Jon Murphy is an SVP, Chief Information Security Officer, and a board advisor with more than 25 years of experience as a CISO, Field CISO, and virtual CISO. An award-winning security leader, published author, and speaker, he helps executives connect adroit management of digital risk, cybersecurity, AI governance, and operational resilience to business value. His guiding principle: “Find the Signal. Ignore the Noise.”
For Jon, effective security leadership means separating real exposure from distraction. His approach includes proving a capability gap before buying new tools, holding every security exception to a named owner and an expiration date, and framing budget and risk conversations around the business’s ability to operate. In this edition of CISO Tips, Jon shares practical lessons on security exceptions, time-to-contain ratios, board budget asks, vendor pitches, and incident communications.
1. Complete this sentence: “Before you buy any new security tool, first...”
“Prove you have a capability gap, rather than an execution gap.” Check what you already own, who will operate the new tool, and what business exposure will measurably decrease.
2. What’s one rule you enforce on your team that other teams would find strict?
Every security exception needs a named business owner, a stated consequence, an entry in the risk register, and an expiration date. “Temporary” cannot become a permanent permission slip.
3. What’s a number or ratio that guides how you allocate budget, headcount, or your own time?
The ratio of our time to contain an attack to the time it takes that attack to cause material harm; the goal is below one. If we cannot act before the damage occurs, that gap deserves priority over another dashboard-esque project.
4. What’s one line that works when asking the board or CFO for budget?
“This is the cost of reducing the chance that we cannot operate, serve customers, or collect revenue, and here is the exposure we retain if we decline.” Give them a business decision with consequences and options.
5. What should a CISO cut from their program tomorrow with zero regret?
Duplicate reporting that consumes analyst hours without changing a decision or meeting an obligation. Your team’s attention is a security resource; stop spending it on formatting the same facts three ways.
6. What’s your 60-second test for whether a vendor pitch is worth your time?
“Tell me what exposure remains after your product is fully deployed, and what work my team inherits.” A vendor who can explain limitations and operating demands earns more time than one promising effortless protection.
7. What’s one meeting, report, or process you eliminated, and what replaced it?
Eliminate round-robin status meetings where everyone narrates information we can read ourselves. Written updates replace the narration; meeting time is dedicated to removing blockers, advancing decisions, and assigning who owns the next action.
8. In the first 10 minutes of an incident, what’s the one action teams most often skip?
Verifying that the response team’s communication channel is trustworthy before sharing sensitive plans. If the attacker is still “inside the wire,” they likely can read your email or collaboration platform; you’re handing the attacker your next move.
9. What’s one question every CISO should ask their team this week?
“Which control are we relying on that nobody has recently proved works?” Ask for a demonstration. The gap between configured and effective is where false confidence grows.
10. What’s a phrase or framing you use to translate a technical risk for executives?
“How long can the business tolerate losing this capability that is vulnerable to this risk, and can we restore that capability within that window?” That makes resilience a concrete operating requirement executives can judge and fund.
11. What’s your best tip for surviving the CISO role in exactly five words?
CARE deeply; don’t CARRY everything!
More tips from the series:
CISO Tips: Merlin Namuth on Earning Trust and Measuring Everything Against Risk
CISO Tips: Samuel Keter on Turning Security Controls Into Business Decisions
CISO Tips: Bryce Austin on Building a Security Program That’s “Secure Enough”
CISO Tips: Stefano Pasotti on Turning Cybersecurity Into Business Resilience
CISO Tips: Maurizio Imperadore on Resilience, Identity and Cutting Security Noise