No CISO cares about a vendor’s technical innovation for its own sake. They care about how their solution can help solve their problems. So why are so many vendors missing the point when they make their pitch?

This week’s episode is hosted by me, David Spark, producer of CISO Series and Andy Ellis (@csoandy), principal of Duha. Joining us is Daniel Liber, CISO, Monday.com.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Material Security

Full Transcript

[Voiceover] Best advice I ever got in security. Go!

[Daniel Liber] So, the best advice I got for security is when you start a new job as a CISO is to adapt to the organizational culture, but not at any price. It means that you need to be aware of where your boundaries are and to assure that they’re not being crossed, even if it means you need to pull the organizations a bit towards you.

[Voiceover] It’s time to begin the CISO Series Podcast. 

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I’m the producer of the CISO Series, and joining me as my co-host, it’s the principal over at Duha, none other than Andy Ellis. Andy, say hello to the audience. 

[Andy Ellis] Good afternoon, folks, or depending on when you are in the world, good morning, good evening, or good night. 

[David Spark] And what language is that in? 

[Andy Ellis] That would be American English. 

[David Spark] Well, how would you do it in European? 

[Andy Ellis] Had I gone with the Queen’s English, I might’ve been like, “Good afternoon, Governor.”

[David Spark] [Laughter] 

[Andy Ellis] A little Mary Poppins English for you. 

[David Spark] There you go. [Laughter] 

[Andy Ellis] I mean, I guess I could have done, given that we had Daniel here, [Foreign Language 00:01:57], but then I always have to remember what the right transition sentences for when you are in the world, and I have to look that up in Hebrew. 

[David Spark] We’re available over at CISOseries.com, where you can find all of our wonderful programming, if you are not checking that out already. Our sponsor today is Material Security. Secure what your business is made of. Material is a unified detection response platform for Google Workspace and Microsoft 365.

More about just that a little bit later in the show. Andy, we were talking about swag hunting moments ago, and I want to know what is the one or two pieces of company swag that’s not for a vendor that you’ve ever worked with that you have, and you really like, and you still have it?

[Andy Ellis] So, the first one is actually going to be from Gardent, who was an MSSP a long time ago in the Boston area. They gave out a little guard dog, looked like a little Rottweiler or something, but the underside of it was a felt for wiping your laptop monitor.

[David Spark] Ooh, that’s a good idea. I like that. 

[Andy Ellis] And so, I’ve had that one, I want to say almost 20 years now. 

[David Spark] Oh, my God. [Laughter] 

[Andy Ellis] That one wanders around with me. I’ve still got it. And then currently, and this is one of the pieces of swag that is ever useful, is charging banks because the standard of like how much power you can get out of one keeps going. So, the current one I’ve got is I think from the CyberEdge Group, basically slaps onto the back of my iPhone and charges it.

Picked that up, I think, at Cyber Marketing Con last year. 

[David Spark] You know what the pieces of swag that I have still, and I really enjoy are simple, adaptable screwdrivers, where they change to Phillips head or flathead or different sizes because I’ve actually got one at a show and used it to fix my gear on the spot.

So, it was amazing. 

[Andy Ellis] I do have one of those, but I have one from Akamai. Our network engineering team made them for all of the network engineers, and I got one. And it’s great, it’s a Swiss Army knife that was focused for network engineers with all of the adapters for the small screwdrivers that most people don’t have.

[David Spark] Yeah. And I have one that’s kind of a small set, I have one that’s like a real kind of heavy duty, and all it is is a Phillips head and a flathead that you can flip over, and I use them both all the time. 

[Andy Ellis] Yeah. No, you get some great swag, but you can also get some really cheap stuff. 

[David Spark] Understood. Let’s bring on our guest because we’re not just talking about swag this whole time. Very thrilled that he is on, and he’s all the way from Israel. Thrilled. It is the CISO over at Monday.com, Daniel Liber. Daniel, thanks so much for joining us.

