there’s still a large segment that only moves when there’s a finding or when the examiners start asking uncomfortable questions. Otherwise, they’re just putting out fires.

Greg: From the vCISO perspective, that aligns with what we see as well.

A lot of times we’ll recommend enhancements to a security program and hear things like, “Well, the examiners are fine with it,” or, “The auditors are fine with it.”

I always think about the Office Space “minimum flair” speech. Meeting the minimum isn’t bad. It’s great that you’re meeting the minimum. But it’s still the minimum.

The bad guys don’t care about minimum requirements.

You can become more robust without making dramatic changes. You can improve your security posture incrementally. But sometimes there’s resistance to that.

I don’t necessarily judge it as good or bad. It’s just reality.

Financial services is so heavily regulated that regulation becomes both an accelerant and, at times, an impediment depending on the culture of the organization.

Cy: Well said.

Greg: One of the biggest topics in the industry today wasn’t even on our radar four years ago: AI.

Generative AI and everything that comes with it.

What are you seeing from financial institutions regarding AI adoption? Some are embracing it. Some are avoiding it. What’s your perspective?

Cy: It’s fascinating.

You can have a four- or five-billion-dollar institution that’s very aware of AI and monitoring developments closely, but they aren’t really doing much with it. Then you’ll find a five-hundred-million-dollar institution that’s in exactly the same place.

On the other hand, you’ll see another five-billion-dollar institution that’s fully engaged. They’re excited. They’re experimenting. They’re actively looking for use cases.

For years, organizations have struggled with repetitive manual processes. Maybe somebody spends four hours every week reconciling ATM reports. Now Copilot can perform most of that work in minutes, and the employee simply reviews the output.

Those organizations are leaning into productivity gains and eliminating repetitive point-and-click work. It’s similar to what happened when spreadsheets became mainstream. Nobody wants to go back to doing everything manually with a calculator.

The organizations that view AI through a productivity lens are doing some really interesting things. They’re using it for vendor management, governance, and compliance. They’re feeding large volumes of regulations, policies, and requirements into systems that can quickly surface relevant information.

When implemented properly, it can feel like having the world’s smartest consultant sitting next to you with a photographic memory.

The organizations that understand that potential are doing some great things.

The organizations that concern me are the ones saying, “Everybody else is turning it on, so we’re turning it on,” without any real planning, governance, or understanding of the risks.

Most of them are using Copilot, which provides some protections, but only if it’s configured correctly.

Greg: Right.

Cy: Exactly.

If enterprise protections are enabled and they’re staying within the tenant, that’s one thing. But sometimes executive teams have enterprise licensing while everyone else is using public AI tools.

Nobody has explained the difference. Nobody has explained that if you’re using a free public tool, you may be training the model with the information you’re submitting.

That’s where the risk comes from.

It’s usually not malicious. It’s ignorance. It’s a lack of understanding.

People upload information they shouldn’t upload. They ask questions they shouldn’t ask. They don’t understand acceptable-use requirements.

At the end of the day, it comes back to the same fundamentals we’ve always talked about: Did you classify your data? Did you secure it appropriately? Did you communicate expectations? Did you train your employees? Did you identify where your crown jewels are located?

Those fundamentals haven’t changed. Unfortunately, I’m still seeing a lot of organizations struggle with those basics.

Greg: And I think that’s the biggest takeaway.

No matter what the technology is, it always comes back to the basics. Whether it was social media, cloud adoption, or now AI, people tend to react as though the technology itself is the problem. But usually it isn’t. The real issue is governance. Knowing what information you have. Knowing where it lives. Knowing who has access to it.

If you don’t have a good inventory of your information assets, you can’t control them.

AI is another tool. A powerful tool, certainly. But it’s still a tool. Apply the fundamentals and you’ll be in a much better position. Would you agree?

