Cybersecurity expertise is a rarity on company boards. So what does meaningful governance mean where there is a fundamental gap in understanding?

This week’s episode is hosted by me, David Spark, producer of CISO Series and Andy Ellis, principal of Duha. Joining us is Dmitriy Sokolovskiy, senior vice president, information security, Semrush.

Join the conversation on LinkedIn.

Huge thanks to our sponsors, Dropzone AI and Strike48

Full Transcript

Intro 

0:00.000 

[Voiceover] Biggest mistake I ever made in security, go! 

[Dmitriy Sokolovskiy] Not putting enough time into maintaining relationships. Every time I run into a problem inevitably comes back to either me or my team not putting enough time into a relationship. 

[Voiceover] You’re listening to CISO Series Podcast, recorded in front of a live audience in Boston. 

[Applause]

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the host and producer of the CISO Series. And on my far left over there, that is Andy Ellis, who is my co-host. He’s the principal of Duha. Let’s hear it for Andy. 

[Applause]

[David Spark] Say hello to the audience and please feel free to plug your book. 

[Andy Ellis] Good afternoon, folks. I was just having fun pulling up my book and pointing out…

[David Spark] The book, 1% Leadership.

[Andy Ellis] 1% Leadership and just pointing out that I have a chapter for Dmitriy’s bad event, which is celebrating victories builds relationships. Always help people celebrate their victories because other people aren’t doing that. It’s a cheap and easy way to make friends.

[David Spark] Yes. Not just happy birthday, by the way. I find that the weakest way to celebrate. 

[Andy Ellis] That’s a weak way, but I used to do cake with the CEO. 

[David Spark] Mm-hmm.

[Andy Ellis] When somebody fixed a major problem that I had told the CEO existed, we would get cake, bring it to the meeting with the CEO, and have the team show up. They would get cake and I would say what amazing things they did. 

[David Spark] So the more problems you solve, the fatter the team got. 

[Andy Ellis] Absolutely. But I would have people saying, “What do I have to do to get cake with the CEO?”

[David Spark] Solve a problem. 

[Andy Ellis] Solve a problem.

[David Spark] There you go.

[Andy Ellis] And they would say, “Well, what’s the list?” And we would give them something to go do. 

[David Spark] Let me explain to the listening audience where we are. We have a nice, wonderful live audience in front of us right now. We are at Aqueduct Technologies offices, they’re a VAR and they have a beautiful, this atrium space which is gorgeous that we’re doing this show under.

So let’s hear it for our host, Aqueduct Technologies. 

[Applause]

[David Spark] And let’s also hear it for our sponsors and let me mention our two sponsors for today’s episode. We have Strike48, the agentic operations platform without blind spots, and Dropzone AI – hunt, investigate, and respond at machine scale. Let’s hear it for those sponsors as well.

[Applause]

[David Spark] And we will hear more about them later in the show. Okay. So, briefly, I always ask Andy before we do show, like, what do we want to do a quick banter about for just about one minute, and you brought up something called red button/blue button.

This is a sort of philosophical exercise. Explain.

[Andy Ellis] Yeah. So, it’s this meme going around that everybody on the planet is given two buttons. If half of you press the blue button or more, everybody on the planet lives. But if fewer than half of the people press the blue button, then only the people who pressed the red button live, and what do you do?

And like Mr. Beast did this on Twitter, and apparently, he got like 54% of the people to pick the blue button. The correct answer is to push the red button because the right way to phrase this is if you push the red button, you live. If you push the blue button, you die unless you manage to emotionally blackmail 50% of the planet into dying with you, at which point the person who set up the trolley car problem decides not to kill you all.

Push the red button. 

[David Spark] No, but here’s the other thing. If you press the red button and not enough people press the blue button because you’re one of the people who did not press the blue button, then you’re going to live a miserable existence with half of the planet gone.

[Andy Ellis] No. It depends on which half, but look…

[David Spark] No! I don’t think…

[Andy Ellis] …the fact that you want to commit suicide. 

[David Spark] Okay. This half is gone.

[Andy Ellis] Okay. If they were all foolish enough to press the blue button…

[Crosstalk 00:03:49] 

[David Spark] This half, this half is gone. [Laughter] 

[Andy Ellis] Well, there’s a couple of people I think should move over, but the correct phrasing is the blue button, people are trying to commit suicide and trying to convince you to join them in hopes that that will cause them to not die. Push the red button first because then you live and everybody who pushes the red button lives.

This is not that you live at the expense of someone else. They’re trying to blackmail you into feeling like it’s your fault they died. It doesn’t work that way. 

[David Spark] No, it’s true. It is. And so now we all know we can’t trust Andy. All right. 

[Andy Ellis] You can absolutely trust me because you know I will push the red button. Very predictable. 

[David Spark] And send us all to our demise. 

[Andy Ellis] No, you will send yourself to your demise by pushing the blue button. 

[David Spark] I am more supportive of the people around me.

[Andy Ellis] I’m absolutely supportive, which is why I’m telling them not to rely on you pushing the blue button. 

[David Spark] Press the blue button. 

[Laughter] 

[David Spark] To my immediate left right here is our guest for today, and I’m thrilled that he’s here. A repeat guest, we’ve had him on many times before, senior vice president of information security over at Semrush, which just recently got bought by Adobe.

Let’s hear it for Dmitriy Sokolovskiy. 

[Applause]

[Dmitriy Sokolovskiy] Thank you, Dave. Thanks. 

Is AI going to help us or hurt us? 

5:00.429 

[David Spark] “Every repository of code you rely upon just became a liability with a clock on it.” That’s Rob Joyce, who spent 35 years in an NSA leadership watching offense/defense dynamics shift. He’s now saying Mythos, Claude Mythos, is different.

Not an incremental change – a structural break. Now, agentic vulnerability discovery operates at a scale that makes the entire concept of patch and defend feel like bailing out a ship with a cup. I’m going to start with you, Andy, on this. Does this move technical debt from a budget problem to an existential one?

