#99 Cybersecurity for Leaders: What Every CEO and Board Must Know

You're listening to the Proteus Leader Show, a top 10% world-rated podcast where you'll get practical tools and insights for leading, managing, and staying ready for the future. Your host today is a senior leader of Proteus International, a firm that focuses uniquely on leader readiness, working to support organizations of all sizes and industries all over the world. Ready for something you can use today? Enjoy this episode.

Welcome to the Proteus Leaders Show. I'm your host, Marie Oliff. Today we're diving into one of the most critical topics for leaders and boards: cybersecurity. With increasing regulatory pressures, evolving cyber threats, and the rising financial and reputational risks of breaches, Leaders can no longer afford to treat cybersecurity as just an IT issue. It's a business imperative. Joining me today is Vishal Shola, cybersecurity strategist and CEO of Blue Ocean Cyber. With 25+ years advising Fortune 100 boards and CEOs at firms like Deloitte and PwC, Vishal turned cyber risk into a strategic weapon. At Blue Ocean, he built Risk GPS, a platform that helps organizations outthink criminals and nation-states to prevent business disruption. By linking cybersecurity directly to revenue protection and ROI, Risk GPS makes cyber defenses a boardroom priority. Vishal's expertise has been featured in the Wall Street Journal, MIT Review, and NACD, where he equips leaders to turn cyber risk into a competitive edge. Welcome to the show, Vishal.

Thank you for having me, Marie.

My pleasure. So let's dive in. Cybersecurity, Vishal, is often seen as a technical issue, but you argue that it's a leadership and governance issue. Why is that shift in perspective so important for CEOs and boards today?

It's a good start and I'm excited to talk about it because I've been in this space for 25 plus 30 years, started as a developer and then being a partner, driving a lot of cyber enablement for companies. I saw the maturity where cyber, when you look at technology first, the technology used to be about enablement. Where it was there to bring efficiency and reduce cost. So I'm running a bank, I use technology for certain enablement and reduce cost, and that's where technology used to be. So cyber came and started becoming a technical issue because if I'm using technology to enable some process, I can do it. And that was in the '90s and early, probably late '90s. And when the internet started coming, It just said, oh, I don't need to go to the bookstore. I can go to the Amazon website and buy books. So the technology shifted from being an enabler to technology being the driver of your business model and the strategy. So once the shift happened from technology being enabler to technology being the driver of the strategy, What that changed today is if you look at if you can be any of the biggest bank in the world, they are running more like a software company than a bank. They are more software company which happens to do banking. I am a manufacturing— I'm a technology company who happens to manufacture iPhone. So they are basically a software and a tech company who is doing a business model. What has happened is the criminal understands this better, unfortunately, within compared to a lot of leaders sitting in the executive suite in the boardroom, because the criminal says, how I make money is by disrupting business. So what I need to disrupt, I need to disrupt the thing which drives the business, which is technology. So if I disrupt it, I disrupt business. So when the criminal acts from that perspective, they are going after it. If we need to go back as a board and this executive. Now we need to start looking at cyber as core to the business issue because the technology which it can disrupt is going to be impacting how we make money, how we grow, how we build trust with the customer, and how we'll respond to our stakeholder. Everything is integrated into how our technology is driving strategy, and only thing which is not, which can disrupt that, is cyber.

Got it. So because technology is now the driver, not just the enabler, you need to focus on that as a core to the business strategy. That's powerful. So with the SEC's new cybersecurity disclosure rules, Boards now have direct accountability for cyber risk on top of it. So what are the biggest governance gaps you see and how can boards and executives proactively address them?

Let's dive in a little bit into the SEC cyber rule. All SEC said was, we understand technology is the driver of the companies today. A business disruption because of technology can have the impact on the financial standing and the forecast of a company.

Yeah.

So if anyone is a shareholder, they got to know about how secure you are. If you have a material breach, then you got to be able to tell to the investor so investor can make a decision whether I want to remain invested or not.

Right.