Cy: Generally, yes. Although I do have one caveat

I try to be optimistic. I don’t like being overly skeptical. But the caveat is this: the large organizations building these systems—Microsoft, Meta, OpenAI, and others—have a tremendous responsibility. Are they going to build these systems in a secure and safe manner? I hope so.

That’s really a separate issue from how organizations use AI.

Greg: Right. That’s less about usage and more about how the technology itself is built.

Cy: Exactly.

Think about it like a car. I can be the safest driver in the world, but if the car wasn’t built safely, eventually I’m going to have problems.

If it doesn’t have seat belts, if the brakes don’t work properly, or if the wheels fall off when I turn too sharply, it doesn’t matter how carefully I drive.

The same concept applies here. The builders of these systems have to build them securely. They have to think about safety. They have to think about quality control. They’re building products that could be used by a seven-year-old or a seventy-year-old. They have to account for all of those scenarios.

It really comes down to the age-old question: it’s a hammer. Is it a weapon or is it a tool? The answer depends on how it’s built and how it’s used.

Greg: Exactly.

There’s obviously a lot of stress associated with everything we’ve talked about today. Technology changes quickly. Security changes quickly. The learning never stops.

One of the things I always like to ask people is what they do to recharge.

What’s something you do to decompress from all of this?

Cy: For me, it comes right back to Time, Energy, and Attention.

From an energy perspective, I’ve spent a lot of time trying to understand what genuinely recharges me. The answer is pretty simple: family and being outside.

If I’m sitting around a campfire, that’s my happy place.

We took our travel trailer out over Memorial Day weekend and went camping. I can be completely exhausted when I arrive, but within fifteen minutes of sitting around a campfire, it’s like somebody flipped a switch. All of a sudden I’m energized again. I’m ready to play a game. I’m ready to do something fun. I’m ready to stay up and have conversations.

It’s amazing how quickly it changes my energy level.

Being around the kids helps too, although that depends on which version of the kids shows up that day. If they’re happy, energetic, and ready to go do things, that’s fantastic. If they’re whining and arguing, sometimes that’s a little less energizing.

But overall, it’s being outside. It’s being away from screens. It’s getting off the phone. It’s reading a good book. It’s having a meaningful conversation with a friend. It’s grabbing breakfast with somebody like you.

Sometimes the recharge comes from nature. Sometimes it comes from somebody else’s positivity and encouragement. But those are probably the two biggest sources of energy for me.

Greg: I love that.

What do you have coming up this summer?

Cy: It’s going to be a busy summer.

We’ve got some family trips planned. I’ve got a couple of banking conferences that I’ll be attending, and my wife and daughters are going to tag along for some of those. We’ve got some camping trips planned, and we’ve got a Dollywood trip coming up.

Greg: Oh my goodness, Dollywood.

I’ve never been. I don’t know whether I want to go or not, but I feel like I need to go at least once.

Cy: My ten-year-old is a roller coaster junkie.

Every year I tell her the same thing: we’ll go to Dollywood, we’ll ride everything, we’ll have a great time—just don’t make me go to Disney.

Greg: Because Disney requires a second mortgage these days.

Cy: Exactly.

And I’m not interested in taking that on right now.

We’re trying to keep things balanced. Not overcommit. Protect the time. Protect the energy. Protect the attention.

Greg: Well, Cy, as I expected, we’ve gone a little over our planned time, but that’s okay. Good conversations tend to do that.

Before we wrap up, do you want to explain where “Cy the Cyber Guy” came from, or is it just a nickname you decided to embrace?

Cy: Honestly, I don’t even remember exactly where it started.

I think it was either a client or a coworker about ten years ago. They introduced me and said, “This is Cy the Cyber Guy.”

Everybody laughed. The name stuck, and apparently I’m still carrying it around all these years later.

Greg: I love it.

Cy: I use it every chance I get because it’s memorable.

Greg: Well, Cy the Cyber Guy, thank you, my friend, for joining us today and sharing your wisdom once again. I’d love to have you back on the show. Hopefully it won’t take another four years.