And is this a transition point we’ve never managed before? And just right now, I’m boiling it down to what are the questions we need to ask ourselves to determine first steps? 

[Andy Ellis] So first, I just want to disagree with some of his language, even though I mostly agree with him on this one.

[David Spark] Okay.

[Andy Ellis] Which is rare. I usually don’t agree with Rob Joyce, but he’s clearly never been an accountant with double-entry bookkeeping because every liability you have is matched by assets. You want more liabilities so you have more assets. Like literally, these are going to balance out.

If you only look at code as a liability, then you’re not looking at the fact that code is also an asset that brings you value. And so even the language you use is broken. Technical debt? Most companies are debt fueled. Most homes are debt fueled. Debt is just part of our economy.

The language feels fraught with risk, but it’s not really, and it doesn’t help to have conversations there. But let’s come down to really what the challenge here is. How many people in the audience have a car? Everybody’s going to raise their hand because we’re in Boston.

It’s not really safe to ask this question in Tel Aviv or San Francisco, where half the people don’t. 

Imagine if some random person in your family, and it could be your kid or someone else, says, “I found out about a security flaw in your car. I’m going to go fix it.” And you’re probably going to look at them and be like, “No, you don’t touch my car.” I have a dealer, I have a mechanic, or whomever that deals with my car.

This is how security professionals interact with code today. We are not the people who maintain software, and yet somehow, we think we get to decide and go patch things. And this is the biggest sin of software engineers, is they have convinced the rest of the business that that is in fact how it works.

That the security team is responsible for fixes, yet the software teams aren’t going to bother doing them. 

It is the responsibility of the software engineering organizations to patch software, preferably before it ever goes out. And until we as organizations hold them accountable to it, we are… Oh, wait. We’re not an explicit podcast, so we’re foxtrotted at that point.

Like it’s not our problem to fix, but we should be pointing out not the problem of what vulnerabilities are there, but the problem that engineers aren’t fixing them. That’s the problem.

[David Spark] All right, Dima, jump in on this. Someone… Sue likes what you had to say. 

[Dmitriy Sokolovskiy] I do agree, and I think that’s the existential problem that we’re dealing with. The fact that we have crappy software, we’ve been making crappy software for the last 20, 30 years, and we continue to do so now at faster speed…

[Andy Ellis] Yep.

[Dmitriy Sokolovskiy] …because we can, and no one is going to stop us. That’s what product is saying right now in many cases. Now, is this a transition point that we’ve never managed before? That’s not true. I think in many places, I’ve seen this infidelity, let’s say 10 years ago, where their infrastructure is ephemeral.

It doesn’t live long enough to cause damage because they’re continuously redoing it. Now, that’s a change in everything about how you release your product, how you run things. Now, instead of trying to build infrastructure to run a product, we should all change the mindset into we’ve got to build the infrastructure that can survive this and then build the product to run in that infrastructure.

That’s the existential problem we’ve got to fix. 

Surprising research just in! 

9:02.794 

[David Spark] “Most boards are simply completely incapable of overseeing cyber risk. It’s just so far outside of their experience and their expertise that all they can do is assess the credibility of the executives that are put in front of them.” Now, a field study of 38 directors, CISOs, and consultants in the journal Management Science confirmed what most security leaders already suspected.

Non-expert boards go through the motions, like asking questions they don’t fully understand, receiving reports they can’t critically evaluate, and unknowingly letting CISOs set the very terms of their own oversight. Cybersecurity expertise sits on fewer than 15% of public company boards.

The more interesting question isn’t how to shame boards for this gap, it’s how do you extract maximum value from directors who hold governance authority? So, I’m going to start with you, Dima, on this. How do you get more value out of those who don’t have expertise?

[Dmitriy Sokolovskiy] I don’t think they need to have the expertise in their majority, but they do need to maintain the fiduciary responsibility. It’s not just making sure that we don’t lie to them, it’s not just about specifically me, it’s about going a little bit further.

Some of them that don’t know technology, don’t understand the things, do still understand the things in their terms – business, finance, etc. 

[David Spark] And that’s why we always talk about this, it’s important that you translate to business risk. 

[Dmitriy Sokolovskiy] But I think they don’t do enough about driving us to those conversations. We’re being asked to tell them how things are, and we’re not given any guidance. And if the situation is, look, tell us how it is, but please account for the fact that we don’t understand.

We need you to tell it to us in the following terms. Here is a finance consultant that can work with you to quantify cyber risk in your company. 

[David Spark] I’m assuming this took you a while to figure out yourself, yes? 

[Dmitriy Sokolovskiy] The last almost 10 years’ worth of board conversations is where this kind of landed, but I got to give credit to the boards I was dealing with, they understood, and some of this was happening in the conversations we had. So, it is happening somewhere, but maybe not enough.

[David Spark] Andy? 

[Andy Ellis] I just first want to disagree with Dmitriy, if you’re trying to quantify cyber risk, you’re doing something very badly wrong. 

[David Spark] By the way, Andy has a lot of opinions on this. Go for it, Andy.

[Andy Ellis] I’d recommend going to howtoCISO.com and getting Volume 2 on Risk, and it will teach you a little bit more there. Sorry, I just had to do that one. Look, I want to agree with this, with the question it’s not even asking, simply because, hey, if you’re a company out there that needs cyber expertise on your board, I’m an experienced board member and an experienced cybersecurity professional, it’s in my interest to say you should get more of me.

[David Spark] All right, so also get Andy’s book, 1% Leadership. 

[Andy Ellis] But let’s just be very clear, other than the CRO and the CFO, boards do not have the expertise to engage with most of the executives. A CMO walks into the room and boards just go blank, right? They see someone talking about a pipeline number that’s a joke because the size of the pipeline is usually 30 to 40 times the size of their revenue, and they’re like, “What is this?” But that’s okay, we’ll get you in, we’ll get you out.