[Daniel Liber] Thank you, David. Thank you, Andy, for having me as well. 

What about this AI security challenge? 

4:47.195 

[David Spark] “Well, most tools aren’t fully equipped to scan AI models or prompts for malicious code, and attackers are already exploiting that gap.” Now, that’s Brian Fox from Sonatype, as quoted in a recent CSO Online article, not mincing words on why AI sprawl is security’s nightmare.

AI models are essentially black boxes stored in formats most security tools can’t read. Traditional dependency scanners, code reviews, and vulnerability assessments weren’t designed for assets that are fundamentally unscannable, let alone the scale of staff that can now vibe code their way into a security incident.

So, Andy, I’m starting with you. When malicious code can hide inside a file masquerading as an AI model, and prompt sharing platforms are being weaponized to steal API keys, how do you secure what you literally cannot see? 

[Andy Ellis] So, I think this is an awesome challenge that we’re all going to face, but first we have to understand it is a new challenge. I was talking to a founder yesterday in the AI security space talking about MCP, Model Context Protocol, which I’ll be honest, like, I didn’t really grasp as well as I should have.

And he basically said, “Look, it’s like walking into a Chinese restaurant and being handed a menu. You don’t just get to order what’s on the menu. The menu is a hint for you.” And that’s all that MCP is, is this idea that an LLM sits in front of an API and explains the API to you, and then you have an LLM in front of your client that says, “Hey, here’s what I want,” and your LLMs talk to each other.

But the problem is the LLMs can do anything. They’re not tightly bound by the API. 

And in a sense, this is the same transition we went to when we went to general purpose computers. If you remember, like electronics used to have everything in firmware, you did exactly one thing, and if it didn’t do it well, well, you were kind of stuck.

There were no easy upgrades. And then we went to general purpose computers and the world of security exploded because we went from trying to solve a specific problem to solve you have this omni-capable computer that could do anything and might do everything.

And I think we’re just hitting that again, which is we’ve gone from APIs that were very tightly defined, and we tried to make sure that the API itself wasn’t broken, to now, we’ve replaced the APIs with general purpose LLMs. And you have to sort of apply the same principles.

How do you prevent the LLM from doing things it’s not supposed to do? Does the LLM have control over keys? And if so, why? Why does it need to have access to keying material in the same way that you don’t necessarily give your web application server access to keying material that’s often handled off board that system?

I think that’s what we have to think about is new design paradigms that tightly control these agents, whether it’s MCP or something else, so that it can act in this general purpose way but constrained. 

[David Spark] So, we talk a lot about guardrails, but this seems like a really complicated to define and create guardrail, Daniel. Yes? 

[Daniel Liber] Yeah. I mean, it’s quite difficult to define where we would actually need to implement controls, and I assume that every security team is having the discussion about what do we do about AI. Actually, we had a discussion about this recently, and we tried to break it down into, let’s say, three different categories on how we approach AI security.

So, the first one is the easy one. It’s more of the same, meaning the principle is quite known. It just was we’re also currently covering new scope by AI, for example, SaaS security, okay? So, now we have AI tools. That’s easy. The other one is on the other side, and that’s where we need heavy expertise.

I think you just said in the beginning about model poisoning and doing something which is more about data sciences that requires significant training and expertise, which is really being outsourced. I think that is going to stay the same. Now, what’s in the middle is all the new domains which are about AI that you need to think about, and I think this comes with a plethora of new vendors that try to hook on these new things.

For example, agent security, which is now becoming a topic, and it’s really just trying to break it down into different areas and what you need to do. I think the main problem is that in this specific section, what used to be an easy way to distinguish in the past, you had the perimeter by network, and then the cloud came in, and now everything is connected.

I mean, not just IOT phrasing, but really everything is connected. And it’s becoming very difficult to define the roles and responsibilities about who should protect what because code is now with infrastructure and agents and cloud, so it’s becoming a mess.

And I think the key point is to untangle this and create a vision before you start acting. 

How can we improve this pitch? 

