Category: Cyber Security

AI has been sweeping the internet for months since the release of Chat GPT 3. As the world looks at the implications of these powerful new AI models, the cyber security industry is no exception. On Episode 17 of The Cyber Security Matters Podcast we spoke to David Stapleton, the CISO at CyberGRX, who we met at the RSA conference. With over 20 years of experience in business administration, cyber security, privacy and risk management, David has a unique expertise that makes him the perfect person to share insights on the relationship between Cyber Security and AI. Read on to hear his thoughts! 

A lot of attention has been paid to AI – with good reason. I have this mental model where if my mother is aware of something that’s in my field, that’s when it’s really reached the public Zeitgeist. When she asked me a question about the security of AI, I knew it wasn’t a niche topic anymore. 

Artificial intelligence is an interesting phenomenon. Conceptually, it’s not that different from any other rapid technological advancement that we’ve had in the past. Anytime these things have come up, the same conversations have started to happen. With the advent of cloud there was a real fear that was sparked – particularly in the cybersecurity community – around the lack of control over those platforms. We had to trust other people to do the right thing. How do I present that risk to the board and get their approval for that? Maybe it’s a good financial decision, but we are introducing unnecessary risks. 

Another example of that may have been the movement towards Bring Your Own Device (BYOD) and allowing people to connect their personal devices to company networks and data. That sounds terrifying from a security perspective, but you can see how that opens the door to increased productivity, efficiency and flexibility. 

AI is not too dissimilar from that perspective, and we can see plenty of positive aspects to the utilisation of artificial intelligence. It’s a catalyst for productivity which could provide exposure to multiple different data points and bring together salient insights in a way that it’s hard for the human mind to do at that kind of a speed. It can also reduce costs, bring additional value to stakeholders and potentially help companies gain competitive advantages. 

Conversely, there are potential risks. It is such a new technology, and we’re still learning about how it works as we’re using it. There’s a lot of questions from a legal perspective about the ownership of the output of different AI technologies, particularly with the tools that produce audio visual outputs. The true implementation and impact of that isn’t going to be known until the courts have worked those details out for us. 

We’re in a position now where some companies have taken a look at AI and said, ‘We don’t know enough about this, but we feel the risk is too great, so we’re going to prohibit the utilisation of these tools.’ Other companies are taking the exact opposite approach: ‘We also don’t know a whole lot about this, but we’re going to pretend this problem doesn’t exist until things work themselves out.’ 

At CyberGRX we’re taking a middle of the road approach where we’re treating AI models as another third party vendor that we’re using for work purposes. We’re going to share access or data with that tool, but we need to analyse it from a security risk and legal risk perspective before we approve its utilisation. That’s a fairly long-winded way of saying that there are amazing opportunities for AI but there are risks. 

We’ve already seen threat actors starting to use artificial intelligence to beef up their capabilities. You could understand logically how artificial intelligence gives a fledgling or would-be threat actor the ability to get in the game and take action sooner than they otherwise would be able to. When Chat GPT first was released to the public, the very first thing that I put into it was ‘Write a keylogger in Python’. That’s a little piece of malware that will log your keystrokes and collect things like passwords or credentials. It just did it. It was there on the screen as a perfectly legitimate piece of software. Since then they’ve tightened the controls, but there was a time when someone with bad intent could start producing different types of malicious software without even learning to code.

To learn more about the uses of AI in Cyber Security, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Growing companies often face cyber security challenges as they manage teams that are scattered across the world. On The Cyber Security Matters Podcast we were joined by Ivan Milenkovic to discuss how companies can manage those challenges, even inside the industry. With over 20 years of expertise in information security, Ivan is currently a Group CISO at WebHelp, where he’s managed a large security team that doubled in size to over 140,000 people. He’s a security evangelist and a huge advocate of addressing cultural and leadership factors rather than relying solely on technology to protect your teams. 

What were the security challenges involved in scaling so fast at WebHelp, and how did you overcome those?

When I joined three years ago, WebHelp was just shy of 58,000 people. Throughout COVID we started growing to address the way that our clients worked, and what was happening to the sector at the time. We are very aggressive when it comes to acquisitions and expanding into new markets, and that brings some very interesting challenges. We’re a very large global company. That’s how our clients see us, and they expect a certain level of quality across the board, regardless of where their services come from. 