So, this is not a problem unique to CISOs. Every executive has this problem. The best executives talk to their board outside of board meetings. If you would like to engage with your board, most directors will happily take a meeting with you and dig in on your data and have the conversation.

When I was a CISO, I had a 17-page report ready to go all the time whenever a new board member showed up that I sent them, that explained to them what the company did because nobody else had done that. I said, “Here’s all of our product lines, here’s the sorts of risk they bring us, here’s what we do to mitigate it, so that when you hear about a thing and you’re surprised, you can refer to my guide.” They were using my language before the product people’s language because product wasn’t briefing them.

I got to get a step ahead. So this is the real answer, and Dmitriy did hint at that one as well. Talk to your board outside of a board meeting because a board meeting is Kabuki theater. What you say, the CEO has already blessed. You’re not setting the terms of your own oversight, the CEO is doing that, and you’re just working around the edges.

[Dmitriy Sokolovskiy] So, you’re saying teach them?

[Andy Ellis] Yes, but don’t teach them in a way that sounds like you’re teaching them. You’re just being open and transparent and recognizing that their time is valuable in a board meeting and not wasting it there and giving them the opportunity to ask questions in front of you that they might not ask in the board meeting because they’re afraid of looking stupid.

But they’ll ask you a question one-on-one. 

[Dmitriy Sokolovskiy] Yeah, and I can concur, this is what happens. When you engage one-on-one with the board members that have some connection, this is what happens. 

Sponsor – Dropzone AI 

14:02.607 

[David Spark] We have two wonderful sponsors, and I want to tell you about both of them, but we’re just going to do it one at a time here. So, let me ask you something. What does your SOC do at three in the morning on a Tuesday? New threat intel drops, an attack pattern targeting your industry, your team is four people, all on day shift and already behind.

By the time someone gets to it, the window for early detection has closed. 

Dropzone AI is built for exactly this problem. AI agents that investigate alerts, hunt threats, and respond to attacks across your full security stack while your team sleeps, or eats lunch, or focuses on the work that actually requires a human brain.

These aren’t chatbots or Copilot, they are autonomous AI agents that query your tools, follow the evidence, and deliver completed investigations with every reasoning step visible. No black box, no hidden humans, your analysts direct the strategy, the AI agents handle the volume.

Now Dropzone is deployed at over 300 organizations and recognized by Gartner as a cool vendor for the modern SOC. You want to learn more? You got to go to their site, dropzone.ai, and when you go, let them know you heard about them from the CISO Series.

It’s time to play “What’s Worse?” 

15:38.982 

[David Spark] All right, I’m assuming you are all aware of the game “What’s Worse?” Yes? You’ve listened to the show, you’ve heard this, we’ve been doing this game since the beginning. These are two awful scenarios. Andy is already scribbling down, he’s going to write notes down.

By the way, this, I would say, variations of this, I think, are playing out right now. Okay? This comes from Jeremy Trammell of Check Point Software, thrilled that he sent this in. Andy’s going to answer the scenario first, then Dima, you can agree or disagree, and then I will throw it to the audience by applause.

We’ll see which of the two scenarios you like. 

All right, scenario number one, I’ll just title it, Taking the AI Lead for Competitiveness. Security be damned, we’re moving fast. Who knows what risks are coming on? We’re going to win. The goal is to beat competition to the market. Security implications of AI agents running wild are completely unknown.

The business’s attitude has always been, we’re business first, security second – I would say all businesses are like that – but the risks are so completely unknown because we have no idea what these agents will do. You’ll get to implement security, but you won’t know until after the agents are deployed.

That is scenario number one. 

Scenario number two, company is very risk averse. They’re playing it very safe with AI adoption, moving very slowly, and getting the security team involved at every step. Sounds great, but they’re in a very active space and their biggest direct competitors have made it clear that they’re pushing forward fast and aggressively with AI adoption.

So it sounds like they got competitors in scenario number one. So lack of AI adoption could set your business and company back years, but if your competition missteps, you could step ahead. Andy, which one’s worse? 

[Andy Ellis] Okay. So this one’s an interesting one. Can I specify the size of the company? Because I think that actually does matter.

[David Spark] Sure.

[Andy Ellis] Okay. So you said active, competitive, aggressive space. So, we’re not talking really large multi-billion dollar established companies. 

[David Spark] Probably not. 

[Andy Ellis] Great because that definitely will change things. 

[David Spark] Those guys are, in general, more risk averse. 

[Andy Ellis] So, there’s this great article about the Redmond versus the Cambridge approach to delivering software. This was probably written 25, 30 years ago, which basically says there’s two ways that you can build software companies. One way, the Redmond way, à la Microsoft, is take something that’s barely minimally functional and put it in the hands of users so that you grab all the market share.

The other, the Cambridge way – yes, Cambridge, Massachusetts, named after MIT – is to wait until you have a perfect thing and then try to get it in the hands of users. One of these builds large companies. One of them does not. 

And that’s basically what we’re facing here, which is, do you want to have a company at the end of this? Because if so, then you’re going to adopt option one. You might not have a company. Just to be clear, you still might fail. Bad things can happen.

But chasing option two is the way to not have a company because you have a run rate. You have so much time until you’re out of business. And if you don’t have market share…

[David Spark] Hold on, but you’re assuming scenarios too. It’s a startup. These two are startups with that attitude. 

[Andy Ellis] If you are relying on the fact that you’re going to get to keep whatever revenue you have and maintain profitability in an aggressive and changing space while you are not innovating, you might as well function like a startup. 

[David Spark] This is not saying they’re not innovating, just means they’re moving slowly. The first one is moving fast and breaking stuff. 

[Andy Ellis] David, I’ve been in these meetings. If you have security involved at every single step and you don’t make any progress until the security team says yes, that is a very polite code word for saying you are not making any progress at all and you are death by committee.

