Everyone talks about the need for prevention in cybersecurity. But the dirty secret is it’s rarely practiced because it introduces productivity friction. Will prevention always be cybersecurity lip service, or is there a way to achieve meaningful prevention without interrupting the business?

This week’s episode is hosted by me, David Spark, producer of CISO Series and Andy Ellis (@csoandy), principal of Duha. Joining us is Jason Loomis, CISO, Freshworks.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Safe Security

Full Transcript

[David Spark] Before I begin this show, I do want to let you know about two great episodes that have just dropped on CISOseries.com. For our show Security You Should Know, check out the episode entitled, “Harnessing AI-Native PAM…” that’s privileged access management “…with Formal.” And we also have a great episode of Defense in Depth entitled, “How Are You Managing the Flow of AI Data?” You can find Security You Should Know and Defense in Depth on your favorite podcast app or over on CISOseries.com.

[Voiceover] Best advice I ever got in security. Go! 

[Jason Loomis] Probably the best advice I ever got was from my old CTO and it’s overused, I’ve seen it on T-shirts, it’s, “Fake it till you make it.” But it’s really about always saying, “Yes,” to when you’re faced with a new challenge or a new opportunity or something you’ve never done before.

They go, “Hey, do you want to take over privacy operations?” I can’t spell privacy, “I’ll take it. Yes.” Always say yes. 

[Voiceover] It’s time to begin the CISO Series Podcast. 

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the producer of the CISO Series. Joining me is Andy Ellis. He’s the principal at Duha. Andy, say hello to everybody. 

[Andy Ellis] Good afternoon, folks, or depending on when you are in the world, good morning, good evening, or good night. 

[David Spark] By the way, Andy was pointing to a graphic over his left shoulder. I have explained to him many times that this is an audio-only program. He still doesn’t get it. 

[Andy Ellis] But I’m really excited that I have a monitor behind me so I can do videos with my slides here. But I’ve got to work on the contrast here. 

[David Spark] I don’t know. We all need to help Andy understand the difference between video and audio. Audio, you can only hear. You can’t see things. 

[Andy Ellis] Unless you have synesthesia. Please. Let’s not be normist. 

[David Spark] [Laughter] Good point, Andy. We’re available at CISOseries.com, where all your senses but touch and smell can be used. 

[Andy Ellis] Ooh, smell-o-browsers. 

[David Spark] Oh, and taste. Touch, smell and taste, I take that… Seeing and hearing. You could do it. Yeah.

[Andy Ellis] We should get scratch-and-sniff stickers to give away at the next conference. 

[David Spark] That’s not a bad idea. We do have stickers, though. By the way, if you ever see me, I usually have stickers on me. Approach me, and I’m happy to give you a packet of stickers of logos of all our programs you can put on your laptop. Let everyone know you listen.

I do that. I hope you’re doing that, Andy, as well.

[Andy Ellis] Sometimes. 

[David Spark] [Laughter] Sometimes? You take them on and off your laptop? 

[Andy Ellis] I have different devices, and so some devices have stickers on them and some don’t. 

[David Spark] My son went to a skateboard camp and he gave a sticker to a professional skateboarder who put it on his helmet. So, CISO Series is on the helmet, I don’t even know who it is, of a professional skateboarder. 

[Andy Ellis] Very cool. 

[David Spark] Our sponsor for today’s episode is SAFE Security, world’s first self-driving third-party risk management platform. We’re going to learn more about this very cool third-party risk management platform later in the show, so stay tuned for it.

We’ll be talking about it. Now, Andy, this is something I’ve said on the show multiple times before, but it bears repeating because I do enjoy it, and that is compliments. I’m a big fan. Are you a big fan of compliments, Andy? 

[Andy Ellis] I love compliments. Anybody who wants to give me a compliment, always welcome to. David, by the way, you’re looking remarkably lovely this morning.

[David Spark] Thank you.

[Andy Ellis] I see that you are observing the fast of Tammuz and not getting your hair cut for these three weeks before Tisha B’Av. 

[David Spark] I did not know that was a thing to do, but I have not gotten my hair cut for quite some time. But my hair is not growing at the rapid rate it used to as well. But the thing is, [Laughter] honestly, we’ve been getting practically daily compliments about our programming.

I just want to say, and I’ve said this… 

[Andy Ellis] Oh, just which intern keeps doing them so we can pay them more? 

[David Spark] It is not an intern. It’s multiple different people. I know you want to knock me down a peg, and I just also want to say that the compliments, while they come through me as a conduit, that I know that I am not the one who should be absorbing all the benefit of these compliments, that they should be going to you, to the other co-hosts, to my entire team.

So, I reiterate it to everybody again and again that we’re all benefiting from these wonderful compliments we’re hearing, although they’re often coming directly to me. So, by the way, feel free to send compliments directly to Andy as well and to Mike.

[Andy Ellis] Actually, send them to the audio editors who make us sound good. 

[David Spark] Yes. And to the audio editors. You can also say that for the audio. We have multiple audio editors who work on all our programming, and video editor too as well. And the entire team that’s just making everything awesome. So, just want to say that we appreciate the compliments.

As I’ve said before, the line I use, I have a very high tolerance for compliments, I’ve yet to find my limit. So, if you want to keep hitting me with them, maybe one day I’ll find it. Probably not. Let’s begin with the show. What do you say, Andy, yes?

[Andy Ellis] That sounds like a great idea. 

