Staying on top of regulations is a headache for every CISO. But this isn’t just about compliance. What happens when regulations disrupt the sales process?
Check out this post by Geoff Belknap, co-host of Defense in Depth, for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and John Overbaugh, CISO, Alpine Investors. Joining us is our sponsored guest, Pukar Hamal, founder and CEO at SecurityPal.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, SecurityPal AI
Full Transcript
Intro
0:00.000
[David Spark] In normal times, staying on top of compliance and regulations is a headache for every security department. Throw in an urgent last-minute business request, a company merger, or anything that “has to happen.” There’s so much to do with so little time. What do you do in these urgent compliance situations?
[Voiceover] You’re listening to Defense in Depth.
[David Spark] Welcome to Defense in Depth. My name is David Spark, I am the producer of the CISO Series. And joining me as a guest co-host for this episode, first time he’s ever done it, thrilled that he’s here. It’s John Overbaugh, CISO over at Alpine Investors. John, thank you for joining us.
[John Overbaugh] Hey, it’s great to be here, Dave.
[David Spark] Our sponsor for today’s episode is SecurityPal, 100 times faster security reviews powered by both AI agents and expert humans. You get both. More about that later in the show. In fact, the CEO of the company is going to join us today. But before we do that, let’s talk about today’s topic. For years, cybersecurity has been trying to shake off the tired moniker of being the “Department of No.” It’s well known that cyber’s job is to service the business, but what happens when those service requests come in last minute? An urgent compliance check to work with a specific vendor or a business merger that is a looming deadline? In essence, it’s something you hadn’t foreseen, so it just wasn’t on your roadmap. I’m going to ask you, John, what can you do in those urgent moments and how do you handle those requirements going forward? I mean, you don’t want each one to come off as a fire drill, and I’m sure they often do, yes?
[John Overbaugh] That’s right. Yeah.
[David Spark] So, how can we handle this best, so they’re not always fire drills?
[John Overbaugh] Yeah, I think, number one, these are opportunities, right? So, as you’ve mentioned, [Laughter] and as we’ve talked about on the show often, security is often seen as the Department of No, this is an opportunity to really be a business enabler. So, the first thing is always look for a way to yes. And then when that path to yes is bigger than the timeline that is available, try to figure out what are incremental deliverables that can be put together that would start to fulfill the need, create the business relationship, let the contract move forward, but also give breathing room to the team to finish up on all of the compliance that’s required.
[David Spark] Excellent point, John. And the person to help us in this very conversation is our sponsored guest. Thrilled to have them on board, thrilled to have them as sponsors. That’s SecurityPal. We have none other than the founder and CEO of SecurityPal. It is Pukar Hamal. Pukar, thank you so much for joining us.
[Pukar Hamal] It’s great to be here, David.
Who needs to manage the risk?
2:36.046
[David Spark] Steven Jensen, the CISO of Magellan Health, said, “I’ve definitely encountered situations where the business wanted to pursue a contract, whether in the public sector or with a large enterprise, before the right security controls were in place. Often to win the business, you’re expected to agree to have certain controls implemented by the time the contract is executed. But security and business are not always aligned. Sometimes it’s due to lack of maturity, missing controls, limited resources, or budget constraints. The gap can introduce real risk and financial exposure. Compliance requirements, especially in government and regulated industries, are evolving quickly. I’ve seen organizations scramble to meet data isolation or control mandates with quick fixes. But in reality, those don’t exist. You need executive commitment to accelerate data governance and control initiatives well before the opportunity arises.” Now, that was a long quote, but I read it solely because it’s a great definition of the problem. He isolated it beautifully.
Andrew Wilder, CSO over at Vetcor said, “We were dealing with a company in the Middle East that had a security questionnaire, which is pretty standard, but they wanted screenshots of our configurations, which I was not willing to provide. Anything that impacts a potential sale is escalated quickly and to the highest possible level. Eventually, the business accepted the risk in order to make the sale.” All right. So, great setup. Great example of like one of these urgent issues where it’s clear security was not the priority. The business was the priority. The sale was the priority. So, I’m sure you’ve seen this before, John, yes?
[John Overbaugh] Yes. Number of times.
[David Spark] I mean, really the best you can do in this situation is, A, figure out what you can and can’t do, and also explain, like, we can’t do whatever X is in this period of time. You just have to provide what you can do and provide options. I got to assume, yes?