I appreciate the update on what’s been happening in your world. I appreciate your insights into security, leadership, and personal growth. And I especially appreciate you sharing the concept of Time, Energy, and Attention because I think that’s something everyone can benefit from.

Thank you for joining us.

Cy: Absolutely. My pleasure.

Protect it the best you can, everybody.

Greg: And everybody, stay secure.

Greg Schaffer: Hi, I’m Greg Schaffer, and welcome to the Virtual CISO Moment. Today’s guest is Becky MacDonald. She is the founder of Cyber Risk Navigator and a seasoned cybersecurity leader with decades of experience helping organizations turn confusion into clarity when it comes to cyber risk and compliance. Becky has led security programs across healthcare, higher education, financial services, and more, guiding organizations from fragmented, compliance-driven efforts into mature, risk-based cybersecurity strategies. Through her work as a fractional CISO, she helps organizations strengthen their security posture, reduce risk, and navigate complex regulatory environments, all without the overhead of a full-time CISO. Becky, thank you so much for joining us today.

Becky MacDonald: Hi, Greg. Happy to be here.

Greg: Yes, and my assistant does such a great job of making these intros for me. Thank you, ChatGPT.

Becky: I was going to say that sounded very much like what was on my LinkedIn profile.

Greg: That’s where we get it from. So if there’s anything wrong in the intro, it’s because there’s probably something wrong on the LinkedIn profile or I made an error.

Becky: No, you hit it on and you did really well.

Greg: Well, I appreciate that. And that’s obviously just a very brief, high-level overview of your past and your history and your experience. But why don’t you take us back to the beginning — how and why you got started? I understand when we were talking beforehand that we both are fellow former CNEs, that most people probably don’t know what that means for Novell. But why don’t we go back to the beginning and bring us all the way to today?

Becky: That’s funny because, you know, working with younger folks today, I actually have had people like, “Seriously, Becky, what is Novell?” And so I had to go Google it and send them the link of the history of Novell, right? Because a lot of people don’t know.

Greg: Or they say “novel.”

Becky: Yep.

So let’s see. I started my career in networking and servers. Actually really loved that. I actually started college in programming, believe it or not. Within the first year, realized that really wasn’t for me. I took a networking class, fell in love — loved the idea of connecting and communicating and doing that kind of work much better than programming.

So I started off as a systems administrator. And I’d like to say that I’ve been doing security since day one, right? When you’re a server and a network person, your whole focus is on securing access and permissions and things like that, right? Identity — making sure that all of that is at the core foundation of everything. So it was very natural for me to fall in love with security as well.

Greg: Yeah. And I like to tell people, we didn’t have red teaming, blue teaming, purple teaming, or whatever back then. We called it troubleshooting. It was part of the job. None of this color-coded stuff. It really wasn’t specialized. It was all part of what we did.

But I’m sorry, I didn’t mean to interrupt your story. I had to get that in because it’s very much true.

Becky: And so it was like the jack-of-all-trades kind of thing too, right, back in those days. I don’t want to age myself too much here. But honestly, things evolved pretty quick. They weren’t so specialized. You had a lot of opportunity.

I also spent the majority of my career in nonprofit organizations, particularly healthcare, higher education, and K-12 education. You wear a lot of hats in those kinds of roles, right? I feel like those are the roles that really shaped who I became and what kinds of opportunities were given to me and how I grew my skills. You became a jack of all trades. You weren’t so specialized and siloed as you are today or in larger organizations. So I really loved that.

At some point throughout my career, I started getting into leadership. I had the opportunity to lead a help desk, server, and network team. That grew into also supporting DBAs, business intelligence, and all of that. Basically, if it wasn’t the main application, I was supporting it.

And when I took that supervisor position, it was also right in the early days of HIPAA. And they’re like, “Oh, other duties assigned. We need HIPAA policies. We need to make sure that our technical controls are aligned with HIPAA.” So I took that on.