[David Spark] Our guest, first time on a CISO Series show, thrilled to have him on board. He is the CISO over at Freshworks. They are not a delivery mechanism for your supermarket, no.

[Andy Ellis] They don’t deliver talcum powder for your baby’s bottom. My understanding is ITSM and customer experience and security stuff-ish. 

[David Spark] Exactly. But I bet you if someone makes a really big deal with you, I bet you you’d throw that in as an add-on. Like, “You need a bottle of talcum powder? All right, we’ll throw it in.” 

[Jason Loomis] I don’t know if we’re that startup-y anymore. 

[Laughter] 

[Jason Loomis] We’re pretty established. So, we have a great security program, but it’s not part of our product. 

[David Spark] Let me say who this is. The man who’s speaking right there, he’s the CISO of Freshworks. It’s Jason Loomis. Jason, thank you so much for joining us. 

[Jason Loomis] Thank you. Thank you. Thank you so much for having me on. Long-time listener, first-time guest. 

Well, that didn’t turn out the way we expected. 

6:15.839 

[David Spark] When it comes to preventative cybersecurity, our industry definitely suffers from “physician heal thyself” syndrome. Now, Ross Haleliuk of Venture Insecurity recently called out what many CISOs know but don’t like to admit. Everyone talks about prevention, but very few actually implement it.

Now, of course, if it was easy, everyone would do it. Prevention requires organizations to know exactly what they’re trying to stop, and unlike detection tools that work silently in the background, preventative controls introduce productivity friction.

So, you might be succeeding with prevention, but at the cost of political capital in the business. Suddenly, every preventative measure becomes a negotiation with frustrated users or impatient executives. So, Andy, I’m starting with you. If we’re going to actually make the organization take our prevention medicine, do we need to start with a cultural shift and buy-in before implementing controls?

How do you start this process of actually doing prevention which kind of everyone’s on board with? 

[Andy Ellis] So, I think the most important thing here is this is not your medicine to give. It’s the organization’s medicine to choose to take. Right? You go to a doctor, and a doctor says, “I’m going to put you on statins,” it’s your call whether you’re going to take the statins or not, like the doctor is not forcing them down your throat.

And too many security folks think, “Oh, I get to force it down the company’s throat and choose.” You have to sell these. 

[David Spark] That’s, by the way, a good point. By the way, my dad, who was a doctor, talked about this all the time. He goes, “I don’t know what it is. Sometimes my patients just don’t want to take their medicine.” 

[Andy Ellis] . Yep. Yeah, I was working with a company actually just a couple days ago and I’m sitting in on an executive team meeting, the CISO is presenting, and they’ve got like 12 slides, and I cannot understand the priorities of the CISO. I’m sorry, I’m a professional here, and I’m trying to tease this apart, and I’m finally found on one slide and I’m like, “Are you trying to do this work because…” and I described the scenario, which is the real scenario.

Like, “Oh, we have this specific problem in our business, here’s this thing.” And I said it and every executive’s like, “Wait, what? We’re doing what? What is happening? Stop that.” And the CISO is looking aghast, he’s like, “For months I’ve been trying to sell you on this project, the set of preventative measures, and nobody has cared.” And I said, “That’s because you didn’t tell them why.

You tell them why, and now they’re bought in, and they’re going to demand preventative measures from you. That’s how you roll them out.”

[David Spark] All right. Very good point. I throw this one to Jason. Have you had this same struggle yourself? 

[Jason Loomis] No, never. I’ve never heard of this problem ever. 

[David Spark] [Laughter] 

[Jason Loomis] I don’t know who you’re meeting with, who are these CISOs? And who can’t tell a story? Wait.

[David Spark] [Laughter] 

[Jason Loomis] I really want to hit on Andy’s thing about storytelling. It’s absolutely one of the most critical skills of a CISO. He’s absolutely right. You can go show spreadsheets, but until you’re telling the story about it, you’re not going to get anywhere.

So, totally agree with that. Yes, absolutely. Preventative controls are the strongest. It’s like having a lock on the door versus an alarm system. Alarm system, they break in, they get out, “Oh, hey, look. We detected, and then we reacted. Fantastic.

Too bad my jewelry’s gone.” So, yeah, preventive controls are the hard… But they’re also the most impactful because when I put the lock on the door, now I got to make sure my wife has a key. I make sure she understands how to work that door lock. She can get in easier now, but it’s going to increase time.

If she’s carrying groceries, she’s going to have to let one hand go. So, there’s always an impact to something with a preventative control. 

So, the way I like doing them, and I really think everybody should focus on this, meaning almost drop the preventive controls that are left/right shifting left…or far to the right. The ones that are really further down to the right of something, meaning you’re doing it after you built the system or you’re doing it after the system was up and after people are using it, drop that.

Don’t even do it. Worry about the next system you’re deploying and make sure you have the controls either before you deploy it or further left in the stack if you’re coding. 

[David Spark] Okay. If you successfully do that with the next control, is there any way to create success? Like people go get it and then you can sort of go back and start dealing with old controls or no, that’s not doable? 

[Jason Loomis] That’s a storytelling that I use. So, great to get metrics, great to get a story behind those metrics to say, “Look we put in this new control that we’re blocking at the dev workstation for a critical.” So, preventing a critical security bug from going into staging or production.

If you do it there, then you got to tell the story after, like, “Look, I just saved 100 hours of development time because we know it takes this long to do a critical bug in production because I stopped it at the developer workstation when I deployed this new preventative tool.

