Compliance regimes and security awareness training have been around for time immemorial in cybersecurity. But for all the money we’ve invested in them, have they actually improved anything? This show was recorded live in Clearwater, FL at the Convene conference hosted by National Cybersecurity Alliance.

This week’s episode is hosted by me, David Spark, producer of CISO Series and Pam Lindemoen, CSO, vp of strategy, Retail and Hospitality-ISAC. Joining them is Jason Mayor, deputy CISO, Raymond James Financial.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsors, Adaptive Security, KnowBe4, and Zepo

Full Transcript

Intro

0:00.000

[Voiceover] Biggest mistake I ever made in security, go!

[Jason Mayor] Biggest mistake I ever made was stopping my pursuit of understanding the business. Obviously, we talk a lot about knowing your business very well. I think I got to a point in my career where I thought I knew the business well enough. Long story short, came to a head in a very senior risk management discussion where I had sort of lost sight and lost some of my business understanding, which resulted in me telling a very different story about a particular risk category when the business was viewing that risk category very, very different than me at the time.

[Voiceover] You’re listening to CISO Series Podcast, recorded in front of a live audience in Florida.

[Applause]

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the host and producer of the CISO Series. Joining me, sitting directly to my left, is the CSO and VP of Strategy for Retail & Hospitality ISAC, Pam Lindemoen. Let’s hear it for Pam!

[Applause]

[David Spark] Say hello to the audience, Pam, so people know your voice.

[Pam Lindemoen] Hi. The southern voice?

[David Spark] That is your voice right there. Our sponsors for today’s episode are Adaptive Security, KnowBe4, and Zepo. Let’s hear it for our sponsors, they’re the reason we’re here!

[Applause]

[David Spark] And let’s hear it for the National Cybersecurity Alliance, staysafeonline.org. They are putting on this huge conference, Convene. That is where we are. We’re here, our fourth time coming, thanks to Lisa Plaggemier and also Cliff. Thank you so much for bringing us out here.

You have come to this conference before, yes, Pam?

[Pam Lindemoen] I have. I have.

[David Spark] You actually saw this show last year.

[Pam Lindemoen] I did.

[David Spark] What did you think of it last year? And you’re hoping it’s going to be better this year?

[Pam Lindemoen] It was very energetic.

[David Spark] Good. Can you hold up that energy?

[Pam Lindemoen] I’m hoping so.

[David Spark] I hope you can as well. All right. We’re going to jump into this because we have a lot of show packed in. I want to introduce our guest as well, on the far end here, who is the deputy CISO over at Raymond James Financial. It is Jason Mayor.

Jason, say hello to the audience.

[Jason Mayor] Hello. Thanks for having me.

[Applause]

Why has this topic suddenly become the center of attention?

2:21.000

[David Spark] “Despite regulatory compliance requirements and significant investment, security awareness training seems to deliver marginal benefits.” Now, I know this heresy in this room, but that’s Jon Oltsik of SiliconANGLE calling out the security awareness training paradox.

Organizations spent 6 billion on security awareness training in 2025, yet 70 to 90 percent of breaches still stem from human error. This audience knows that. Human risk management seems to be the industry’s solution, focusing on what employees do rather than what they know, using AI-powered personalization and real-time behavioral nudges.

Many training vendors have already rebranded themselves as human risk management but – and I’m going to start with you, Pam, on this – is this solving the problem or just repackaging it? And for those who’ve moved to a human risk management approach, are they seeing measurably better outcomes, or is it the same wine but a new bottle?

What do you think?

[Pam Lindemoen] I’m of the belief that there is ROI in security awareness, and I’ll tell you a few things.

[David Spark] But specifically with the shift to HRM, human risk management.

[Pam Lindemoen] Yeah, I don’t care what you call us.

[David Spark] All right.

[Pam Lindemoen] I don’t care what you call us. But I think it depends on what I’ve heard today – having supportive, targeted, it’s embedded into daily work, and it’s not just a compliance checkmark, and that you’re changing your dialogue based on the threats of today.

Like threat actors posing as IT workers, like making sure you’re addressing that right now when it’s happening. So, there’s value. Absolutely.

[David Spark] All right. Jason, value. But I’m very interested in the shift from what was just security awareness to human risk management. Have you seen there is a significant leap or change, or the same old thing?

[Jason Mayor] Yeah, I would say there is a little bit of a change. I think part of our approach to kind of combine the two things, the traditional awareness training with sort of measuring the human risk changes over time, they’re really powerful when you start to put two metrics side by side.

Just as an example, where sort of the regulatory requirements of you got to do annual training and all those types of things, where maybe the ROI isn’t as clear. But when you think through what behavioral changes do we expect to see based on this training, and you put those two things side by side, for example, real world click rates when bad things land in a user’s email, ideally, those are going down over time because your training program is actually being successful.

So, I think when you combine those two things and really look at them as one package, I think you start to see the benefits.