That's the shift what SEC wants you to do. If there is a breach, inform it so the shareholder can make independent assessment. Now, here's the shift, how that has played out. So I'm going to take a breach which happened with a situation of Clorox, which is a company builds chemicals and bleaches and everything and all that kind of stuff. Nothing wrong with— definitely they do best they can do from a cyber standpoint. But Clorox company had a cyberattack and that cyberattack, basically what they did was the criminal, they took down their purchase order system. You take down the purchase order system. What happens is you cannot get the orders from Walmarts and Sam's Clubs and Costcos and all over the world. So once you cannot get the order, your purchase order system sits in front of supply chain. So it's not getting enough order and supply chain feeds into the factories what to manufacture within few days. 18 out of their 23 factories were running at 50% capacity. Clorox had to go to the market and say, this breach is material to our financial statement. They restated earnings, they restated forecasts. They took the overall impact over next 9 months ended up becoming half a billion dollars approximately. And it took them nine months to get back to where they were operating, and their stock took a dive by twenty twenty-five percent and stayed there in that range for about a year till they came back to the operation. Right?

Wow! So the cybercriminals attacked them at the core operations. It just affected the entire supply chain. Exactly.

Let's see. And we can look at FBI and others. They always have said it's not a question of if versus when the breaches happen. So the breach is someone entering into your— call it the business ecosystem.

Yeah.

The attack is what they go after. We got to be ready to be proactive and defend ourselves. So if something like this kind of attack happens, we can reduce it or we can totally protect it. And that's what the question boards need to start asking is, are we doing proactive security in terms of are we proactively planning in terms of what are our business activities and what we are looking at? Because SEC wants you to tell them. The number 2, from an SEC perspective, they want you to say, show me how you're managing these risks. So you should be able to understand from your Leadership, show me how we are securing the critical part of business activities. If they disrupt it, they will have a material attack on my business results.

Yep.

Right? And the third thing is the board should be doing scenario modeling more in terms of how criminals can protect— look at their— how adversaries look at their business and what they come after, what all those scenarios can be. Just like they do business strategy scenario, they got to be doing cyber scenarios to build proactive defenses, not just proactive responses. We do a lot of work in respond and recover, which is easier, but proactive defenses take more strategic and governance. And that's where SEC wants— to me, what SEC has given is a board's weapon to really bring their company to start thinking more proactively about one of the biggest risks in the world to their company. Got it.

Proactive defense. I'll remember that. It's clear that cybersecurity is not just the IT's responsibility because of all the things you shared. So it's clear that cybersecurity is a business risk. So we need to incorporate that into the overall business strategy and decision-making process. So how can leaders do that, Michel?

It's a great question. So let me, I think we touched on those things. So let me start with giving you a little bit, I'll take a use case and this is real public data. So SolarWinds happened a few years ago. They were attacked. And the way criminals got in was it's a software company pushing software out to thousands of companies all over the world. Criminals got in, they put some malware into their software update process. So when the software got pushed out, 100,000 companies got that malware and criminals got the gate open.

Wow.

But when SEC investigated, one of the big questions they asked was, this is the software which drives 46% revenue for your company. Why this software's build process was not so secure that this should not happen.

But it was the key revenue source.

The revenue stream. So the question is, and we are seeing that, that whenever the disruption happens in last 12 months, only 11% companies reached back to the same level where they were before the disruption. So if you think from those 2 data points, When you bring the strategy to the table, everything is in those documents except the thing which is going to hurt it most, which is cyber. So what business needs to do is ensure cyber is sitting right next to the strategy table and you ask them their strategy to enable the business strategy while defending it so it can drive the business enablement and growth. But also prepare you proactively from any disruption down the line.

Got it. So what that tells me is that it requires a lot of collaboration across departments to make that happen. So how can you embed that into the company culture and build better cyber resilience?

I'll tell you what the root cause to make that happen. So it's an interesting question because the culture is the key as you know it. Marie, and I've followed your work, is culture can make and break the company. We hear culture will eat strategy, right?

Yes.