[John Overbaugh] To a certain degree, but I think the key here is not to say what we can’t do. The key is to start with what we can do, right? So, one of the challenges of being in security is you’ve got to be that enabler for the business. So, in this case, in both of these situations, we’re going to look for what we can accomplish and when we can get it done and partner with the business on delivering those solutions.
[David Spark] Okay. I throw this to you, Pukar. This is kind of an issue you saw when you were sort of starting your business, essentially. I mean, this is kind of like, oh, I’ve seen this a million times. What is it that you realized needed to happen? Because this is not a one-time issue.
[Pukar Hamal] No, it’s not a one-time issue and it’s not going away. My first experience with this was at my previous company. We were a small startup. This was circa 2018, and we were building in the sort of highly regulated HR tech industry. So, lots of PII, lots of sensitive HR information. And I remember we were really close to closing this large enterprise deal. The team was giddy. It was exciting. We’re going to close this company. We’re going to bring in a lot of money. Investors are going to be happy. The team was going to be happy. And literally, at like the last mile, I thought like what was a DocuSign in my inbox was actually like a 200-page security review in .docx form with tons of like scary-seeming words, and as a co-founder at the time, I was sitting next to our chief architect and I was just like, “What is this?” It might as well have been hieroglyphics to us, right? Questions about like do we have barbed wire around our data center?
[David Spark] Did they have one like that? Barbed wire?
[Pukar Hamal] Oh, yeah.
[David Spark] [Laughter]
[Pukar Hamal] Barbed wire around our data center, anti-slavery policy. All sort of like, I would say, by and large were questions that were obviously trying to seek a degree of assurance from us as they went about buying our products. Upstream of those questions were regulatory requirements that were forcing these companies to ask those questions to us. And after May 2018, we started seeing a lot of that. May 2018 famously is when GDPR went live and, like, we just ran into a lot of these and that was the pain. I tried to find like a scalable solution out there, but nothing quite hit the mark. And that was really what inspired me to start SecurityPal back in March of 2020, working with early customers like Airtable and Figma to essentially help them map out their security controls and security posture in a way that they could easily explain it to their customers.
And I think with the question from David here, oftentimes what ends up happening is you are asked questions that look very scary. You’re asked all these questions about acronyms that you’ve never seen, but oftentimes you actually have good controls internally. It’s about how do you communicate that and map that to what the company that’s asking you is actually concerned about. It’s what’s the question behind the question, right? They might be asking about data segregation according to some Middle Eastern regulation, but really what they’re asking is like, “Hey, is our data going to be combined with other people’s data and who has access to the production environment? Like, can you just like give us some degree of assurance around that?”
[David Spark] Yes, that is a really, really good point. And I find, and I want to get into this a little bit more and I’m just going to sort of set it up now. This kind of goes back to why I love the sort of the Japanese philosophy of the five whys. Like, why are you asking me this question? Why did you ask me that? Why did you? And then you get down to the core reason. Well, like what you just said, Pukar, that’s the real reason. Okay, then why don’t we just skip to that? Let’s get you the answer to that question, and then honestly, you don’t need 200. Often, you need just five, you know? [Laughter]
[Pukar Hamal] To be honest, I was talking to a CISO, and he was like, “You know, you really just need one.” If I could just talk to the CISO, here’s the one question. This is sort of like the one that I say at all these like cocktail parties I’m at. It’s, if I could just talk to the CISO, I’d be like, “Hey, what keeps you up at night?” That’s it. Because that’s ultimately what you’re trying to get at.
What are the elements that make a great solution?
8:28.458
[David Spark] Louis Zhang of AIA Australia said, “Here’s my approach. If the request is truly urgent and has a clear business impact, whether it’s revenue related, compliance driven, or even survival level, we drop what we’re doing, prioritize it, break it down and conquer it. But if it’s a situation the team’s never encountered before, and we weren’t prepared, then that’s a learning opportunity. We document what happened, build internal knowledge base, and if it’s likely to repeat, we turn it into a process or standard operating procedure. It’s all about turning chaos and risks into capability and opportunities for next time. I love that.
Now, Mike Wilkes of Columbia University said, “We ran into a robot called TISAX, T-I-S-A-X. I was working with a manufacturing client who wanted me to perform a risk assessment. And we’re all ready to go and suddenly, they pull this fairly obscure German automobile industry standard, insist that the project be scoped around preparing for that audit. Well, what did we do? We became experts immediately on the subject in two ways, downloading everything we could find on the standard and worked up a nice mapping for more common regulatory controls so that our talking points only had to address the small delta of controls that were unique to TISAX. Needless to say, TISAX is now part of our arsenal of frameworks and standards, and getting that first audit under our belt was instrumental to the follow-on business that began to show up as more and more suppliers to the German automobile industry began searching for such expertise. Sometimes a bump in the road is a blessing that improves your vehicle and journey.” I love both of those stories, essentially turning a lemon into lemonade in rough sense in that it’s a pain in the butt, but oh, it kicked off business opportunities for us. Have you seen this before, Pukar?