[David Spark] You’re looking to me, Pam, as if I have a solution to this. I’m not the CISO. So, he’s making an argument that the two combined. You say, “Name it whatever the heck you want.”

[Pam Lindemoen] Yeah. Look, it’s all metrics. I think I heard today like, listen to your SOC, understand what the threats are, marry them up with what you’re seeing in terms of your phishing and your exercises and your training, and make it matter. Same thing to me.

Don’t care what you call it.

They didn’t think that through all the way, did they?

5:28.000

[David Spark] Security theater. It’s real, and savvy security professionals just shake their heads when they see it. So, I wonder what are some of the worst you’ve all seen? And I’m going to give you some examples straight from the cybersecurity subreddit.

Here are three. Phishing tests that had to be announced in advance, data labeling systems where users downgrade classifications to bypass controls, or the DLP solution left in report-only mode, and it was only used once they realized they actually had to make a public data breach notification.

Now, the obvious response to a lot of this is, “You know this isn’t doing anything,” but you say that and you sound like a pest. So, I’m going to start with you, Jason. How do you make real change in security theater controls? We’ve all seen it. Even if they argue back, “Well, this is the way we’ve been doing it for years.” I mean, you’ve seen it.

How do you politely say, “We got to stop this, it’s not effective”?

[Jason Mayor] Yeah, I would position it more as not we have to stop this, but we have to change this to make it more valuable. The example, and as a disclaimer, the third-party risk team reports into my organization, so this is going to come off as a pretty hot take, but the third-party risk process, sort of the security questionnaire, collecting a policy or standard, I think for the last decade plus, I would categorize as almost security theater, right, just to make sure we have something on file that we’ve done some due diligence.

The way that we’ve tried to position that or change it is, if your only output of that risk assessment process is the questionnaire, the completed questionnaire, and a policy or standard, and not tailored specific controls based on your assessor’s understanding of not only your business, but that third party, then I think obviously, a lot of that is security theater.

So, to me, it’s not stopping, but it’s repositioning it or changing it to have that benefit to your business.

[David Spark] I mean, we could do a whole show on third-party risk management, but it’s really, for many, it’s like we got to do something here. We know it’s a giant hole that’s screaming at us that it’s going to get us. So, doing something better than nothing, even if it is a little bit of security theater, what do you think, or no?

[Jason Mayor] Yes, you have to do something in that space. And obviously, as you said, this is a problem statement that every firm in every sector, I think, has faced for the last 10 years. But again, to me, I’m trying to set up a team that does these risk assessments in a way that we are doing it slightly different, right, and we will be in a slightly better position than the other consumers of that particular vendor when and if something bad happens.

[David Spark] All right, Pam, what do you think? First of all, any good example of security theater you can give us and how you’ve dealt with it?

[Pam Lindemoen] There’s a lot of security theater out there with everything we do. And I think it’s just…

[David Spark] By the way, phishing tests, by the way, can be a great example of security theater just in themselves if they’re so poorly designed.

[Pam Lindemoen] Absolutely. You have to raise the bar with what you have, and you have to treat like a phishing exercise as like coaching. And what I would say is use what you’ve got, do something. If you don’t, you’re not doing your job. And your job is to articulate the risk to the business.

That’s your job as a security professional, and we lose sight of that all the time. But basically, how do you translate that so that your business hears you, understands you, and they’re changing their behavior? They know the why behind what you’re telling them to do.

[David Spark] Okay, well, that’s a great example because you can, like in security theater, you can say, “This is not reducing risk.” And I mean, do you just boil it down to that? Or does that scare them? Or it comes off as obnoxious?

[Pam Lindemoen] I use it as a coaching period, right? Like when I do phishing test days or someone on my team does them, and it causes and spurs a lot of consternation or really panic, I use that and say, “Hey, you’re in a safe place right now. Aren’t you glad that you learned in a safe place?” I use it as coaching and, “Here’s what could have happened.

Here’s what did happen. Here’s what you can do better.” And then you get that voice throughout your organization. I used to walk through the halls of an organization, and they would see me and say, “You didn’t get me this time, Pam. You didn’t get me.” When you have that kind of a culture, that’s they’re changing their behavior and they understand why you’re asking them to do what you want them to do.

[David Spark] I like that you could do better, in a very positive way, not in a scolding way. And kind of like what you were just saying, Jason, is like, “Well, we know we need third-party risk management, but we can do better than this.”

[Jason Mayor] That’s right.

Sponsor – KnowBe4

10:13.000

[David Spark] We have lots of wonderful sponsors, and this is the first one I’m going to tell you about. Security teams don’t lose sleep over firewalls anymore. They lose sleep over people. Because even with all the tools in the world, nearly 70% of breaches still involve human behavior – just talking about that in the last segment – and now AI is accelerating the problem.