I stopped 100 of them, which is equated to about a thousand hours’ worth of dev time.” So, there’s absolute ways with that story… Everything comes back to storytelling. Storytelling, you got to have the metrics for it, and then the storytelling behind it to show the value.

[Andy Ellis] And even better, if instead of saying, “I saved,” you’re like, “This team saved the company by implementing this control.” 

[Jason Loomis] Oh, yeah, I never do. I actually, except on my podcasts, I only talk about me, me, me. 

[Andy Ellis] Yeah.

[Jason Loomis] I always use it. You bring up another great point. Always use “we.” It’s “we.” It’s a team effort. It’s always “we.” As a leader, that’s the number one thing. You never take credit for anything. I never say, “I did this,” and I’ll call out individuals who did the work.

Like, “Oh, this is my head of product security ran this, was an awesome job. Naga,” that’s his name. 

[Andy Ellis] Yeah. Oh, I go one step further. The security team doesn’t take credit. The team that actually got it implemented is the one you give credit to. So, other teams are like, “Get out of my head, man. You said nice things about me in front of the CISO.

You said nice things about them. How do I do work for you so that you’ll compliment me?” 

[Jason Loomis] Pays benefits. When you say, “Oh, product engineering developed this. This was their baby. And thank you so much, product engineering. You did great work here.” Oh, yeah. 

[Andy Ellis] Yeah. 

[David Spark] Dividends. 

[David Spark] I will also say while receiving compliments is great, so is giving them. 

[Andy Ellis] Yeah.

[David Spark] Giving is better than receiving. 

As a CISO, what do you think about this? 

12:13.108 

[David Spark] If you go on the cybersecurity subreddit, there’s almost a constant drumbeat of posts talking about burnout and the day-to-day pressures of cybersecurity. These posts are usually met with frank advice, helpful anecdotes, and more than a little snark.

It’s still Reddit overall. But one recent post asked if CISOs and other security leaders need a “space to support cybersecurity leaders and teams more intentionally.” Now, this essentially seems like a CISO support group to me, and we have some spaces for this on Slack and LinkedIn, but is that enough?

I mean, what would these kinds of spaces need to include in resilience and leadership training to be worth your time? And starting with you, Jason, is it too limiting for individual CISOs? Don’t we need this kind of support for the whole team? Basically, what we have, is that enough?

[Jason Loomis] No, but it’s so up to the individual, the organization, and the team. So many things drive CISO stress, from who you’re reporting in to, what’s your executive leadership team like? Do you have the budget and support you’re given? How good is your team?

Were you handed the team? Were you able to pick the team? Are you a good leader yourself? Because that’s going to cause problems if you’re not a good leader. There’s so many different variables with that. 

But overall, the theme about are CISOs stressed out? Absolutely. We have one of the hardest jobs because we don’t really ever get wins. Revenue, sales, get wins. “Oh, you busted out the quarter, nice work,” and you’re mentioned at the town halls. Marketing?

“Wow, what a great marketing effort. Did you see everybody driving by to see that billboard?” Everything else is sales, product, “We nailed these features, and our customers are so happy.” CISOs never get it. You’re always doing something wrong. It’s like the power company, right?

You only get complaints when the power goes out, and that tends to be. So CISOs are extremely stressed out. I don’t like the virtual nature of the Slack and the LinkedIn groups. I think we need in person. 

[David Spark] Well, and we have that to a degree, like there are conferences and the two big events like Black Hat and RSA are huge. And I also started a security group in the San Diego area, which has been great for that as well. 

[Jason Loomis] David, in my opinion, those groups are what are the best solution. When you can get – I don’t want to be at a conference and talk to somebody I don’t know – but if I’ve met you twice at this dinner and we talked about our kids or about softball, I’m going to get to know you more.

And then we’re going to start talking about how sharing the stress of… The idea is the same storm, different ship. The idea that a CISO can, “Oh, we’re all facing the same problem.” And that makes us actually feel better so that we don’t think it’s unique to us or that we have these stressors that if we know that other CISOs are facing the same problems, that helps.

And you can’t do that at Black Hat. Some things you can’t say. I mean, we might over a beer [Laughter] once I found out and I start to trust you as another CISO. So, I’m really a fan of those smaller. I belong to two of them, one in L.A. and one here in Colorado that I absolutely make the dinners every two months, and it’s just such a great small 10 of us.

[David Spark] Right.

[Jason Loomis] That’s where I get that support and be like, “Okay, I feel better, my board just yelled at me.” They don’t yell, but… 

[David Spark] And wherever you are, you could be doing this in your space. There’s nothing limiting you to do this in your own space. I can’t stress it enough.

[Jason Loomis] Yes. 

[David Spark] I moved here knowing nobody or knowing, excuse me, one person. And then he was the one who helped me start the group. 

[Jason Loomis] Yeah. And it doesn’t have to be at the CISO level, like you mentioned. It can be at the director level, the manager level. It could be at a specific vertical within security. Hey, we’re Incident Responders Anonymous. 

[David Spark] It could be a bunch of people looking for their first job, too. 

[Jason Loomis] Those are great. Yeah. For the networking, for the just to get to know somebody, to get your foot in the door. Absolutely. 

[David Spark] All right, Andy, I throw this to you. Is what we have satisfactory enough? Both Jason and I agree that if you can do regular in-person meetups wherever you are, that’s ideal. 

[Andy Ellis] So, first, I want to start by saying that if you’re worried about burnout, hanging out on Reddit is probably not helping you. 

[David Spark] Well, people like to shout. 