[Pukar Hamal] We sort of call this the security assurance industry at large, but all of these are in many ways opportunities to expand TAM, right, Total Addressable Market. If you look at every sort of like moment where you’re being asked to do something from a particular customer or a segment of the market that you’re going after, if you’re able to figure it out, that’s an advantage you have that your competitors don’t have, and it’s an opportunity for you to, like, move faster into a market and accumulate information, right? Oftentimes information asymmetry, we’re scared by it, but once we learn it, we realize, hey, like in this case, they looked at all the existing controls that they had. Turned out there was a small gap between TISAX and what they were already doing and they closed that, they communicated, and now they’re going forward and maybe they opened themselves up to OEMs, all these original equipment manufacturers, all these automobile companies, but you’ve got to be able to tell that story to the business, right? It’s not just about, “Hey, we had this roadblock, and it was really painful.” No, you’ve got to find a way to say, “Hey, we had this roadblock, and we turned our pain into progress, and now here’s the Total Addressable Market that we can actually go after with this. Let’s put our TISAX attestation or controls that align with TISAX on the front page of our website. Let’s write a blog about it. Let’s share that.”
And I think these are fundamental skill sets that security teams and GRC teams are having to learn, which is before it was just like, okay, we’re just going to do the compliance stuff in our corner, but no, like, the market wants to know that you’re making these investments, and they want to hear from you, and this is a really an opportunity to differentiate yourself, as well. The conversations I have with a lot of the executives is, “Hey, can we flip it?” Right? Can we ju-jitsu this into how do we actually drive our core business metrics, TAM expansion, ARR growth, new markets opening up, improving with retention. Maybe somebody is thinking about turning from your product, but the product that they’re moving to does not necessarily align with these standards. That could end up creating a risk for that business. These are important conversations to have.
[David Spark] All right, John, your take.
[John Overbaugh] Look, Pukar’s spot on, and I want to take a step back then to a couple of things that Louis mentioned in his quote. The first one is breaking it down. This is about chopping wood. Really, when you look at it, maybe this number’s wrong, but there’s about 1,200 security controls, maybe it’s 1,400, maybe it’s 1,100, but really, there’s only so many security controls in the world, so a new standard that comes in can look really scary until you break it down. Once you start to break it down, you realize, as said, there’s probably just a few gaps there, and we can go and address those gaps.
I also love what Louis said about this as an opportunity. If you know about risk management, risk actually has two kind of alter egos. One is risk, potential negative impact. The other is opportunity, potential positive impact. So, every time we look at these new frameworks, we can see them as an opportunity as long as we break them down correctly. The companies that I work with, we talk about TAM all the time and security-led growth. All the spaces we’re in, we start looking for ancillary markets that have impediments to entry, which include complex cybersecurity because generally it’s not complex and it can be done. This is why I succeed in my role, is because I focus on that growth, and we talk about growth all the time. We’re enabling the business to expand.
Sponsor – SecurityPal AI
13:52.170
[David Spark] Before I go on any further, I do want to tell you about our actually spectacular sponsor, and that would be SecurityPal AI. So, founder and CEO, Pukar Hamal, our guest for today, he actually told this story. He was about to close the biggest deal of his startup career, and then when boom! A 200-page security questionnaire landed in his inbox, and that was the moment that inspired SecurityPal AI, and I bet you, you have had similar moments yourself. So, why did this become such an inspiration? Because companies waste thousands of hours and millions of dollars on security assurance requests while juggling GDPR, FedRAMP, DORA, NIS2, and AI Act and more. If you’re a CISO, a CIO, or a GRC exec, you know these headaches: 300-question reviews that stall deals, compliance requests that snowball, vendor approvals that grind to a halt. But don’t worry, SecurityPal AI and their adorable Himalayan mascot, the SecureYeti, they’re on the case.