[David Spark] Okay.

[Andy Ellis] We’ve all read the KGB manifesto about how to destroy American corporations and it’s that. So, I’m going to say that scenario two is much, much worse. 

[David Spark] Okay. All right, Dima, you agree or disagree? 

[Dmitriy Sokolovskiy] I agree. There’s higher risk, much higher risk in not adopting this technology everywhere possible than anything else. 

[David Spark] Okay. All right, I’m throwing this to the audience. So, scenario number one is taking the AI lead for competitive, moving fast, and breaking stuff. By applause, how many people agree with the two of them? By applause.

[Applause]

[David Spark] All right. You can’t applaud.

[Laughter] 

[David Spark] It’s the audience. All right. By applause, how many people think you got to be a little risk averse here, you got to be a little safer here. By applause, how many people think that’s the right strategy? One person. Little louder. Come on.

Clap loudly. 

[Andy Ellis] What’s your name?

[David Spark] Jermaine. 

[Andy Ellis] Jermaine with a J? A-I-N-E at the end? 

[David Spark] All right. What’s… 

[Dmitriy Sokolovskiy] He’s writing.

[David Spark] Oh, he’s giving you a copy of his book is what he’s doing.

[Dmitriy Sokolovskiy] He’s signing a book, yeah. 

[David Spark] Good job. 

What are they talking about? 

20:34.451 

[David Spark] All right. We have a new game. Well, we’ve played it a few times. So, I’m going to play a series of sound clips of people answering a question for which you do not know what the question is. Your goal in this game is to figure out what question were they answering, and I’ll give you a hint.

All of these are what a CISO would say if. Okay? All four of these are that. All right. So, we’re going to go to the first one. We’re going to let you two try. You can keep guessing. 

[Andy Ellis] I’m always bad at these games. 

[David Spark] After you do, we’re throwing it to the audience. See if they can get it.

[Andy Ellis] Okay.

[David Spark] Okay, here we go. First clip. You’re going to hear multiple people answering. They’re all answering the same question. All right? So, it’s what a CISO would say if. 

[Voice 1] At least it wasn’t an insider threat. 

[Voice 2] That went worse than I expected. 

[Voice 3] Hopefully, you will still have a CISO tomorrow. 

[Voice 4] How many lawyers am I going to have to be speaking with for the next six months? 

[Andy Ellis] They got breached?

[Dmitriy Sokolovskiy] It’s got to be. Something like that, yeah. Incident. 

[David Spark] Yes, that is correct. You got that right. Good job. 

[Applause]

[David Spark] All right. 

[Organ music]

[Andy Ellis] It’s the first time I think I’ve ever gotten one of these right on the first try. 

[Dmitriy Sokolovskiy] It’s because I’m sitting next to you. 

[Andy Ellis] Yeah, there we go. 

[David Spark] All right. Here’s the second one. 

[Voice 1] Got some budget you want to share with me for that? 

[Voice 2] We’ll do our best, but no promises. 

[Voice 3] Do you want us to award prizes? 

[Voice 4] Sorry, we can’t. It’s something everybody hates. 

[David Spark] All right. I will just say…

[Andy Ellis] What was the last one?

[David Spark] I’ll play it. “Sorry, we can’t. It’s something everybody hates.” I’ll play it again. This one is a lot tougher than that first one. I’ll play it again. 

[Voice 1] Got some budget you want to share with me for that? 

[Voice 2] We’ll do our best, but no promises. 

[Voice 3] Do you want us to award prizes? 

[Voice 4] Sorry, we can’t. It’s something everybody hates. 

[Andy Ellis] So, you’re being asked to implement something, but I’m trying to figure out what the thing… Because the last one implies it’s a specific thing instead of just like you’re being asked to go deploy something new. What does everybody hate?

[Audience member] Yes.

[Andy Ellis] Besides security awareness training. 

[Dmitriy Sokolovskiy] Yeah, awareness training, that’s probably like… 

[Andy Ellis] [Laughter] 

[David Spark] Hold on. Okay, you’re right. I’m giving you a half a point for that, but there’s something specific that brings that about. So, I’ll play it one more time. 

[Voice 1] Got some budget you want to share with me for that? 

[Voice 2] We’ll do our best, but no promises. 

[Voice 3] Do you want us to award prizes? 

[Voice 4] Sorry, we can’t. It’s something everybody hates. 

[David Spark] So, listen, you got the right part on the security awareness training, but there’s something specific about that that the first few sort of give you clues on. 

[Dmitriy Sokolovskiy] Prize is something about money, like…

[Andy Ellis] Oh, like a bug… Can’t be a bug bounty. Oh, incentivize, like paying people for doing good security awareness training?

[Dmitriy Sokolovskiy] Like awareness competitions.

[Andy Ellis] Like awareness competitions.

[Dmitriy Sokolovskiy] Like you reported the [Inaudible 00:23:19] gamification. 

[David Spark] Oh, you’re dancing around and I’m throwing this to the audience. 

[Dmitriy Sokolovskiy] I don’t know.

[David Spark] It’s what a CISO would say if. What do you think? 

[Audience member] Phishing simulation. 

[David Spark] No, it has to do about security awareness training. What a CISO would say if. Something about security awareness training. What, you want to try? Throw it out. 

[Audience member] Going after new clients. 

[David Spark] New clients. This is a super tough one. I’ll be honest. One more. Try, Val. 

[Audience member] Assign performance for businesses for successful completion of training?

[David Spark] I’m going to give you the answer here. 

[Andy Ellis] Maybe people do personalized training whenever they screw up. 

[David Spark] It’s what a CISO would say if HR told them to make security awareness training more fun. 

[Laughter] 

[David Spark] Here, listen to it again. 

[Voice 1] Got some budget you want to share with me for that? 

