Subscribe now

Stefano Pasotti, CISO and ICT Manager at DN Automotive Italy, brings a pragmatic perspective to cybersecurity shaped by years of experience across software development, IT leadership, manufacturing, and logistics. In his role, he oversees cybersecurity, infrastructure, and digitalization initiatives across European operations, where technologies ranging from WMS and production planning to EDI and IoT must work securely and reliably.

For Pasotti, effective security is ultimately about making better business decisions. His approach emphasizes measurable risk reduction over flashy tools, practical incident readiness over compliance theater, and clear communication that translates technical risk into business consequences such as production downtime. In this edition of CISO Tips, he shares his principles for evaluating security investments, preparing teams for incidents, working with vendors, and leading security programs with discipline and reflection.

Complete this sentence: “Before you buy any new security tool, first...”

...I ask myself how much it actually reduces our risk percentage, how much it really makes us safer. Is it a necessary move, or just a ‘cool tool’?

What’s one rule you enforce on your team that other teams would find strict?

Document everything. An experience that isn’t written down is an experience lost.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

Training before tools, always. It only takes one wrong click to waste a thousand technology solutions.

What’s one line that works when asking the board or CFO for a budget?

I put risk on the table, not the tool. How much risk is the company willing to take? How much downtime can we afford, and how likely is it to actually happen?

What should a CISO cut from their program tomorrow with zero regret?

Some certifications that only exist for the plaque on the wall. If they change nothing in practice, they’re just time spent — not security.

What’s your 60-second test for whether a vendor pitch is worth your time?

“If they throw around technical jargon at random, or bombard me with overly detailed questions that make no sense at this stage, I know right away they haven’t listened. Same if they show no interest in understanding who we are and what we do before pitching us something: they’re not selling a solution, they’re selling a script.”

What’s one meeting, report, or process you eliminated, and what replaced it?

I rarely eliminate; I prefer to rebuild. The latest case: incident response policies and runbooks that only existed on paper — I rewrote them to be truly operational, not just a compliance exercise.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Stopping to think. Speed is critical, so the temptation is to act immediately — but acting without a moment’s reflection can cause more damage than the incident itself.

What’s one question every CISO should ask their team this week?

If it happened right now, would we actually know what to do, or would we be improvising?”

What’s a phrase or framing you use to translate a technical risk for executives?

I translate everything into production downtime. Once the risk is clear to everyone, then we talk solutions.

What’s your best tip for surviving the CISO role in exactly five words?

Stop, reflect, then take action.

Subscribe now

Subscribe now

Cybersecurity leadership is rarely about having the most tools or the most elaborate security program. For Jörg Scheiblhofer, Chief Information Security Officer at ORF, effective security starts with understanding the organization’s requirements, processes, and actual risk before deciding which technologies or controls are needed. His approach emphasizes analytical thinking, consistency, and a clear understanding of the potential impact of security decisions.

In this edition of CISO Tips, Scheiblhofer shares his perspective on making better decisions under pressure, communicating cyber risk to executives through relatable analogies, and avoiding assumptions during critical incidents. From assessing the real situation in the first minutes of an attack to tailoring risk discussions for the board, his advice reflects a practical philosophy: strong cybersecurity requires sound analysis, clear communication, and a human approach.

Complete this sentence: “Before you buy any new security tool, first…”

…you have to think about process and your requirements “

What’s one rule you enforce on your team that other teams would find strict?

There are no exceptions on suspicion without an analytical basis and certainly no general exceptions.

What’s one line that works when asking the board or CFO for a budget?

It is not a single sentence; rather, it is a presentation, tailored to the target audience, of the risks that exist or may arise if measures are not implemented.

What’s your 60-second test for whether a vendor pitch is worth your time?

Has he dealt with his potential customer?

What’s one meeting, report, or process you eliminated, and what replaced it? -

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Accurately assessing the actual situation. In the heat of the moment, this is often overlooked. What’s one question every CISO should ask their team this week?

What’s a phrase or framing you use to translate a technical risk for executives?

I like to use the creation of analogies from everyday life. In a way, a language in pictures, so that management can imagine something better.

What’s your best tip for surviving the CISO role in exactly five words?

1.) remain consistent 2.) adopt an analytical approach 3.) tailor communication to the target audience 4.) assess the risk and potential damage 5.) remain human

More tips from the series:

• CISO Tips: Maurizio Imperadore on Resilience, Identity and Cutting Security Noise

• CISO Tips: Jigar Shah on Buying Fewer Tools, Building More Trust

• CISO Tips: Andy Curtis on Turning Cybersecurity Into Business Risk Decisions

• CISO Tips: Carlos García Batista on Turning Cybersecurity Into Operational Resilience

• CISO Tips: Sergey Tairyan on Thinking Like an Attacker and Leading Through Cyber Risk

Subscribe now

Subscribe now

Maurizio Imperadore, Head of the Cybersecurity Team at Connect S.p.A., brings a network engineering background to the CISO role, with experience spanning telecommunications, network design, Cisco and HP systems, and Session Initiation Protocol (SIP). His approach to cybersecurity is grounded in operational resilience: making the most of existing security investments, maintaining strong identity controls, and ensuring security decisions are tied to business continuity.

In this edition of CISO Tips, Imperadore shares practical lessons on where security teams should focus their time and resources. From enforcing zero exceptions on MFA to replacing lengthy risk reports with a single-page executive dashboard, his advice centers on reducing noise, communicating risk in financial terms, and building a security program that protects the operations the business depends on most.

Before you buy any new security tool, first…

Ensure you are fully utilizing the native security capabilities of your existing stack.

What’s one rule you enforce on your team that other teams would find strict?

Zero exceptions on MFA and identity verification, even for emergency admin actions.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

The 80/20 rule: 80% on core operational resilience and visibility, 20% on new security innovation.

What’s one line that works when asking the board or CFO for a budget?

“This isn’t an operational expense; it’s the cost of keeping our core revenue streams online.”

What should a CISO cut from their program tomorrow with zero regret?

Outdated annual compliance training that tick boxes without changing user behavior.

What’s your 60-second test for whether a vendor pitch is worth your time?

If they can’t clearly articulate the specific problem they solve without using buzzwords in the first minute.

What’s one meeting, report, or process you eliminated, and what replaced it?

Eliminated lengthy monthly risk slide decks and replaced them with a dynamic single-page executive dashboard.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Pausing to establish clear incident roles and dedicated communication channels before touching systems.

What’s one question every CISO should ask their team this week?

“Which alert or process is generating the most noise and wasting your time?”

What’s a phrase or framing you use to translate a technical risk for executives?

Translating technical vulnerabilities directly into financial downtime: “If X fails, core operations stop for Y hours at a cost of $Z.”

What’s your best tip for surviving the CISO role in exactly five words?

Prioritize relentlessly, delegate, rest daily.

More tips from the series:

• CISO Tips: Jigar Shah on Buying Fewer Tools, Building More Trust

• CISO Tips: Andy Curtis on Turning Cybersecurity Into Business Risk Decisions

• CISO Tips: Carlos García Batista on Turning Cybersecurity Into Operational Resilience

• CISO Tips: Sergey Tairyan on Thinking Like an Attacker and Leading Through Cyber Risk

• CISO Tips: Kristin Lowery on Turning Security Activity Into Measurable Risk Reduction

Subscribe now

Subscribe now

For many security leaders, the biggest challenge isn’t keeping up with the latest threats; it’s ensuring cybersecurity remains aligned with business priorities. Jigar Shah, Chief Information Security Officer at Medusind, believes the most effective CISOs are those who focus less on accumulating security technologies and more on solving real business problems. Drawing on more than two decades of leadership across healthcare, financial services, banking, retail, and consulting, Shah has built his career around connecting cybersecurity, technology, business strategy, and governance.

In this edition of CISO Tips, Shah shares the principles that shape his leadership approach, from evaluating vendors based on business outcomes rather than product features to eliminating “security theater” that adds complexity without reducing risk. He also explains why trust, not technology, is the foundation of every successful security program, and why CISOs should spend far more time preventing tomorrow’s incidents than reacting to today’s.

Complete this sentence: “Before you buy any new security tool, first...”

“...understand the business problem you’re trying to solve.”

Technology should never drive strategy. If you can’t explain the business outcome in one sentence, you probably don’t need another security tool.

“Buy fewer tools. Solve more problems.”

What’s one rule you enforce on your team that other teams would find strict?

“Never bring me a security problem without at least one business-focused solution.”

I don’t want my team to be known for just identifying risks. I want them to be known for enabling the business safely.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I follow a simple rule: 80% enabling the business, 20% fighting fires.

If I’m spending more time reacting than enabling, we’re investing in symptoms instead of resilience. Spend 80% preventing tomorrow’s incidents or issues that can become an incident and 20% responding to today’s.

What’s one line that works when asking the board or CFO for a budget?

