- 19
- Episodes
- Bi-weekly
- Cadence
- 2024
- First episode
About Cybersecurity for Non-Technical Leaders
A two-host anatomy of real cybersecurity incidents told through the eyes of executives who had to make the call. A security consultant and a skeptical board member walk through what actually happened, what it cost in dollars, and the exact decisions that mattered—translated into plain business language with no jargon left unexplained. Learn what to ask, what to refuse, and how to spot the moment when a leader's judgment call becomes the difference between containment and catastrophe.
- Publisher
- Podyzer
- Category
- business
- Language
- en
- Explicit
- No
- First episode
- 27 Nov 2024
- Latest episode
- 8 Sept 2026
Latest episodes
19 episodes in the feed.
8 Sept 2026
How Poor Incident Response Plans Cost Millions in Recovery
When a cybersecurity incident occurs, the immediate response can make or break a company's recovery efforts. This discussion focuses on a real case where inadequate incident response planning led to prolonged downtime and significant financial losses. We explore the decisions made by executives in the heat of the moment, the lack of a clear response strategy, and how these oversights compounded the impact of the incident. The consultant outlines the critical components of an effective incident response plan, emphasizing the importance of preparation, communication, and rapid decision-making. The executive host raises essential questions: What should be included in a robust incident response plan? How can organizations ensure that all stakeholders are prepared to act quickly? And what lessons can be learned from companies that faced similar challenges? We analyze the decision-making process during the incident, the aftermath of the recovery efforts, and the long-term implications of neglecting incident response preparedness. Ultimately, this conversation highlights that the difference between a swift recovery and a costly delay often lies in the strength of a company's incident response strategy.
1 Sept 2026
How a Miscommunication Led to a Major Security Breach
In the fast-paced world of business, clear communication is crucial, especially when it comes to security protocols. This discussion centers around a real incident where a lack of clarity between departments resulted in a significant breach. We explore the moments leading up to the incident, the decisions made by leaders that prioritized speed over thorough communication, and how this misalignment created vulnerabilities that attackers exploited. The consultant breaks down the importance of cross-departmental communication in security, why assumptions can lead to catastrophic outcomes, and what leaders can do to foster a culture of transparency. The executive host raises essential questions: How can organizations ensure that security updates are clearly communicated across teams? What role does leadership play in bridging communication gaps? And how can we create a feedback loop that encourages open dialogue about security concerns? We analyze the decision-making process that contributed to the breach, the immediate fallout, and the lessons learned about the intersection of communication and security. Ultimately, this conversation highlights that effective communication is not just a nice-to-have but a necessity in preventing security incidents.
25 Aug 2026
When Data Privacy Policies Backfire and Create Vulnerabilities
In the quest to comply with data privacy regulations, organizations often implement policies that inadvertently create new security vulnerabilities. This discussion centers around a real incident where a company's stringent data access policies led to a situation where employees were unable to access critical information during a crisis, ultimately exacerbating the problem. We explore the decisions made by executives in crafting these policies, the balance between compliance and operational efficiency, and how the intent to protect data can sometimes lead to unforeseen consequences. The consultant outlines best practices for developing data access policies that prioritize both security and usability, while the executive host raises essential questions: How can organizations ensure that data protection measures do not hinder operational response? What role does employee feedback play in shaping effective policies? And how can leaders navigate the complexities of compliance without sacrificing security? We analyze the decision-making process that led to the policy's creation, the immediate fallout during the incident, and the lessons learned about the intersection of data privacy and organizational resilience. Ultimately, this conversation highlights the reality that well-meaning policies can have unintended effects, and leaders must remain vigilant in assessing their impact on both security and business continuity.