9:42.411 

[David Spark] Why are cybersecurity companies so terrible at explaining what they do? Now, that was Patrick Garrity of VulnCheck’s takeaway at Black Hat, where he found more word salad than substance. It turns out customers don’t care if you’re first, autonomous, automated, agentless, agentic, or AI powered.

They care about what problem you solve and whether you solve it well. We’ve become so obsessed with buzzwords and technical differentiators that we’ve forgotten to lead with the actual pain point. I would agree. I mean, they used to be really, really good at that, and now not so much so.

So, I’ll start with you, Daniel. What else makes a security pitch land versus crash and burn? 

[Daniel Liber] Ooh. That’s a strong one. I actually had an interesting discussion about it this week with an SDR that tried to do cold calling. So, I actually sat down and explained to him what I expect. So, I told him, I mean, first of all, it’s about how to approach, but the two main things I told was that they need to understand the problem.

They usually come in and say what the solution is without understanding the problem, and this is mostly for sales guys coming with a sales background, but usually with a very, very weak to non-existing technical background. So, when you start to discuss with them, they have no idea why you reject them, and it’s very hard to explain to them.

And among those that do have technical expertise, and that’s point number two, they usually are unable to differentiate what would make their products succeed and others fail or vice versa. For example, if I have, let’s say, a strong Mac-dominated organization with endpoints, and you try to sell me an endpoint solution that is strong with Windows, but not with Mac, then obviously, you should know in advance to ask me about this, and that it’s probably less to succeed.

But they’re kind of, I won’t say ignorant, but they’re kind of oblivious to this criteria, to be honest. 

[David Spark] All right, Andy, I’m going to guess you have one, maybe two opinions on this subject? [Laughter] 

[Andy Ellis] Oh, I have so many opinions. 

[David Spark] By the way, just to set everybody up, at Black Hat, Andy was literally writing down all the copy that he saw on the signs in the booths, and you wrote up a massive amount on this. And actually we can link to this in this episode on the blog post, but go ahead, Andy.

[Andy Ellis] Yeah. So, 34 of the 359 vendors that I got data on at Black Hat said that they were the, the first, the only, the 100%, like superlatives. So 10% of the vendors claimed to be the outlier. I will tell you 20% of the vendors, I have no idea what they actually did because their booths either said nothing or they were trick or treat, they were Halloween themed.

[David Spark] Some of them actually do have candy, so you could trick or treat. 

[Andy Ellis] They have candy, but you trick or treat for swag. But there were a handful of vendors that it was more about the booth design than it was about the company. 

[David Spark] And that’s true. I’ve seen it. There was one that was built like a high school locker room that I thought was quite entertaining. 

[Andy Ellis] There was a high school locker room. That was Zafran was the high school locker room. Rapid7 had the, like the bar saloon. Torq had the big giant truck. Sorry to call out a bunch of vendors here, but I think what happened is…

[David Spark] By the way, I just want to say that’s not that bad. I mean, that’s a kudos to the design company that brought it in. 

[Andy Ellis] Maybe, maybe that’s what you wanted. 

[David Spark] Yeah.

[Andy Ellis] Maybe that draws in what you’re looking for. But I will say that one of the biggest challenges you end up with here is you’re actually catering to other marketing professionals rather than the buyer. Or you have great swag and you’re catering to the people who just want to do swag collecting.

Like, if you want to be amazed, go walk outside the show floor right as it closes on the last day, and look at how many people are walking out with like two or three bags because they walk around to the booths and they’re like, “What do you not want to take home?” And they’re just collecting piles of stuff.

[David Spark] By the way, can I just say, like if I hired someone and paid for them to fly out there, go to the hotel, not working in the office, and they come back with $5 swag, a bag of it, I’d be furious. 

[Andy Ellis] Well, they’re not going to tell you they did that, David. Come on. 

[David Spark] No, but you would see it on their desk eventually. 

[Andy Ellis] Or they’re taking it to their kids or they’re doing something with it. Who knows? 