I’m not asking you to fund cybersecurity; I’m asking you to protect the business strategy you’ve already approved. That changes the conversation from cost to business enablement.

What should a CISO cut from their program tomorrow with zero regret?

Security theater. Anything that looks impressive but doesn’t measurably reduce risk or improve resilience. Examples include reports nobody reads, meetings without decisions, and controls that create more friction than value.

“If it only checks a box, cut it.”

What’s your 60-second test for whether a vendor pitch is worth your time?

I ask three questions:

1. What business problem do you solve?

2. Can you prove measurable outcomes? Give an example of how you turned things around for your customers?

3. Why are you different from the ten vendors I met this month?

If they answer with features instead of outcomes, the meeting is probably over.

“Features sell products. Outcomes earn meetings.”

What’s one meeting, report, or process you eliminated, and what replaced it?

I eliminated long weekly status meetings. We replaced them with a live dashboard and a 15-minute decision meeting. The goal isn’t to exchange information. The goal is to make decisions and have an action plan with outcomes.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Defining who’s making decisions. Everyone starts investigating. Very few establish clear incident command. Without decision ownership, technical excellence becomes organizational chaos.

What’s one question every CISO should ask their team this week?

“If you were attacking us tomorrow, where would you start?” It changes the conversation from compliance to adversarial thinking.

Alternative: “What are we doing today simply because we’ve always done it?”

What’s a phrase or framing you use to translate a technical risk for executives?

I rarely talk about vulnerabilities. I ask: “What happens to revenue, customers, operations, or reputation if this control fails?” Executives don’t invest in CVEs. They invest in protecting business outcomes. I frame it in business results, risks, and revenue.

What’s your best tip for surviving the CISO role in exactly five words?

“Build trust before a crisis happens.” Because that’s really the essence of the CISO role. Technology changes. Threats evolve. But the ability to build trust with executives, employees, customers, regulators, and your team is what ultimately determines your success.

More tips from the series:

• CISO Tips: Andy Curtis on Turning Cybersecurity Into Business Risk Decisions

• CISO Tips: Carlos García Batista on Turning Cybersecurity Into Operational Resilience

• CISO Tips: Sergey Tairyan on Thinking Like an Attacker and Leading Through Cyber Risk

• CISO Tips: Kristin Lowery on Turning Security Activity Into Measurable Risk Reduction

• CISO Tips: Paul Blahusch on Business Success Coming First

Subscribe now

Subscribe now

Andy Curtis is an experienced cybersecurity leader and CISO with a background in information security implementation, architecture, and strategic security programs across government, finance, and enterprise environments. As CISO at Gadget Access, he has worked across frameworks including ISO 27001, NIST, and Essential Eight, helping organizations strengthen their security posture while aligning cyber initiatives with broader business priorities. His approach combines hands-on technical expertise with a strong understanding of risk, governance, compliance, and the realities of operating security programs at scale.

In this edition of CISO Tips, Curtis shares a practical perspective on making cybersecurity more effective by connecting technical decisions to measurable business outcomes. From avoiding unnecessary security-tool sprawl and translating vulnerabilities into executive-level risk, to testing incident response plans and proving that backups can actually support recovery, his advice centers on one core principle: security teams should focus less on collecting tools and metrics and more on reducing material risk. For Curtis, that means learning to communicate in the language of business, making informed trade-offs, and ensuring that cybersecurity decisions ultimately support the organization’s ability to operate and recover.

Complete this sentence: “Before you buy any new security tool, first...”

...prove it will reduce a material risk—and prove you can operate it.

The license fee is only the admission price. The real cost includes implementation, integration, data ingestion, training, tuning, support, additional infrastructure, operational headcount and the time required to investigate whatever the new dashboard turns red.

I am a supporter of best-of-breed technology when an organization can afford best-of-breed integration and operations. Otherwise, you can end up with several excellent products collaborating mainly through their invoices.

Sometimes a well-integrated platform delivers a better overall outcome than a collection of individually superior tools with gaps between them. Equally, consolidating everything onto one platform simply because the vendor has an attractive bundle can introduce lock-in and concentration risk. The right answer depends on coverage, interoperability, operational maturity and the risk being treated—not which logo appears highest on an analyst diagram.

A vendor-sponsored 2025 survey of 1,000 executives found that participating organizations were using an average of 83 security solutions from 29 vendors. That does not prove platforms are always better, but it does confirm that integration overhead is not something CISOs have collectively imagined after too much coffee.

The CISO’s job is not to assemble the most impressive security-tool collection. It is to achieve the greatest sustainable reduction in risk for the money available.

What’s one rule you enforce on your team that other teams would find strict?

Everyone in the security team must be able to explain their work in business, executive, and risk language.

I do not expect every analyst or engineer to become a miniature CFO. I do expect them to understand the business service they are protecting, the risk scenario they are changing, the consequence of doing nothing, and the decision required from management.

“We have 4,700 vulnerabilities” is information.

“Three internet-facing vulnerabilities create a credible path into the customer payments environment, and the remediation owner needs an approved outage before Friday” is decision support.

A technical finding without business context is unfinished work.

This is not about dumbing down the technical truth. It is about expressing that truth in the operating language of the audience. Executives generally think in terms of objectives, exposure, obligations, trade-offs, money, customers and accountability. Security professionals should be able to move between those concepts and the technical detail without losing accuracy in either direction.

Current ASD guidance explicitly treats business acumen, communication and relationship-building as core CISO capabilities, and expects cyber reporting to translate security issues into operational, financial and legal risk. I apply that expectation across the team rather than reserving it for whoever attends the board meeting.

CVSS 9.8 may be technically correct. It is rarely a complete executive sentence.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

My starting ratio is 50:50.

Roughly half of the program should be driven top-down by material business risks: critical services, crown-jewel data, regulatory obligations, credible threat scenarios and the consequences the organization genuinely cannot tolerate.

The other half should be driven bottom-up by operational reality: unsupported systems, excessive privileges, weak configurations, failing backups, poor asset visibility, incomplete logging and all the low-hanging fruit that has somehow remained on the tree for six budget cycles.

The top-down half prevents the security team from becoming extremely efficient at fixing the wrong things. The bottom-up half prevents the enterprise risk register from becoming a beautifully formatted description of controls that do not actually work.

NIST CSF 2.0 reinforces this linkage: practitioners implement and measure risk treatment activities, while executives integrate cyber risk information with the organization’s wider enterprise risk decisions. Both views are necessary because neither strategy nor telemetry is sufficient by itself.

I use industry spending benchmarks and breach-cost studies as reasonableness checks, not as allocation formulas. “Our peers spend 12 percent” does not tell me whether our identity architecture is sound, whether our backups restore or whether half the estate is running on something last patched during the Howard government.

The ratio is a compass, not a religion. It should move as risks, maturity and business priorities change. Incidents, in particular, have very little respect for resource-allocation models.

What’s one line that works when asking the board or CFO for a budget?

“It is cheaper than one material breach every five years.”

That line gets attention. It does not, by itself, earn approval.

The next slide needs to contain the arithmetic: the credible scenario, the business services affected, the potential outage, the likely response and recovery cost, the customer and regulatory consequences, and how much the proposed investment will reduce either the likelihood or the impact.

The argument should not be, “Cyber incidents are expensive, therefore approve everything in my spreadsheet.” It should be, “Here is a plausible loss scenario, here are the available treatment options, here is what each option costs, and here is the residual exposure under each choice.”

IBM’s 2025 study reported a global average breach cost of US$4.4 million across the organizations studied. That is useful context, but a generic worldwide average is not a substitute for understanding your own economics. A CFO should see the potential interruption to your services, your revenue, your customers and your obligations—not an impressive-looking number borrowed from somebody else’s breach.

Fear may secure a meeting. Credible options, quantified assumptions and transparent trade-offs secure a budget.

What should a CISO cut from their program tomorrow with zero regret?

Raw technical reporting to executives who cannot reasonably act on it.

I would immediately cut the 40-page reports filled with vulnerability counts, firewall events, malware detections, phishing statistics, and screenshots from security products. That information may be valuable to security operators, engineers and control owners. It is usually not useful in its raw form to a board or executive committee.

Executive reporting should answer a smaller set of harder questions:

What important business service is exposed? What is the credible scenario? Is the exposure increasing or decreasing? Are the relevant controls working? Who owns the treatment? What decision or intervention is required, and by when?

The underlying technical evidence should still exist. It should simply be presented at the level where someone can use it.

AICD guidance recommends that board reporting go beyond isolated technical measures and traffic lights to include risk outcomes, relevant threats and trend information. ASD guidance similarly expects reporting to be structured around business functions and to cover risk profiles, key systems, uplift activity, incidents and expected returns on security investment.

A board pack is not a SIEM export wearing a tie.

What’s your 60-second test for whether a vendor pitch is worth your time?

