9 Cybersecurity Questions that Define a CISO

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the questions every CEO should be asking their CISO and what the right and wrong answers are. And I'm going to be talking with Will. Klusowski. Did I get that right? I don't know. Klusowski. Yes. Will is a business advisor to cybersecurity and tech firms, a public speaker, and a host of the Keyboard Samurai podcast. Welcome, Will. Thank you for coming and talking with us.

Yeah. Yeah. Thanks, Matthew. Happy to be here. I love doing this kind of stuff and sharing my knowledge with the 5 people out there that want to hear it.

So, well, I really appreciate it, right? Because recently, You published this LinkedIn post and it was brilliant and it outlined 9 questions that every CEO should be asking a CISO. And then you broke it down in detail on what a good answer would be and what the CEO should be demanding of the CISO if they didn't answer so well. We'll just put it nice and politely that way. So before we get into it and we're going to pop those questions up and kind of talk about it. You know, why do you think this topic is important to our industry right now? What, what drove you to drive that post?

Yeah, it's, it's super interesting because, uh, the first thing, the first thing as far as like what drove the post and kind of that it's one of my content pillars and I discovered it because when I talked about technical to business translation. People responded. So, um, Social Media 101, if they like it, do more. So, you know, and, and, and me being somebody who came up in the technical world and really became an advisor and worked on the business side and like really good at like working between all the different business pillars, I was like, oh, this is, this is kind of easy for me to help. And I know it's a struggle for both the top and the bottom to kind of come together. So, um, that's kind of how it come out. I do a lot of content around, you know, what to say in the boardroom or to your director, manager, whatever, versus the technical thing and vice versa. And so that's really the antithesis of this, which I thought was, uh, intentionally like, as the CEO, what would I care about? And I'm like, well, what do they not know about? Right. Um, so that's, that's where it came out. And I think it's important because we are still in a world where yes, to some degree, the business branch of the, of the executive leadership team cares a little bit about cybersecurity sometimes, or as so much as they want it to go away so they can go on and do business. So I think it's a matter of helping elevate that information because there are real risks. And two, helping those of us who have kind of grown up in the industry who struggle because much like everything else in our field, the technical person gets promoted and never gets training on leadership or business. You know, most of us aren't carrying an MBA, or if we do, we got it way later in life, things like that. So trying to help all of those people who want to lead, not just get stuck banging their head against the wall.

Yeah, and I find it brilliant. I've been stalking some of your content out there, which is just, again, it's just awesome for— everybody should be following you and reading what you're posting and listening to that, again, that synthesis of the technical side and the business side, because cybersecurity is being elevated. The expectations are getting higher, and we've got boards and CEOs and C-suites that are finding difficulty in communicating and making sure that the business aspects are still being preserved, especially if they're talking with a primarily technical CISO that can't communicate in those business terms. You just get this chasm. So again, I love this. And so I want to jump to this real quick here. So let's go to the first one, right? Investment and ROI. You know, CISO being asked by their CEO about investment in R&I and where are we spending? Because it always seems that cybersecurity is just, it's a sink. You're just pouring water and money into it and you don't know where it goes. And, you know, is it making a difference? Is it not? You know, so cover for me what the right answer is here and what CISOs, and I'm going to extend that out and also say boards, right? What CISOs and boards should really be asking of that CISO to get them on the right track.

Sure. Yeah, the, the, the, this is kind of, this is a double-edged one, which is why it's the first one, because asking this question helps the CEO and the board as much as it helps the CISO because it provides a level of education. And that is a lot of people buy things because they think they should. They don't actually assess the risk and have some idea of what the impact is and are we spending money in the right places. And you'll see that theme kind of strewn throughout this entire thing because to the CEO and the board, it's, you have a mission, it's usually, you know, make money or serve constituents, like depending on the industry you're in, right? So if what you're doing in security doesn't help to do that and the things you're spending money on don't protect the ability to do that, then you need to rethink why you're doing things. And so from the CEO's perspective, it gives them a warm and fuzzy that they're spending the money in the right places. From the CISO's perspective, it allows them to say, well, I'd like to do that, but I need to assess this, or we haven't done this, or we need— here's how we get to that stage. And then again, through education, instead of going, I'm the technical person, you should listen to me, through that education, they can kind of come together.

And I see you're really pushing that risk-based framework, right? Because it all starts with, well, what are the risks? We don't eliminate everything, but at least figure out where the biggest issues are and then start aligning those funds, that investment to those big areas, right?