[David Spark] Yeah, I know. I must say that when I saw a stuffed animal, I would bring them back to my kids. Yes, that’s always fun. 

[Andy Ellis] Yeah. Right. But to Daniel’s point is you have to actually understand what truths the buyer needs to believe before they’re going to buy from you and what your truths are match theirs. And so, I have what I call like the nine truths model.

It’s really simple. It’s do they have a location, as Daniel said. Like if you’re a Mac shop and they’re selling a Windows solution or vice versa, like your location just doesn’t even match. Is there a problem? Is this urgent? Is this the owner? Do their peers think they own it?

Do their stakeholders want them to fix it? And then you can talk product marketing. Here’s how you could solve it. My solution is the best and you should get money for this. But if they don’t have those nine truths in their head and you don’t resonate with them, they’re just going to walk past.

Three hundred fifty nine booths. Nobody is walking through looking to see what you do. They’re walking through looking for a problem, right? The two best booths I will give was – I’m now blanking on their names. It was the two people who had vibe coding on the side of their booths.

Right? And I was like, this is brilliant because everybody’s talking about vibe coding. We already talked about it today. And now if that’s your problem, you’re walking, looking for the problem, and you’re going to end up at either Backslash’s booth or Mirror Security’s booth because they were the only ones who said vibe coding.

You were looking for the problem that resonated with you. 

Sponsor – Material Security 

15:37.830

[David Spark] Before I go on any further, let me tell you about Material Security. Now, we all know that every era of cybersecurity has inspired purpose-built security for important assets. So, EDR for endpoints, IAM for identities, and CSPM for cloud workloads.

We’re familiar with this. Yet somehow, the system that modern companies really live in, Google Workspace, is still protected by a patchwork of tools created for different purposes, so documents, data, communications, and accounts all live in Google Workspace.

It’s time to implement dedicated protection for this very specific critical infrastructure. 

So, Material Security is the first and only detection and response platform purpose-built to defend Google Workspace. Other point solutions treat Google as an afterthought, leaving you with massive gaps in coverage. Material provides continuous protection across your entire environment before, during, and after an incident.

The platform automatically identifies vulnerabilities and suspicious activity, reduces the impact of a breach, and protects sensitive data even when credentials are compromised. Now, sophisticated email attacks, risky misconfigurations, shadow IT, account takeover, all of this stuff, Material not only monitors everything continuously, it applies fixes and steps in to make sure information only flows where it’s supposed to go.

So, if you’re ready to stop trying to fill the gaps and start getting ahead of threats, check out Material Security. You can learn more at their website material.security and let them know that you heard about them from the CISO Series. 

It’s time to play “What’s Worse?” 

17:25.921 

[David Spark] Daniel, you are familiar with this game, correct? 

[Daniel Liber] Yeah. 

[David Spark] You’re familiar. All right. You’re ready for it. 

[Daniel Liber] I’m ready for it. 

[David Spark] And you know that Andy has to answer first and then you can agree or disagree with him. 

[Daniel Liber] Mm-hmm. 

[David Spark] All right. This one is an interesting “What’s Worse?” in the sense that it’s actually two good things with a negative twist attached to them, you’ll see what I mean. This comes from Jonathan Waldrop, who’s a former CISO over at The Weather Company.

He’s given us a lot of great “What’s Worse?” scenarios. So, Andy, here we go. What drives the “What’s Worse?” here? So, the CISO thinks they’re doing a great job because no one provides feedback to the contrary because others don’t know how to talk to the CISO.

In actuality, there’s a great deputy behind the CISO that is actually running the show. That’s scenario number one. 

[Andy Ellis] Okay. Doesn’t sound bad, but if you’re in that scenario as a company, like come hire me, and I will help you learn how to talk to your CISO. Okay. 

[David Spark] Scenario number two. 

[Andy Ellis] Couldn’t avoid that pitch. Sorry.