Phishing, vishing, deepfakes, voice cloning, the attacks are faster, smarter, and built to exploit trust. That’s why more than 70,000 organizations worldwide trust KnowBe4. KnowBe4 is the global leader in human risk management. For over 15 years, they’ve focused on the most targeted part of your security stack, the workforce.

Not just training people to spot phishing emails, but helping organizations measure, manage, and reduce human risk across the entire enterprise.

And the workforce is changing. Tomorrow’s workforce isn’t just people. It’s people plus AI agents working side by side. KnowBe4’s HRM+ is the only platform built to secure that hybrid future, protecting both humans and AI agents as trusted colleagues.

With nearly a decade of production, AI experience, 50-plus security patents, and the industry’s only production-ready AI defense agents, they’re not experimenting with AI. They’re leading. KnowBe4, secure the next generation workforce, KnowBe4.com, and when you go there, let them know you heard about them from the CISO Series.

It’s time to play “What’s Worse?”

11:58.000

[David Spark] For those of you who are not familiar with this, “What’s Worse?” is a game we’ve been playing since Episode 1 of the CISO Series, and it is exactly what it sounds like. Pretty simple to follow. Our fans, they send in scenarios, horrible scenarios.

They both stink. And you have to determine, and we will get the audience’s vote as well, which one of these two scenarios is worse. All right? I will have you, Pam, answer first, and we want to hear your reasoning on this. It comes from Jonathan Waldrop, CISO over at Acoustic, and here are his two scenarios.

Scenario number one, an enforced policy on phishing simulations. Three strikes, you’re fired. Not good. Or security awareness training conducted weekly for one hour, mandatory attendance.

[Laughter]

[David Spark] Ooh, God, that one got some murmurs. Which one’s worse?

[Pam Lindemoen] Weekly training.

[David Spark] Okay, I want to hear your rationale because I’ll argue back on the other one. So, why is weekly training so much worse?

[Pam Lindemoen] People will get numb to it. They’ll just ignore you. Weekly training? I don’t want to do anything weekly. I don’t work out weekly.

[Laughter]

[David Spark] All right. So, it essentially, the effectiveness will just start to decline and decline.

[Pam Lindemoen] Absolutely.

[David Spark] You don’t think, like, what if you had the best, most creative weekly training, and people would look forward to it? Like you got these fun videos that we saw before. That still wouldn’t work?

[Pam Lindemoen] I don’t watch anything that much.

[David Spark] Nothing?

[Pam Lindemoen] Nothing.

[David Spark] You don’t have a series you like to watch?

[Pam Lindemoen] Yeah, but not every week. I watch it when I want to watch it. I’m a human.

[David Spark] I don’t know. I think many of the vendors here would argue that their training is so entertaining, they would want to watch it every week.

[Pam Lindemoen] Okay, try me. Don’t think so.

[David Spark] All right.

[Pam Lindemoen] Don’t think so.

[David Spark] Well, you heard that. She’s up for the challenge, vendors, by the way. All right. I would also argue that the other scenario is pretty bad because you’ve now created sort of a fear economy at your company.

[Pam Lindemoen] Well, I totally agree, but you made me choose one.

[David Spark] That is true.

[Pam Lindemoen] I absolutely agree with you.

[David Spark] So, you think that one’s worse than the fear economy that you’ve created?

[Pam Lindemoen] Yes.

[David Spark] All right.

[Pam Lindemoen] Because no one’s going to listen to you. They’re just going to be numb to you. At least I’m giving somebody three chances, and they’re out. At least they get three chances. I don’t have a choice to watch something every single week.

[David Spark] Oh. That is a good point. That is a good point. Because it’s mandatory. But mandatory that you’re…

[Crosstalk 00:14:29]

[Jason Mayor] There’s nothing wrong with a little healthy fear. It’s not a bad thing either, I would say.

[David Spark] All right. So, what do you think? Do you agree or disagree here with Pam?

[Jason Mayor] I would agree. Honestly, we’re not talking about ROI yet.

[David Spark] Well, no, ROI that could be a factor here.

[Jason Mayor] The cost of those meetings, when you’re talking about bringing in your business users, would get very high very fast, and I think it would be nearly impossible to show the ROI of those weekly meetings if at some point you were asked to do so.

So, I agree with Pam on this one.

[David Spark] All right. I’m guessing the audience agrees because of the gasps that we heard when I mentioned it. But I’m going to just argue, you don’t think the fear that was created by the three strikes and you’re out wouldn’t be worse?

[Jason Mayor] No.

[David Spark] You still think the other one would be worse?

[Jason Mayor] I do, yeah. It’s your podcast, but I’m going with Pam on this one.

[David Spark] All right. I’m going to the audience here. I want to see, by applause, how many people think essentially the first scenario, three strikes and you’re out, that is worse than the mandatory hourly training? By applause, if you think that one’s the worst.

[Applause]

[David Spark] All right. Three to four, about four people, I think I see. All right. For those of you who gasped, how many people think, like my two guests on stage, the mandatory hourly training every week is far worse? By applause.