[Voice 2] We’ll do our best, but no promises. 

[Voice 3] Do you want us to award prizes? 

[Voice 4] Sorry, we can’t. It’s something everybody hates. 

[Andy Ellis] Oh, I see. The person is declaring that it’s something everybody hates as a necessity, which is wrong. It’s easy to do security awareness training that people like. Make it short and fast. 

[David Spark] All right. We got two more. Here we go. 

[Voice 1] Thank God, it’s only taken me 10 years.

[Voice 2] We’re going to implement this immediately before you change your mind. 

[Voice 3] I will spend it wisely. 

[Voice 4] Now I can finally get something done. 

[David Spark] So, what a CISO says when?

[Andy Ellis] They get more money. 

[David Spark] Yes! That is correct! Good job. 

[Applause]

[Platoon] Sir, yes, sir!

[Andy Ellis] Dmitriy was on that on the very first one. [Laughter] 

[David Spark] Yes, yes, yes. All right. Last one. Good job. 

[Andy Ellis] I don’t know that CISOs ever have said that because that would imply getting more money. 

[Dmitriy Sokolovskiy] Yeah. It doesn’t happen. 

[David Spark] Well, it just means what a CISO says when they get budget. All right, last one. 

[Voice 1] We’ve talked about this. I warned you. 

[Voice 2] Hopefully, you haven’t ransomwared the company. 

[Voice 3] This is why training is so important. 

[Voice 4] Thank you for showing everybody that you’re human, too. 

[Andy Ellis] When the CEO clicks on a phishing link. 

[David Spark] Yes! Very good!

[Applause]

[Dmitriy Sokolovskiy] I was going to say good. 

[David Spark] Good job, Andy. And you were saying you’re no good at this game. 

[Andy Ellis] Well, so this one, this one actually entertainingly, I had a CEO who instead would get up and instead of me going and doing the various security awareness trainings in all hands, he would do it and he would go up and be like, “I clicked on this link, and you shouldn’t,” to sort of normalize it.

He had never clicked on those links, but he would totally pretend that he had gotten phished and had fallen for things to normalize. 

[David Spark] That’s a damn good CEO. 

[Andy Ellis] It was really amazing, like fantastic that he would get up and do it, and he would show people like, “I shouldn’t have clicked it, but I was just going so fast and I had to call Andy.” The first time he did it, I’m like, “What is he talking about?”

[David Spark] [Laughter] 

[Andy Ellis] “We didn’t have this conversation. Nobody told me about this.” I’m like texting the head of IT being like, “When did this happen to him?” And later he’s like, “Oh, yeah, no, no. It’s never happened.” 

[Dmitriy Sokolovskiy] Is this what he does instead of budget? 

[Andy Ellis] Yeah. 

[Laughter] 

[Andy Ellis] Hey, it worked, I got to tell you. I have to say the biggest challenge of security awareness training, since we hit it here, is that we have actually normalized hiding your failures and being embarrassed by them. We should normalize the opposite.

You are going to get phished and it’s not your fault. It’s the fault of our computer systems, and we appreciate that you tell us when it happens. And so you should report it very publicly. In fact, our mailing list for people who were socially engineered was public.

Anybody in the company could be on it. And you got to say, “I just got a phone call that claimed to be from the CEO asking for somebody’s phone number.” And whether or not you fell for it, you would still send mail because the CEO would reply and say, “Thank you for not falling for that,” or “Thanks for telling us so that we can deal with the damage.” Normalize it.

[Dmitriy Sokolovskiy] I’m going to write this down. Thanks, Andy. 

Is this really the right strategy? 

27:00.650 

[David Spark] “All these solutions are trying to massage existing security techniques and apply them to LLMs.” This was said by GigaOm’s Andrew Green. Now, the hope is LLMs will build completely new approaches we never thought of before. We traditionally had humans running security.

Now that’s not necessarily the constraint. How can we think of security differently? It’s possible the large players are purchasing startups as an aqua hire for talent, hoping these smart cyber soldiers will build the solutions that will be relevant in the future.

And we’ll start with you, Dima. What are the ways we need to be thinking differently about security if we’re not constrained by the capabilities of humans? 

[Dmitriy Sokolovskiy] I think we can dig deeper into the humans now that we have the capability that is above that, and I think we can get to things like intent and try and understand what people want to do versus just try and match some technological factors.

It’s kind of like the next level in behavior analytics, the super-weird high-level behavior analytics. Again, it would probably be weird but all of this is, where AI could understand what you want to do based on what it knows about things that are happening around you and the project.

So, I think we can get there. It is a little creepy, but we could. 

[Andy Ellis] A little creepy? It’s a lot creepy. 

[Dmitriy Sokolovskiy] [Laughter] It’s AI. 

[Andy Ellis] It’s AI. So, I’m going to go in a different direction, which is, I hate to use a Navy analogy since I’m an Air Force veteran, but we should think of humans as becoming AIrcraft carriers, and I capitalize the A and the I in that one, right?

Which is it used to be that the human had to do work, and if they wanted some more work done, they got another human to do some work. And instead, this is about power projection. AI is how you project power, but you still need a human at the center of it, right?

And I’ll be honest, if you want to know how to do this, go talk to a marketing professional, and if you’re here, I’ll point at one that’s doing it really well. How do you take AIs and do the work that humans actually aren’t great at, but needs to be done at scale?

Because you still value human decision making and human intent, but you can have AI execute on pieces of it. Where I think people get it wrong and say, “Think about how do I replace a human with AI,” rather than saying, “How do I augment a human with AI so they can get more done?” So that when they’re reviewing the press release, they have an adversarial AI that goes in and looks from a product perspective and says, “Oh, here’s words you shouldn’t say because they’ll reveal future capabilities.” And one that’s looking at it from a legal perspective saying, “Oh, this will get us in liability trouble.” And one who’s looking at it from a security…

And all of these different perspectives, and all of a sudden, this thing that takes groups of humans insane amounts of time – if you’ve never been part of drafting a press release, you will be stunned and amazed at how much human time goes into it – that could be mostly replaced by AI.