From there, the passion just grew. I really wanted to get more on the risk management side of it and a little bit less on the tactical side. So working through that, I’ve always stayed somewhat tactical, but also very strategic and risk-focused. And I really like the risk side of it.

You can look at frameworks and say, “You’ve got to do this, this, this, and this.” Really, it comes down to risk. You’ve got to have that risk conversation and determine what is right-sized.

So after that, I did that for many years, and then I took a CISO role. My first CISO role was with a pretty good-sized health system. I did CISO work for ten years, both in higher education and healthcare. I really got to see the forefront of a lot of great things and a lot of growth in the security realm.

When I first started in security, there weren’t a lot of real-life examples of these breaches actually happening. Then you could go back to Anthem — the first huge one in healthcare. From then on, my job got so much easier. It became real.

And I wouldn’t say it was easy-easy, but it became real for leaders, for those in healthcare. It all became very real. You take a look at Target too around that same time, and that really started to shape where I think security was going and security leadership was going across organizations. We’ve seen a lot of growth over the last ten years.

Greg: I think that might have been fifteen years ago now — Anthem?

Becky: Yeah, I think you’re right. I think it’s been a minute, that’s for sure.

So we have CISO roles. And I’ve always wanted to really work for some large corporations because those afforded me opportunities that you don’t get in smaller nonprofit organizations — very mature GRC programs, medical device segmentation, unlimited tools, really good “sexy tools,” what I call them, that your smaller organizations can’t afford.

But my heart’s always been in that smaller midsize market. Being in healthcare and nonprofit for as long as I was, I feel like my superpower is finding a way to make things happen with limited budget and getting creative. I feel like that’s where I have the most passion — making progress despite not having a huge budget.

Greg: Well, that’s like classic risk management mindset, right? And I know you mentioned that. I pinged on that because when I was going for my CISSP, I thought that networking was going to be my strongest domain there because I’d been doing it for so long. And actually risk management was, which was like, “Oh, okay.” And that’s when I realized, no, I think I want to be a risk manager or go more towards that space.

But that’s exactly what it is because the difference between looking at a list — I think you alluded to frameworks and checking off things — as opposed to really understanding the risk of the environment is really the big difference from a business perspective, right?

Becky: Correct. A lot of folks go into this thinking you’ve got to implement check, check, check, check, check. Does that make sense for this organization? Is it the right approach for them? Could we do something a little bit different or lighter based on budget or their risk profile?

So that’s kind of my superpower — figuring out that niche and what is going to work right. Because there is no one way to do things right now.

Greg: Well, right. And that brings me — I want to talk just for a moment about the virtual CISO world. It certainly evolved over the last ten or fifteen years, and I think that sometimes it gets a little bit muddied as to what really makes a good, effective virtual CISO. We’ve kind of danced around some of the things with risk management, but from your perspective, how would you answer that? What really are the qualities that a virtual CISO needs?

Becky: Yeah, and I think it’s a breadth of things. I would say some technical acumen, even though many would argue that that’s not true.

I feel like I can be in a room with engineers and systems folks and I can see through the BS because of my technical background. “Okay, you’re telling me that this is going to cost X number of dollars and it’s going to take a year to implement. Hmm. I think there’s another approach to that and it could look something more like this.”

So it kind of cuts to the chase on some of those more tactical aspects of the role. And it helps right-size and shape our roadmap.

But I really think it’s about that risk and the willingness to understand the business and their profile and where their real threats are. I’m not going to push them to implement something that really shouldn’t be in scope for them because maybe it’s just not in their wheelhouse or a threat that is pertinent for them right now.

So really trying to understand that business. You need to understand risk and you need to understand the technical capabilities in my mind.