SecurityPal AI solves that with a blend of fast, accurate AI and a global team of certified security and GRC experts. So, you’re not being left in the lurch here. This is good. You get 24/7 coverage, enterprise-grade precision, and turnaround times in hours, not weeks. Whether you’re handling outbound questionnaires, inbound reviews, or third-party risk management, they eliminate the friction so your teams can focus on growth. Because heck, that’s what we’re talking about here, right? These things can sometimes hinder growth. Forbes featured SecurityPal AI. Fast Company called them one of the most innovative AI companies since 2025. You need to find out why as well. So, if you’re ready to eliminate friction and win trust faster, go to their website. It’s securitypal.ai. Go check them out. And when you check them out, let them know that you heard about them on the CISO Series.
What are they looking for?
15:54.518
[David Spark] Aniket Kulkarni, who’s a global CISO over at Circle, “These moments define one’s security culture.” I like that. “We once got a ‘must-go-live by tomorrow’ request. The tool needed full production access, zero notice. Yay. Well, instead of blocking, we partnered fast, staged a safe replica, scoped access with zero-trust principles, and enabled delivery without compromising posture. Security gate is now part of the velocity path. Pre-approved blueprints accelerate safe adoption. Access is risk-scored, time-bound, and justified. Security didn’t say, “No.” We said, “Not like that, and found a better, faster way together.” Ooh, that’s a good way of putting it.
And Duane Gran of Converge Technology Solutions said, “Just a few security questions would end up haunting us. Years ago, I joined a closing meeting to set up a sales partnership between our medium-sized company and a much larger organization, which was literally 100 times bigger. We were the niche player in the market, and we fit into their portfolio for a combined sales strategy. Anyhow, everyone felt great about it. But as an afterthought, our colleague mentioned that their security team would have a few follow-up questions. Ooh, easy, right? Nearly a year later, we could finally sign contracts because in order to capitalize on this opportunity, we needed to radically put on the big boy pants of security program management to engage this partnership. It was a big adjustment, but like most times you were challenged to step up your game, in the end you were stronger for it. So, John, I’m going to throw to you on this. These two quotes are about you as a security professional being approached with the challenge to do this and people essentially meeting the challenge. And that really is kind of a sign of a great security professional, yes?
[John Overbaugh] That’s right. Yeah. The will to get to yes in every situation is what makes the difference between a long tenure in a company and a short tenure in a company.
[David Spark] I think the reason that security professionals have had the Department of No is no is easy. It’s easy to not do something. It’s very easy.
[John Overbaugh] No is easy. And yes is scary, right? Yes means I don’t know how we’re going to make this happen, but we’re going to make it happen. So, courage in this role is really important. Courage and the same commitment to closing a deal that the sales team has, just figuring out how we’re going to get there.
[David Spark] I’m going to throw this to you, Pukar. The way I see it, SecurityPal is offering these great moments of triumph. I think you’re trying to help your customers in that way. So, let us be that asset to you to have that moment of triumph. I would hope you would like to think of your product that way. Yes?
[Pukar Hamal] Yeah, absolutely. We see ourselves as we’re here to accelerate global GDP by solving these security assurance challenges and bottlenecks at scale. I mean, fundamentally, if you think about my journey in my previous company as a founder of SecurityPal, we were really close to closing this deal. We couldn’t close it. Well, what did that mean? Well, this company didn’t get access to the innovation that we had, and thus they could not hire faster, and thus they could not grow faster. And so, in many ways, our inability to deliver assurance quickly slowed down transactions, and slower transactions means less innovation. Less innovation means less human progress in many ways. And so, there’s a really logical chain. And when we go into every relationship with customers, we had a customer where it was taking them a month on average to turn around security questionnaires. When we got that down, on average, by the way, so imagine 50% are greater than that, right?
[Laughter]
[Pukar Hamal] So, like, that’s pretty painful. And so, when we got that down to sub-24-hour turnarounds, what does that do to the business? What does that do to the customer that they’re dealing with that, like, “Wow, you guys are really buttoned up. Like, we sent it to you, and it was back the next day.” What does that…? It maintains that deal momentum. It’s like, “Oh, wow, like, you guys are with it.” And we’ve actually had a lot of our customers say, yeah, like, they were impressed at how quickly we got this turnaround, all the documentation, everything like that, and everyone was happy. And like, what’s the last thing, like, a CISO wants? The CISOs don’t want to be the Department of No. They don’t want that deal to be escalated by the CRO to the CEO to the board being like, “Oh, it’s held up in security.” Like, how awful is that? That’s like the last thing that we want, to be viewed in that way.