[David Spark] There you go. The program is running well, but the CISO doesn’t articulate the value well, and the executive team views him as an overpaid manager. So, which one is worse? So, understand both programs are going well for different reasons, but the perception of what’s going right and wrong or understood is different.

So, in the first scenario… 

[Andy Ellis] Wait. So, in the first one, you have a great deputy who’s running the program. 

[David Spark] But they assume the CISO’s doing well. 

[Andy Ellis] They assume the CISO’s doing well, like nobody’s telling the CISO they’re doing badly. 

[David Spark] But that CISO isn’t doing bupkis. They’re not doing anything. 

[Andy Ellis] Okay. They’re a placeholder who’s… Okay. 

[David Spark] But the second one is the program’s doing well, but perceived as an overpaid manager, but the CISO is doing the work. 

[Andy Ellis] Oh, second one’s the worst. 

[David Spark] Just because of the perception. 

[Andy Ellis] Yes. Yes, because perception is reality, and at the end of the day, the fact that you have a program that works isn’t what’s important. I mean, it’s important, to be very clear. 

[David Spark] [Laughter] 

[Andy Ellis] It’s about how are you making sure the business makes wise risk choices into the future? It’s not about how well you’re securing what’s in your bailiwick. It’s how are you making sure the executives are doing the right thing, and if the executives do not respect you and do not trust you, and they think you’re just an overpaid manager who can’t communicate, when new and novel risks come up, the business is going to do the wrong thing.

Now, the first case actually has some issues with it, but at the very least, at least the competent deputy is protected from the executives, and maybe at some point they’ll figure it out, but you’ve at least got a program that works. The CISO appears to be respected and trusted.

So, as long as they’re not screwing it up, when new things come up, as long as the deputy does a good job of sock puppeting the CISO, which I’ve been that CISO, just to be very clear. 

[David Spark] But also, I want to point out in the first scenario, others just don’t know how to talk to the CISO at all. 

[Andy Ellis] But it didn’t say that they thought the CISO was bad. 

[David Spark] Right. 

[Andy Ellis] No, I think in the first one, they’re giving the CISO all the credit for what the deputy is doing.

[David Spark] Well, in a sense, but nobody communicates with them. It’s like… 

[Andy Ellis] That’s a weird dynamic. Like this one, I actually like this one. Jonathan, by the way, it’s very rare that I’m like, “Huh, this one’s really good,” because you took the normal, like two awful scenarios, and gave us two actually fairly normal scenarios.

I know a lot of CISOs who are good, but their company doesn’t think they are. And ultimately, that always ends up badly. So, I’m going to go with the second one is the problem because if you’re not a good communicator, you’re not actually doing the job.

[David Spark] All right, Daniel, agree or disagree here? 

[Daniel Liber] Agree. 

[David Spark] All right. Same reason, different reason?

[Daniel Liber] As a CISO, I think the first thing I have in my mind is the security of the company, and if the CISO delivers but fails to communicate, then the executive team might think, “Well, yeah, you know we’re going to sack him and then also his team, and maybe we’re going to cut budget.” And eventually they’re going to cut into things which really make difference without them knowing, and they’re going to get hit without understanding.

While in the first scenario, there are two options. One, they’re going to fire the CISO only because they’re unhappy with them, but then you have the deputy CISO, which is going to take over, which is perfectly fine. But another option is that the team is losing trust in the CISO because they’re taking all the credit or kind of leading without doing the heavy lifting.

But in that case, it’s less likely that they will be dropped altogether. They’re probably going to leave one by one, which is not optimal, but still better than the second scenario, in my view. 

[David Spark] All right. I like it. Good answers, both of you. And kudos to Jonathan for giving us a great scenario. 

What we’ve got here is failure to communicate. 

22:10.510 

[David Spark] “We live in a model where marketing outpaces innovation. The top vendors spend millions telling you they’re number one.” That’s what Andy said. “Meanwhile, real solutions from smaller players rarely break through.” Now that’s Dr. Chase Cunningham’s assessment of cybersecurity’s “self-licking ice cream cone of misery.” I saw this at Black Hat hearing identical pitches on the show floor, “We do continuous testing.

