Chuck Brooks argues that today's CISOs focus too much on technical fixes like patching and tools while ignoring business strategy and adversary tactics. Cheaper technology lowers barriers for attackers, making it critical for security leaders to understand business context and align decisions with actual risk, not just technology.
Yeah, it's really amazing how technology and hardware is getting cheaper and cheaper. I remember what, the late '90s, it was so expensive to get storage. Today, storage almost doesn't cost anything. Yes. That's being a problem when you add adversaries use the skills, whatever is out there against you. Actually, you know Matthew Rosencrist? He was a guest on the show.
Oh, sure. Yeah, good friend. And very— one of the most knowledgeable people in cyber I know.
Absolutely. I believe that is definitely true. So, Matthew, don't get such a big head, okay? But yeah, it is definitely true because one message that I really took on when I interviewed him and then later interviewed him for his podcast is the way a lot of CISOs right now, they just focus on being technical or patching system and vulnerability, but they don't think about the big picture, right? The business itself, but not only the business, but also the adversary. Who are they? What are their capabilities? What are their motivations? So they completely do not think about that at all. And I don't think you can be an effective cyber executive if all you are thinking about is just, you know, whatever tools you are using and being technical. I think it's much more than that in 2025. What do you think?
I agree. And really, what you're talking about really is mostly resilience, because you have to understand, have to have an incident plan, you have to expect you're going to get hacked. I mean, no one is, you know, impervious to it. And you have to have your leadership understand that it's a reputation issue, too. And so you have to plan, you have to have the legal protections. I mean, companies too, I mean, there's things they could do, they could segment their data, valuable data. And they should be doing that already. But most of them don't. But, you know, I think that you really— there's a lot of stuff that's just logical to do. And also, I mean, for a lot of small, medium businesses, maybe the cloud is a good answer, because you do get some protection there, the risks, yes. But, you know, I think, true, it's a step that it makes them less vulnerable.