I ask one question:

“In one minute, explain the problem you believe we have, the measurable outcome you will improve, and what we can stop doing if your product works.”

A good vendor will have asked enough questions to understand the environment, the existing controls, the operating model, the constraints and the outcome we are trying to achieve.

They will also be able to discuss implementation effort, dependencies, staffing requirements, data quality, integration limitations and where their product is not the answer.

A weak vendor will respond with the company origin story, three analyst quotations, the phrase “single pane of glass” and an urgent announcement that artificial intelligence has changed everything since Tuesday.

I am also interested in whether the proposed solution replaces or simplifies anything. Adding one more console, agent, data lake, workflow and set of alerts is not necessarily an improvement simply because the demonstration contains a colorful attack graph.

Current ASD procurement guidance emphasizes supplier transparency, security track record, lifecycle considerations and clear allocation of responsibilities between customer and supplier. Those are much better indicators of a sustainable relationship than the smoothness of the demonstration environment.

Any vendor can demonstrate a dashboard. The grown-up conversation is about the operating model.

What’s one meeting, report, or process you eliminated, and what replaced it?

I eliminated the vulnerability meeting that consisted of security reading scanner results aloud to people who were quietly reconsidering their career choices.

It was an activity meeting rather than a risk meeting. We could spend an hour discussing thousands of findings without answering the most important question: which weaknesses create a credible path to material business impact?

I replaced it with an application and business-service risk review.

Instead of beginning with vulnerability volume, we begin with business criticality, internet exposure, sensitive data, identity and privilege pathways, known exploitation, exploit probability, compensating controls, remediation ownership, and trend. The scanner results still provide evidence, but they no longer dictate the agenda.

This matters because no single technical score represents organizational risk. FIRST’s EPSS estimates the probability that a vulnerability will be exploited, but explicitly warns that it is not a complete risk score. Asset purpose, value, accessibility, controls and potential impact must still be considered.

We use RAG reporting because it gives executives a rapid view of hotspots and creates some healthy competition between teams. But RAG is navigation, not analysis. Green is not a control, and red is not a diagnosis. A red customer-payment platform and a red internal test server are not equivalent merely because PowerPoint has assigned them the same shade.

The new discussion is not, “Who has the most vulnerabilities?”

It is, “Which application is most likely to hurt us, who owns the response, and is the exposure moving in the right direction?”

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Activating the business response, rather than only the technical response.

Technical teams quite reasonably begin containing the threat, collecting evidence and working out what happened. But a significant incident also needs an incident commander, a decision log, a reliable communications channel and early engagement from the people responsible for legal, communications, business continuity, critical services and executive decisions.

Someone should also be given explicit responsibility for protecting and validating the recovery path. That does not mean immediately restoring systems or connecting backup infrastructure to a potentially compromised environment. It means establishing whether the backups are isolated, current and likely to be usable; whether the associated credentials may be compromised; and whether there is a clean recovery path available when it is needed.

Backups are frequently treated as a magic incantation: somebody says, “We have backups,” and everyone feels better. The useful question is whether we can restore the right services, from trustworthy data, within a timeframe the business can survive.

ASD guidance emphasizes enacting the incident response plan once an incident is identified, while its continuity guidance highlights the need to maintain communications and critical business functions when normal systems are unavailable.

The SOC can contain malware. It cannot, by itself, authorize customer communications, decide whether payroll outranks email for recovery, or explain the situation to the regulator.

What’s one question every CISO should ask their team this week?

“When did we last prove, in practice, that our incident response and business continuity plans work together?”

Not when were they last reviewed.

Not when did somebody update the document footer.

When were they last road-tested under realistic conditions, involving the people, suppliers and decision-makers who would actually be required during an incident?

A meaningful exercise should test decision authority, escalation paths, out-of-band communications, executive availability, legal and regulatory thresholds, supplier contacts, manual business workarounds, backup restoration, service-recovery priorities and the assumptions behind recovery time and recovery point objectives.

It should also expose awkward practical details. Are the emergency contact details stored somewhere accessible when email is down? Can the crisis team collaborate without using the potentially compromised corporate environment? Does the person named as incident commander still work here? Can the backup be restored, or has the organization merely been paying to store it very carefully?

Current ASD guidance requires incident management policies and associated response plans to be exercised at least annually, and separately expects boards or executive committees to participate in planning and exercises for major cyber incidents. For a critical or rapidly changing environment, annual testing should be treated as a floor rather than an aspiration.

A tabletop exercise that ends with everyone congratulating themselves is often just a meeting with a plot.

What’s a phrase or framing you use to translate a technical risk for executives?

I use a structure like this:

“This creates a credible pathway to [critical service] being unavailable or compromised for [period], affecting [customers, operations or data], with a plausible financial impact of [$X–$Y]. We can reduce the likelihood or duration through [action] at a cost of [$Z]. The decision required is [choice].”

That framing translates the technical condition without hiding it. It connects the weakness to a business promise, explains the plausible scenario, acknowledges uncertainty, quantifies the potential consequence and makes the decision explicit.

I also try to make “reputational damage” less abstract. Reputation is not a mysterious cloud that descends after an incident. It can appear as customer attrition, reduced conversion, lost bids, delayed sales, increased support demand, regulatory scrutiny, partner concern or prolonged executive distraction. Where possible, I connect reputation to those observable commercial and operational effects.

The use of ranges is important. Cyber quantification should improve decision-making, not manufacture false precision. Saying the impact is plausibly between $3 million and $8 million, based on stated assumptions, is often more credible than claiming the answer is exactly $5,421,763 because a spreadsheet contains several decimal places.

Both ASD and NIST expect cyber risk information to support broader organizational risk and investment decisions rather than remain isolated in specialist terminology.

Executives do not need a guided tour of the CVE. They need to know which promise to customers it could break.

What’s your best tip for surviving the CISO role in exactly five words?

Learn to talk executive risk.

More tips from the series:

• CISO Tips: Carlos García Batista on Turning Cybersecurity Into Operational Resilience

• CISO Tips: Sergey Tairyan on Thinking Like an Attacker and Leading Through Cyber Risk

• CISO Tips: Kristin Lowery on Turning Security Activity Into Measurable Risk Reduction

• CISO Tips: Paul Blahusch on Business Success Coming First

• CISO Tips: Diyar Akhmedov on Prioritizing Risk Over Hype

Subscribe now

Subscribe now

For Carlos García Batista, cybersecurity is ultimately about protecting the continuity of essential services. As CISO and Information Security Officer for the Directorate General of Emergencies within the Gobierno de Canarias, he operates at the intersection of critical infrastructure protection, emergency response, operational resilience, and regulatory compliance. His responsibilities include coordinating cybersecurity across technical and operational environments, working with authorities on incident management, and helping ensure that essential services remain secure and available when they are needed most.

That perspective shapes a pragmatic approach to security leadership, one grounded in ownership, accountability, and resilience rather than simply accumulating more tools and controls. From questioning whether a security investment actually reduces operational risk to establishing clear command structures during incidents, García Batista emphasizes the importance of turning cybersecurity into actionable decisions. In this edition of CISO Tips, he shares practical guidance on everything from evaluating vendors and securing privileged access to communicating risk with executives and knowing which security activities are no longer worth the effort.

Complete this sentence: “Before you buy any new security tool, first...”

Before you buy any new security tool, first define the operational risk you are trying to reduce, who will own the tool, who will operate it, and what decision it will help you make.

A tool without ownership becomes another unmanaged asset.

What’s one rule you enforce on your team that other teams would find strict?

No privileged access without a clear purpose, a named owner, traceability, and a review date.

Access should never be granted just because “it may be useful someday.” In security, convenience without control becomes risk very quickly.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I try to keep a practical balance between prevention, detection, response, and resilience.

If most of the effort goes only into buying preventive controls, the organization may look protected but still be unable to detect, respond, or recover properly. For critical services, resilience deserves budget, time, and executive attention.

What’s one line that works when asking the board or CFO for a budget?

“This is not only a cybersecurity investment; it is an operational continuity investment.”

That framing usually works because it connects security to service availability, institutional responsibility, and business or public-service impact.

What should a CISO cut from their program tomorrow with zero regret?

Security activities that generate reports but do not generate decisions.

If a report, meeting, metric, or control does not help reduce risk, improve visibility, assign responsibility, or support a decision, it should be simplified, automated, merged, or removed.

What’s your 60-second test for whether a vendor pitch is worth your time?

I ask three questions:

What specific risk does this reduce?

How will it integrate with what we already have?

Who in my team will operate it on a bad day?

If the answer is vague, the pitch is not mature enough.

What’s one meeting, report, or process you eliminated, and what replaced it?

I try to eliminate meetings that only exist to exchange information that could have been documented beforehand.

They should be replaced by short, evidence-based operational reviews: what changed, what risk increased, what decision is needed, who owns the next action, and by when.