Greg: Well, and I think that bringing it home right there answers where I was about to go next. Because when I’ve talked about the virtual CISO field evolving — and in some cases maybe de-evolving — you’ve got some instances where folks that have very limited experience in the field, like they’re IT security managers, and they slap the vCISO moniker on their name.

And I was going to ask this question, but I think you answered it. I implore folks that when they’re looking for virtual CISOs, see what their approach is exactly. And if they go down the check-the-box route, maybe not so much. If they go down the risk management route and looking at things holistically and asking first about what the business is like, they’re the ones that are going to be more successful.

But how does one communicate that to an organization that’s looking for a virtual CISO that doesn’t really know the difference between them because they both say “vCISO”?

Becky: Right. And honestly, let’s be honest — in the space that we’re talking about here, small and midsize organizations, most of these folks are looking for “most cost effective,” right? They’re looking to check the box or they’ve had an incident.

I feel like those that have had an incident are really looking for strong leadership and they can dig through that. I think what you want to do is look at their background.

I’ve seen it too. I’ve seen it on people’s LinkedIn profiles. You went from maybe being a sales rep selling cybersecurity to all of a sudden now you’ve started your own vCISO program and you’re a vCISO.

Maybe that’s not the right approach depending on your situation. It could absolutely be the right approach if you’re just looking to have somebody guide you from a leadership standpoint and you feel like you’re strong in the technical aspects and you’ve got strong leadership there and capabilities.

Maybe that kind of CISO works for you. I think ideally you’d want to look for somebody that is well-rounded and has done a lot of those things because they bring more to the table.

Greg: Yeah, and I’ve put forth the idea over the last year or two that I think we’re starting to see a widening split in the vCISO world between those different types. I don’t know how that’s eventually going to shake out.

At one point in time I was thinking maybe it would be better if the industry had different monikers for each side. Maybe call one “fractional” and one “virtual information security officer.” I don’t know.

Becky: That’s tough because I think a lot of folks still haven’t really even caught on to what a vCISO is. A lot of clients I work with, they’re not searching for or looking for a CISO. They’re looking for cybersecurity expertise. That’s about as much as they know a lot of times.

Greg: Yeah, and a virtual CISO goes so much beyond the cyber aspect into governance, risk management, and all of that. You’ve got to have all those parts.

Here’s one of my biggest things on the governance and policy side: people just slap policy templates out there and then that’s not how the business runs and nobody’s adhering to them. You’re in violation of your policies from day one.

That drives me nuts. I’d rather you have a policy that is something that you can enact and operationalize than to just have a papered policy.

Becky: Right.

Greg: And that brings me to another question about the engagement. You already mentioned one mistake that sometimes people make — they either use templates or nowadays they’ll use ChatGPT or Copilot or something to create a policy. And if it doesn’t really reflect your environment, then that could be a real issue, particularly if you’re ever going to be audited because that’s what audits do.

But what are some of the common mistakes that you see when you first engage with clients as a virtual CISO? Mistakes that the organizations have made and are making — and maybe even expectations as well?

Becky: Yeah, so obviously the policy one is they have a lot of policies, they haven’t been updated in years, and they can’t even cite to me what their policies say. Their employees don’t know.

I do a risk assessment and I’m asking folks, “Do you have a disaster recovery plan?” Surprisingly, you’ll find the server folks and the network folks don’t even know that the plan exists. They are critical to that plan. So the plan needs to be dusted off.

Greg: I mean, you and I, when we were doing the networking stuff back in the day and the server admin work, we would have one because we wanted to keep our jobs.

Becky: Absolutely. And it was a point of pride to us, right? In our days, we wore all of those hats.

So I think that’s a challenge. The other thing I see is tool sprawl. Way too many tools with a niche and a little piece here and there, and honestly not fully utilizing each tool.

I think we’ve all seen that a lot. You buy this tool, you stand it up, you do the bare bones. You probably have good intentions of growing and putting in those next pieces of maturity with it, enabling those next features. Either you get pushback from leadership because “it might impact things,” or you just get busy onto the next project, the next project, the next project.