[Andy Ellis] Think about your selection bias of what community you’re hanging out with. 

[Jason Loomis] All caps.

[David Spark] Mm hmm. 

[Andy Ellis] But let me actually say, I know this is a huge problem in our industry and I’m going to try saying something radical. Get over it. Our community is actually not that special, but everyone pretends we are. We do not have more stressful jobs than the CRO, who if they don’t make the number, get fired.

They’ve got one year to make a number or they’re fired and go… 

[David Spark] But don’t you think there’s a little bit of a Rodney Dangerfield sort of sentiment in the security industry? 

[Andy Ellis] Oh, there’s a lot of people who are like, “Oh, my God,” who are going to blow it all out of proportion. We take onto ourselves stressors that are not ours. We panic when people around us aren’t stressing, and so we stress more. And so, at some point, you actually have to say that this is a job.

You’re not a superhero. Your job is not to save the planet. You have a job to do, which is to enable your business to make wiser risk choices. And I’m not saying that burnout is not ever going to be a problem and that it’s all self-induced, but there is a component of it that is self-induced.

[David Spark] But hold it. I’m going to push back on this because this is a lot of sort of Dr. Phil style response, in that “just get over it” kind of a thing. But there are mechanisms to get over it. There are techniques to get over it. There are techniques to manage it.

[Andy Ellis] Yeah.

[David Spark] And that’s why you need your groups. 

[Andy Ellis] But if your groups are all the people who don’t know how to get over it…

[David Spark] Then you got an echo chamber. 

[Andy Ellis] That’s part of the problem here is that we talk to each other and we talk to people who say, “Oh, my God. It’s awful.” And so, we believe it’s more awful. Go find your support group of levelheaded people or people who work outside of cybersecurity who have very stressful jobs and listen to how they manage stress.

I know CROs, you know how a lot of them manage stress? They go golfing. They go fishing. They do things that have nothing to do with their day job. 

[David Spark] So, I’ll tell you a perfect example of very this, and I think it has to do with the security people who like to blame the “stupid users.”

[Andy Ellis] Right.

[David Spark] And the people who realize, “No, they’re doing their job.” And years ago, you know this Ashley Madison case where people got caught and…

[Andy Ellis] What was Ashley Madison? I don’t know anything about it. Were you one of the users of it? Is that how come you know about it? 

[David Spark] I read the news, Andy.

[Andy Ellis] Can’t believe you walked into that one, David. I read the news? 

[David Spark] The Ashley Madison case, and I did one of my Man on the Street videos where I asked people, “Now the Ashley Madison, what’s your advice for users who got snagged in the Ashley Madison case?” All right? I would say half, half of the people – and this goes back a number of years, this goes back maybe eight, nine years ago – half of the people’s advice, because this is security professionals, their advice, again, I was asking for advice, was, “They shouldn’t have been on there in the first place.” And I’m like, “That’s not advice.

That’s ‘I told you so.'” And I did get good advice, I talked to some lawyers, and they actually provided some good advice on how to deal with this kind of thing. And so, this is often I think the problem is when something hits the fan, they just want to show that they were right.

And again, this I don’t see nearly as much of it today as I did back then. Anecdotally, how do you feel, Andy? 

[Andy Ellis] The challenge is – I agree with you – that some of this is people who think that they’re the center of the universe. They’re not focused on the user. You want to talk about Ashley Madison? If I recall, there were several suicides related to that breach.

[David Spark] Mm-hmm.

[Andy Ellis] And so, if your advice to people who are having literally the last worst day of their life is, “You shouldn’t have done it,” which sure, we all can agree on that one. 

[David Spark] Just so we can all define it, that is technically not advice. [Laughter] 

[Andy Ellis] Right. That is feeling holier than thou. Too many people think that they’re paladins out to go save the world. No, no. We are the sidekicks to the business. My best advice to you is recognize that you are Alfred. You are not Batman. 

[David Spark] All right. 

[Jason Loomis] That’s fair, but when you’re stressed out and you need almost psychological support…

[David Spark] Yes. 

[Andy Ellis] Yep.

[Jason Loomis] …you, just like alcoholics. Do they put them with, “Hey, just go talk to people who aren’t alcoholics”? No. You talk to other alcoholics, “What have you been through? How did you experience this?” It’s a shared experience of therapy to get better, and CISOs are the same.

[Andy Ellis] Okay, but you don’t just go talk to other alcoholics who’ve not been through therapy. 

[David Spark] Right, right. Someone who’s not an alcoholic is not going to provide good advice. 

[Jason Loomis] Well, actually, that’s who’s your sponsor, is somebody who’s been through it, who knows. 

[Andy Ellis] Right. 

[Jason Loomis] And you do find these at the CISO groups of, “Hey, what did you do in this situation? You know what? I never thought of that, Dave. That’s a great approach. I’m going to try that next time.” 

[Andy Ellis] Well, and Jason, you’re on to something right there, which is, and I don’t I don’t really like the alcoholic analogy, but I’m going to run with it. 

[Jason Loomis] Bad analogy.

[Andy Ellis] Which is you don’t put alcoholics just with other alcoholics who have not been on the road to recovery. The key there is you want the people who know how to get to recovery, who’ve been there as part of that, and that’s a key part of it.

Absolutely, CISOs who know how to manage the stress is who you should be talking to. You should not get into a room with a bunch of CISOs who do not know how to manage the stress because you will just burn each other out. 

[Jason Loomis] That’s fair. 