Security governance should create clarity, not ceremony.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

They often skip defining the incident commander and the decision-making channel.

Many teams start investigating immediately, but without clear coordination, roles, and communication discipline. In an incident, technical work matters, but command structure matters just as much.

What’s one question every CISO should ask their team this week?

“What are we currently accepting as normal that is actually a risk?”

That question usually reveals technical debt, informal exceptions, undocumented dependencies, weak ownership, or processes that only work because one person knows how to keep them alive.

What’s a phrase or framing you use to translate a technical risk for executives?

I translate technical risk into operational consequence.

Instead of saying, “We have a vulnerability in this system,” I prefer to say, “If this fails or is compromised, this service may be unavailable, this decision may be delayed, or this operational capability may be affected.”

Executives need to understand impact, not just threat language.

What’s your best tip for surviving the CISO role in exactly five words?

Govern calmly, document, prioritize, breathe.

More tips from the series:

• CISO Tips: Sergey Tairyan on Thinking Like an Attacker and Leading Through Cyber Risk

• CISO Tips: Kristin Lowery on Turning Security Activity Into Measurable Risk Reduction

• CISO Tips: Paul Blahusch on Business Success Coming First

• CISO Tips: Diyar Akhmedov on Prioritizing Risk Over Hype

• CISO Tips: Peter Egyed on Why Consistency and Prioritization Strengthen Cybersecurity

Subscribe now

Subscribe now

In cybersecurity, effective leadership requires more than deploying the right tools or responding quickly to incidents. It requires a mindset built around continuous learning, attacker thinking, and the ability to translate technical risk into business impact. Sergey Tairyan, Chief Information Security Officer at the Technology Management Center of Yerevan City and founder of OmniSec and Oky.ai, brings more than 15 years of experience building and transforming security programs across industries. His expertise spans security operations, SOC leadership, SIEM and DLP, IAM and PAM, endpoint protection, incident response, and emerging areas such as steganography and post-quantum cryptography.

Known for combining hands-on ethical hacking with long-term security strategy, Sergey approaches cybersecurity with a focus on reducing real-world risk while keeping organizations resilient and operational. His advice reflects that philosophy, from researching a vendor before buying its tools and measuring security decisions in business numbers to prioritizing daily learning and clear leadership during a crisis. In this edition of CISO Tips, Sergey shares the principles, habits, and practical approaches that shape how he thinks about security leadership in an increasingly complex threat landscape.

Complete this sentence: “Before you buy any new security tool, first...”

Before you buy any new security tool, first do OSINT on the company behind it.

What’s one rule you enforce on your team that other teams would find strict?

Two non-negotiable rules:

• All team members must maintain 24/7/365 availability, including weekends, holidays, vacations, and days off.

• Every team member spends one hour daily on learning and research.

In cybersecurity, threats don’t rest and neither does learning.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

65% prevention, 15% detection and response, 20% innovation and research.

AI has shifted the balance toward innovation, but the ratio should continuously adapt to business risk, technology, and the evolving threat landscape.

What’s one line that works when asking the board or CFO for a budget?

The board and CFO understand numbers, not technical details. So, I don’t ask for a security budget; I present a business risk calculation, showing the potential financial impact of an incident, its likelihood, and the cost of reducing that risk.

What should a CISO cut from their program tomorrow with zero regret?

With AI and mature open-source solutions, many enterprise security tools (such as SIEM, security scanners, and password managers) can now be deployed faster, customized, and operated at a fraction of the cost.

What’s your 60-second test for whether a vendor pitch is worth your time?

I present the vendor with 2-3 real security challenges and watch how they respond.

I’m looking for honesty, technical depth, and a problem-solving mindset - not marketing. If they ask the right questions and acknowledge limitations, they’ve earned more of my time.

What’s one meeting, report, or process you eliminated, and what replaced it?

I eliminated meetings focused on what we did and replaced them with discussions on what we learned.

Instead of status updates, we focus on new threats, lessons learned, and opportunities to improve our security posture.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Teams often skip establishing clear leadership.

In a major cyber incident, the CISO becomes the incident commander, directing the CIO, CTO, and other teams to coordinate the response.

What’s one question every CISO should ask their team this week?

What else can we automate to improve our resilience?

What’s a phrase or framing you use to translate a technical risk for executives?

Let’s talk in numbers.

What’s your best tip for surviving the CISO role in exactly five words?

- Learn. Test. Hack. Repeat.

More tips from the series:

• CISO Tips: Kristin Lowery on Turning Security Activity Into Measurable Risk Reduction

• CISO Tips: Paul Blahusch on Business Success Coming First

• CISO Tips: Diyar Akhmedov on Prioritizing Risk Over Hype

• CISO Tips: Peter Egyed on Why Consistency and Prioritization Strengthen Cybersecurity

• CISO Tips: Nikolas Oelkrug-Alders on Why Strong Security Starts With the Fundamentals

Subscribe now

Subscribe now

As cybersecurity leaders face growing pressure to reduce risk while proving business value, the role of the CISO is increasingly defined by the ability to connect security decisions to measurable outcomes. Kristin Lowery, Field Chief Information Security Officer at Optiv, brings extensive experience leading information technology and cybersecurity initiatives across Fortune 500 enterprises. Her background spans cybersecurity controls, cloud computing, vulnerability management, data protection, governance, business continuity, and large-scale technology transformations, with a focus on helping organizations reduce threats while supporting resilience and sustainable growth.

Throughout her career, Lowery has worked closely with senior executives and cross-functional teams to develop security strategies, strengthen governance, improve operational efficiency, and align technology investments with business priorities. In this edition of CISO Tips, she shares a practical perspective on making security programs more effective, from evaluating the real problem before buying another tool and cutting unnecessary complexity to translating technical vulnerabilities into business exposure and establishing clear decision ownership during an incident. Her advice centers on a simple principle: security teams should focus less on activity for its own sake and more on measurable risk reduction, business impact, and the resilience to keep moving forward.

Complete this sentence: “Before you buy any new security tool, first...”

Before you buy any new security tool, first get clear on the problem you’re trying to solve. Too often, teams add technology before confirming whether they already own a tool that can do the job—or whether the real issue is process, ownership, or adoption. I also think it’s important to regularly review your existing technology footprint, because many organizations are not getting full value from the solutions they already have. One recent conversation that stuck with me was with a CISO who asked his team to review their top tools and validate actual usage, especially as new AI capabilities continue to emerge.

What’s one rule you enforce on your team that other teams would find strict?

If we can’t connect a recommendation to risk reduction or a business outcome, we need to rethink it. Security teams can generate a lot of activity, but activity is not the same as progress. To me, progress means measurable operational risk reduction or an increase in business capability.

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I pay close attention to the balance between effort and actual risk reduction. If something takes significant time, creates operational drag, and does not meaningfully reduce risk, that is usually a signal to simplify it. I also believe key performance indicators and risk appetite should be reviewed at least annually so they remain relevant and useful.

What’s one line that works when asking the board or CFO for a budget?

“This is not about buying another security tool. It is about reducing the likelihood and impact of an event that could disrupt the business, affect customers, or slow recovery.” CFOs and other leaders do not want to hear about the latest shiny tool. They want to understand impact, value, and how the investment fits into the broader environment.

What should a CISO cut from their program tomorrow with zero regret?

I would cut anything that creates noise without improving decision-making. That might include duplicate tools, reports no one uses, or processes people follow simply because “we’ve always done it that way.”

What’s your 60-second test for whether a vendor pitch is worth your time?

I want to quickly understand what risk they reduce, where they fit in the environment, what problem they solve better than what I already have, and how I would know the solution is working. If they can’t explain that clearly, it’s probably not the right conversation.

What’s one meeting, report, or process you eliminated, and what replaced it?

I’m a big believer in replacing status-for-status-sake meetings with decision-focused conversations. Instead of walking through dashboards, I’d rather ask: What changed? What matters? What decision do we need? Who owns the next step? I’m also comfortable canceling meetings that are no longer needed or ending them early. Staying connected with leaders and teams matters, but the agenda should support that purpose.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Teams understandably jump into technical triage, but they often skip defining business impact and decision ownership. Early on, someone needs to clarify what is affected, who needs to know, and who is empowered to make decisions.

What’s one question every CISO should ask their team this week?

“Where are we making security harder than it needs to be?” That question usually opens an honest conversation about complexity, ownership, and whether our controls are working the way we think they are.

What’s a phrase or framing you use to translate a technical risk for executives?

I try to shift the conversation from “technical vulnerability” to “business exposure.” For example: “This is not just a system issue; it could affect operations, customer trust, recovery time, or our ability to meet business commitments.”

What’s your best tip for surviving the CISO role in exactly five words?

Stay curious, practical, and resilient. Keep moving forward—don’t spend too much time looking backward, because that’s not where you’re going.