18 Aug 2026
How a Social Engineering Attack Targeted Executives and Failed
In the world of cybersecurity, social engineering is often seen as a low-tech threat, but its impact can be devastating, especially when it targets high-level executives. This discussion centers around a real incident where a group of attackers attempted to manipulate executives into divulging sensitive information through carefully crafted interactions. We explore the psychological tactics used, the critical decisions made by the executives, and how their responses shaped the outcome. The consultant breaks down the elements of effective social engineering, why it often bypasses traditional security measures, and what leaders can do to protect themselves and their teams. The executive host raises essential questions: What warning signs should executives look for in suspicious communications? How can organizations create a culture of skepticism without fostering paranoia? And what role does leadership play in reinforcing security awareness? We analyze the decision-making process that led to the near breach, the lessons learned about human behavior in security contexts, and the strategies for building resilience against social engineering attacks. Ultimately, this conversation highlights the reality that even the most sophisticated security systems can be undermined by the human element, and leaders must be vigilant in recognizing and addressing these threats.
11 Aug 2026
The Financial Fallout of Cybersecurity Incidents on Investor Relations
When a cybersecurity incident occurs, the immediate focus is often on technical fixes and operational recovery. However, the repercussions extend far beyond the IT department, impacting investor relations and market perception. This discussion centers around a real incident where a data breach led to a significant drop in stock prices and investor confidence. We explore how executives navigated the communication challenges with shareholders, the decisions made to manage the fallout, and the strategies employed to rebuild trust in the company's leadership. The consultant outlines effective communication tactics for addressing investors during crises, emphasizing transparency and proactive engagement. The executive host raises critical questions: How can organizations prepare for investor reactions to cybersecurity incidents? What role does public perception play in financial recovery? And how can leaders turn a negative incident into an opportunity for demonstrating resilience? We analyze the decision-making process that influenced the company's response to investors, the long-term impacts on stock performance, and the lessons learned about the intersection of cybersecurity and investor relations. Ultimately, this conversation highlights the reality that the financial implications of a cybersecurity incident can be as significant as the technical ones, and leaders must be equipped to address both.
4 Aug 2026
The Role of Cybersecurity in Mergers and Acquisitions Success
Mergers and acquisitions often focus on financials and market share, but the cybersecurity posture of both companies can make or break the deal. This discussion explores a real incident where a merger was nearly derailed due to undisclosed vulnerabilities in the target company's systems. We analyze the critical decisions made by executives during the due diligence process, the importance of assessing cybersecurity risks alongside financial evaluations, and how leaders can navigate the complexities of integrating two different security cultures. The consultant shares insights on what to look for during cybersecurity assessments in M&A, while the executive host raises essential questions: How can organizations ensure a thorough cybersecurity audit before finalizing a deal? What are the potential liabilities if vulnerabilities are discovered post-merger? And how can leaders foster a unified security approach after the acquisition? We examine the aftermath of the merger, the steps taken to address identified risks, and the lessons learned about the intersection of business strategy and cybersecurity. Ultimately, this conversation highlights that in the world of M&A, overlooking cybersecurity can lead to significant financial and reputational repercussions.
28 Jul 2026
The Unseen Impact of Cybersecurity Breaches on Company Culture
When a cybersecurity incident occurs, the immediate focus often lies on financial losses and technical fixes. However, the long-term effects on company culture can be profound and far-reaching. This discussion centers around a real incident where a significant breach not only affected the bottom line but also altered employee morale, trust in leadership, and overall workplace dynamics. We explore how executives navigated the aftermath, addressing employee concerns and rebuilding a sense of security within the organization. The consultant outlines strategies for leaders to communicate effectively during crises, emphasizing transparency and empathy. The executive host raises critical questions: How can organizations assess the cultural fallout from a breach? What role does leadership play in restoring trust among employees? And how can companies turn a negative experience into an opportunity for cultural growth? We analyze the decision-making process that influenced the company's response, the initiatives taken to engage employees post-incident, and the lessons learned about the intersection of cybersecurity and company culture. Ultimately, this conversation highlights the reality that the effects of a breach extend beyond financial implications, shaping the very fabric of an organization.