[Louder applause]

[David Spark] Yes. There we go. All right. You got agreement from the audience.

What is Dave’s mom talking about?

15:54.000

[David Spark] All right. This is our next game and here’s how this game is played. My mother is going to be surprised, not so savvy about cybersecurity, but she is supportive of her son, and when I come up with a stupid idea for a game, she’s happy to play along.

So, what I’m going to do, now, I have four clips here, I just said the term. By the way, everyone in this room knows these terms. Everyone here knows them. My mother doesn’t necessarily know them. They’re varying degrees of correct or completely wrong.

You have to try to determine what the heck she’s talking about. She just, given the words, she tried her best guess effort as to what it is. All right? Here’s the first one, I got four. I’ll have them try at it. If they can’t get it, I’ll go to the audience.

Here we go. And I can play them multiple times because they come on quick.

[Dave’s mom] Some people get into your information and they’re really bad news.

[Pam Lindemoen] Hackers?

[David Spark] A specific kind, though, because not a hacker is just negative. It would be a…?

[Jason Mayor] Malicious hacker?

[David Spark] Black hat hacker. Yes, black hat hacker.

[Jason Mayor] Got it. All right.

[David Spark] We’ll take that. All right. Good answer. All right. Let us hear it. In fact, let me give you a proper kudos.

[Organ music]

[David Spark] All right. Kudos for you on that one. All right, here comes the next one.

[Dave’s mom] When information is purposely corrupted.

[David Spark] This is pretty much on target. What is that?

[Jason Mayor] Encryption?

[David Spark] No.

[Jason Mayor] Ah!

[David Spark] Purposely corrupted. Oh, it can be encrypted. Yes, it can be encrypted, corrupted that way. What would be another purposely corrupted? Play it again.

[Dave’s mom] When information is purposely corrupted.

[Jason Mayor] Anonymized. Obfuscated.

[David Spark] I think you know this. She’s on target with this. My mother actually got this one right.

[Pam Lindemoen] Ransomed?

[David Spark] No. All right, I’m throwing this to the audience. What the heck is she talking about?

Audience member: Malware.

Audience member: Malware.

Audience member: Malware.

[David Spark] Not malware.

Audience member: Poisoned.

Audience member: Poisoned.

[David Spark] Poisoning. Correct. Yes, it’s data poisoning.

Platoon: Sir, yes, sir!

[David Spark] Good job.

[Laughter]

[Jason Mayor] You can have my job.

[David Spark] All right.

[Laughter]

[Pam Lindemoen] And mine.

[David Spark] Okay. I’m going to warn you. This one is completely incorrect.

[Dave’s mom] Rear end information.

[Laughter]

[Jason Mayor] Say that again.

[Dave’s mom] Rear end information.

[David Spark] Rear end information.

[Pam Lindemoen] Backup? Oh, back door?

[David Spark] You just got it. I just heard it. Someone yelled it out. It is back door.

[Ringing]

Audience member: Ah!

[Crosstalk 00:18:21]

[David Spark] Good job. Good, good job. All right. Last one. Our audience is quicker than the two of you.

[Laughter]

[David Spark] All right. Last one. I think you can get this one. This one’s reasonably on target. Here we go.

[Dave’s mom] It’s technology in which you have no faith in people.

[Laughter]

Audience member: Zero trust!

[David Spark] Someone just yelled it out. Zero trust.

[Groans]

[David Spark] Again, you guys, you can’t…

[Applause]

[Laughter]

[David Spark] We got off the hook for those.

[Pam Lindemoen] That was awesome.

[Wild applause]

[David Spark] Yeah. The two of you, our audience, unfortunately, this is…

[Sound effect]

[Laughter]

[David Spark] All right. You tried your heart out. It just wasn’t as good as you could have been. Our audience is smarter than you.

[Pam Lindemoen] They are.

[Jason Mayor] No doubt.

Sponsor – Zepo

19:08.000

[David Spark] For decades, cybersecurity has relied on a defensive strategy focused heavily on technical controls and mandatory compliance. But as attack strategies evolve, checking boxes is no longer enough. The critical determinant of your organization’s resilience isn’t just your firewall.

It’s your people. So, it’s like this line, you know, that people are the weakest link? No, they’re actually your greatest asset. It is time to transform the paradigm with Zepo Intelligence. Now, Zepo is a human risk management platform that moves you beyond simple compliance tracking to building verifiable human capability.

They don’t aim to just fix your employees. Ever try to fix a spouse? That never works.

They enable their mastery – I like that, mastery – through hyper-personalized multi-vector simulations, Zepo reveals precisely how your workforce performs in moments of actual risk. They turn everyday behavior into measurable security metrics, allowing you to close capability gaps faster and prove the ROI of your security investment.

Stop viewing your workforce as a vulnerability. Start building a proactive culture where security feels intuitive. Zepo – go to their website and let them know you heard about them from the CISO Series.