More tips from the series:

• CISO Tips: Paul Blahusch on Business Success Coming First

• CISO Tips: Diyar Akhmedov on Prioritizing Risk Over Hype

• CISO Tips: Peter Egyed on Why Consistency and Prioritization Strengthen Cybersecurity

• CISO Tips: Nikolas Oelkrug-Alders on Why Strong Security Starts With the Fundamentals

• CISO Tips: Rocco Barra on Never Taking Anything for Granted

Subscribe now

Subscribe now

Paul Blahusch is the founder and president of B&A Cybersecurity Consulting. He is a former federal cabinet agency Chief Information Security Officer (CISO) with over 25 years of experience in cybersecurity leadership, specializing in safeguarding information systems and data. He has a proven ability to enhance organizational efficiency while managing substantial budgets and ensuring compliance with regulatory standards. Paul has expertise in developing and implementing comprehensive cybersecurity strategies, including zero trust frameworks and risk management initiatives. He is committed to fostering a culture of security awareness and readiness and is passionate about leveraging technology and best practices to protect critical assets and support organizational missions.

In addition to his work with B&A Cybersecurity Consulting, he is the Cybersecurity Advisor for the Consortium of Universities of the Washington Metropolitan Area, a Mission Critical Fellow, and a frequent speaker at cybersecurity conferences.

1. Complete this sentence: “Before you buy any new security tool, first...”

Determine if it makes you better and, if so, how you can afford it.

2. What’s one rule you enforce on your team that other teams would find strict?

I stressed scrupulous adherence by the cyber team to all organizational policies: budget, procurement, HR, physical security, and more. If we expected organization personnel to follow our cybersecurity policies, the cyber team should lead by example across the board.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I’ll go with my own time. There is an ongoing mental calculation. Whatever is urgent and important gets attention. Generally, that ends up being what is most important at the moment to help protect and ensure business success.

4. What’s one line that works when asking the board or CFO for a budget?

Here is how this will pay for itself, through efficiencies, reducing or eliminating duplicative solutions, lower insurance premiums, and other savings.

5. What should a CISO cut from their program tomorrow with zero regret?

Do this exercise. Ask your team to tell you what activities they do that don’t appear to have value, and to estimate how much time they spend on each. For example, this could be a long-standing report they prepare that no one up the org chart ever comments on. Evaluate the results. Eliminate based on least value and highest cost. No regret.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

Tell me what problem I have that this helps solve, or how this makes me better, more secure, more efficient. Why would I want this? And tell me how I can have this within my current budget, whether by replacing or reducing something else, lowering cost elsewhere, or another option. How can I afford this?

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I killed maintaining the five-year cybersecurity strategic plan document. It was a bloated, time-consuming, never-referenced, obsolete-as-soon-as-it-was-published, costly product. We replaced it with annual tangible and trackable goals, combined with shorter “sprint” objectives throughout the year.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Using the playbook. They often get so quickly engrossed in the technical details of the incident, determining the where and how, that they forget to open the playbook. This can lead them to miss important steps defined in the playbook, like preserving evidence, documenting a record of the incident, and establishing secure communications.

9. What’s one question every CISO should ask their team this week?

How can I best help you be successful? Is that by being a sounding board, getting you needed resources, providing top cover for an initiative, or providing a decision or approval?

10. What’s a phrase or framing you use to translate a technical risk for executives?

Executives are familiar with evaluating risks of all types. Frame technical, or cyber, risk through a similar lens. Namely, how it will impact the business.

11. What’s your best tip for surviving the CISO role in exactly five words?

Remember, business success comes first. As a C-Suite executive, my role isn’t to provide cybersecurity. Rather, it is to make sure the business is successful. The primary way I, as CISO, contribute to that success is by directing a cybersecurity program that keeps cyber risk at an acceptable level to the business.

Get more tips from CISOs working in various industries:

• CISO Tips: Diyar Akhmedov on Prioritizing Risk Over Hype

• CISO Tips: Peter Egyed on Why Consistency and Prioritization Strengthen Cybersecurity

• CISO Tips: Nikolas Oelkrug-Alders on Why Strong Security Starts With the Fundamentals

• CISO Tips: Rocco Barra on Never Taking Anything for Granted

• CISO Tips: Barak Blima on Building Trust Before Needing It

Subscribe now

Subscribe now

With more than 20 years of experience across banking, financial services, government, and critical infrastructure, Diyar Akhmedov has built his career around helping organizations make practical, risk-based security decisions. His background spans cyber risk management, security strategy, governance, regulatory compliance, security architecture, and building security programs that align with business objectives rather than industry trends.

In this edition of CISO Tips, Akhmedov shares why every security investment should begin with a clear understanding of the problem it solves, why proof-of-concept testing matters more than polished vendor presentations, and how CISOs can communicate technical risks in business terms. His advice emphasizes disciplined prioritization, operational effectiveness, and focusing security efforts on measurable outcomes instead of the latest buzzwords.

1. Complete the sentence: “Before buying any new security tool, first…”

…make sure you clearly understand the problem you are trying to solve.

In practice, this is not always as obvious as it sounds. Sometimes a solution looks attractive because the market is talking about it, other companies are using it, or the vendor gave a strong presentation. Before making a decision, I try to answer a few basic questions: Which risk are we reducing? What will actually change after implementation? And how will we know whether the product is working?

For critical solutions, I prefer to run a PoC first. Over the years, I have seen products look excellent during a demo and then struggle with basic integration once the PoC started.

2. What is one rule you enforce on your team that other teams might consider too strict?

We do not make major security decisions based only on a vendor presentation, an analyst rating, or a product’s reputation in the market.

I need to see how the solution performs in our own environment. A strong presentation does not guarantee a successful implementation. During a PoC, you may discover issues with integration, performance, support quality, or day-to-day operations.

I have seen well-known products with strong brands create more manual work for the security team than real value. I have also seen less prominent solutions perform very well simply because they were a better fit for the organization’s actual processes.

3. What metric or ratio guides how you allocate budget, headcount, or your own time?

I do not use one fixed formula for every situation.

I normally look at the level of risk, the expected risk reduction, the cost, and the complexity of implementation. A low-cost initiative is not always the highest priority, and an expensive one is not automatically excessive. It depends on the potential business impact of the risk.

I apply the same approach to my own time. I try not to become involved in every technical detail when the team can resolve the issue independently. My time should be focused on areas where prioritization, a management decision, or communication with the business is required.

4. What is the best phrase to use when asking the board or the CFO for the budget?

I try not to start a conversation with a product name.

Instead of saying, “We need to buy a new system,” I explain the current risk, how it may affect the business, and what will change if the investment is approved.

The board does not necessarily need to understand every technical difference between EDR and SIEM solutions. It does need to understand whether the current situation could lead to the disruption of a critical service, financial loss, regulatory consequences, or damage to customer trust.

Once the conversation starts with business risk, the budget discussion becomes much more practical.

5. What should every CISO remove from their program tomorrow without regret?

Projects that exist only because they are currently popular or because “everyone else is doing them.”

The information security industry is highly influenced by trends. Every year brings new technologies, approaches, and impressive terminology. But if an initiative is not connected to a specific risk or business need, it can quickly become an expensive project without a clear outcome.

I would rather have a shorter, realistic security program than a large roadmap that cannot be delivered properly. It is better to address five important risks than to launch fifteen fashionable projects and fail to make any of them operational.

6. How do you decide within 60 seconds whether a vendor presentation is worth your time?

I normally ask three questions:

What problem does your product solve? How difficult is the integration? How will we measure the result after implementation?

I do not expect a complete technical answer in one minute. I want to understand whether the vendor can speak about real-world operations rather than only product capabilities.

If the answer immediately turns into a discussion about artificial intelligence, unique algorithms, and attractive dashboards, but says nothing about integration, operational workload, or success criteria, I usually take that as a warning sign.

7. What meeting, report, or process did you eliminate, and what replaced it?

I try to reduce meetings where participants simply repeat information that is already available in reports.

If the status of a project can be shown on one page or in a short dashboard, there is no reason to bring ten people together for an hour. A meeting is useful when a decision needs to be made, a blocker needs to be removed, or ownership needs to be clarified.

The same applies to reports. If a report is produced every week but no one uses it to make a decision, I question why the team is still spending time on it.

We should not measure effectiveness by the number of meetings or documents. What matters is how quickly decisions are made, and real problems are resolved.

8. What do incident response teams most often miss in the first ten minutes?

The first instinct is understandable: stop the attack as quickly as possible.

But in doing so, teams sometimes start shutting down systems, terminating processes, or changing configurations before collecting the necessary data. As a result, logs, memory contents, and other important evidence may be lost.

I am not saying that evidence preservation is always more important than containment. If there is an immediate threat to the business, it must be stopped. But the team should act consciously and understand which actions may destroy evidence and which data must be preserved first.