We’re contextual. We remediate automatically.” But there’s no way to tell who’s better. They all sound exactly the same, and nobody seems to be proving anything. 

Now I started to say compare this to the AI tools in the last two years, where we could literally watch Midjourney and DALL-E improve, compare output side by side, and choose based in results. I mean, these are the image generating programs, and I was introduced to it over two years ago, and it was very crude back then, but we all saw it getting better together.

And it was very visible, and we could all see it with our own eyes. But in cybersecurity, we just get marketing promises. So, I’ll start with you, Andy, as a CISO, how do you cut through the hype? But I’d be more interested actually for the vendors, how do they actually show improvement, like show the equivalent of what we saw in imagings rather than just these empty marketing platitudes?

[Andy Ellis] So, I’m like this weird outlier in the marketing and security world, which is I just want to know what you do. Tell me what you do. And part of that’s because…

[David Spark] But believe it or not, you’re not an outlier on that. [Laughter] 

[Andy Ellis] Because I’m a technologist. Like, I don’t care that you’re the number one CTEM platform out there. Like, first of all, I was on the board of the first CTEM companies and like half of what people are calling CTEM today, I have no idea what they’re actually doing.

It’s like 18 different things. Just tell me what you do. “Oh, we are a platform that collects data from 17 different sources, we disaggregate it, here’s our defining feature,” I will know how to plug you into my security program. What’s that 15-second barbecue technology pitch?

If you also want to give me the value pitch, that’s okay, but I think every marketer has been told do value-based marketing, value-based selling, but then they all end up gravitating. It’s like the ice cream vendor problem. You’re familiar with this, the beach ice cream vendor problem?

If you have a beach, right?

[David Spark] Mm-hmm.

[Andy Ellis] And you have two ice cream vendors. In an ideal world, the vendors are like spaced like a 25% and 75% down the beach because then everybody has the minimal walk, right? 

[David Spark] Right.

[Andy Ellis] But the reality is any vendor that moves towards the middle picks up more of the beach because they’re closer to more people, and at some point, you end up with two vendors dead center in the beach, and most people now have to walk very long distances.

That’s what cybersecurity feels like is we have all of these vendors gravitating towards the perceived buzzwords that are valuable. 

[David Spark] Yes. 

[Andy Ellis] AI this year. 

[David Spark] Yeah. By the way, don’t put it just on the vendors. I see the VC firms doing this as well. 

[Andy Ellis] Oh, absolutely. As a former VC, we did it as well. It was like, “Oh, we see 18 people investing in X. Who’s going to be our bet in X?”

[David Spark] Right. 

[Andy Ellis] You absolutely do see this, but what it means is that the differences between these companies is really hard for someone to find out. Like if you’re in the AppSec world, like what’s the difference between a side code and a Veracode? Technologists might know, but they both come out and they’re both like, “Oh, we’re both doing ASPM.” 

[David Spark] Just so you know, so when I was at Black Hat, in one day I got three pitches from three autonomous pentesting companies. 

[Andy Ellis] Yep. A lot of those. 

[David Spark] And they said exactly the same thing, all three of them.

[Andy Ellis] Right.

[David Spark] And by the third one, I said, “Just so you know, you’re all saying the same thing,” and it was surprising to them because I’m in the seat where I’m hearing the pitches. They’re not. They’re in the seat of giving the pitches, not hearing them.

[Andy Ellis] Right. 

[David Spark] And what they would do is at the end, they’d go, “Well, how do you differentiate?” And honest to God, this is what they all say, “Well, we’re obviously better.” No, no. Why? How would I know that? Like how? [Laughter] 

[Andy Ellis] Yeah. Here’s my recommendation for every vendor, which is you don’t have to always use this as a deck but build a deck that explains the attack that you defend against. That just says, “Here’s what the attackers do. Here is how my technology stops that.” Whether I’m proactive, reactive, preemptive, whatever it is, learn that narrative because what has to be true in the environment will come out, what the threat is, is this really urgent?