Right. And the neat thing, the neat thing, the great thing about having a risk-based approach is in that creation of that framework, how you're going to run the organization, you decide how decisions are going to be made. Like that's part of that, which is, you know, we're going to accept this level of risk. We're going to transfer this level of risk. We're going to assess this level of risk. And again, by both sides of the house kind of understanding, well, how are we going to make decisions? All right, it's risk-based. Well, what does that mean? And laying that out again, that helps ensure that everybody's talking the same language, even when they're not.

And you can't have that discussion. You can't talk about what's acceptable, right? We're not eliminating all risks. That would be way too expensive or probably impossible. Impossible. So it's a matter of finding that optimal level and you can't have that discussion if you don't have a risk assessment and communicate it in business terms. So again, awesome. I love the fact that you started off with that one. So that kind of leads into what are, you know, the priorities around all that. What do we need to look at from a cybersecurity perspective? And why is that important, right?

Yeah, so this is the one where the CEO is holding the CISO accountable. And again, there's mutual education happening here because as the CEO, I want to know that you've got a plan and we're working towards it and you're not just doing things willy-nilly, right? Do you have a roadmap of work that we're supposed to do? Is that, again, tied back to the risk? Is it tied back to how the business is running? And again, that helps the CISO understand the priorities of the CEO or the board or whoever you're talking to on the business side so that they can make sure when they're building business cases or investment cases that that stuff's aligned, right? You can easily say, hey, we're working on this project that's going to take 18 months and cost millions of dollars, but this is why, this is the impact it's going to have, right? And if there is no roadmap, then that's where the CEO needs to go, well, we need one, and help that CEO get the funding and or the availability, whatever it is that's required to kind of get that current state and desired state and make sure you know where you're going, right? Because if you're on a journey and you don't have a map, you're just going to run around.

I mean, cybersecurity is a long game. If you're just there to respond to what's happening, you're going to lose. You're going to burn out. You're going to waste your resources. You're not going to last. Whereas when you have a roadmap here, that gives that strategy. What are we investing in? How is that tied to those risks? How are we going to perform and optimize moving forward? The only question I have for you and my only criticism on this one, you know, it's require a roadmap. And again, if we're a technical CISO, we're looking at as, oh, a technical roadmap, right? These are the products I'm going to buy. Whereas I'm thinking it's not just what products you're going to buy. But what are the policies? What are the services? What are the business targets? What is the competitive advantage I'm bringing in? And that is part of the roadmap, not just the security toys and the shiny objects that you need budget for.

Yeah, and I talk a lot about that too. I always say it's programs, not projects, right? Anything you need that's technology fits into a program of some kind, right? If you're buying a GRC tool, You should have a risk management program with program managers and people assigned to it. And if you're putting a DLP tool in place, you've got data protection people, you've got boards making decisions. There's all of this, it's all programmatic. And a lot of times that's what the roadmap items may be. Hey, we are updating our identity and access management system to this, but that's part of our larger program for zero trust that's happening, right? So that should all be tied back to programs. I'm right with you, no shiny No chasing shiny keys.

Well, you can't just buy the black box, turn it on, and it just solves your problems. Come on. Okay. Biggest risk. Again, I love the mindset here because there are many risks, right? Unfortunately, some CEOs think, oh, I'm just worried about ransomware. I'm just worried about data breaches, or I'm just worried about regulatory non-compliance. That's the only risk, right? Or I'm just worried about those hackers, right? Whatever those are. And they just peanut butter it and think, well, your job is easy, right? And so even framing the fact that we're going to be talking about lots of risks, but now let's talk about the big one, right? I think goes a long way in conveying some of the complexity, around what we're doing. And I've been in boardrooms and coached CISOs many times. And one of my favorites is when they brought up the biggest risk actually being internals. And everybody stopped. They're like, what? It isn't the hacker? It isn't? No, no, no. Let me show you the risk assessment. So, you know, what are you looking for here as a CEO when you ask this?