Good incident response is a balance between speed, damage control, and the ability to reconstruct what actually happened afterward.

9. What question should every CISO ask their team this week?

“Which security control do we believe is working even though we have not tested it recently?”

It could be backup and recovery, MFA, EDR, PAM, security monitoring, or the incident response plan.

In information security, it is very easy to confuse the existence of a control with its effectiveness. A system may be installed, the licence may be active, and the dashboard may show a green status, yet the control may still fail when it is actually needed.

That is why I trust test results more than confident assumptions.

10. What phrase do you use to explain technical risk to executives?

I usually say: “This is a business risk caused by a technical issue.”

That wording helps move the discussion from a purely technical level to a management level.

Executives do not always need the details of a vulnerability, configuration issue, or attack scenario. They need to understand what may happen, how likely it is, what the potential impact is, and which options are available.

My role is not to overwhelm them with technical language. It is to provide enough information for an informed decision.

11. What is your best survival advice for a CISO role in exactly five words?

Prioritize risks. Build trust. Explain.

Get more tips from CISOs working in various industries:

• CISO Tips: Peter Egyed on Why Consistency and Prioritization Strengthen Cybersecurity

• CISO Tips: Nikolas Oelkrug-Alders on Why Strong Security Starts With the Fundamentals

• CISO Tips: Rocco Barra on Never Taking Anything for Granted

• CISO Tips: Barak Blima on Building Trust Before Needing It

• CISO Tips: Fred Streefland on Managing Risk So the Business Can Do Business

Subscribe now

Subscribe now

Cybersecurity programs are often judged by the tools they deploy or the threats they block, but lasting resilience depends on making disciplined decisions about where to focus time, budget, and attention. As Chief Security Officer at Erste Magyarország, Peter Egyed believes effective security leadership starts with prioritization, investing in controls that deliver measurable risk reduction, applying policies consistently across the organization, and avoiding unnecessary complexity.

In this edition of CISO Tips, Egyed shares practical advice drawn from years of security leadership. He explains why CISOs should validate a vendor’s real-world impact before making a purchase, why no employee (including the CEO) should receive exceptions to security processes, and how staying calm during the opening minutes of an incident leads to better decisions. His insights reinforce a simple but powerful principle: strong cybersecurity is built on consistency, focus, and clear priorities.

Complete this sentence: “Before you buy any new security tool, first…”

Be sure that the product or service has a real impact and risk mitigation effect for your organization. Secondly, be sure you are not duplicating an already existing feature in your infrastructure. It seems stupid, but I’ve seen this mistake so many times.

What’s one rule you enforce on your team that other teams would find strict?

No exceptions with people. Everyone in the organization must go through the same security procedures to obtain anything. So even if a CEO asks you to bypass some rules, don’t do it!

What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

Security people’s life is always about prioritization. Try to prioritize your 3-4 most important problems and don’t let low-priority events mislead your attention.

What’s one line that works when asking the board or CFO for a budget?

The cost of risk mitigation is much lower than the impact on the organization in case the negative event we try to prevent occurs.

What should a CISO cut from their program tomorrow with zero regret?

Low-priority or low-impact targets that are in the “nice to have” category or are in the “must do but zero benefit” category.

What’s your 60-second test for whether a vendor pitch is worth your time?

Show me 2 real-world use cases that has positive impact on your previous customers.

What’s one meeting, report, or process you eliminated, and what replaced it?

Those meetings that could be an email.

In the first 10 minutes of an incident, what’s the one action teams most often skip?

Be calm and get the biggest picture available.

What’s one question every CISO should ask their team this week?

Where are the difficulties and problems where you need my help?

What’s a phrase or framing you use to translate a technical risk for executives?

Risk Vs. Probability Vs. Impact in a simple way. If we don’t do that, there is a real chance this will happen, but we can mitigate it that way, and there is a cost to it compared to the cost of the negative impact.

What’s your best tip for surviving the CISO role in exactly five words?

Consistency, Focus, Priorities, Strategy, Coffee (a lot)

• CISO Tips: Nikolas Oelkrug-Alders on Why Strong Security Starts With the Fundamentals

• CISO Tips: Rocco Barra on Never Taking Anything for Granted

• CISO Tips: Barak Blima on Building Trust Before Needing It

• CISO Tips: Fred Streefland on Managing Risk So the Business Can Do Business

• CISO Tips: Victor-Andrei Nicolae on Protecting What Keeps Business Running

Subscribe now

Subscribe now

Strong cybersecurity leadership often comes down to resisting complexity rather than adding to it. As Group Chief Information Security Officer at ARZ Haan AG, Nikolas Oelkrug-Alders oversees information security across a highly regulated financial services organization supporting Germany’s healthcare sector. His responsibilities span compliance with frameworks including DORA, BAIT, ISO 27001, BSI C5, and GDPR, while ensuring security remains aligned with broader business objectives.

Drawing on experience across technology, aerospace, power generation, and financial services, Oelkrug-Alders approaches cybersecurity as a business risk that should be managed with discipline, practicality, and clear priorities. In this edition of CISO Tips, he shares why CISOs should focus on getting the fundamentals right, how to evaluate vendors beyond marketing claims, why security teams should act as service providers instead of gatekeepers, and the importance of simplifying processes rather than creating new ones for every emerging threat.

1. Complete this sentence: “Before you buy any new security tool, first...”

…ask whether you can truly embed it in your existing security strategy and actually operate it day-to-day. A tool that nobody has the capacity to run is not a control; it is shelfware. This matters even more in mid-cap and smaller organizations, where every new tool competes for the same scarce attention. If it does not fit your daily processes, it will not make you more secure.

2. What’s one rule you enforce on your team that other teams would find strict?

I would not call it strict, but I insist that security always acts as a service provider, not only as a gatekeeper. Enforcing controls is part of the job, yes, but so is explaining why we do things and how each measure fits the wider security strategy. We cannot expect other business functions to understand that from the requirements alone. If the only thing they ever hear from us is “no”, we have already lost them.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

Frankly, I distrust the idea of a single magic ratio. Prioritization is hard right now, with so many “new” risks appearing every quarter. My guiding principle is to solidify the basis first. Before I chase the newest threat, I want a clear, rehearsed incident-response capability in place, and I will deliberately spend a disproportionate share of my time on it. Get the fundamentals right, and most of the exotic risks become manageable anyway.

4. What’s one line that works when asking the board or CFO for a budget?

Two things, really. First, information security is just another business risk, and it should be treated as such. Whether we act depends on the potential impact and the effort required to mitigate it. As long as we treat cybersecurity as some separate, special animal, we will always struggle to have the conversation at the board level. Second, and this is the line that tends to land: I do not ask for money; I bring savings, either through risk mitigation or through consolidation.

5. What should a CISO cut from their program tomorrow with zero regret?

The reflex to invent a brand-new process or strategy for every so-called “new risk”, AI being the obvious example. If your current strategy cannot already accommodate something like AI, the problem is your strategy, not the absence of an AI strategy. Bolting on new processes will not help you handle the complexity; it will only add to it.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

I ask myself what this vendor’s actual intellectual property is. Where is the real, hard-won substance? If I could vibe-code an equivalent myself over the weekend, there would be nothing to talk about.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

Several, and the common thread is consolidation and the formation of a clear picture of an incident as early as possible. We simply do not have the time to doom-scroll through logs and manually stitch the pieces together into a case. So that manual triage work is being replaced by automation, at least up to the point where human judgment genuinely adds value.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Breathing. Pausing to focus on what actually matters. Teams skip the simple act of taking a few seconds, or even a couple of minutes, to calm down and think. It feels counterintuitive under pressure, but you make that time back many times over, and you avoid the panic-driven mistakes that turn an incident into a crisis.

9. What’s one question every CISO should ask their team this week?

Of everything we do, does it all truly serve a purpose, and can you name that purpose? If a given activity is not measurably improving our security posture, that is a strong signal we need to re-prioritize.

10. What’s a phrase or framing you use to translate a technical risk for executives?

Almost any technical risk can be translated into a risk we already recognize from everyday life, not only from the business context. People grasp a threat far more quickly when they can relate it to their own home or family. Would you leave your front door unlocked because locking it is inconvenient? That kind of framing does more than any CVSS score ever will.

11. What’s your best tip for surviving the CISO role in exactly five words?

Never settle in, always adapt!

• CISO Tips: Rocco Barra on Never Taking Anything for Granted

• CISO Tips: Barak Blima on Building Trust Before Needing It

• CISO Tips: Fred Streefland on Managing Risk So the Business Can Do Business

• CISO Tips: Victor-Andrei Nicolae on Protecting What Keeps Business Running

• CISO Tips: Tarik Ustuner on Fixing the Locks Before Buying Alarms

Subscribe now

Subscribe now

Rocco Barra is a seasoned cybersecurity and technology executive with over 15 years of experience operating at the intersection of IT systems, security, and business transformation. He currently serves as Chief Technology Officer (CTO) and Chief Information Security Officer (CISO) at Aeromeccanica Stranich S.p.A., where he leads both the strategic direction of IT and the governance of cybersecurity risk across the organization.