It comes down to the fundamentals.

20:49.000

[David Spark] “Explaining ROI for cyber is a dark art,” said Defense in Depth co-host Steve Zalewski in a recent CISO Series AMA – that’s an Ask Me Anything – on the cybersecurity subreddit. By the way, we do those CISO Series. We do them every month.

Companies are demanding that security demonstrate business value rather than just pouring money into continuous improvement exercises. Answers for showing ROI varied. Some suggested financial risk modeling that dovetails with cyber risk. Another relied on quantitative frameworks such as FAIR focusing on whether controls reduce annualized loss expectancy.

And these methodologies exist, are well documented and debated. And I’m going to start with you, Jason, on this. Where do you think we should show the value of cyber? And I think actually the answer varies depending on what industry you’re in. Can we show that it’s helping us make money?

Or is it better ROI about demonstrating the cost of not doing it? I mean, where do you begin to determine that?

[Jason Mayor] I would never start with the cost of not doing it. Honestly, I don’t think that would go over very well. And honestly…

[David Spark] That goes into the FUD, the threat.

[Jason Mayor] Yeah. And honestly, the industry, I think, does that for us, right? I mean, the cost of not doing it is on the front page of the news most weeks anyway, so I don’t know that you need to oversell that. My response here, I think, is first and foremost, however you approach this, it has to align with your business culture, right?

At Raymond James at least, we are very, very much relationship based, especially at the senior management sort of risk committee level and board level, where a lot of these discussions might be taking place. I think it would not resonate well today if we walked in or my boss, Todd Ferguson, walked in and started throwing around numbers, whether they were generated through FAIR analysis or otherwise.

Where we would like to be, I think, is to have some of those data points to supplement that relationship-based discussion with your board or senior leadership in terms of the ROI on the security program in general. But to me, it has to align with the business culture, first and foremost.

[David Spark] So, I’m going to drill down on it. They hire you because they trust you and trust you to explain the situation, but they still want to understand, if we’re spending this money, how is it going to change the business? How do you have that conversation?

[Jason Mayor] Yeah, I have some examples here too, I think, which will maybe highlight what I’m describing. But what we do when we’re thinking through our roadmap from a cybersecurity perspective, we’re not spending a ton of time on what do we expect the ROI to be.

Maybe we’re doing that wrong, but we’re just not today. We put that effort into, in business terms, trying to describe how this effort is going to sort of enable the business. And the example that we have from many years ago and another more recently is around sort of mobile access, right?

Where we wanted to get better and more mature in sort of our mobile capabilities. Well, guess what? We have business areas, think of like our investment bankers that are on the road all the time, who want that mobile capability, probably as much as we want it to secure and mature our mobile capabilities.

So, when you describe it in business sort of enablement ways versus just a numbers way, I think they pick up on that very quickly and very easily.

[David Spark] All right. How have you approached this, Pam? And also being that you’re with this ISAC, I’m sure this conversation comes up. Have you heard varying stories?

[Pam Lindemoen] Of course, of course. I think this is one of those decisive conversations that CISOs have is, “How do you do it?” And that’s the beauty of an ISAC is you get to share best practices, like this worked with my board or this worked with my executive leadership.

And a lot of times because success often looks like nothing happened, [Laughter] that’s not a really great story to tell, you do have to have stories about what’s going on in the business and how you’re either not implementing friction, like you described, which I thought was lovely, or you’re reducing exposure.

And you can, just like you said, you can look at that from a business perspective, like your business line. It really does matter how you describe that to your different audiences. And it’s an art. It’s definitely something that you have to understand how the business runs.

You have to be deep in it in the business language so that you can describe it for your audience.

[David Spark] So, I want to go back to something you said, Jason, about the culture. I get the sense that you can’t build anything unless the culture’s on board. I mean, just let me ask you, if you didn’t have a security culture, how much of a mountain are you climbing at this point?

[Jason Mayor] Yeah, I would say it’s insurmountable, I would imagine.

[David Spark] Yeah, because you could start spending money that technically on paper, if used properly, would work. But you might have essentially the company fighting against you, and it may just all fail. Yes? I mean, have you or anyone you know seen this?

Like, I’m fighting a culture. I mean, I hear this from CISOs all the time.

[Jason Mayor] Keep in mind, the sector or industry that I’m in, obviously that doesn’t really exist in today’s world.

[David Spark] Oh. Right.

[Jason Mayor] It can’t. But through sort of the networks, we have heard and experienced some of our partners in our roles in other organizations where some of the security program is not directly driven by the industry that they’re in. I think you have to look for and find small wins, again, sort of building that trusted advisor relationship with your board or senior management.

And again, I go back to even the foundational security programs or controls or expectations. They all come with some sort of way that they’re enabling the business. You just have to figure out how to identify those and then how to make those very clear to the business.