And that’s why I think it’s so important for us to remove these blockers because in many ways, I think what’s happening in the world is there’s a lot more need for assurance because there’s a lot more data at risk. If you go back 50 years ago, we didn’t have our data flying around in all these systems all the time. We had it in file cabinets and secure buildings and stuff like that. But now everything moved to the internet. So, like a lot of commerce touches the internet now. And so, that’s, I think, one of the things that’s leading to all these like regulations is because of the fact that, hey, commerce is touching the internet, our data’s everywhere, and the need for trust and the need for assurance, it’s permeated across the world for valid reasons.
[John Overbaugh] The other point that I want to call out on this is it doesn’t have to be all or nothing, right? When you’ve completed that security assessment, if there are gaps, we can move forward sometimes. So, I’ve been on the opposite side where I’ve been at a large company, heavily regulated, looking to partner with very nimble, fresh new technologies. And sometimes the technology was ahead of the security at those companies. We found ways to get them integrated. We would bring them into non-production environments so they could demonstrate and prove their value on de-identified data. Those kinds of strategies really work to help drive innovation and drive growth and yet still kind of keep everyone on schedule.
Well, I guess that’s one way to solve it.
21:48.945
[David Spark] Anatoly Chikanov of HealthEquity said, “I had it happen quite a few times when working with energy utility customers. Now you would need to be NERC-CIP certified and not having this certification was an issue. However, the way we resolved it was by taking a deeper look at the regulation and at our product and finding that we didn’t really fall under the scope of the regulation because we wouldn’t have moved enough load to the grid to satisfy the regulatory requirement. So, I would recommend to closely look at regulation and see if it’s even applicable. Oftentimes, third-party risk teams on opposite sides think it’s applicable to you as a vendor, but that’s not always the case.” So, I’ve had this before. I’ve had requests from sponsors and when I was not doing this as a contractor, making requests, I go, “This isn’t appropriate for me.” And what happens is the reason you get these is they just have a blanket form for everyone, and if it’s not appropriate for you, it’s not appropriate. And you kind of need to explain that. Yes, I’m assuming you’ve run into this, John, yes?
[John Overbaugh] 100% yeah. Yep. I totally agree with Anatoly’s strategy here. In fact, I encourage my companies to go one step further, even if they’re in regulated industries. If they can de-identify that data, they no longer have to comply with those regulatory requirements. Same when they share it with a third party. The best data is the data you don’t have or the data that’s not regulated. It’s a lot easier to comply in those situations.
[David Spark] Okay. I’m throwing this to you, Pukar. Let me ask – with your tool, do you sort of integrate what the business is and are you able to essentially say not applicable when these questions come up, yes?
[Pukar Hamal] This is the most important thing to understand about a lot of these processes. So, oftentimes the company that is actually sending you the requirements, whether it’s an addendum, whether it’s a questionnaire, whether it’s some sort of like portal, it’s not even the company itself. Sometimes they’re outsourcing it to a third party. Sometimes it’s some division that has no idea what your product is actually going to be used for. So, back to John’s point, that it’s a blanket questionnaire. So, that’s why it’s so important to have a strong handle on your own GRC and security posture, and such that every answer that you share is highly defensible, right?
We talk about all the time at SecurityPal about having high-quality defensible responses, where if somebody says, “Hey, you said here that you don’t comply with this or this is not applicable,” you can be like, “That’s correct. It’s not applicable because we are a sub-500-person company.” Or all data in your instance is actually already hosted in Europe. Or some specific thing, documentation that you could point at. And oftentimes, that exercise is enough, right? Again, back to the point. There are a lot of third-party organizations that send these types of requests, and they have an obligation on their end to hit certain types of billable hours, right? They have their own set of incentives. And so, we had a customer that sort of called it as like, oh, like they have their wizard, so you have to have your wizards like sort of like fighting them a little bit. They have their warlock, you got to have your warlock [Laughter] type of thing. And I think that’s right. I think you want to be well equipped with the language and a good, strong understanding of what your controls are so you can represent it. And if you’ve done the correct things that most CISOs know today, most GRC leaders know today, then you can stand, like behind the posture that you have, and it shouldn’t create too many hurdles.
So, I think this is a great strategy of just saying, “Hey, like a lot of these things are not applicable.” And then it really also is important to talk to who’s the business buyer on that end? Because the business buyer’s not always the person that is actually taking you through this stuff. It’s a different division, right? It’s the risk department is doing the risk analysis on you. And the business department, it’s just they’re following the procurement train.
[David Spark] Not all forms fit all sizes, essentially.