[David Spark] It’s not so much don’t have a plan or don’t want to deal with it. They’re just living in it, swimming in it. 

[Andy Ellis] Right. 

[Jason Loomis] Or they don’t know what to do. I think most of it is they don’t know what to do, “Hey, my board’s coming down on me and I don’t know what to do here,” and that peer discussion helps so much. 

Sponsor – SAFE Security 

21:43.593 

[David Spark] Before we go on any further, I do want to tell you about our spectacular sponsor, and that is SAFE. This episode is sponsored by SAFE, the cyber risk management company flipping the script on third-party risk management with agentic AI.

This was a hot topic at RSA this year. So, let’s face it, traditional TPRM, it’s broken. Manual questionnaires, static assessments, and siloed tools can’t keep up with the speed and complexity of today’s vendor ecosystems. And this is where SAFE comes in.

SAFE leads the way with agentic AI, powering a zero-effort TPRM platform that automates the entire third-party risk lifecycle, from onboarding and due diligence to continuous monitoring. SAFE’s growing fleet of specialized AI agents does the heavy lifting, so your team can focus on what really matters – making smart, risk-informed decisions.

Now, that means 100% automated vendor risk assessments and real-time risk prioritized visibility without the manual grind. So, it’s no surprise SAFE was recently named a leader in Liminal’s 2025 TPRM report, top in the charts for product capability. SAFE is also the fastest growing vendor in the TPRM space, hitting 10 million in annual recurring revenue from its TPRM platform alone in just 10 months.

So, if you’re looking to scale your TPRM program without adding headcount, visit safe.security and see why autonomous TPRM is the future with SAFE leading the charge. 

It’s time to play “What’s Worse?” 

23:22.122 

[David Spark] All right. Jason, you know how this game is played, correct? 

[Jason Loomis] Yes, I do.

[David Spark] All right. We got a brand-new contributor. Just literally minutes before this recording, this “What’s Worse?” scenario came in. It comes from Ozren Bogovac of Generac. Here’s the situation, you got the following situation. You are the CISO of a publicly traded company that acquires a manufacturing plant in Germany.

Shortly after the deal closes, the site is hit with ransomware, resulting in a two-week outage. After a tireless recovery effort, the site is finally back online. Now, the investigation reveals that the existing endpoint detection response solution is outdated and inadequate.

So, your team is prepared to deploy your standard enterprise platform to restore visibility and strengthen defenses. However, a privacy impact assessment has not been completed, and the workers’ counsel has not been consulted. You are still trying to confirm whether one has been formally established.

Both steps are required under German law. You are also informed that if privacy violations occur, local authorities could intervene and potentially shut down the plant again. 

All right. Here are your two scenarios. Scenario one – and by the way, Jason, just so you know, I’m going to have Andy answer first, so hold your response – scenario number one, you deploy immediately to contain the threat. Privacy teams may block it, and the move could damage trust with internal teams and the new subsidiary.

Or scenario two, you just wait for approvals, which could take months. Meanwhile, the plant remains vulnerable and at risk of another attack. So, Andy, which one is worse? 

[Andy Ellis] Like [Laughter] I’m trying to find the trick here because this is pretty clear that number two is worse. 

[David Spark] Well, hold it. Let me see. 

[Andy Ellis] Just go deploy. 

[David Spark] Both of these are risk. Risk of getting fined…

[Andy Ellis] Yep.

[David Spark] …and getting shut down or risk of being attacked. 

[Andy Ellis] Right. Yeah, I think you go deploy. You file a bunch of CYA paperwork. You notify lots of people that we’re doing this, we’re going to rapidly do a privacy impact assessment. We are going to hide all of our logs from our U.S. colleagues for a little while.

You jump through some hoops to make it clear that you are not end running the privacy system, you’re just end running the bureaucracy. You’re going to get it out, but you’re going to comply with everything. You engage folks. You can manage this. This is a paperwork exercise that is completely manageable on this front end.

Establishing the precedent up front that, “Oh, no, no, we don’t do anything until this bureaucracy comes through.” Even in a crisis? Yeah, no, I’m going to go with number two even if it costs me my job is what I prefer. So, number one’s worse. 

[David Spark] But we’re assuming that they don’t care that you say all of this stuff. Because if that were the case, what you said, Andy, then, of course, scenario two would be far worse. That’s assuming that like, “Oh, we’re okay with the fact that you did this and you sent the paperwork.

But look, we have privacy laws in Germany, and we don’t care that you said it.” 

[Andy Ellis] Yeah, I still think that in this case, you’re going to proceed with, because almost every one of the laws… First of all, you get to file your paperwork in German, which is a lot of fun dealing with the German government. You file nothing in English; it’s all in German.

But basically, you have an emergency, you’re doing emergency cleanup. You will do the privacy impact assessment in parallel, but you’re not going to sit here and say, “Oh, we are going to leave German power offline until we get the privacy impact assessment done.” No, we’re going to do the privacy impact assessment.

If it turns out we picked wrong, we’ll fix our error. 

[David Spark] All right, Jason, do you agree or disagree? 

[Jason Loomis] Door number two, please. Door number two. I disagree. 

[David Spark] You disagree?

[Jason Loomis] Yes, I disagree. 

[Andy Ellis] Oh, so you would rather wait for the assessment. 

[David Spark] Okay. All right. 

[Jason Loomis] But…

[David Spark] Hold it, wait. Let me just…

[Jason Loomis] Please let me finish that sentence.