21 Jul 2026
The Hidden Costs of Cybersecurity Insurance and Risk Management
As organizations increasingly turn to cybersecurity insurance to mitigate risk, many leaders overlook the complexities and hidden costs associated with these policies. This discussion explores a real incident where a company faced a significant breach and discovered that their insurance coverage did not provide the expected protection. We analyze the decision-making process that led to the purchase of the policy, the assumptions made about coverage, and the unexpected exclusions that left the company vulnerable. The consultant breaks down the nuances of cybersecurity insurance, including what to look for in a policy, the importance of understanding terms and conditions, and how to align insurance with actual risk management strategies. The executive host raises critical questions: What are the common misconceptions about cybersecurity insurance? How can organizations accurately assess their risk exposure before purchasing a policy? And what role does insurance play in an overall security strategy? We examine the aftermath of the breach, the financial implications of inadequate coverage, and the lessons learned for future insurance decisions. Ultimately, this conversation highlights the reality that while insurance can be a safety net, it should not replace proactive risk management and security measures.
7 Jul 2026
When Trust Becomes a Liability in Vendor Relationships
In the world of cybersecurity, trust is a double-edged sword, especially when it comes to vendor relationships. This discussion focuses on a real incident where a trusted vendor's oversight led to a significant data breach, exposing sensitive information and damaging reputations. We explore how the initial trust placed in the vendor created vulnerabilities that were exploited, and the critical decisions that executives faced when the breach was discovered. The consultant breaks down the importance of due diligence in vendor selection, the need for ongoing assessments, and what leaders should demand in terms of transparency and accountability from their partners. The executive host raises essential questions: How can organizations balance trust with verification? What contractual safeguards should be in place to protect against vendor failures? And how do we communicate with stakeholders when a trusted partner lets us down? We analyze the decision-making process that led to the breach, the aftermath of the incident, and the steps taken to rebuild trust with customers and partners. Ultimately, this conversation highlights the reality that while partnerships can enhance capabilities, they also require vigilance and proactive management to prevent trust from becoming a liability.
7 Jul 2026
The Costly Mistake of Ignoring Cybersecurity Training for Employees
In many organizations, cybersecurity training is seen as a checkbox activity rather than a critical investment. This discussion centers around a real incident where a lack of proper training led to a significant breach, costing the company not just in dollars but also in reputation. We explore how the failure to educate employees about basic security practices created vulnerabilities that attackers exploited. The consultant breaks down the elements of effective training programs, why one-size-fits-all approaches often fail, and what leaders should demand from their teams to ensure everyone understands their role in cybersecurity. The executive host raises essential questions: What specific training content resonates with employees? How can organizations measure the effectiveness of their training initiatives? And what are the long-term impacts of neglecting employee education on security? We analyze the decision-making process that led to the breach, the aftermath of the incident, and the steps taken to rebuild trust and improve training. Ultimately, this conversation highlights the reality that an organization’s first line of defense is its people, and investing in their education is not just a good practice but a necessity.
18 Mar 2025
Building a Board Ready Security Strategy Without Becoming the Boy Who Cried Wolf
A security leader presents breach scenarios to the board every quarter, but by the third presentation, executives stop listening because nothing ever happens. This final episode examines how to communicate security risk in ways that drive decisions rather than trigger fatigue, and how a leader avoids the trap of over-dramatizing threats while still getting budget approved. We synthesize lessons from the previous eight incidents and extract the framework that works: lead with business impact, not technical detail; distinguish between theoretical risk and active threat; and close with the specific decision the board needs to make this week. The consultant and executive host work through a real board presentation, identifying the moments where clarity wins and where fear-mongering loses credibility. We examine how to structure security budgets around risk tiers, how to measure whether spending actually reduces breach probability, and what metrics matter to boards versus what security teams measure. The episode walks through the decision to invest in detection versus prevention, how to staff a security team for the threats you actually face, and why the best security strategies look boring because they work. We close with the three questions every leader should ask their security team this week, the red flags that signal a security team is either asleep or crying wolf, and how to recognize the moment when a security recommendation is actually about risk reduction versus consultant revenue.