[David Spark] Well, let me throw this out because this is what I’ve been thinking about with regards to AI, and that is, it is so powerful and can do so much. Won’t there be some things that someone will think of like we’ve never thought to do this before because no human or groups of human could handle it, so let’s now try it with a machine.

[Dmitriy Sokolovskiy] A ton of things. Andy’s hitting, that’s exactly it.

[Andy Ellis] Yeah. Right.

[Dmitriy Sokolovskiy] There’s so many things we already know. If I could only do this at scale, but unfortunately… Oh, we can. Now we can. 

[Andy Ellis] Right. Now we can do it at scale.

[Dmitriy Sokolovskiy] Now we can do a lot of those different things at scale, at massive scale, conveyor belt. You just repeated my conversation from this morning with my team. We’re not looking to replace people. We’re trying to give people, put them in the right places, and give AI freedom to be as expansive with power as it can be in the rest of it.

The things that you do repetitively. 

[Andy Ellis] Right. What AI’s going to give us is the ability to do things at scale individually. We’ve already had the ability to do things at scale. We have software. It does stuff at scale and has for a very long time. What AI will allow us is take a human and scale the human so that they’re only spending the time on the things that humans are great at, and the things that they don’t need to do, like I mean…

[David Spark] Also humans are bad at because we make mistakes with repetitive actions. 

[Andy Ellis] Right. Like read the press release. Like how many times, and as I’ve got a PR person in the room that I know, how many times you have to read the same press release over and over again? Because every time somebody edits it, you have to check to make sure that they didn’t F it up in a way that you’re going to have to deal with.

An AI can say, “Here’s the changes that were made. This is what you should care about.” And yeah, somebody happened to accept a tracked change since the last time you saw it. So, you didn’t get to see it, but the AI can catch it. There’s so much in that.

Leave the human doing the thing that’s important, right? Help coordinate this, make sure it’s on message, get it out. Let the AIs do the things that humans aren’t great at. 

[Dmitriy Sokolovskiy] Do you need a hug? Feels like you’ve suffered here. 

[Laughter]

[Andy Ellis] I have suffered, man, through the press release challenge many, many times. But fortunately, I have the person who suffered more right over there, and so he needs some alcohol. 

Sponsor – Strike48 

32:13.430 

[David Spark] It is no secret that AI is only as good as the data available to it. That’s where most AI security solutions fall short. Strike48 takes a different approach. The platform unifies agentic AI with unmatched log visibility, querying your data wherever it lives, including cold storage logs.

Now that means no blind spots, no data gaps, and no rip and replace. This gives Strike48’s purpose-built agents the full picture they need to actually do the work. Not summarize it, not suggest next steps, but actually do it and with a full audit trail.

Use the no-code agent builder to create and deploy agents for phishing detection, alert triage, threat correlation, and more. Or get started immediately with pre-built agent clusters. Your agents run investigations, complete incident reports, and hand off findings to each other around the clock, compressing what used to take hours into minutes.

You can learn more at strike48.com. 

Unexpected outcomes or failures? 

33:27.067 

[David Spark] “If we know about it, we have to report it.” Now that sentence, offered as justification for walking away from a working tool, is the whole problem. Joshua Copeland of Crescendo argues that alert fatigue is a misdiagnosis. What organizations actually have is a low tolerance for the obligations that visibility creates.

Investigate, prioritize, communicate upward, and fix it. That’s a lot. So the alerts aren’t the problem. The accountability they trigger is. So, I’m going to start with you, Andy. So, how do you build a security program that can absorb the truth its own tools are telling it, and when ownership of an alert and capacity to deal with it are misaligned, whose job is it to say so?

[Andy Ellis] Okay, so there’s two different problems here, and this is sort of a magician’s trick. He’s sort of blending two problems in to give you sort of a motte and bailey attack. And one of the problems we already talked about earlier in the show, which is if you are not the team that can fix it, then there is a piece of alert fatigue, which is I get lots of stuff and I can’t really do anything with it.

I can investigate, I can prioritize, but if I’m not fixing it, my prioritization is kind of meaningless, and the rest of the organization is weaponizing that against me. Let’s ignore that for the moment and let’s just point out that most security tools suck.

[David Spark] Oh, there are many vendors in this room, Andy. 

[Andy Ellis] Sorry. 

[David Spark] You’re insulting our audience. 

[Applause]

[Andy Ellis] Your tools suck. 

[David Spark] Wait, wait. 

[Andy Ellis] You guys are awful. 

[David Spark] The vendors are actually applauding right now. 

[Andy Ellis] Even vendors are applauding here, right? Why? Here’s the reason why, and I point back at one of my favorite security standards, which is the PCI Data Security Standard, and in that security standard, I’m going to put Dmitriy on the spot here, right?

[Dmitriy Sokolovskiy] [Laughter] 

[Andy Ellis] It requires that you ensure the integrity of system-level objects. What is a system-level object, Dmitriy? 

[Dmitriy Sokolovskiy] Don’t I have to define it?

[Andy Ellis] Shouldn’t it be defined by the PCI DSS?

[Dmitriy Sokolovskiy] Would be good. 

[Andy Ellis] Guess what? It isn’t. Why isn’t it? It isn’t so that Visa and all the other members now of the PCI Council can always say you failed. There has to be an unpleasant truth here, which is you cannot possibly comply with the PCI Data Security Standard, and in fact, every company that has been breached while in compliance was retroactively found to have not been in compliance because there are impossible things to do, right?

This is the same challenge a vendor has. Imagine I get breached, and you were my security vendor responsible for something around where the breach was, and you had not fired a single alert indicating anything that that breach might possibly happen. I’m going to say to you, “You failed.