How well do you help? But if you cannot explain to me, and this is the biggest challenge that the automated pentesters have, is like, what are you actually preventing? “Well, we’re preventing you from not knowing about the vulnerabilities that you can’t fix.” Can’t fix them.

Not knowing or knowing isn’t going to help me. 

[David Spark] All right. I’m throwing this to you, Daniel. You get the ear of a lot of vendors. And by the way, the AI story is that’s really what I’m focusing on is what I am seeing is no one vendor really leaps and bounds ahead of another because the AI quality is moving at the same pace for everybody.

So, for example, two years ago with the imaging tools, it was all crude for everybody. There wasn’t one making photorealistic back then and one making garbage. They were all kind of making garbage at the time, but they all moved at the same time. And I’m getting the sense that the same thing is happening in security.

So, what do you do when, like what Andy said, everyone’s selling ice cream. Yeah, one ice cream may be a little bit better than the other, but they’re all selling the same thing. 

[Daniel Liber] So, many systems do a lot of POCs, and I think that the ground rule is that if I need to use your product to understand how it differentiates from others, your marketing failed.

[David Spark] Good point. 

[Daniel Liber] So, there are two things that we try to do. The first one is we come prepared. We take like the funnel, we look on the market, the market leaders, then go to talk with some vendors verbally. And then we’ll go to the demo calls with the top three or top two.

We ask for demo, not a sales pitch, a demo so we can see the features with our eyes. And going back for a second to what we discussed about good salespeople, they’re the ones which are both technical and honest. And they can tell, “You know what? We’re good because we are cheaper because maybe in that model, we are less good, but this one, we really kick ass from the other competitors.” And those conversations are the best ones we had because it’s easy to make a decision, and to be honest, it creates trust between us and the marketing and the sales team of the vendor, which lasts even beyond our current employment.

It goes on for years afterwards. So, in my view, these are the two key points to come ready and to have a good counterpart that knows how to sell with the differentiation points. 

What’s the best way to handle this? 

29:16.150 

[David Spark] “The most dangerous CISO isn’t one who reports to the wrong person. It’s one who mistakes being right about risk for being effective at managing it.” Many CISOs fall into this trap of a dictator-level authority mentality, according to Carraig Stanwyck of 3 Tree Tech.

He makes the point too many miss. If leadership accepts a risk after being properly informed, that’s not failure. That’s functioning risk management. That’s easy enough to conceptualize. But how do you actually know if you calculated the risk correctly?

When leadership accepts your assessment and moves forward, are you confident or just hoping you’re right? I’m going to ask you, Daniel, how do you validate your risk assessments are actually accurate when the feedback loop might be years away or never come at all?

[Daniel Liber] I think many CISOs make the same mistake of rushing into mapping the organization, trying to understand the controls and everything around it, trying to set up the risk register, and come up to the board or the executive management with a list, obviously, for budget and resources.

I think that part of the process is not just about mapping the organization but doing something that I like to call sensing. I mean, it’s maybe a nice word for risk appetite. But I try to get at least a few meetings doing my own boarding with the executive team, and we do a small game of, let’s say, adjusting the scales.

So, I said, “Let’s assume that we approve all the risks on one hand and let’s assume we approve nothing.” And then we try to put scenarios in between to kind of gauge how comfortable the organization feels or not. And this is where I kind of started to understand where I came into, and my purpose is to also put myself on the same scale and try to bring us together closer.

Maybe I can compromise a bit or the organization. And I think when you do that, and then you start to discuss about the risk treatment and risk evaluation, it’s much easier because everybody has the same mentality and the same risk appetite based on that sensing.

[David Spark] All right. Andy, I send it to you. We’ve been talking a lot about risk and what’s the best way to quantify it, but I really like this whole idea of just how do you know if you’re making a good decision or not? Like you could create all these numbers and charts and things and make it look impressive, but really, how do you know?