[Pukar Hamal] Exactly, exactly. And so, I think it’s important to just be aware of, again, what is the question behind the question? What are they really asking for? Do they even know what your product is? And so, we’re always, like when we share our information, we have our Trust Center, freetrustcenter.com. You can go and get your own as well. And that, we can just redirect people to that artifact. And then the fact that in every answer that we share, we say, “Hey, listen, we’re a cloud service platform. All data is hosted in the US, in Iowa, GCP Data Center. These questions are not applicable given the nature of the product and services that we provide.” It’s just important to constantly repeat that. Like, repetition is so important.
Closing
26:44.259
[David Spark] Well, this brings us to the point of the show, and I’m going to ask you, Pukar, first, which quote was your favorite and why? So, looking back at the quotes that I read, which one was your favorite and why?
[Pukar Hamal] I really like the one from Mike Wilkes at Columbia University.
[David Spark] Talking about TISAX.
[Pukar Hamal] Yeah, TISAX. Because I think it’s just such a good point that like these acronyms, these new regulations are going to continue to come down the line. Having the mindset that, hey, it’s not scary because we know what we’re doing. We’ve invested in security and GRC. We’ve invested in the controls. It’s a matter of understanding what’s going on. And how do we ju-jitsu this into expansion for the business? How do we actually position ourselves as experts? They actually became experts immediately on the subject. That is such a helpful guide for how other people should think about it. Like instead of thinking about it as a nuisance, “Oh, how do we ju-jitsu this into actual growth? How do we ju-jitsu this into like being able to deliver superior assurance and trust to our customers so we can win faster, so we can penetrate markets in a more compelling way?” And you become this business enabler that John has been talking about throughout the conversation.
[David Spark] All right, John, your favorite quote and why?
[John Overbaugh] My favorite quote is from Aniket. I just love the idea, the approach taken here, where you break it down, you map the controls to your existing controls, figure out what the gaps are, and put together a plan to address the gaps.
[David Spark] Very, very good point. Well, thank you very much, John Overbaugh, who is the CISO over at Alpine Investors. Thank you so much for joining us again. And I want to thank Pukar’s company, that is SecurityPal, 100 times faster security reviews powered by both AI agents and expert humans. A nice combination right there. Pukar, do you have any special offer you would like to give to our audience?
[Pukar Hamal] Well, one thing that we’ve done, we’re big on just giving away software for free, especially to a lot of companies that, again, like breaking down the information asymmetry, right? So, we’ve given away our Trust Center for free. So, you can get a free version of our Trust Center at freetrustcenter.com. It’s a great artifact asset to use. It’s used by publicly traded companies, fast growing startups. That is a unique offer that you can just sign up for, and you can say David at Defense in Depth sent you in the notes and comments, and we’ll try to expedite it as much as possible. So, yeah.
[David Spark] Say Defense in Depth, CISO Series, my name, whatever you would like. Just let them know that they’re valuable sponsorship and your learning more about them came from us.
[Pukar Hamal] The other thing is the team in the US, our headquarters is in San Francisco. We have an office in New York City, but we actually have a large team in Kathmandu. Our office is exactly 100 miles away from the top of Mount Everest. We had that inaugurated by the US ambassador to Nepal. One of the things we’re doing is we understand that CISOs have a lot on their plate, so we’re trying to close the security talent gap by building our own sort of like academy. We partner with universities to train top-notch students in cybersecurity so they can do some of this work, and this becomes training grounds for them to work on before they go on to like being in a CISSP or working at companies and moving on in their like security careers. Because this type of work can be a really great way to get the reps right, get the practice to then go on and build a career in security. So, we have a team of 200-plus professionals, the vast majority of which are actually certified, and we take them through Security+, ISC2, Cisco, other certifications, and it’s a 24/7 facility.
[David Spark] So, if someone wants to learn more about that, what is the name of this program?
[Pukar Hamal] We call it our Security Operations Command Center. You can just go to securitypal.ai or securitypal.com, and you can find out more about it on the website.
[David Spark] I’m assuming you’re always looking for more people, yes?
[Pukar Hamal] Yeah. We’re always looking for more cybersecurity experts, obviously here in the US for our customers here, but also in our Security Operations Command Center, which is 100 miles away from the top of Mount Everest.
[David Spark] With that said, thank you very much, Pukar. Thank you very much, John. And thank you to our audience. We greatly appreciate – I really, really mean this – we greatly appreciate your contributions and for listening to Defense in Depth.
[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.