Yeah, well, part of it is you want to know that the CISO has done a good job and actually knows what the biggest risk is. And isn't just saying it's ransomware because that's what it probably is, right? So that's the check and balance there. And then again, making sure you have clarity and understanding why, and this goes back to the first one. Okay, if that is our, if whatever ABC is our biggest risk, why is that? And then the CISO needs to be able to respond because if this system goes down, we can't serve our constituents, we can't create the widgets, we can't invoice whatever it is, and we know that that's a priority for the organization or this is a keystone system. And so again, it's making sure that they've done their homework and they actually know it is their biggest risk. So this one is a little bit on the accountability side for the CISO. But then again, there's education on the CEO side because they probably haven't thought about things that way. Because like you said, they're thinking, I'm worried about hackers or nobody's, you know, we're not worried about us because we're too small. And at the reality, doing a little bit of assessing, like, yeah, but we're connected to these 3 really big defense contractors and they'll, crush us if we get breached, right? That kind of stuff.

And I notice you mention a risk register here. Are you advocating the CEO come to the board, come to the CEO with the risk register and go, okay, well, here's all our risks. And what do you think on that? This is a trick question, by the way.

Well, generally speaking, I don't think the CEO is interested in the risk register. I think they want to know that one exists and again, how decisions are being made. And what that is, is that's a tool for the CISO because those of us in the consulting world who've ever done any assessment ever, when you show up to the board of the room to present, as soon as you turn the slide on, somebody ultimately interrupts and goes, just tell me the top 3 things I need to do. Right? And that's what this is, right? This is the CISO saying, hey, this has been the top priority on our risk register for 6 months, 18 months, 24 months, we haven't done anything about it. You continue to accept and/or ignore the risk, whatever, right? So that's the tooling there.

Perfect. Perfect. And I love that. And it is a great internal tool. I think that looking forward, we're going to evolve past basic risk registers and get a little more in depth. And, you know, when I talk with CISOs, you know, I tell them, hey, come in with a story. If you're going to talk about the top 3 risks and don't, Dare put up the risk register, right? Don't just say it's ransomware, right? You need to talk about who the threat agents are, what their motivations, what their targets are, what their typical methods are, what kind of controls you have to mitigate and where you're weak. And then what's the business impact if they, you know, succeed? And that's your rich story that you can communicate in business terms. And everybody loves a story. Right? If you just say the biggest threat is hacker, everybody's view of hacker is something different. So as the expert, you have to come in and be that astute storyteller to convey the risks in a way people understand and can relate to them.

Yeah, it's funny and interesting because I have another carousel that is basically how to present to executives. And that's the key thing is right there. Take your data and turn it into a story. And if the story can be about you, it's going to resonate. And, you know, to take the marketing flip, you know, if you can show a use case, a real-world scenario, like proof is very hard to ignore. And if you can say Lapsus$ is targeting healthcare organizations and we're one that, you know, and they're attacking this ERP system that we also have, and this is the bad thing that happened over there. We don't want that to happen here. Like that's a story that people are going to lean in and listen to and then want to ask questions about.

And they can understand that, right? Even if they don't understand the technical elements of how this other company got hacked or how this competitor suffered, they can realize, well, hey, they're our competitor. They probably have the same similar systems or the same systems we do and the same processes. And yet, wow, you know, they just got smashed. We don't want to be like that. So, regardless of whether they understand the technical aspects or the fine nuances, it can relate to them.

Yeah. So I do have to caveat, never sell on fear. No, no FUD, no fear, uncertainty, and doubt. This is a story that is relevant. I hate anybody that's selling with— as an executive and every one of the CISOs that you've probably known, if you come at me with fear, I'm immediately dismissing that you know anything what you're talking about.

And let's dig into that because I think it's great. It's a great topic and I hate it. When CISOs go in there and it's normally junior ones and they're using the fear, uncertainty, and doubt. And the reality is it works the first few times. You're going to get a bag of money, but then the expectation is, well, you fix the problem. Security is fixed, right? And no, you're going to keep coming back with more fear, more fear, and they get tired of it very quickly. And then they realize you're just incompetent and you've burned your credibility. So if we have to resort to just fear tactics, it is a sign that we don't understand our risks. We can't explain them and we can't put together a good perspective that articulates it in a way. Yes, there will be fear, but we don't lead with that. We lead with risks. We show consequences. We give options for resolution. Right? Or some level of mitigation. There is fear underneath that because they don't want bad things to happen. Well, it's— But you're not leading with it. You're leading with your expertise.

That's it. It's risk-based, man. It's not fear-based.

Yeah. Blind spots. What are you talking about here? You want to know what I can't see? What kind of absurd question is that? Walk me through this.