Becky MacDonald: The next project, the next project is generally the biggest challenge. And in higher education, we tended to see a lot more of that pushback from faculty and things like that. But often it’s just the continuous cycle of the hot project and the next initiative. You never fully implement everything.

So stepping back and looking at the ecosystem and saying, “Okay, this tool does this, this tool does this, and this tool does this.”

Greg Schaffer: I think that’s a common issue for a long time because I remember one of my earlier networking jobs — this was my first really supervisory-type position — we had a nice SNMP-based network management platform that had been purchased and installed by the vendor a year and a half earlier, but there was really nobody taking advantage of it.

The problem wasn’t because of lack of knowledge or lack of will. It was lack of time and lack of resources. And I tell you, you fast forward now — that’s been probably twenty-eight years — and the problem still exists.

So how can we do better in the security industry, particularly since we’re talking about SMBs and trying to be as efficient as possible? How can we be better with getting them to manage the tools properly or make maybe other decisions?

Becky: Right. So I think, first of all, we’ve got to stop the problem of not disclosing or making visible to the leaders the effort that really goes into fully deploying something.

A lot of times the security stuff and the IT stuff is back-end, back-office. It’s not visible to the leaders. So it becomes a thing of what’s visible to them is what we work on, and we forget about everything else because this is what’s important to the leaders.

So describing and putting on our roadmaps and our plans these tools and the full deployment of them and why they’re important and why they feed things — “It’s going to help us with availability. I’m going to know quicker that something’s down,” in your SNMP example.

We have to carve out the time to do those things. If we don’t carve those out, you’re building capabilities and business capabilities on top of a weak structure.

So having that conversation — and it’s not the easiest conversation to have because a lot of this just goes over their head. They also don’t understand why it takes so long to do or why we need so many resources to do it.

I think the conversation about tool sprawl and having too many different things is easier when you’re saving the organization money. All you’ve got to do is turn around and show that revenue gain.

Getting the time and the effort to merge and redeploy the right solution — or maybe taking the time to take that functionality out of tool two and tool three and putting it into tool one — sometimes is the tougher sell.

I’m not going to have bodies maybe to work on initiatives two and three for you from a business perspective because I’ve got to get this done.

I think it’s about balancing priorities too. There’s just too many hot priorities a lot of times.

So finding a way to put those up there enough that they get enough attention that we’re still moving along while addressing what the business needs to.

Greg: And part of this that’s so important is being able to communicate properly. And now this comes around full circle to what we were talking about in the beginning about what makes a good virtual CISO — and I’ll say what makes a good CISO.

Remember, first of all, the way this whole virtual CISO industry started is that it was prior CISOs that were then offering their services fractionally because they came to realize SMBs don’t have that sort of capability.

But then you get the people who put the moniker, the title, on their LinkedIn and all that, but they don’t have the experience of being able to talk and communicate with the C-suite and board members because they were never at that position anywhere in their organization.

And that’s one of the reasons why I historically used to be very hardline about this. I’d say, “You cannot be a virtual CISO if you were never a CISO before,” because you don’t understand.

I’ve backed off a little bit from that because I’ve met people that are practitioners in the field that are excellent with risk management. They get it. They’ve learned that skill some other way along the way.

But you can’t be a virtual CISO — or a CISO — without having that skill set.

Becky: I mean, nobody has been a CISO forever either, so you have to start somewhere.

Greg: Right.

Becky: And what I find is there are different types of CISOs in my mind.

So your small organizations — if I were starting out in the field right now today, I’d be looking for those small organizations where my leadership and the business leadership are going to be more tactical and business-focused.

I wouldn’t be going after the large organization that has a board — a very significant, high-end banking board and things like that. I’d be looking for those smaller niche-type organizations to cut my teeth as a CISO because they’re going to be more forgiving and they’re going to help you learn that skill — that whole idea of talking to them in business terms.