[David Spark] Hold it. Let me pause you for a second, Jason. 

[Jason Loomis] Yeah. Yeah.

[David Spark] I just want to point out that Andy was so confident. 

[Jason Loomis] Mm-hmm.

[David Spark] Like, “Of course, number two is what’s dancing. Of course. You’re a fool for even reading this, David.”

[Jason Loomis] [Laughter] 

[Andy Ellis] I did not say you’re a fool for even reading this, although I did think it. 

[David Spark] No, but it was intended. Jason, you heard it. It was intended, right? Everyone sort of read that between the lines. 

[Jason Loomis] I could see him. He was dancing. 

[David Spark] He was dancing.

[Andy Ellis] I was? I totally was dancing. 

[David Spark] All right. I love, whatever comes out of Jason’s mouth, I know I’m going to love it. 

[Andy Ellis] Okay, I want to hear Jason’s justification for leaving his company exposed to ransomware that could shut down the German power distribution infrastructure when he has an off-the-shelf tool currently capable to deploy.

[Jason Loomis] Sure. An untested in that environment tool. 

[Andy Ellis] No, no. 

[Jason Loomis] And a tool that’s not 100% efficacy. I don’t know if the tool’s going to work. For me, I’d focus on mitigating controls. There are always mitigating controls to one specific control. So, I would say I’ll wait, and I’ll figure out… 

[Andy Ellis] No. Okay, so Jason is editing, which I just want to point out… 

[David Spark] Hold it. What is your…

[Andy Ellis] …that Jason edited the scenario to say untested tool. No, no. This is your standard off-the-shelf tool. 

[Jason Loomis] There’s no this is a Kobayashi Maru?

[Andy Ellis] Yeah, that’s your standard off the shelf. This is the EDR that you’re running everywhere else in your business. 

[David Spark] Right.

[Andy Ellis] That you just want to deploy into here because it is effective for your business. You think it’s fit for purpose, you can’t make it not fit for purpose for this scenario. 

[David Spark] Yeah.

[Jason Loomis] No. So, I’m going to wait to deploy that, but there’s nothing wrong with why I can’t focus on other controls to help prevent what happened. 

[Andy Ellis] You have to do privacy impact assessments for those. No, no. You can’t deploy anything if you’re waiting. 

[Jason Loomis] No, no. That’s not true. We don’t know. I’m positive there are things I can do that aren’t the EDR that are going to affect privacy. 

[David Spark] Now, hold it. First of all… Yeah.

[Jason Loomis] I respect the law. 

[David Spark] So, the way these platforms work is you only can do A or B here. There isn’t a choice of C or D here. [Laughter] That’s how this game works, Jason. 

[Andy Ellis] Jason does not want to, they don’t want to agree with me.

[David Spark] I said I was going to love everything [Inaudible 00:29:34] until he went rogue on the game. [Laughter] 

[Andy Ellis] I know. 

[Jason Loomis] Oopsie. Okay, I’ll still go B. It’s the right thing to do. 

[David Spark] You’re still going… Hold it. You mean B, you prefer? Because the game’s called “What’s Worse?” you have to check which one you think. So, is it worse?

[Jason Loomis] I prefer B. 

[David Spark] You prefer B than…

[Andy Ellis] Leaving your company open to the ransomware. 

[Jason Loomis] I respect the personal right of individuals over my company.

[David Spark] Ah, you see? And that’s what the German government thinks as well. 

[Jason Loomis] And I don’t want to touch with that and that’s what government believes and I’m a fan of that. 

[David Spark] Jason is in line. Do you really, really want to mess with the German government? They’re probably bigger than you. 

[Andy Ellis] Me? Wait. You’re asking if I want to mess with the German government as I hold up my Star of David? 

[David Spark] No, no, I don’t. You don’t. They’ve got some pretty strict privacy laws now. 

[Andy Ellis] They absolutely have strict privacy laws, but they are not, despite the reputation that they might have, they’re not stupidly draconian. 

[Jason Loomis] Wait, aren’t we going outside of the rules of the thing again if you say, “Oh, they’re really not going to come after us”? 

[Andy Ellis] No, they might come after you, but they’re not going to come after you in a way that is overly punitive. I’ve operated in Germany before. They don’t come and be like, “Oh, my God, you did this one thing without any permission. Your whole company’s going to jail.” They’re like, “Why did you do this?

Okay, let’s get the paperwork done right.” As long as you’re willing to work within the bureaucracy, you’re fine. You might pay a fine, but would you rather pay a fine or risk not being in business in Germany with the subsidiary you bought that clearly didn’t understand security?

Is AI going to help us or hurt us? 

31:11.264 

[David Spark] “On paper, a doorman gets paid to open a door. An automatic door does it cheaper, faster, and never takes a lunch break. If you only measure the task, it’s obvious we don’t need doormen in 2025.” But as you might have noticed, we still have them in similar jobs like Costco receipt checkers.

So, rather than considering these roles a novel anachronism, Nick Romanos of Rivers Agency pointed out this reductive approach mistakes the visible task for the full value. The doorman also screens for sketchy people, recommends the best nearby latte, and signals status of the building where you’re at.

So, can we extend this “doorman” effect to AI? In cybersecurity, we’re facing the idea of replacing an analyst, researchers, and even some architects because their output can be mimicked by machines. But the best security professionals navigate organizational politics, interpret ambiguous intelligence, and read the room during incident response.