This is again, you know, CEO holding CISO accountable. Like, have you thought about all the stuff you haven't thought about yet? That's really what it comes down to. You know, I look at the last couple, and this probably came out in the last couple of, last 5 years or so when attack surface tooling became much more useful, advanced, and relevant. And, you know, we are now seeing a shift that the mature way as an organization to look at cybersecurity is from the attacker viewpoint, not internally, right? We built our castle walls and we patrol our walls, but now we need to be looking at it from the bad guy, bad person point of view.

Every serial, yes.

Yeah, so that's kind of what this came down to because so many people are like, well, we have all of this in place, our walls are great, you know, we patrol the walls, I look and there's no holes, but if you go outside the gate, there's a, you know, a server that's misconfigured that's left there from some M&A acquisition from a name that you don't even have anymore, but it's still got data you're responsible for. It's out there, right?

That never happens. No, never, never. Real world thing.

Hey, we found this PII box. Do you want to do something about it? So that's the reality. And again, taking this, this is going to feed into your vulnerability management program, your third-party risk, like everything, just kind of taking a look at like, okay, just because you're sort of checking the internal boxes, but are you looking at everything? Have you really thought about all that other stuff that maybe you haven't?

I love this question because it tells me two things. If I'm a CEO, it tells me if my CISO is overly arrogant, because if they say, oh no, we got it all taken care of, we, you know, it's fine. You know, we know what vulnerabilities we have. We know this, that, and the other. We don't have a blind spot. I know they're incompetent, number one, right? Because there's so much we don't know. And the other thing, right, is really about being able to do what you were saying, right? To be able to see it from an adversarial perspective. And that will tell me that they're not just responsive, that they're proactive to some extent. If they say, hey, we do this stuff really good, but the attackers are starting to move here and they're starting to go into AI and they're starting to do this, Right. We're going to have problems there. I already know that. Right. I'm thinking, yes, my CISO is thinking 2 or 3 steps ahead instead of just being a fireman putting out fires after they're being detected. So, you know, I do like this question as absurd as it is. Right. We don't know what we don't know. So tell me about it. Yeah. What?

I always—

I think it can be very insightful for CEOs to understand the maturity level of their CISO right off the bat.

100% agree with that.

All right. Walk me through this one. Accepted versus unknown. Yeah.

This is funny because I just chatted with somebody else yesterday or so. I think another podcast about how ignored risk is just accepted risk.

Yeah.

Right.

You can accept, transfer, you can mitigate.

You can pretend it's not there and stick your head in the sand, you know, but that doesn't mean it's not there, right? This is really a matter of, and again, this holds both sides accountable and does some education because I think there are a lot of, probably a lot of CISOs who may not know all of their risks and haven't communicated those up. And then, you know, vice versa, the CEOs haven't seen all that and been able to make a decision, right? We talked about this at the beginning. Our role as security practitioners is to find the risk, quantify it somehow, and then tie options to it. Here's best case, worst case, cost for that to mitigate, transfer, all that stuff. And then the business owner makes a decision on that and says, well, all right, we said we're going to choose risk-based approach. This is low risk and high cost. So we're going to just accept that, right? And go down that path. So this is really a matter of making sure that You know, this is all building, right? Now we know our risks. We understand what the costs are and we haven't ignored things just because, right?

Out of all the 9 questions, as a CISO, this is the one I want to be asked because it is an opportunity because you say we, what risks are we accepting? The reality is if you're CEO or you're the board, You're accepting that, right? You get to define. If you say reduce the risk by half, I own that. I'm accountable. You're going to measure me against that. But if you say, nope, I'm good with that. I'm fine with that M&A box outside the walls and it's got some of our IP on it. I understand the risk. You've made it clear. You quantified the risk and I'm okay with it for whatever reason. And it could be legitimate or not. They're the owner, they're the shareholder representatives, whatever. They get to make that call, whether we agree with it or not. We just execute that. But I want them to know what risk they have accepted. Now I'm gonna put my 2 cents in and go, I think we're idiots because we're accepting this. It really should be brought down here. You know, it's your call, your call. But if it breaks, it's your call, it's your call. I've documented it, you own it. And when the shareholders or the SEC comes in or the investigators come in, this is the email and the presentation that I'm going to be providing that the company knowingly, willingly accepted this risk.

Yeah.

And I was going to say— Please ask me this question as a CISO.

I was going to say, that's the key. Document it.

Yes. Document it.