Give me all my money back.” So what do you do? You make sure that your system alerts on everything that might possibly ever lead to a breach so that you can always say, “Look, we told you. It’s buried there among a million other alerts, that if you’d only noticed it six years ago, then you would not have suffered the breach.

This is your fault.” Just to be clear, you have the economic incentive to build the products that do this to us, and then we have the audacity to complain to you that you’re building what we actually did ask you to build. 

[Dmitriy Sokolovskiy] I agree with you about the alert fatigue piece. That’s, I think, just mixed here, but I think that simply saying vendors suck or the tool… 

[Andy Ellis] No, I’m not saying the vendors suck, just to be clear. 

[Dmitriy Sokolovskiy] The tools suck.

[David Spark] I do remember you saying that. 

[Andy Ellis] No, I said their tools.

[Dmitriy Sokolovskiy] Yeah.

[Andy Ellis] Their tools suck. 

[David Spark] The tools suck. Okay, so their children suck. Got it.

[Andy Ellis] Vendors are. That’s very different. Vendors are responding to the economic incentives that have been put in front of them. 

[Dmitriy Sokolovskiy] But no one is making me use it the way that they’ve set it up. I think there’s also responsibility on me as a practitioner to understand what I’m going to get. 

[Andy Ellis] Yes.

[Dmitriy Sokolovskiy] The reality of these tools is that they suck. 

[Andy Ellis] Right.

[Dmitriy Sokolovskiy] Okay, that’s my reality. So if that’s my reality, I can do something about it not to drown in this alert fatigue. But that’s not the problem we’re facing. The problem that Joshua’s talking about is that we see the thing, the reality of a thing.

[David Spark] This is why, by the way, this is why a lot of people do not take vendors up on their free scan that almost every single one offers because they just don’t want to know. 

[Andy Ellis] I disagree 90% with this. There is a 10%, which is at some point, like when somebody says, “Oh, we can increase your pipeline of ingest problems,” but you don’t have the capacity to deal with more. Unless you actually are going to increase my pipeline with things that are more important than what I know about today, I’m uninterested in learning about things that are less important than what I’m actually able to handle today.

[David Spark] Well, that’s not… Usually these scans are showing like how many SaaS tools you have in your environment that you didn’t even know or something like that. 

[Andy Ellis] Sure, but if I know that I have more than 500 SaaS tools in my environment, and you show me about 7 more, but I’m not doing anything to the 500 I’ve got today… 

[David Spark] Well, yeah, but usually…

[Andy Ellis] Why do I need…?

[David Spark] Usually, they’re wake-up call types of scans. They’re not like that. They’re like, “Oh, I already knew about 5,000, you showed me 5,007.” It’s rarely that situation. 

[Dmitriy Sokolovskiy] Yeah, I think the point here isn’t… It’s not about the tooling. It’s about my decision. Do I want another set of tooling because I now have more capacity? 

[Andy Ellis] Right

[Dmitriy Sokolovskiy] Right, that’s where the conversation should start. “Hey, CEO, can I get more?” Oh, you gave me more capacity. Okay, what can I do with that? 

[Andy Ellis] Yes.

[Dmitriy Sokolovskiy] Now, at that moment, I could argue about using another scan on a tool. There’s plenty of things to do with the tools we already have, misaligned, misconfigured, whatever they are, but I think it’s still on us. It’s not just tools suck.

It’s we also have to be a part here. 

[Andy Ellis] Yes. I think there are too many tools that we chase that are cataloging tools. They will tell you about the things in your environment, how many there are, how many problems there are, and not enough that are filtering tools that are going to go through and actually fix problems and remove issues.

And so at some point, yes, you don’t want another cataloging tool when you don’t have more capacity to filter. 

It’s time for the audience question speed round. 

39:47.038 

[David Spark] What I hold in my hands are index cards with questions from you, the wonderful audience, and we have some time left, so let’s just get through as many of these as we can. Here we go. You don’t both have to answer, but you can if you want to.

This comes from Sam Paris, who is with the company Fractional CISO. She herself has just become a CISO.

[Andy Ellis] Congratulations. 

[Applause]

[David Spark] She asks, as someone… Hold it. Let’s give Sam appropriate applause.

[Applause]

[David Spark] All right. Sam has a very important question here. As someone who has just become a CISO, Sam, what’s a tip to manage imposter syndrome? 

[Andy Ellis] Ooh, so the first thing I’m going to, rather than pimping the book I have in front of me, which does actually talk about imposter syndrome, so you should read my book. 

[David Spark] And by the way, almost every security professional I’ve spoken to admits to have had it or currently have it. 

[Andy Ellis] Yes, and I also tell you, go read howtocISO.com, which is entirely free and advice for CISOs. But here is the reality. Imposter syndrome is part of what makes humans amazing, is you take on a thing that you are not perfect at. If you were perfect at it, you would be bored.

So you always are stretching. That’s how you grow. Imposter syndrome is what pushes you to get better because you don’t want to keep feeling that. So this is how you manage it, is be willing to take risks, recognize that you might fail. That’s okay.

Figure out what your failure budget is and move forward. 

[David Spark] Hold it. What is a failure budget? 

[Andy Ellis] How often are you allowed to fail? I would tell my team, “You have an apology budget, which is how often I’m going to apologize on your behalf that I screwed up by letting you do a thing wrong.”

[David Spark] That’s good.

[Andy Ellis] You have an apology budget, and only once have I ever said these words to somebody. I said, “By the way, you’ve used up the apology budget for a little while, so can you stop?”

[David Spark] [Laughter] All right. 

[Dmitriy Sokolovskiy] The problem with imposter syndrome is that the failure is what we’re afraid of. It’s not the fact that we’re going to fail. It’s the fear of the failure. That’s the syndrome, right? So Andy, just you have to keep talking to yourself, recognize it as that’s part of the job.