I’ve reported to CFOs, and they probably were some of the best leaders I had to prepare for. Talking money. Talking risk. CFOs understand risk and money more than a lot of CEOs do, to be honest with you.

Greg: No, absolutely. If the organization doesn’t have a CRO — a chief risk officer — then the CFO is the best one to report to.

Becky: Absolutely. Even better than IT.

I find with IT — and I’ve reported to a lot of CIOs, and there’s not necessarily a problem with that — but that leader has the same challenge of talking to the business and getting time with the business and being seen as an innovator and supporter and not just a back-office function.

Through a lot of my career, the whole IT department has been seen as back office. You’re not enablers and not business savvy. You don’t know about IT unless something breaks.

Greg: Unless something breaks and they don’t factor it in.

Becky: Right. And that has really shifted over the years. But I think in smaller organizations, you have that ability to have those conversations directly with the presidents and the CEOs and the CFOs because you’re generally a one-person shop trying to do all of those things and you’re reporting directly to them. It helps build that.

So if that were me — but I’m kind of with you on this whole “vCISO without being in the field” kind of thing. I have mixed feelings about it.

I also am tired of hearing that we have a shortage — a talent shortage. No, we don’t.

Greg: No.

Becky: We have a unicorn shortage. Everybody wants the unicorn. And I’m sorry, but not everybody can be a unicorn.

Greg: No. You can be a CISO for thirty years and still have shortcomings in some areas.

Becky: Absolutely. So be willing to work with somebody in those short areas.

Like, “Okay, this whole boxed-in thing where you can’t get into finance unless you’ve been in finance” — that drives me nuts.

I understand they’re more regulated, but in some ways that makes my job a whole lot easier. So why can I not get into the banking industry?

Greg: Yeah. I tell folks all the time: security is security is security. Sometimes the acronyms change.

You do the same thing across every sort of industry. You’re going to get like ninety percent there right off the bat. Then it’s just a matter of maybe learning some specifics around regulations or reporting requirements.

We all had to learn HIPAA too. We figured it out.

Becky: Right. We didn’t have regulations when we were doing security.

Greg: No, we didn’t.

Becky: And so we’ve been subjected all these years through all of that.

You know, I saw one the other day. It was for a fractional vCISO, and they specifically wanted you to have startup experience. Well, in a startup company, okay, I understand the reason why — things move fast, they’re a little chaotic, they want to make sure that you’re going to be able to work in that kind of environment.

Well, just because I haven’t done that before doesn’t mean that I can’t work in that kind of environment. I’ve seen that a lot with lots of other established businesses. You have change in business. You have things go on. Things get chaotic. And a lot of businesses are chaotic, and many of us work just fine in that.

Greg: Every mile starts with the first step.

Becky: Yeah, every mile starts with the first step. It doesn’t mean I don’t know how to walk. I can figure it out. I can navigate through.

Greg: And I’m going to use that as a segue, as I look at your background there, because you talked briefly about starting Cyber Risk Navigator. I love talking with folks that go down the entrepreneurial path.

What was one of the more difficult things that you found by going down that path that maybe you didn’t anticipate?

Becky: I think I anticipated it, but it’s worse than I thought it would be: sales and marketing.

Greg: Ah, four-letter words, both of them.

Becky: I have a dislike for sales and marketing. And I completely underestimated the amount of effort and time it was going to take out of me to do those things.

I want to be doing cyber stuff. I want to be leading organizations and making an impact over there. So that’s the toughest part for me, I think.

And I’m really focused on trying to keep my business light — more of a boutique, solopreneur kind of thing. I don’t have huge growth aspirations where I want to hire a bunch of staff. I want to keep my costs low, and I want to focus on the organizations that value somebody like me who is going to give them one hundred percent, even if I am fractional.

I’m going to be ingrained in their organization and work with them to build their cybersecurity maturity.

