Biz Success: S4:E45 Cybersecurity Leadership in a Dangerous World

8 Aug 2025 · 2 min

Watch on YouTube

2:14

In this interview segment, the host (Speaker A) explains that modern CISOs must act as entrepreneurs within the organization, using influence and partnership rather than direct authority to embed security into every business function. He emphasizes the need to adopt a business‑mindset, speaking the language of revenue and risk, exemplified by a KPI that measures the time to close a deal—showing how security can accelerate business outcomes. To bridge the gap between technical jargon and executive expectations, he pursued an MBA, enabling him to translate security value into clear business terms. He also discusses the perennial challenge of proving the value of preventive security, noting that it’s hard to demonstrate success when no incidents occur. The conversation underscores that security leadership is about aligning with business goals, gaining trust across departments, and quantifying impact in terms that matter to the C‑suite, board, and investors.

Chapters

I get all of the other business functions to trust and support and partner with security to help them do their job more securely and easier. I think that's really the mindset you need to have. Starting to think as an entrepreneur in a way, but really being business-minded and using leadership skills, influence to affect all of the other people. Because the truth is, as you know, as a CISO, you have a lot of responsibility on paper, but you usually don't have any control over things that you are responsible for. And you really have to rely on the other folks to do the right thing. And I think that's kind of where we are now.
Yeah. And I love that perspective of value, right? Providing more value. Yes. Avoiding bad things, you know, attacks and impacts and so forth. That's definitely important. Regulatory compliance, also very important. But there is more to that story. And I love your KPI, right? The time to close a deal. That's a great KPI, right? Because you're contributing to that, and time is money, and getting revenue on the books and all these things. And that's important to that business group, that's important to the C-suite, and that's important to the board and the investors they represent. So, you know, you're talking their language.
Mhm. Yes. And we really need to, to get out of speaking technical jargon that nobody understand. Uh, I, I think Again, that's another reason why I felt like I needed to go get an MBA so I could speak the language of business. Because I think sometimes senior management don't really understand what security does. It's like they put money there, it goes into a black box, they're doing something trying to keep us safe, but they really don't see the value. And in some of the jobs I've had as the head of security or CISO, I really had to prove to the leadership that yes, I need to be here and this is why. This is what I bring. And now we had the discussion when you were on my podcast where security is kind of like a losing proposition. Sometimes it's not very easy to prove something that didn't happen, right? What is the value if you're saying, okay, we didn't have any cybersecurity incident this year and it's because of me, but how are you able to prove it? Now, when I was at the Defense Language Institute, I was the EDU for their EDU network, right?