It’s not going away. That’s why you’re good. That’s why you are a CISO because you have it. Without it, you won’t be able to. 

[David Spark] All right. We’re going to push this a little bit longer because I want to get through a few more questions here. From Bill Brenner of CYBR.SEC.Media. There’s Bill right there. What can, and by the way, I love this question. It’s the opposite of what we normally hear.

What can CISOs do to better communicate to vendors so we can all better solve our problems? 

[Andy Ellis] Stop.

[David Spark] No, come on. 

[Laughter] 

[David Spark] Come on.

[Andy Ellis] Okay. No, no. So, Bill’s a plant, I’ve got to start with that one. 

[David Spark] He wasn’t a plant. 

[Andy Ellis] No, he’s a plant. Bill used to work for me many, many years ago, and we work together still. The most important thing is be honest with them. If you are not going to buy from them and you don’t want to talk to them, just say that. Don’t lead them on.

Don’t say, “Come talk to me later next quarter.” Right? You get some SDR who’s trying to get a meeting with you or you’re going to be at a conference, and they see you’re there and they’re like, “Hey, can you meet with my founder while we’re there?” Don’t lead them on.

Right? 

[David Spark] That’s good advice.

[Andy Ellis] They need to get to fast no’s. 

[David Spark] Nobody needs to waste your time, their time, nobody else. 

[Andy Ellis] Right. Because here’s the problem. Their incentives are not aligned correctly. This is a vendor problem that they are just willing to push and push and push in hopes of getting to a yes. If they don’t have a shot at a yes, you just need to say no.

“Nope. Sorry. I’m not interested. I’m not a lead for you.” It’s fine. If you want an email template for this, Google “vendor rebuff,” and the first non-sponsored link you will get is a template you could just make your signature file. So you hit reply, switch your signature, and just send it.

[Dmitriy Sokolovskiy] What if they just want to learn more about you? 

[Andy Ellis] They don’t just want to learn more about you. Oh, my God. 

[Dmitriy Sokolovskiy] I don’t know.

[Andy Ellis] We weren’t asked for the vendor advice, but the vendor advice is just stop lying to us. We know that you don’t want to get a friendship with us. 

[David Spark] I’m going to throw this question in this because this has had to do with you talking about vendors. From Hannah Kelly at Strike48, what has a vendor said about AI that makes you believe they get it? Because I know you’ve heard the opposite.

[Andy Ellis] Man, that’s a… Phew. 

[Dmitriy Sokolovskiy] When they said it’s hard to understand. 

[David Spark] Okay. I would agree on that one. 

[Andy Ellis] So, actually, it’s an interesting trend that I noticed because I walked all the vendor booths at RSA and at Black Hat so that none of you have to.

[David Spark] How many hundreds? 

[Andy Ellis] 607 booths at RSA and 360-something at Black Hat.

[David Spark] Well, that’s a lot. 

[Andy Ellis] And I will tell you, there were vendors who started to listen because if you were at Black Hat, all of the vendors talked about replacing humans with AI. That was implicit in their messaging. And by RSA, more and more of the messaging was about how AI was going to augment humans in various ways.

That’s very clearly vendors who are listening to the fact that CISOs are not responsive to the message, “I will take away the humans who work for you.”

[Dmitriy Sokolovskiy] See, this is why they want to talk to you. 

[David Spark] All right. I’m going to make you… Because Andy’s dominating. So, Dima, you’re taking these next two questions here. And Andy, you can throw in. From William Tolle [Phonetic 00:45:16] of Valicity, how does pending legislation affect your decision making?

So, it could be anything that’s pending in the government, or it could be in the EU. Does that ever affect you? You’re like, “I can’t pay attention to it. I just got to move through.” 

[Dmitriy Sokolovskiy] No, it does not. I don’t. There are people on the legal team. 

[Applause]

[Dmitriy Sokolovskiy] Thank you. The people on the legal team that should. And if something really, really bad comes up, I hope they’ll tell me. But I’m definitely not spending any of my mind time on that. 

[David Spark] Andy? 

[Andy Ellis] I paid attention to it. In fact, I hired a lawyer to pay attention to it so that I would know before our public policy team would get around to deciding what they wanted. Mostly so that I could decide how I wanted to weaponize the knowledge in my favor.

[David Spark] All right. Last question here from Amber Bennoui of AI Security Alliance. What is one thing security culture has to adapt to, given AI? 

[Andy Ellis] That implies there’s a security culture. 

[Laughter] 

[Andy Ellis] I think Dmitriy’s struggling with like what does security culture actually look like today? 

[Dmitriy Sokolovskiy] It’s coming and we can’t stop it. So we got to do something about it. I don’t know. 

[Andy Ellis] So, I think that the big change is everybody is a developer now. HR reps are developers, marketers are developers. Everybody in your business is now a developer. And see earlier in the show, when we talked about how the developers already aren’t listening to you.

Well, now that’s not 20% or 40% of your organization. That’s 100% of them. 

[Dmitriy Sokolovskiy] Everyone is not listening to you. 

[Andy Ellis] And they’re still not listening to you. 

Closing 

46:47.907 

[David Spark] Well, that brings us to the very end of the show. I want to thank my guest, Dima Sokolovskiy. Let’s hear it for him. From Semrush. 

[Applause]

[David Spark] And my co-host, Andy Ellis of Duha. Author of 1% Leadership as well. Keep it going. Let’s hear it for our sponsors. Strike48. The agentic operations platform without blind spots. And Dropzone AI. Hunt, investigate and respond at machine scale.

Go to strike48.com and dropzone.ai. I want to thank, again, Aqueduct Technologies for hosting this event. Let’s hear it for them.

[Applause]

[David Spark] And we loved being here. We’d love to come back. Thank you, everybody, for being here. And thank you to our audience. As we always say, we greatly appreciate your contributions and for listening to the CISO Series Podcast. 

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.