And those small wins start to add up over time, and hopefully, eventually, you get to a position where it’s so trust-based at the CISO and board level that very few times are we sort of challenged. There’s some healthy challenging going on, of course, but very few times do we communicate that we need something for our program that we don’t get.

[Pam Lindemoen] Also, find a way to show that security is an enabler of the business. Like a good example is a password manager because everybody [Laughter] hates passwords, right? Or implementing password lists throughout your organization, which is hard to do.

But if you can find those quick wins, easy wins, you’re a hero. Like, I’m a hero with my husband because of a password manager.

[David Spark] My co-host, Mike Johnson, CISO of Rivian, his thing is he tries to talk to the employees about their personal security, and if he does that first, then they understand business security. Because if you can’t get them to understand their own security, I mean, that’s a crazy logical leap to business security.

Yes? You’re both nodding your heads.

[Pam Lindemoen] I don’t think it’s a crazy leap. I use it all the time.

[David Spark] No, I’m saying if you don’t do it, it’s a crazy leap, yeah.

[Pam Lindemoen] Oh, absolutely. Yes, I think that’s a great way to get a win and to be seen.

[David Spark] Have you done that, Jason?

[Jason Mayor] A hundred percent. Actually, on our intranet, not only do we have information about our standard enterprise security program, but we actually have a tab that says, “Click here to kind of view some personal recommendations for your day-to-day life.”

Managing security changes for business optimization.

28:00.000

[David Spark] When you can show the value of security, it can drive a big impact. Now, a well-developed security program influences go-to-market strategy, product velocity, customer trust, and brand reputation, said Rinki Sethi, who’s the CISO over at Upwind Security.

Knowing this, CISOs should be operating as business architects rather than just being in charge of their division. The days of relying on dashboards for health checks are over. It’s not about visibility, but context to business operations. So, security leaders are measured on velocity, adaptability, and decision making under pressure, aka resilience, rather than proving maturity or compliance.

Now, if we’re trying to build a security culture across the business, shouldn’t we first be creating a business culture within the security team? So, I’ll start with you, Pam. We already expect CISOs to be doing this, but how do you get the rest of the security team involved of having a business culture?

[Pam Lindemoen] I had a leader once that I looked back to when I read this question early on, and it was this person would ask us why, like no less than five times. Every answer, they would say, “Why?” So, if you think about this, like, not in a gotcha way, but to force you to think through and to slow down and to, really, why are we doing this?

What’s the reason? Why this control? Why this alert? Why now? And eventually, why does the business care?

[David Spark] This is the Japanese philosophy, also, of the five why’s too, that digs down deep.

[Pam Lindemoen] And it can get uncomfortable because it’s just not natural, but it does work. It really does work.

[David Spark] Totally. And also, it also works really well when you’re doing postmortems of a breach and you’re trying to understand why something happened. You don’t just go with the first answer. You have to keep digging down deeper.

[Pam Lindemoen] And it’s kind of like a snowball effect. If one person does it and you start hearing the team say it, [Laughter] it’s kind of interesting, right? You’re building that within your security team, and it becomes a muscle that they all have and they all share.

And then they start talking to each other, and then they start learning the business, sitting with the business. Like we used to do rotations with the business to kind of understand what the business leaders were going through, to kind of help us understand what our controls were doing to them.

So, it’s a real easy way to get that culture changed.

[David Spark] For those of you not familiar with the Japanese philosophy, I believe it’s the five why’s, it’s five. The way it was described to me, so I wear a Fitbit. And so, like if you ask someone, “Why do you wear a Fitbit?” It’s like, “Oh, I want to count my steps.” And then you ask the question of why there, “Why do you want to count your steps?” “Well, I want to stay healthy.” “Well, why do you want to stay healthy?” “Well, I want to be healthy for my kids.” “Well, why do you want to be healthy for your kids?” “Well, I don’t want to die.” So, you realize, like, no one’s going to say, why do you wear a Fitbit, “I don’t want to die,” as their first answer.

[Laughter]

[David Spark] But you can get to it if you keep asking. Jason, I’ll go back to the original question I asked for Pam. How do you get the security team to have a business culture, which is what you have to do as a CISO?

[Jason Mayor] Mandatory one-hour weekly meetings…

[Laughter]

[Jason Mayor] …to talk about business. No, I will say we do some of that mandatory training in our firm just to sort of give some credibility to a lot of our security practitioners on the business side. So, think of like FINRA registrations. We actually have some requirements for some of our roles to achieve that business training over time.

But to me, maybe take it a little bit of a different route. Information is power. I also think exposure is power a lot of times. And so, finding opportunities for your security practitioners to get exposed to the business, even if it’s sitting in as a fly on a wall on a meeting so they can really understand and hear from the business, oftentimes, how little they know about security.

And sort of start to connect some dots on what they do in their day-to-day and why it’s important for them to truly understand how the business thinks and how they operate. Because we all know you really can’t be successful, obviously, from every role in security without understanding that.