4 Mar 2025
Regulatory Fines and the Compliance Decision That Wasn't Really About Security
GDPR fines can reach 4% of global revenue, and many companies face penalties not because they were breached but because they didn't follow rules about how they handle data. This episode examines the difference between security breaches and compliance violations, why a company can be technically secure but legally exposed, and what happens when regulators care more about process than prevention. We walk through a real case where a company experienced a breach, disclosed it properly, but faced massive fines because they hadn't implemented required privacy controls beforehand. The consultant explains what GDPR, CCPA, and other regulations actually require, why compliance is often a legal problem masquerading as a security problem, and what documentation and processes matter more than technology. The executive host asks the uncomfortable questions: Why do regulators fine us for breaches we reported? What does data minimization actually mean in practice? And how do we balance innovation with compliance requirements that seem designed for a different era? We examine the decision to invest in compliance infrastructure, the role of data protection officers, and why some companies treat compliance as a checkbox while others embed it into operations. The episode closes on the reality that regulatory risk is sometimes bigger than breach risk, and a leader's judgment call about compliance spending can matter more than their security budget.
18 Feb 2025
Cloud Migration Gone Wrong and the Misconfiguration That Exposed Everything
A company moves its data to the cloud and accidentally leaves the storage bucket publicly accessible, exposing millions of records to anyone with a browser. This episode examines the gap between moving to the cloud and actually securing it, why default configurations are dangerous, and how a simple oversight can undo years of on-premises security work. We walk through a real incident where a cloud migration team focused on speed and compatibility, assumed default settings were secure, and didn't verify access controls before going live. The consultant explains how cloud security differs from traditional network security, why shared responsibility models confuse companies about who owns what, and what automation and testing should happen before data moves to the cloud. The executive host asks: Why didn't anyone catch this before it went live? What's the difference between on-premises and cloud security? And if data's already exposed, how do we know how many people accessed it? We examine the decision to shut down the bucket, notify affected parties, and investigate the logs, and why the reputational damage often exceeds the technical fix. The episode closes on the reality that cloud adoption speeds up deployment but requires a different security mindset, and many breaches happen not because cloud is inherently insecure but because organizations treat it like on-premises infrastructure.
4 Feb 2025
Supply Chain Sabotage and the Software You Didn't Know You Owned
SolarWinds' 2020 breach compromised 18,000 organizations through a single software update, and most victims didn't know they were vulnerable until the government told them. This episode examines what happens when attackers compromise the software a company uses to manage its own security, creating a situation where the defender's tools become the weapon. We walk through how the attack worked, why SolarWinds' development environment was vulnerable, and how a malicious update distributed through legitimate channels reached thousands of organizations simultaneously. The consultant explains software supply chain risk, why companies can't audit every line of code in their tools, and what visibility into vendor development practices actually exists. The executive host asks the practical questions: How do we know what software we're actually running? Who's responsible when a vendor's update breaks our security? And what does due diligence on a software vendor even look like? We examine the detection and response timeline, why some organizations found the compromise immediately while others took months, and what the government's role was in coordinating the response. The episode closes on the reality that perfect visibility into supply chain risk is impossible, and leaders must accept a level of trust in vendors while building detection systems for when that trust is broken.
21 Jan 2025
Phishing Campaigns That Fooled Executives and Drained Millions
A phishing email that looks like it came from the CEO can move millions of dollars in minutes, and the decision to wire funds or question the request often comes down to whether one person pauses. This episode walks through a real case where attackers spoofed executive email addresses, created urgent-sounding payment requests, and convinced finance teams to transfer money to fraudulent accounts before anyone could verify. We examine the psychology of the attack, why time pressure and authority matter more than technical sophistication, and how attackers research companies to make their emails convincing. The consultant explains the difference between phishing that steals credentials and phishing that directly moves money, why email authentication tools like DMARC exist but aren't always used, and what training actually works versus what people forget five minutes after the session ends. The executive host pushes on the hard questions: Why did finance teams not verify with the CEO directly? What's the liability if someone falls for a phishing attack? And how do we balance security culture with the reality that people make mistakes under pressure? We examine the recovery process, what law enforcement can actually do to trace stolen funds, and why some companies get their money back while others lose it forever. The episode closes on the uncomfortable truth: no technical control prevents human judgment from failing, and the biggest vulnerability in any organization is the person who answers the phone.