There's several real-world examples in the last year or so that proof that you need to document it.

If it's not documented, it didn't happen, which means you're on the hook. So business resilience, you know, we've talked a lot about it and the industry has really shifted, right, to not only prevent but also be resilient overall. So when things do happen, still prevent, right? Still detect. But as part of that response, you want to be able to bring things back up. So definitely, I think a question that the CEO needs to ask because there may be some hidden nuances here, right? So walk me through what you think a perfect CISO answer is, given the fact that we don't know what we don't know, given the fact that there's a whole bunch of different risks, right? And you're not going to have 6 hours to explain all the different permutations. What's that perfect answer?

Yeah, the right answer for this is, you know, we've done a business impact analysis. We know what systems have to be brought up first and in what order. We have them backed up. We've actually tested and restored them and recovered them on a regular basis. Not just the database, not just one of the operating systems. We've actually rebuilt the, you know, yada, yada, yada system that makes all our money and it comes up to work. That's the answer you want to be able to give. And this is one that, like, from the CEO perspective, this is really the most important thing. You know, I hate to say that it's not if, but when thing, But it is like, that's the world we live in. And that's why resilience matters. And so many organizations I'm talking to today, like this is a huge, like DR and BCP is like very big deal. Like, you know, are really worried about it and they should be. But the other part of this is, you know, the helping the CISO out is have you done the business impact analysis? Do you know what critical systems are? Because just doing that gets you so much other informational data, like data flow diagrams and business process flows and, you know, kind of ownership of other things and insight into how things are actually operating and running. Because that's the biggest risk here, I think, is in my experience, there's 3 ways everything is done. There's the way it's documented, there's the way that management thinks it happens, and then there's the way it actually happens. So anybody who's ever done an assessment has gone in and said, hey, I need to talk to you about your, you know, PCI process. Cool. Bob does that. I get Bob. Bob in the room, I ask him 2 questions. Now Mary's in the room and then she's like, well, Joe does this. And then best thing, next thing I know I have 15 people because that's the actual real process and that's never been documented. Now that system blows up and you have to rebuild it and all those people aren't necessarily available. Now you've got a really, really, really hard thing to recover and rebuild from, or when it should have been very easy if it was documented right.

Yeah. And, and I love the fact that you said, here's the proof. Because it's one thing to theorize about it. And as you said, those three states, right? That first state is when the system was originally built 10 years ago, this is how it's configured and the dependencies, right? It's no longer, you know, true. Everything changes so fast. So, you know, here's the proof. We did it 6 months ago. This is what we're able to do. The one other thing I would add in here, and I'm actually going to lean into the next question, is I like it when CISOs also come back and say, hey, we've done this test and we've incorporated our third-party vendors and suppliers. We're working with them when we do these tests. That from a CISO's ears, that should be golden. Your CISO walks on water. If you're a CEO and you hear that from them, because that's again leading into this next one here, right? Third-party risk. And if you have such a good relationship with your third parties and the CISO knows them and has not only vetted them but has an ongoing relationship sufficient enough that they're going to work and partner as part of an exercise. Oh, oh, good things. Very good things.

Very choice. Yeah, that you really, really do want that. Like you said, they walk on water, they've done all the right things, that's perfect. Because having them involved, I mean, that's the, you know, doing a tabletop exercise and having the responders in the room and the executives and your critical third-party supply chain people. I mean, that's the holy grail of incident response tests right there.

Yeah, I agree. I mean, do you think this particular question would have come up 4 or 5 years ago?

I mean, I would have brought it up, but— well, it's funny because there's third-party risk, supply chain risk, vendor risk. It's all the same thing. And I think we've— I mean, I'm pretty sure vendor risk has been on ISO 27001 for all of its iterations to some degree, right? You at least had to have them sign a document that says you're going to protect the data I give you to the same degree I did. But yeah, we start seeing supply chain, you know, things break down. So I think this is really, again, showing that the CISO also has the support he needs because again, third-party risk is not a tool. There are tools out there that help you do it. And thank God these days there's automation and AI takes a a lot, a lot of stress off of the individual GRC consultant running this stuff. But you can't, you can't just make that tool the thing and have it go. You still need a program manager that's got all this and you have to tier things. Like I knew a healthcare organization of like 10,000 vendors. You can't assess every one of those vendors the same way. So you have to have a, here's the quick ones with the low risk. Here's the ones. So again, as the CEO, you know that your CISO has done the work. To say, you know, to look at those vendors in the right way, to assess them and, you know, again, ideally protect you to the most cost-efficient way possible, right? You know, spend the right amount of money to protect the right vendor, the right risk.