[Andy Ellis] So, you just asked the right question, which is how do you know if you’re making a good decision? But those are two different you’s. The first you is the CISO. How does the CISO know if the company is making a good decision? And the problem is you can’t make a decision about risk without also talking about the whole business context, right?

And you have to understand how humans behave. Humans are not rationalists. Nobody pulls up a spreadsheet to decide whether or not to tie their shoes. Like, you just tie your shoes. Like you say, “Oh, I shouldn’t tie my shoes here because I’m on a busy intersection and somebody in a scooter is going to run me over.

Let me step to the side.” You don’t do math to make that equation. That’s because you believe in the risk. 

And that’s what our job is as CISOs is we are, I hate to tell this to everybody, we are evangelists, evangelizing about risk. It’s our job to be informed, to evangelize the right risks, but when the business is going to do something, they’re making a risk trade-off, right?

They’re investing time and energy. And yes, future hazards might come in. That includes security hazards in hopes of some benefit. So, if you just come in and say, “Well, you can’t do this because the security hazard is too high.” It’s easy for them to say, “Ah, you’re just a doom and gloomer.

I can ignore you. My only risk is that like you’re going to tell me I was wrong in the future, but instead I’ll go make a billion dollars.” You have to make them believe in the risk. You have to make the risk part of their model so that when they say, “Oh, I’m rolling out an LLM.” Oh, right.

I got to pay attention to the fact that people might steal everything my LLM has access to. It does not matter that they have the percentage right. If they don’t believe in that risk, you didn’t do your job. 

And that at the end of the day is all we can hope for is that we can get people to believe in the risks that are relevant to them so that they are making wiser risk choices and that those choices are happening at the right level of the company. Some random manager should not be able to say, “Oh, I’m going to release an LLM with access to all of our production data that anybody can query,” right?

That’s the point where the CISO doesn’t step in to say no. They step in to say, “There’s so much risk here. This decision has to be made at the VP level, and they need to be cognizant of the risk.” That’s it. Get people to believe that they own the risk.

[David Spark] Right. And what I’m also hearing from you is non-security people should make generally good decisions about risk. Like we don’t run out into traffic because we know that’s risky, even though we’re not traffic cops. 

[Andy Ellis] Right. Humans are really good at making risk decisions. The problem is sometimes risk gets really esoteric, and the people who own it are more excited about being right and dominant than they are about educating and making people aware. 

Closing 

34:32.707 

[David Spark] Well, that brings us to the very end of the show. I want to thank our sponsor, first of all, and that would be Material Security. You remember Material Security. Secure what your business is made of. Material is a unified detection and response platform for both Google Workspace and Microsoft 365.

You can just go to their website, material.security. Hey, let them know that you found out about them through the CISO Series. Daniel, thank you so much for coming on the show. We greatly appreciate having you here. Let me ask you this question. Are you hiring over at Monday.com?

[Daniel Liber] Yes, we are.

[David Spark] So, how would we go about finding and could someone contact you if they’re interested in a position? And by the way, are you hiring anywhere in the world or where you looking to hire? 

[Daniel Liber] So, we’re currently hiring in the States, in the UK, and in Israel. You can find the careers on Monday.com websites or you can actually ping me through LinkedIn directly. I’m quite open for discussion. 

[David Spark] We will have a link to Daniel’s LinkedIn page on the blog post for this very episode as well. Well, thank you so much for coming. Did you have a good time? 

[Daniel Liber] I had a blast. It was amazing. 

[David Spark] I’m glad. Andy, thank you for making it a great show as always. 

[Andy Ellis] Hey, thanks for doing all the prep work to make it easy for the rest of us. 

[David Spark] It’s not just me. We have a great production team behind us. Thank you so much, both of you. Thank you to the audience. We greatly appreciate your contributions. Send me more “What’s Worse?” scenarios. And thank you for listening to the CISO Series Podcast.



[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.