There’s more there than just the visible task of analysis. There’s no question AI can and will be used to execute human security tasks, but I’m going to start with you, Jason. What are these doorman effects we’ll miss without a human in the loop? 

[Jason Loomis] A lot. Automating tasks is easy. Automating trust, intuition, cultural fluency, that’s not. The doorman effect isn’t just about finding threats. It’s about knowing why, who to tell, get back to storytelling, and how to say it. AI can analyze, but humans contextualize.

AI can tell you someone’s breaking in, “Oh, yeah. We just had this alert go off. Yep.” AI says, “Ooh, I got an alert. Someone’s trying to get into our systems.” But as of today, it’s the human that’s going to know, “Oh, man, that’s my CEO again. He’s partying in Ibiza and he’s using hotel Wi-Fi.” But I knew that.

There’s value beyond the task, absolutely. Just like the door greeter analogy. And also, the other big thing is when to cause an incident and when not to cause an incident. 

[David Spark] Mm-hmm.

[Jason Loomis] Oh, boy, somebody’s breaking in. And the knowing not to is like, oh, no, that’s your buddy over there again. 

[David Spark] All right. Throwing this to you, Andy. What doorman effects do we lose with any automation? 

[Andy Ellis] I mean, let’s not even go to AI first. Let’s just start with things like Outlook and calendaring and how much of a disaster meeting scheduling has become since we took humans out of the loop. Remember when we used to have admins who would actually figure out optimal meeting scheduling and do same things?

And now it’s like, oh, somebody goes and clicks a link, and they throw something on your calendar like at a pessimal time. And like you have crazy things going on with that. AI might actually make this better. To be clear, I think that the replacing humans with small technologies to do those tasks is the really dangerous thing, right?

An alert that says, “Oh, here’s an alert. Automatically block it.” That’s problematic. 

AI has the potential to start to do some of that correlation that humans have been doing. I don’t think we’re really there yet outside of some very narrow use cases, but I do agree with Jason that it’s that, I don’t want to say the intuition, it’s the context that the human brings.

Because sometimes it’s intuition, but a lot of times it’s just, “No, I remember that, yeah, Jason’s off in Ibiza right now.” There’s no reason your AI doesn’t know that, except that you don’t connect it. How many security systems do people have that are actually connected to your company’s vacation tracker?

Just start with that question. If you don’t know where your people are on vacation and your security systems can’t see that, how are you possibly doing anything from a context perspective? 

[David Spark] That’s a very good point. 

Okay, what’s the risk?

35:02.583 

[David Spark] On Cybersecurity Headlines, we feature a lot of stories about APTs, advanced persistent threats, ransomware, and lots of other flashy risks. These get a lot of attention. But the cybersecurity subreddit recently tried to highlight the underappreciated risks that often go unnoticed.

For example, ads that run scripts on sites deemed “safe” without much oversight, insider threats – either malicious or negligent, and overprovisioned users were popular underappreciated risks. Others cited more basic risks like the weather flooding a data center or your air conditioning going out at your data center.

And of course, good old-fashioned stupidity is a risk. So, Andy, do any of these resonate with you? And what risk do you see not getting the concern they deserve? 

[Andy Ellis] I mean, the single biggest risk is that most companies don’t make good choices. They don’t have the right information to make choices. But that’s not actionable, much like several of these are also not actionable. Like you can’t say stupidity is a risk.

The real risk is you didn’t design good systems, and so users just trying to get their job done cause you problems. But I like this concept, like people do need to be focused. You need to say, “What are the unacceptable losses?” So, you had in here, one of the ones you mentioned was like a data center flooding.

Okay, so somewhere you should write down not the risk of the data center flooding, but that the data center going offline, how bad is that? Is that an unacceptable loss for your business? 

When I was at Akamai, there were basically only a handful of the data center going out was even a problem for us. Most of us, we didn’t care. So, we’re like, “Great, whatever. If data center dies, not our worry.” Other ones, then we’re going to start to focus on these risk scenarios.

And so, I think the challenge is people often start from the sexy risk scenario, and they don’t start from the unacceptable loss. That’s where you actually need to start doing your risk analysis is from what are the outcomes that present problems for our business and how do we mitigate the hazards that lead to those?

[David Spark] But I will also say, and I agree 100%, start with what could happen that would cripple us and our business and then figure it out. But at the same time, you need to know sort of the common ways these things happen as well. 

[Andy Ellis] Oh, sure. You absolutely need to know. But if your challenge is, let’s say, the overprovisioned user, which overlaps with an insider risk threat, overlaps with a bunch of things, is what if you have a single point of failure? Like I’ve got Jason, Jason runs 80% of my business.

If Jason becomes unavailable is my unacceptable loss. Now, my problem is not Jason has too many permissions because taking away the permissions doesn’t solve the problem that the business relies too much on Jason and there’s nobody backstopping him.

I can’t take away his permissions before I give them to somebody else. And I’ve seen companies that focus on how many permissions does one person have versus how many permissions are not replicated. There’s only one person with that permission. 

[David Spark] Okay. I throw this to you, Jason. 

[Jason Loomis] I like looking at it from the controls perspective because it’s about the basics. Almost all risks, I don’t like the data center thing, but that could go into the availability and recovery part of this CSF, but everybody always looks at, “Oh, I got to go protect this APT from this specific attack.” When you figure out how they got in, it’s going to point to one of the basic security controls.

And if I focus, I don’t know if you know, but we know, that if you do 85% of the CIS 18, which those foundational controls, there’s like 50 of them, you do these 50 things, you’re going to reduce 85% of your cybersecurity risk. And we still today don’t focus on those.