Greg: Yeah, and that is the selling point right there.

Because I have found — and I’m not saying this just because that’s where I was too — but I have found that the best service comes from the very small organizations.

I like to say sometimes, “You’re a big fish in a small pond.” But conversely, you have to ensure that they have the experience behind them and that they’re not using you, the organization, as a training field.

I think that’s the most important thing because later we have come upon organizations that have had what I call “vCISOs in name only.” And they’ve done more harm to the overall security program than good.

Becky: I’ve seen it myself. I followed a couple of those, particularly when I worked in the consulting space.

So your MSPs trying to become MSSPs, right, and just throwing that vCISO out there to add onto their consulting business. That can be a challenge.

I think it’s a little bit of a conflict of interest. It can be done well if your CISO services are at the right level of the organization, meaning they can strongly influence to make sure that those things are getting delivered to the client in a timely manner.

Greg: I always have to chuckle because I’ve got to pull myself back. Otherwise, I’m going to go down another twenty-minute rabbit hole.

But suffice to say, conflict of interest with MSSPs is huge. It can be managed. One way to definitively manage it — and this is sort of draconian — is that if you’re an MSSP that has a virtual CISO, the virtual CISO cannot recommend services that your MSSP provides.

But that’ll never happen because the main reason for having the virtual CISO is as an inside salesperson.

So, okay, don’t make it a requirement that they have to purchase your services. Be transparent about it and say, “We can offer this to you, but you can do it elsewhere.”

Becky: Here’s other options, right?

And I will tell you, that did get me in trouble because I was always the one looking for the right-sized solution for the client.

“Okay, yes, we have this and it’s great, and it might cost you this and it includes these things. That’s not a go for you. Here’s some other options to look at.”

And I would go to the next level and help them look at those, even though it maybe wasn’t in the best interest of the overall MSP, which is why I wanted to be independent. I wanted to make sure that I would have full autonomy to do what’s right for the client.

Greg: Right. But this can all be stressful. It can be stressful being an entrepreneur. It can be stressful being in our field.

I encourage folks that they need to do something healthy — or at least do something that is not unhealthy — to decompress from the stresses.

What do you do to decompress from the stress, not only of information security, but also of being an entrepreneur?

Becky: For me, it’s anything in nature.

So if it’s piddling in my flower beds — I love flowers. I have pretty extensive flower beds here. Sometimes it feels like another job, but I enjoy them.

I also live on a lake, so spending time out on the lake and decompressing. We also love to camp.

Basically anything that is non-connected, in nature, quiet, less chaos — gives me time to refuel and just kind of chill.

Greg: Yeah, I just had this random thought. I’ve done almost two hundred and fifty of these discussions, and I would love to correlate the responses to that question over time and do analysis on it.

At first I’m thinking, “Well, I can go through every one,” but I don’t even have transcripts for all these. I started doing that about a year ago.

But I think what I’m going to do is wait just a little bit longer, and once I get to the point where I can point them to a share where I have all the videos, I’ll say, “Look at all these videos and do it for me.”

That would be cool. Then do highlights of what all CISOs do and see if there are any patterns. We can’t do it yet, but I’m guessing two years from now it’ll be powerful enough that I can do that.

Finally, future plans. What do you have on the horizon, either for yourself or for Cyber Risk Navigator or both?

Becky: Really, I’m looking to build the right-sized program for that smaller, cloud-connected organization.

I think that’s underserved — and over-served in some cases. If they have requirements from a regulatory standpoint to do X, Y, and Z, they’re probably overpaying for those services.

For me, I want to find that right niche and that right-sized approach for them that keeps them nimble and light. So that’s kind of where I’m focusing.

Greg: Awesome. Well, hey Becky, it’s been a great conversation. Really appreciate you taking the time out to be with us today.

Becky: Great. Thanks, Greg. I enjoyed it.

Greg: Everybody stay secure.