[David Spark] That’s a really good point of sitting in to understand. And again, not to mock them and not to be shocked, but to understand where they are at their understanding and acceptance of security. A quick example, I was at a physical security conference and the highest level of cybersecurity sort of awareness or sessions they had was the lowest possible, like 100 level.

And I was like, “Oh, my, the physical security environment is so kind of out of touch,” like it kind of shocked me. But this was a number years ago. I got to think they’re more up to speed now. What have you seen?

[Jason Mayor] On physical security?

[David Spark] Yeah.

[Jason Mayor] I have some opinions on physical security, to be quite honest.

[David Spark] Let’s hear them. Come on, let’s hear them.

[Jason Mayor] Look, I mean, a lot of that stuff is not keeping CISOs up at night, generally speaking. I mean, the days I think of sort of breaking into premises to try to steal a hard drive or whatever the case is, I think, is way past this at this point, right?

I mean, what we’re seeing is completely different. Somebody sitting on the complete opposite side of the world is our number one threat, for the most part. So, I think it is definitely taking a back seat, but maybe rightfully so at this point, although I’m sure there’s some differing opinions in the room.

[David Spark] You want to throw in a quick opinion?

[Pam Lindemoen] In our industry, some of them fold together because the cyber actors are working with criminals locally and they’re stealing. Fraud is just rampant in retail and hospitality. So, I would say some of it’s coming together in our industry.

[David Spark] There definitely is convergence.

Sponsor – Adaptive Security

33:52.000

[David Spark] CISOs know the playbook has changed. Attackers don’t need malware to get in anymore. They can use AI to impersonate your CFO on a call, clone a vendor’s voice, or send a perfectly written email that looks like it came from inside your organization.

The new attack surface is trust.

Adaptive is built for that reality. Their platform runs realistic, deepfake, and social engineering simulations, so your team experiences these attacks the way they happen in the wild and learns how to spot them and respond fast. And with Adaptive’s AI Content Creator, security teams can take a breaking threat, a policy update, or a compliance requirement and instantly turn it into interactive, multilingual training without designers, without delays.

Adaptive is trusted by Fortune 500’s and backed by Andreessen Horowitz and OpenAI. You can learn more by going to their website, adaptivesecurity.com. And as always, when you go there, let them know that you heard about them from the CISO Series.

It’s time for the audience question speed round.

35:13.000

[David Spark] All right. In my hand, I have a handful of questions, and we’ve got a good amount of time, so we’ll be able to get through a few of these questions right now from our audience. And they have not seen these questions at all, so we’re going to try to get quick responses to both of them.

Pam, Jason, you ready? Here we go. First one, this comes from Bianca Palacio of Western Alliance Bank. What’s the CISO’s challenge to get the C-suite to buy into security awareness? And I know that varies company to company, but how does that sort of begin?

Assuming you don’t know what the culture is, you’re a brand-new CISO, how do you begin that? Either one of you want to jump in?

[Jason Mayor] Pam.

[Laughter]

[Pam Lindemoen] I think it’s table stakes, and I think any CISO would say that it’s table stakes. So, it’s the art of convincing the C-suite that it’s necessary. It’s absolutely necessary. I would say this. I would use metrics out of the SOC. I would use metrics out of what you’re seeing in terms of phishing and some of the competitors, like, absolutely necessary.

[David Spark] All right. Agree?

[Jason Mayor] Yeah, I would say start with the data, which I know earlier I said, “Don’t say what will happen if you don’t invest in things,” but there’s enough data out there on how much of these bad things start with a click of an email that shouldn’t have been clicked that I think that’s a pretty easy sell at this point.

Then over time, you sort of start to layer in some of the metrics that we talked about earlier that are actually showing behavioral changes in the firm.

[Pam Lindemoen] Do those personal touches. You know?

[David Spark] All right. Well, here, as dovetailed from that question, from Morgan Gardner of Techtronic Industries, how do you convince the C-suite that they’re not exempt from security training? [Laughter]

[Pam Lindemoen] That’s easy.

[David Spark] Okay. How easy is it?

[Pam Lindemoen] Show them a deepfake. Show them exactly who’s paying millions of dollars with deepfake.

[David Spark] So, essentially try to phish them with a deepfake?

[Pam Lindemoen] No.

[David Spark] Just show it to them.

[Pam Lindemoen] Just show it to them. Show them how easy it is and how vulnerable they are, in a non-FUD way. Not…

[David Spark] Just to show like, “I created this, took me an hour, boom.”

[Pam Lindemoen] “It took me two minutes to create this, and this is how they’re going to get you, and you are at risk. We need to lower your risk profile.” I think most executives know today, but.

[Jason Mayor] Yeah, we have a category of emerging threats as a section of our board update yearly, and it’s very, very easy to find examples of C-suite members being specifically targeted. And obviously, the impacts can be much bigger when those individuals are targeted.