We effectively needed to bring everybody up to speed and bought-in to our culture. I’m a big believer that people are a very important part of the picture when it comes to security. That’s why it’s very important to get everybody on board to recognise certain values that must be respected. The challenge is to get people on this journey, and for them to understand that when it comes to security, it’s not just that you’re trying to enforce boundaries, it’s actually about supporting the qualities. You need to be able to lead and take people on that journey, rather than providing rigid boundaries that they don’t understand.

How do you balance managing a large security team with meeting the demands of internal stakeholders?

WebHelp is split into what we refer to as regions. They’re not necessarily geographic regions, but logical parts of the business that operate as semi-dependent companies tied together at a group level. Because of how everything came together, we’re talking about various teams spread around the world. InfoSec is a very large team, so you have all the daily challenges when it comes to the InfoSec itself. Because it is a rather big team, not everybody is my direct report. Whenever you work with people though, you need to respect their different needs and requirements, and understand what’s going on. We’re blessed with the quality and enthusiasm of people that are part of the team, which helps a lot. Most of my time is actually spent dealing with senior stakeholders from the business rather than my team. It’s been important to make sure that my people are bought-in enough to carry on without much management. 

You’re a really passionate advocate of the idea that technology alone can’t solve security problems, so the leadership aspects of cybersecurity are key. Why is that? 

It boils down to two things. One is that culture we touched on, because when people understand why certain things need to be done in a certain way, that’s half the job done. If you have people that are trying their best, that are not scared to report problems, that are educated well enough to understand, appreciate and communicate when something goes bad, everything is easier to deal with. 

If you look at what can be done with technology today, you cannot do without it. We live in a really technological era where there is too much going on, so without technology you wouldn’t have the right level of visibility and you wouldn’t be able to react fast enough. People are very creative, sometimes too creative for their own good. It’s not hard to imagine a multitude of scenarios where a very creative person can easily get around even the best piece of technology. So that’s why you must find the right mix. You cannot rely on just your technology. It’s your processes that glue it all together. So, unless you take people with you on that journey, you don’t stand a chance.

To learn more about managing risks within the industry, tune into the full episode of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Cyber Security is a growing concern for the majority of organisations. On Episode 15 of The Cyber Security Matters Podcast we were joined by Adam Gwinnett, the CTO & CISO of Nine23. With a legal background, he’s experienced in managing stakeholders in the heavily regulated state sector, with 10 years of experience at the Department for Constitutional Affairs, the UK Ministry of Justice, and the Metropolitan Police. Adam joined us to talk about how cyber security impacts state systems, from the challenges facing the police to the government’s response to major incidents. 

What challenges are the police facing from the increase of cyber crime?

I think because of the global pandemic, when people were locked at home with their computers, cyber crimes and quantum growth crime grew dramatically. That raises some really interesting challenges generally, because cyber crime is often transnational. The person committing offences against you is very unlikely to live in your jurisdiction, so even if you do report it, investigation can be very frustrating. As a result, under-reporting is rife. One of the fundamental challenges you have from a law enforcement point of view is that you don’t actually know how much it’s occurring or how impactful it is, because people are quite embarrassed to admit when they’ve had issues with it. They’re often worried about being scrutinised, and worry that people will be critical of their responses to it or how they handled it. People end up suppressing certain information which otherwise could be very interesting and beneficial, not only to the investigation process, but actually to their peer group who might have suspiciously similar looking things in their environment. 

From the law enforcement point of view, I was keen to couple cyber security with the cybercrime division. One of the things that we focused on was ‘How can I take my investigation of a cyber incident, and turn that into a potential initial bundle for the investigating officer to take forward? How can I give the best evidence? How can I provide you with the best material?’ I didn’t have the mandate to do the investigation and proceed because I was civilian styled, but I could take the information from my logs in the digital forensics team and give them the best chance of bringing the offender to justice. I used to talk about it at conferences, where people would just say ‘That’s not our jurisdiction. We haven’t really thought about how we could give them a leg-up or considered how we could best enable them.’ How many SOC analysts can say they’ve actually put a cyber criminal in prison? Several lawyers could say that I contributed to making sure that that offender actually went to prison, and that’s the ultimate closure for me. 