With a strong foundation in integrating complex digital ecosystems, including ERP, PLM, cloud infrastructure, and SaaS platforms, Rocco brings a systemic, end-to-end view of how technology supports business operations. His dual role enables him to align security with production workflows, operational continuity, and long-term growth initiatives. Known for his pragmatic and people-centric approach, he emphasizes governance, real-world context, and continuous adaptation, ensuring that security is not just a control function, but a driver of resilience and business value.

1. Complete this sentence: “Before you buy any new security tool, first...”

First, define the requirement on paper. Then evaluate the possible use cases and think about a scalable project. Only after these steps should you consider purchasing the solution.

2. What’s one rule you enforce on your team that other teams would find strict?

Every project must be designed offline and documented before implementation.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I prefer to evaluate it in reverse. Cybersecurity is not predictable, so I allocate the budget across different areas, measure the impact, and review the results afterwards.

4. What’s one line that works when asking the board or CFO for a budget?

I led the digital transformation of the group, and over time my way of working has built trust. Today, my requests are supported by the results we have already achieved.

5. What should a CISO cut from their program tomorrow with zero regret?

The fear of having to prove that today’s decision will still be the right one in the future. Decisions are made with the information available at that moment. The important thing is to make decisions and adapt when necessary.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

If at least one slide presents a real use case that can be applied to my business, I will continue listening.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I removed the weekly incident update meeting for each department and replaced it with a live Power BI dashboard.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Updating the ticketing system with the information already discovered. It sounds simple, but it is often forgotten.

9. What’s one question every CISO should ask their team this week?

“Do we really have everything under control?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

I explain risks and security investments using the concept of the corporate perimeter, because it is easy for non-technical managers to understand.

11. What’s your best tip for surviving the CISO role in exactly five words?

Never take anything for granted.

Different desks, different rules. More tips from the series:

• CISO Tips: Barak Blima on Building Trust Before Needing It

• CISO Tips: Fred Streefland on Managing Risk So the Business Can Do Business

• CISO Tips: Victor-Andrei Nicolae on Protecting What Keeps Business Running

• CISO Tips: Tarik Ustuner on Fixing the Locks Before Buying Alarms

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

Subscribe now

Subscribe now

Barak Blima is Chief Information Security Officer at CHEQ, where he leads global information security, governance, risk, and compliance. With experience spanning cybersecurity leadership and operational security, he focuses on building security programs that enable business growth while strengthening trust across customers, executives, and engineering teams. He believes the most effective security leaders spend as much time understanding people and business priorities as they do understanding technology.

1. Complete this sentence: “Before you buy any new security tool, first...”

Make sure you’ve fully adopted the ones you already own.

2. What’s one rule you enforce on your team that other teams would find strict?

Don’t bring me problems without bringing at least one possible solution. It doesn’t have to be the right answer, but it should show you’ve thought through the problem.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I try to spend around 70% of my time on business alignment, people, and strategic decisions, and no more than 30% reacting to operational issues.

4. What’s one line that works when asking the board or CFO for a budget?

“I’m not asking you to buy security. I’m asking you to reduce business uncertainty.”

5. What should a CISO cut from their program tomorrow with zero regret?

Security activities that exist only because “we’ve always done them.” If you can’t explain the business value, challenge whether they should continue.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

If they spend the first minute talking about features instead of trying to understand my environment and priorities, we’re probably not a good fit.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

Lengthy weekly status meetings. We replaced them with shared dashboards and shorter discussions focused only on decisions and blockers.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Assigning clear ownership. Teams often rush into technical work before someone is explicitly responsible for coordinating the response.

9. What’s one question every CISO should ask their team this week?

“What are we doing today that adds effort but not security?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

“This isn’t just a technology issue. It’s a business decision about risk, resilience, and priorities.”

11. What’s your best tip for surviving the CISO role in exactly five words?

Build trust before needing trust.

Every CISO carries different rules. Here’s what others shared:

• CISO Tips: Fred Streefland on Managing Risk So the Business Can Do Business

• CISO Tips: Victor-Andrei Nicolae on Protecting What Keeps Business Running

• CISO Tips: Tarik Ustuner on Fixing the Locks Before Buying Alarms

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

• CISO Tips: Shady Shaker on the 70/30 Rule and Discipline That Scales

Subscribe now

Subscribe now

Fred Streefland graduated in 1992 from the Netherlands Royal Military Academy and served 20 years as an Intelligence & Security officer (LtCol) within the Royal Netherlands Air Force (RNLAF). In 2008, he moved to the private sector, received his cybersecurity training in Israel, and has since fulfilled several cybersecurity roles within companies including IBM, Accenture, Exact Software, Leaseweb, Palo Alto Networks, Secior B.V., and Solvinity.

Currently, he is working as the Global Field CISO for Check Point Software Technologies, responsible for the EMEA region. In this role, Fred serves as a trusted advisor and cybersecurity strategist for CISOs and CIOs. Fred holds an Executive Master of Security & Defense (EMSD) from the Netherlands Staff College and a Bachelor title in Management, Economics & Law (Bc.) from the University of Applied Sciences of Amsterdam.

1. Complete this sentence: “Before you buy any new security tool, first...”

Perform a risk assessment.

2. What’s one rule you enforce on your team that other teams would find strict?

Always express your concerns and feelings, good and bad. It’s not strict, but it’s my rule: “Speak up!”

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

The number and prioritization of the risks. My role is to manage the (cyber) risks so that the business can do its business.

4. What’s one line that works when asking the board or CFO for a budget?

The board and CFO are responsible for the overall risk appetite, so: do you want me to mitigate these risks, or will you accept them and not invest in the mitigation?

5. What should a CISO cut from their program tomorrow with zero regret?

Microsoft “security tools.” Microsoft is not a security company but a software company; there are better and more effective security tools than the Microsoft tools.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

Does this vendor really understand our business and my challenges?

7. What’s one meeting, report, or process you eliminated, and what replaced it?

If I eliminate a meeting, a report, or a process, I do that for a reason, not to replace it.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

They don’t read the manual or Standard Operating Procedure (SOP), which is exactly what they should do.

9. What’s one question every CISO should ask their team this week?

Do we have full visibility on our IT/OT infrastructure, cloud(s), supply chain, and AI? But they should ask this question continuously.

10. What’s a phrase or framing you use to translate a technical risk for executives?

I translate the technical risk into a business risk. What will happen to the business if you don’t mitigate this technical risk?

11. What’s your best tip for surviving the CISO role in exactly five words?

Get an experienced CISO as your Mentor! (Sorry, 7 words)

These CISOs have shared their tips. There’s plenty to learn:

• CISO Tips: Victor-Andrei Nicolae on Protecting What Keeps Business Running

• CISO Tips: Tarik Ustuner on Fixing the Locks Before Buying Alarms

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

• CISO Tips: Shady Shaker on the 70/30 Rule and Discipline That Scales

Subscribe now

Subscribe now

Victor-Andrei Nicolae is Chief Information Security Officer at RightClick Solutions, where he leads enterprise information security and IT risk management strategy, working across business units to strengthen security governance, improve risk management processes, and enhance the organization’s information security framework. His experience spans a broad range of IT and security environments, from infrastructure design and cloud administration to enterprise security controls, compliance, and operational resilience.

With expertise across AWS, Microsoft environments, Trellix security solutions, and ISO 27001-aligned security management, Victor brings a practical, systems-oriented perspective to the CISO role. Known for his emphasis on disciplined execution and sustainable risk management, he focuses on building effective controls that support business operations while preparing organizations for emerging challenges, including the rise of AI-driven threats and the shift toward more adaptive, intelligent defense strategies.

1. Complete this sentence: “Before you buy any new security tool, first...”

Identify the business risk it solves, confirm an existing control can’t solve it better, and make sure there’s a clear owner after deployment.

2. What’s one rule you enforce on your team that other teams would find strict?

If losing administrator rights prevents you from doing your job, we’ll talk. Otherwise, you probably don’t need them.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I prioritize investments based on risk reduction versus implementation effort. If a control delivers significant risk reduction with low operational overhead, it moves to the top of the list.

4. What’s one line that works when asking the board or CFO for a budget?

Every euro we invest today reduces the likelihood and impact of a disruption tomorrow.

5. What should a CISO cut from their program tomorrow with zero regret?

Compliance activities that produce paperwork instead of improving security outcomes.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

Show me a real customer problem you’ve solved, not a list of AI features.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I eliminated manual evidence collection for compliance wherever possible and replaced it with automated evidence gathering.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

They forget to communicate. Even a simple “we’re investigating” message prevents confusion and unnecessary escalation.