What's happening in the companies is, and this is something I learned when I talked to one of the CEOs, and I took, took this from him, which I loved it, because in a company, in a business environment, there are 2 types of people. There are sympathetic role people. These are people who are like fire and flight. Driving growth, addressing challenges like the CEO, the CFO, the business leader, the board members. And on the other side, we got parasympathetic role people who look at things like stability, protection. These are chief risk officers, chief information security officers. The challenge is the business is driving growth and they look at these risks and cyber as the department of no, and they don't bring them together. And what we need to shift is where we need to shift is we need to create a brain which drives it. And that brain is the CEO, the board. And what they need is a tool which is more a framework, which is a risk-based framework, which translates technology risk to business losses. And once you enable that, that will bring both sides to look at the problem, even if from their lens, but they're looking at the outcomes which apply to both.

Yes.

And to drive that change is critical. It is important that the business and the CEO drive that change. And what we have seen in some of the leading institutions to drive that culture, we saw this recently, Microsoft did it where As part of the bonus, as part of the overall salary structure, the business leaders should be also held accountable to ensure their business units are following the leading cybersecurity practices across their organization. And we saw Microsoft after recently SEC investigation, they changed, certainly they went in and changed the whole business model around the compensation for all its business unit leaders.

Mm-hmm.

We, and we are seeing that in leading companies. So, so part is building that framework which brings risk lens into how cyber is being deployed within the company to protect business losses. And number 2, enablement is really making it part of your organizational construct. So the level of accountability is tied to your performance review and your bonuses.

Yeah, so the framework can help bring people together and then you need to incentivize accordingly.

That's exactly right.

So we love leaving our listeners, Vishal, with some practical tips. So what are 3 concrete actions they should take today to strengthen the organization's cybersecurity posture?

I think we touched on pretty much all 3 and I'll try to summarize it very critically. First is Making sure cybersecurity is seen as critical component of business strategy and getting the cybersecurity team on the business table, strategy table. They should be part and parcel of every decision-making process into that whole thing. Number 2, asking your cyber team, show me the metrics which very clearly show how cybersecurity is prepared to defend our critical business activities against our risk tolerance. So this concept of risk tolerance and defending business activity proactively, that needs to tie together. And that's what they should be looking for. We don't want people say, hey, we want board members to become more cyber aware. Yes, all that is good thing. But in the end, board members' capabilities and the leadership, they're managing multiple risks, cyber risk, credit risk, market risk. This is just another risk among the top 2, basically.

Mm-hmm.

So they should be able to see from a business impact perspective how cyber is preparing to defend it, how it is going to make sure that financially, operationally, regulatory, reputationally-wise, we are going to be able to minimize the damage or make sure it doesn't happen. And the third biggest part, which we touched in the last collaboration piece, is ensuring that it is part of your organizational construct and ecosystem, that every business has to take the ownership of ensuring their business unit, their technology, their products are secured in a fashion which drives the mission of the company and enables the mission of the company and keeps it secured financially, operationally, and regulatory. And reputationally.

Insightful. Now, Vishal, this has been a masterclass in leadership-first cybersecurity, and you've made it clear that this isn't about firewalls, IT compliance. It's about safeguarding revenue, shareholder trust, and the very future of the business. And what struck me is the power of a framework, because with that framework, instead of chasing threats, you're equipping leaders to think like adversaries and act like strategists. So for our audience of boards and executives, this is the playbook for turning cyber risk into a boardroom superpower. So let's change the narrative. So thank you so much, Vishal, for being with me today.

Thank you so much for having me, Marie. I appreciate it. Enjoyed it.

If you want to know more about Vishal's approach, visit blueoceancyber.com. And for more resources on leadership, visit proteus-international.com. Thank you for tuning in, and until next time, here's to creating the leadership you truly want.

We hope you're feeling better equipped to create the career, the business, and the life you want. To find out more about how we support our clients in leadership, learning, and change, visit us at proteus-international.com. Have an excellent day, and thanks for listening.