Yeah, and they should have a vendor list, right? Just like you've got your risk, you know, they should have that vendor. What data do they have? How dependent are we? You know, all those things. Who are the contacts? Attacks and all that. Okay, so client market lens, right? What would our key clients or investors want to know about cybersecurity? So you're starting to blend into the transformational value that we're seeing in the industry right now where security not only protects but is also adding some kind of business advantage as part of the value proposition, which really makes swallowing that we need more money pill a little bit easier to go, Down. So what would you like to hear from your CISO when you ask them this?

Yeah, if you're asking, I think, you know, being told we are compliant with XYZ, which now gives us a differentiated advantage against most of our competitors, right? We are carrying a high level of maturity in and above our industry. Which makes us incredibly legally defensible if something happens. That's something I learned working with, like, you know, building your program, not just to the bare minimum, like compliance is the floor, right? You want to build up. If you, you want to be in a place where if the insert acronym, you know, takes you to court, Congress, whatever, you know, your, your geographic region requires you to be in at whatever point you've done something wrong, potentially. You want to be able to say, we've done everything possible and then some. Look, we are better positioned than everybody else in our industry or everybody else in this higher regulated industry, right? So it's about having the knowledge that your cybersecurity program is not just about you. And I say that as the CISO, right? We all kind of get caught up in our, we're superhero, secret squirrel, save the day kind of people. We come to work every day fighting the enemy. Which is also not true. But you want to know that we've thought about, hey, the company has a job to make money and/or to serve some constituents and do good things. And we are aware of that and we are making them better able and able to do that.

And again, if we talk about that CISO that walks on water, I would want them to start answering this question by saying cybersecurity is supporting the corporate business goals in the following ways, right? Just, you gotta tie it to the business goals and whether that's revenue, whether that's servicing a constituency, whatever it is, start with that. And then the next thing they should be saying is, and I'm working with the frontline business groups, right? I'm working with the profit centers of the company, the VPs of these groups, and we're exploring how cybersecurity can be a competitive advantage, how it can help them with their margins, how it can drive good better, best marketing strategies, right? And have the vernacular, right, to be able to convey value in a business perspective to your CEO, to your board, and to the rest of the C-suite. And when CISOs are able to do that and they execute to that, they don't even have to answer this question because it's going to be those VPs from those profit centers that are telling the CEO, yeah, yeah, security's helping us. We're adding this in. We're going to have 3 better security features that we can market than our next two competitors. Oh, by the way, security is going to allow us to go into the European market because we're going to be able to comply with all the privacy stuff next year. That's what you want. You want those profit centers who are bringing in money, you're not, right, to really advocate for security because they see the business benefit. You do that, write your ticket.

That is it. Spot on.

Future threats. This goes back to what you don't know. This, uh, So again, very, very important because we, you know, our industry is not static. It isn't. And we have to deal with those intelligent adversaries who can be smarter than us, have more resources than us. Right. And we have to adapt to them. They maintain the initiative. So we're responding to them in many cases. So given that challenge, what should a CEO be looking for when the CISO is talking about future threats?

Yeah, this is a good one that I probably seeded for the CISO a little more than the CEO, because what this does is if your roadmap is woefully behind and dragging and you can't deal with today's threats, the CEO thinking about what's going to be the future might provide a little more care in their minds. The other part of this is technology advancements. And that's just not in our space, right? If there's some new advancement in fintech or healthcare or in payroll or HRIS systems or whatever, like if there's big changes coming in the systems that you're meant to secure, like that's the other thing you have to think about, right? Remote work is a good example. Like I don't think we would have predicted that necessarily, but like Those were things that people didn't necessarily think about before. And now you've got all the AI stuff, which is obviously just exists. So that's where I say it's a little different than, yes, it's what have we not thought about, but this is also to, you know, your walking on water CISO analogy. They're going to be thinking about the future of the business, not just the current state. Like as a consultant, that's always what I wanted to do. If somebody comes to me and says, hey, can you do this? I'm like, yeah, that's fine, but I'm more interested in what are you doing in 3 to 5 years from now so that my roadmap keeps up with you because I'm, you know, I'm here to serve you. And so I think you can do the same thing as the CISO for an organization, especially an organization that's going to be moving and adapting quickly. I mean, I look back at like what retail and finance did during metaverse, right? How much crazy stuff was happening. Once you started doing multi-channel sales and retail, once people start selling on TikTok or started using consumer-level credentials, you know, to get access to, by, you know, doing B2C credentials, things like that. Like all those things happened really, really quickly. And I don't think we always saw that coming.