9. What’s one question every CISO should ask their team this week?

What security control are we relying on the most, and when did we last prove it actually works?

10. What’s a phrase or framing you use to translate a technical risk for executives?

This isn’t about servers or software. It’s about protecting revenue, reputation, and our ability to operate.

11. What’s your best tip for surviving the CISO role in exactly five words?

Protect what keeps business running.

Get more tips from CISOs working in various industries:

• CISO Tips: Shady Shaker on the 70/30 Rule and Discipline That Scales

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

• CISO Tips: Tarik Ustuner on Fixing the Locks Before Buying Alarms

Subscribe now

Tarik Ustuner is the Chief Information Security Officer at Bybit TR, where he is responsible for safeguarding the organization’s information systems in a high-stakes, fast-moving financial environment. In his role, Tarik designs and implements robust security protocols, works closely with internal teams to identify and mitigate vulnerabilities, and strengthens compliance with industry standards, driving measurable reductions in security incidents along the way. Known for his pragmatic, action-oriented mindset, Tarik approaches cybersecurity as a living discipline: one that requires a deep understanding of the business, constant awareness of the evolving threat landscape, and the resilience to respond decisively when it matters most.

1. Complete this sentence: “Before you buy any new security tool, first...”

Audit your existing tech stack to see what’s already capable of doing the exact same thing but was never fully deployed. Most security gaps are caused by 20% tool utilization, not a lack of tools.

2. What’s one rule you enforce on your team that other teams would find strict?

We enforce a strict “no manual changes in production” rule. Even during a high-severity incident, no one is allowed to hotfix code or configurations directly on live servers. Everything must go through the CI/CD pipeline and automated checks. Other departments think it slows us down during a crisis, but it prevents a bad situation from becoming a catastrophe.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

The 80/20 rule. I dedicate 80% of my budget and team focus to rock-solid cyber hygiene: patch management, identity protection, and visibility. The remaining 20% goes to advanced tools and proactive threat hunting. There is no point in buying a state-of-the-art security system if your front door doesn’t lock.

4. What’s one line that works when asking the board or CFO for a budget?

“This budget isn’t a guarantee that we will never be breached; it’s an investment to ensure that when a breach happens, our business recovery time drops from three weeks to three hours.”

5. What should a CISO cut from their program tomorrow with zero regret?

Those annual, boring, compliance-driven security awareness videos that everyone mutes. No one ever stopped clicking on a phishing link because of a slide deck. Replace them with real-time, bite-sized, interactive simulation triggers.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

In the first 60 seconds, they need to talk about my specific business problem, not their product features. If the pitch starts with buzzwords like “AI-driven, revolutionary, next-gen paradigm shift,” my clock runs out and the meeting is practically over.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I killed the traditional two-hour Monday status update meeting and replaced it with a 15-minute daily stand-up. I also eliminated the 40-page monthly PDF security report, replacing it with a single, dynamic executive risk dashboard.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Taking a breath and documenting the initial blast radius. Teams usually panic and rush to patch things or kill servers immediately. In doing so, they often destroy vital logs and evidence. The first 10 minutes should strictly be about calm containment and logging what is currently happening.

9. What’s one question every CISO should ask their team this week?

“What is the one control or system we trust the most right now, and when was the last time we actually tried to break it ourselves?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

I strip out the technical jargon and translate it into operational downtime: “This vulnerability doesn’t just mean an unpatched server; it means our primary revenue engine goes dark for 48 hours, costing us roughly fifty thousand dollars an hour.”

11. What’s your best tip for surviving the CISO role in exactly five words?

Own risk management, not risk.

See the other tips shared by other CISOs:

• CISO Tips: Shady Shaker on the 70/30 Rule and Discipline That Scales

• CISO Tips: Dr. Adeel Shaikh Muhammad on Ownership Before Everything

Subscribe now

Subscribe now

Dr. Adeel Shaikh Muhammad is a cybersecurity leader, author, researcher, and international speaker specializing in AI-driven security operations, cyber risk, governance, and enterprise security strategy. He has advised organizations across the GCC and beyond on SOC transformation, AI governance, security architecture, compliance, and cyber resilience. He is the author of AI-Driven Transformation of the SOC and SecOps and frequently speaks on the intersection of cybersecurity, AI, governance, and leadership.

1. Complete this sentence: “Before you buy any new security tool, first...”

Before you buy any new security tool, first define the exact risk, business outcome, and operating owner it is meant to support. A tool without ownership becomes shelfware very quickly.

2. What’s one rule you enforce on your team that other teams would find strict?

No critical security decision should be based only on a dashboard or vendor score. I expect the team to validate context, business impact, and real exploitability before escalating or closing a risk.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

I like to balance security investment across three areas: prevention, detection, and response. If most of the budget is going only into prevention tools, the program usually becomes blind during real incidents.

4. What’s one line that works when asking the board or CFO for a budget?

“This is not a technology expense; it is a risk reduction investment tied to business continuity, regulatory exposure, and customer trust.”

5. What should a CISO cut from their program tomorrow with zero regret?

Any report, meeting, or tool that does not change a decision, reduce a risk, or improve response capability. Security teams are often overloaded by activity that looks productive but does not improve resilience.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

I ask: “What specific risk do you reduce, how do you prove it, and what will my team need to operate it after purchase?” If the answer is only buzzwords, it is not worth the time.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

I have replaced long status meetings with risk-based decision updates. Instead of discussing every open item, the focus becomes: what risk changed, what decision is needed, and who owns the next action.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

They often skip assigning a clear incident commander. Without one accountable lead, teams lose time debating actions, duplicating work, or communicating inconsistently.

9. What’s one question every CISO should ask their team this week?

“If this control fails today, how quickly would we know, who would respond, and what evidence would prove it worked?”

10. What’s a phrase or framing you use to translate a technical risk for executives?

I translate technical risk into business impact: “This is the path from a technical weakness to financial loss, operational disruption, regulatory exposure, or reputational damage.”

11. What’s your best tip for surviving the CISO role in exactly five words?

Prioritize risk, people, and clarity.

Subscribe now

For more CISO Tips, read Shady Shaker’s 70/30 Rule and take on discipline.

Subscribe now

Shady Shaker is a Senior Manager in Cyber Security at PwC Egypt, with more than 20 years of experience in cybersecurity, information security, and risk management. He has spent more than seven years supporting CISO functions, leading initiatives across cybersecurity strategy, security programs, governance, risk and compliance (GRC), and regulatory compliance. He helps organizations strengthen cyber resilience, manage emerging risks, and align security programs with business objectives.

1. Complete this sentence: “Before you buy any new security tool, first...”

Conduct cybersecurity due diligence on all prospective vendors offering similar tools, verify their security certifications and the scope of those certifications, ensure the tool’s capabilities directly support the specific compliance requirements and use cases you are targeting, confirm that robust implementation and ongoing support services are available, and require a proof of concept (POC) to validate the tool’s capabilities in your environment.

2. What’s one rule you enforce on your team that other teams would find strict?

• Enforcement against shadow IT and shadow AI, by establishing clear acceptable-use rules that define which AI tools and BYOD devices are approved and permitted, which data can be used, and which business roles may use external AI services.

• No production change or new integration may go live unless it goes through the change management process, including a documented security review and explicit approval from the security team, regardless of who owns the system or how minor the change may appear.

3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?

My usual advice is to keep about 70 percent of budget and headcount focused on keeping current controls effective: monitoring, incident response, patching, compliance operations, and essential tooling. The remaining 30 percent goes to strategic improvements, automation, and innovation.

4. What’s one line that works when asking the board or CFO for a budget?

This isn’t a request for security spend; it’s an investment to prevent or reduce the risk of a quantifiable loss of X and to protect Y% of our revenue-critical operations.

5. What should a CISO cut from their program tomorrow with zero regret?

• Anything, or any control, that doesn’t reduce risk or support compliance.

• Unused or redundant tools.

6. What’s your 60-second test for whether a vendor pitch is worth your time?

If the vendor doesn’t understand the problem, or the tool doesn’t actually address it.

7. What’s one meeting, report, or process you eliminated, and what replaced it?

The most important thing is to maintain a concise security dashboard supported by a brief written update.

8. In the first 10 minutes of an incident, what’s the one action teams most often skip?

Documenting what is actually happening before they start “fixing” things, and communicating the incident.

9. What’s one question every CISO should ask their team this week?

Understand the existing roadblocks to implementing new tools, identify where time-to-value can be shortened by simplifying processes, and pinpoint manual tasks that can be automated.

10. What’s a phrase or framing you use to translate a technical risk for executives?

Translate technical risks into business risks and their financial impact.

11. What’s your best tip for surviving the CISO role in exactly five words?

Watch threats from emerging technologies.

Subscribe now