We go with the flash. We go with, “[Gasp] That APT just got in here through this way, and now I got to go make sure I have an MFA-resistant MFA.” And I spend all my critical and it’s my number one priority. When why don’t you just work with getting MFA efficacy across all of your systems?

Being good at the one thing? So, for me, I really think CISOs in general need to focus on just getting the basics right.

[David Spark] We talk about this all the time. 

[Jason Loomis] I feel like this is a 20-year-old speech. 

[David Spark] Yeah.

[Jason Loomis] We’ve known about these controls for 20 years. They haven’t really changed. Even AI, what is AI about? It’s about inventory. It’s about know where your data’s going and who has access to that data and that training data and those models and those systems.

This whole AI security, we got AI security figured out, marketing stuff. Because really, at the end of the day, it’s the same basic security controls that I think all of us CISOs have known for, I just dated myself, over 20 years. 

[David Spark] I will quote something that I read on Reddit, a very popular post on the cybersecurity subreddit, and I’ve said this before. It’s ironic because we’re just a couple of weeks away from Black Hat. But the quote was, “The thing you were worried about before you went to Black Hat is going to be the same thing you’re going to be worried about after you leave Black Hat.” [Laughter] And the whole point of Black Hat is tell you about new stuff to be worried about.

[Jason Loomis] Can I throw one in that maybe not will be that I think and some of my peers think is a blind spot. 

[David Spark] Sure.

[Jason Loomis] And it might be science fictiony, but quantum encryption.

[Andy Ellis] Oh, God, no. 

[Jason Loomis] I think as soon as AES-256 is broken, you’re going to… Somebody is going to figure it out. 

[Andy Ellis] But we don’t have an algorithm to break AES with quantum. 

[Jason Loomis] Not today.

[Andy Ellis] No. But right now, the only functional algorithm we have is Shor’s, which breaks public key crypto, and the whole benefit of quantum is that you reduce NP hard problems to P and breaking AES is not an NP hard problem because it’s not based on a reversible function.

So, I’m going to disagree on that one and say, like, there is a day that we have to worry about it because the way we distribute private keys for AES relies on algorithms that are quantum attackable, but we’re so far away from that right now. But the forward secrecy problem.

[Jason Loomis] Yeah.

[Andy Ellis] The data you’re transmitting today may be broken in 15 years, and is that going to matter? 

[Jason Loomis] Okay.

Closing 

41:07.847 

[David Spark] That brings us to the very end of this show. I want to thank our guest, Jason Loomis, CISO over at Freshworks, where you could ask him all you want, he’s not going to deliver your groceries. 

[Andy Ellis] Dang it. 

[David Spark] So, people are mistaken about Freshworks. What is it not? 

[Jason Loomis] It is it is not a lettuce delivery or grocery delivery service. Freshworks, we uncomplicate EX and CX for your business. So, if you’re ITSM or interfacing with customers, we have an uncomplicated AI-centric platform. 

[David Spark] By the way, do you charge an extra 25 cents for grocery bags? 

[Jason Loomis] No. Only if our AI agent delivers it to you. 

[David Spark] Thank you so much, Jason. We greatly appreciate it. Our sponsor for today’s episode has been, and we love having them on board, it’s SAFE Security. Remember, go to their website, safe.security, talking about their really impressive TPRM, third-party risk management platform, that can do a lot of work for you.

It’s going to be pretty darn cool. 

[Andy Ellis] Apparently, it’s self-driving. 

[David Spark] It’s self-driving. 

[Andy Ellis] The Waymo of third-party risk management. 

[David Spark] It’s the Waymo [Laughter] of third-party risk management programs. Yes, exactly. Just what Andy said there. Jason, let me also ask you another question. Are you hiring over at Freshworks? 

[Jason Loomis] We are. In security, I think every CISO is always hiring to find good talent. And yes, we are. We have multiple open positions out of Bangalore and Chennai.

[David Spark] Right. Nothing in the United States, I understand, correct?

[Jason Loomis] Not today, but soon. 

[David Spark] Soon.

[Jason Loomis] So, keep an eye out. Check our job board, Freshworks.com. 

[David Spark] They have a job board of it. And by the way, it would definitely help, I’m sure, Jason, if they mentioned they heard you on this show, yes?

[Jason Loomis] Yes. We have the freshest groceries in town. 

[David Spark] Well, now this is your new tagline. 

[Andy Ellis] You should say, “That Andy was stupid, Jason. You were so brilliant for disagreeing with him. I want to come be on your team.” 

[Jason Loomis] I love it. You’re hired. 

[David Spark] All right. Thank you very much, Jason. Thank you very much, Andy. And thank you, our audience. Send us more “What’s Worse?” scenarios. You can add an A, B, C, or D option because it looks like Jason wanted to create a C or D, even though it wasn’t there.

I thought the A and B was fine here. But Andy thinks he can just work the German government and get what he wants. 

[Andy Ellis] I’m saying I can mitigate the risk by working the German government. 

[David Spark] Mm-hmm.

[Andy Ellis] But I’m not going to risk having my power plant not functional.

[David Spark] German government cares more about the privacy of their people. 

[Andy Ellis] No, no, they actually don’t. They give lip service in the other direction. 

[David Spark] I think power, I think, beats privacy. I think I would agree with you on that. All right. With that being said, thank you, everybody. And thank you to our audience. We greatly appreciate your contributions and listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.