Yeah, it makes a lot of sense. And really understanding the disruptive technology out there, right? AI right now is huge, not only from companies adopting it, potentially bringing in more vulnerabilities and bypassing your traditional security controls. Let's not worry about that. But the attackers are using it as well, right? And defenders now need to use it as part of their tooling set. So, you know, you've got AI, you've got quantum, you've got distributed computing, you've got all sorts of different disruptive technologies that will fundamentally change the chessboard underneath your feet. And you got to be thinking about that, right? Otherwise you're not seeing, you know, you're in the middle of the freeway and you're not looking to see what truck's coming behind you. You're just watching the cars that have already, already gone past going, "That was close. Oh, I dodged that one." You're not seeing the semi-truck coming up behind you. So you got to be looking forward, you know, in the future. So these are all awesome, awesome, awesome stuff. So I'm going to put the link for the LinkedIn post in there. Two more questions for you, right? For many cybersecurity leaders, what we just saw They're not easy questions to answer, right? There's a lot of work that has to go to even get the information. And then you have to learn how to communicate that and translate it from cybersecurity speak into business risk language. So where do you think CISOs should start?

Are you asking to start to be able to do that translation?

To be able to answer all those questions, right? To be able to be that walk on water. I mean, where do you think they should start?

Yeah, I mean, this is, for me, it's pretty foundational. It's how you build a cybersecurity program is to do it right. You know, pick a framework, get your compliance requirements you have to be compliant with, get a framework picked, find your current state, develop a desired state, get everybody on board with that. You know, there's a whole, I do a whole class on how to build a cybersecurity program and there's like 20 minutes on one slide that just walks you through all that process of you got to get the business mission and then you got to figure out, okay, how do we fit into that business mission? Great. Now, how are we going to make decisions about risk? And for CISOs, like that means not just putting it on paper that we're going to make risk-based decisions, but also going, how did they make decisions in the past? Who are the influences in the company that I have to make sure are on my side? Who can get in the way and make sure nothing ever happens? There's politics to it. We hate to say it, but like that, you know, getting the lay of the land and building an overall strategy. And then it's all about assets. Do you even know what you have? If you don't know what you have and you don't know the impact and the criticality of it, then everything else you're doing is just guessing. So you put all of that together and then again, current state, desired state, and that desired state, you know, can be based on any number of things, right? What the legally defensible thing, the, you know, I want to achieve these type of compliance so that I can win this business. But, and then get everybody to agree upon it and then it's execute and reevaluate on a regular, regular basis.

That's awesome. That's awesome. So last question here. What do you suppose is the outcome if a CISO answers these questions well versus the CISO who answers them poorly? What do you think are the— compare and contrast for me what you think is going to happen.

I think that's vastly dependent on the CEO that's asking, because if this is someone who is, if you can't answer all the questions and you've never been told, no, you can't have budget and you've just kind of, you know, flew under the radar, then this is going to highlight the fact that you may not have been thinking about the things you should have been thinking about. However, if you're in an organization where maybe you've done some of this stuff and you keep being told, no, we don't have any money. No, we don't have any money. Then those questions will actually hopefully educate the CEO more to be like, oh, this is why this is important. The whole intent behind here, the reason I have the CEO asking these questions, because CEOs don't think about this type of stuff. They don't usually care. So the goal here was to show how security impacts the actual business so that you can think about it differently instead of just having the CISO come up and go, hey, I need these new shiny toys. Right.

Great insights. Great insights. Will Klusowski, a business advisor to cybersecurity and tech firms and host of the Keyboard Samurai podcast. Be sure to check that out. I will put the link in the description there. Thank you, sir, for sharing your insights and publishing content like this for everybody to absorb, understand, and discuss.

Appreciate it, Matthew. It was great. I love talking about this stuff, so I'm happy to engage. That's what the content's for. Get in the comments and I'll, I'll, I answer everything. It just may take a while.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders on interesting topics and best practices in the industry. Thank you very much. See you next time.