7 Jan 2025
Third Party Breach Notification and the Domino Effect Nobody Planned For
When Equifax announced its 2017 breach affecting 147 million people, thousands of companies that relied on Equifax data suddenly faced a choice: notify their own customers, or hope nobody noticed? This episode examines what happens when a company's vendor gets breached and the liability shifts downstream to anyone who trusted that vendor. We walk through the exact moment a company discovers its data was compromised in someone else's system, the legal obligations to notify affected parties, the cost of notification campaigns, and the reputational damage that follows. The consultant explains how data flows through vendor ecosystems, why one breach can trigger cascading notifications across dozens of companies, and what a leader should demand from vendors in contracts before disaster strikes. The executive host asks: Who actually has to notify whom? What's the legal timeline? And how do we explain to our customers that someone else lost their data? We examine the decision to over-communicate versus under-communicate, the role of credit monitoring services, and why some companies faced lawsuits while others managed the fallout quietly. The episode closes on the uncomfortable reality: your security is only as good as your worst vendor, and you have limited control over their practices.
25 Dec 2024
The Board Member Who Spotted the Insider Before Security Did
Insider threats are the hardest breach to prevent because the person has legitimate access, knows the network, and often has a reason to hide their tracks. This episode examines a real case where an employee with financial motive began copying customer data and selling it to competitors—and how a board member's casual observation at a company event led to the discovery weeks before automated systems flagged anything wrong. We walk through what the employee was doing, how they evaded detection, and why traditional security monitoring missed the signals that a human eye caught. The consultant explains the difference between monitoring for external attacks and monitoring for insiders, why some behaviors look normal on a system log but suspicious in context, and what tools actually work versus what security teams buy but never use. The executive host asks the real questions: How much privacy do we sacrifice to catch insiders? What's the legal line between monitoring and invasion? And if someone's stealing data, how do we prove it without tipping them off? We examine the decision to confront the employee, involve law enforcement, and preserve evidence, and why the board's informal intelligence network sometimes catches what million-dollar security systems miss.
10 Dec 2024
Ransomware Demands and the Math of Paying Criminals
Colonial Pipeline paid 4.4 million dollars in Bitcoin to a group called DarkSide in May 2021, and the decision to pay—or not pay—sits at the intersection of insurance, law enforcement, and operational survival. This episode breaks down the real pressure a CEO faces when ransomware locks up critical infrastructure: fuel can't be pumped, hospitals can't operate, and someone is demanding money with a deadline. We walk through the moment executives discovered the encryption, the calls to law enforcement and the FBI, the insurance company's role in the negotiation, and the calculation of what it would cost to rebuild systems versus what the criminals were asking. The consultant explains how ransomware spreads, why backups alone don't solve it, and what actually happens when you refuse to pay. The executive host pushes back: If we don't pay, how long are we down? What does the FBI actually do in these situations? And if we pay, are we funding terrorism? We examine the legal gray zones around ransom payments, how insurance shapes the decision, and why some companies pay while others don't—and what the board should know about their own exposure before a ransom demand lands on the CFO's desk.
27 Nov 2024
When a Password Reset Became a Sixteen Million Dollar Decision
Target's 2013 breach started with a contractor's credentials and ended with 40 million payment card numbers stolen. This episode walks through the exact moment a security team flagged unusual activity on the network, the decision to investigate versus the pressure to keep systems running, and why the company's choice to delay disconnecting infected registers cost them millions in fraud liability and settlements. We examine what the board should have been told in real time, what questions would have changed the timeline, and how a non-technical executive could have recognized the difference between a contained incident and one spiraling into catastrophe. The consultant explains how vendor access works in retail, why monitoring it matters, and what a leader should demand from their security team when a third party has keys to the kingdom. The executive host asks the uncomfortable questions: Why wasn't this caught sooner? Who decides when to shut down operations? And what does the liability actually look like when you're holding the evidence in your hands but haven't acted on it yet?
Host of Cybersecurity for Non-Technical Leaders?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.