So, again, it’s communicating. It’s showing those examples. Agree with Pam 100%.

[David Spark] Okay, this comes from both… Two people had to write these questions. Brian Brushwood of Modern Rogue and also Perry Carpenter of KnowBe4. How are you managing the always clickers? The people just click on every damn phish that comes in?

You can’t do it. And adding to that, if a company has a three strike and you’re out rule, does it apply to the CEO?

[Laughter]

[Pam Lindemoen] This is a very controversial topic.

[David Spark] Yes.

[Pam Lindemoen] Should you have consequence models or not?

[David Spark] I will just tell you, my co-hosts hate the three strike and you’re out model. They’re not a fan of it.

[Pam Lindemoen] I mean, I’m a big fan of making it a supportive environment; however, if there are people that will not listen, do not listen, I think you have to put guardrails around them, and you have to help them from themselves. Like we need controls around them that protect them from themselves, and if it’s your CEO, maybe it’s time to have one of his peers talk to him or her.

[Laughter]

[Pam Lindemoen] That’s a hard one.

[David Spark] That’s a good idea – get a peer to talk.

[Pam Lindemoen] Yeah, that’s a hard one.

[David Spark] Find a peer that’s been convinced and have them talk to the CEO.

[Pam Lindemoen] Yeah. Help them help themselves, right?

[David Spark] That’s a good one.

[Pam Lindemoen] It’s your job to articulate it.

[David Spark] I like that tip.

[Jason Mayor] Yeah, I doubt the CEO, I doubt it would apply to the CEO if that were true at our firm at this point, yeah.

[Laughter]

[David Spark] By the way, I worked for a company, and this is early, early days, where we were literally reporting on this malware that was going on and he literally clicked on the thing that we were reporting on to the public. Stunning. [Laughter]

[Jason Mayor] Yeah. Just to expand, I would say you have to be giving that information to that individual – talking about the repeat, sort of never-ending clicker. At some point, it becomes a management performance issue that they need to manage as their direct supervisor or manager.

So, you really should have a process to engage in that HR management discussion to share those data points as part of that at some point. Otherwise, obviously, you’re putting the broader firm at risk over a single individual’s behavior.

[Pam Lindemoen] I would turn up the monitoring on those individuals too, just to get direct alerts, and I would give them my personal phone number so that they could call me whenever they feel like they need to.

[David Spark] Oh, that’s good. I like that. All right, last question from Flavius Plesu of OutThink. Has data ever surprised you about high-risk user behavior? So, like you saw something like, “Whoa, I had no idea.” Have you ever seen anything? About user behavior, high-risk user behavior, anything like that?

[Jason Mayor] Not surprising, but after COVID, our insider threat program had to change dramatically. So, I think that was obviously sort of on the day one, month one, six months into everybody’s favorite RTO efforts at firms, there were some surprising data points that were coming up as part of the insider threat program.

Obviously, that just took some tuning to sort of adapt to the new day-to-day and business as usual. But just one example that came to mind that, yeah, you’ve got to be paying attention to that and obviously, tuning some of these things over time as the data and behaviors change.

[David Spark] All right, last?

[Pam Lindemoen] I’ve had some outsourcing data surprise me before where the SLAs went way down when we started outsourcing to a different organization. So, that surprised me, but not much surprises me anymore, David.

[David Spark] All right. You can’t shock these CISOs.

Closing

41:23.000

[David Spark] That brings us to the tail end of the show. Let’s hear it for my two guests.

[Applause]

[David Spark] Pam Lindemoen, who’s the CSO and VP of Strategy for Retail & Hospitality ISAC. And also, we have Jason Mayor. Come on, keep it going for him.

[Applause]

[David Spark] Deputy CISO for Raymond James Financial. Huge thanks to our sponsors, Adaptive Security, KnowBe4, Zepo. Go to their websites. Let them know that you heard about them from the CISO Series. Let’s hear it for them. We’re here because of them.

[Applause]

[David Spark] I do want to ask both of you, are you hiring over at Raymond James, yes?

[Jason Mayor] Yes.

[David Spark] They are hiring. How would someone find that information?

[Jason Mayor] RaymondJames.com/careers.

[David Spark] RaymondJames.com/careers. And can someone contact you directly if they see something?

[Jason Mayor] 100%, connect with me on LinkedIn. I’m happy to spend time.

[David Spark] We will have the link to his profile on the episode. And Pam, I don’t think Retail & Hospitality, but all your members, I’m sure they’re hiring plenty.

[Pam Lindemoen] We have over 350 members.

[David Spark] And you got a list of them, and I’m sure you can go dig deep and find possible jobs there. Well, a huge thanks to the National Cybersecurity Alliance for bringing us out. Hopefully, we’ll come out again next year. And a huge thanks to our audience for being here as well.

Thank you for listening and contributing to the CISO Series Podcast.

[Applause]

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.