How do cyber security decisions get made within big government departments? 

Some of it’s quite straightforward. Effectively, most decisions that impact the risk appetite, risk acceptance, or risk tolerance will go to a named individual on their board of advisors. They will then review it, look at the balanced risk case like ‘Why are we doing this? What are we hoping to gain through it? What are the potential mitigations we can put in place? Are they proportionate? What is the net impact on our risk position? Does that take us outside of tolerance?’ That makes it quite straightforward. It’s an interesting one, because those people are fundamentally dependent on the advice they’re given. The people asking them to make decisions, accept the risk or present the view will seldom be impacted when the risk emerges. They’re incredibly challenging positions for people in the regulated and public sectors. 

What are the challenges facing cyber security leaders in the sector?

One of the things that can be really challenging is that it can be really hard for those people to understand the net effect of the things they’ve agreed to. So I’ve spoken to CROs from other organisations that said, ‘I’ve had like 40 risk acceptances presented to me this year.’ It’ll happen every couple of weeks where I’m asked “Can we accept this risk?” I don’t know if I can reliably tell them what the net impact on our overall risk is, or the cumulative effect of all of those things that we’ve agreed to.’ In large, complex enterprises, can you understand all the systems, processes and risks that are undertaken? Because the people who own those systems, processes and fundamental aspects of the business will be separate from the people doing the risk acceptance. They don’t always have the mandate to go in and correct all of the issues. They won’t normally have a budget or available resources to do it. If they don’t, it just becomes one of 100 other competing priorities that organisation has to deal with.

In the event of a major security incident, what does the internal decision making process within a big government department look like?

It’s very dynamic. You’ll normally find war rooms and incident response teams almost immediately. Most large organisations have very mature, robust and practised responses, because it’s never quiet. Even when I worked at the Met, I was talking to people from banks, insurance companies and financial services who were a big target, and they had a 10th of the attempted attacks that I did in a week. Our response and investigation processes are incredibly well drilled, because somebody’s always trying something. One of the biggest challenges is that your teams end up being in high alert and response mode all of the time. That level of anxiety, stress and mental overload is not useful for people. It leads to poor decision making. What you will find is that a lot of organisations start putting things like shift rotations in place to tackle those issues. If your response mechanisms are really effective and really well tested, you can rely on them slightly too much. Actually preventing issues is dramatically less problematic than being able to respond to and deal with them effectively, but if you’re always able to jump out in front of it and catch the issue, people will get relaxed about the fact that that’s what will happen. 

To learn more about the threats facing cyber security teams, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Cyber Security is becoming a growing concern for businesses across the globe. On Episode 14 of The Cyber Security Matters Podcast we were joined by Hajar El Haddaoui, who is an international executive. She speaks four languages: French, Arabic, German and English, which has allowed her to lead a large sales team in multiple continents. She is currently leading Swisscom’s managed security services, as well as serving as a board member for the Chamber of Commerce, MOD-ELLE and WIN Women’s International Conference, where she works to support women in business. With such an extensive and exciting background, we were keen to hear her insights on global leadership in cyber security. 

How does Switzerland’s approach to Cyber Security differ from other key European markets?

Switzerland is one of the most innovative countries I’ve worked in. Cyber Security is a part of the business transformation of any company, and in Switzerland they are sensitive to where the data goes and is used. They create security by design, which weaves their Cyber Security into the fabric of their products. 

Do you expect adoption of managed security solutions to continue to increase as a proportion of the overall cybersecurity marketplace?

Absolutely. There are many challenges facing our clients, including the complexity of digital business, where there is an increasing skills and resource gap. There’s a 3.1 million gap in resources and talent worldwide for Cyber Security. Lots of our clients don’t know how to use the hybrid cloud. Therefore, managed services are key for those clients in order to respond to their challenges. We want to transform the industry by making products and services that are secure by design, but there are several clients who need someone to manage those products for them anyway. It’s important to have management in your Cyber Security portfolio in order to meet that need in the market and address the challenges that clients are facing. 

Silicon Valley is seen as leading innovation. How influential are they to Cyber Security?

Research and development are key to innovation, not just in Cyber Security. They give you confidence to innovate and inform how you take a digital solution and rapidly provide insurance to our customers. We’re not just providing security to our customers, we are providing consultancy, technical support services and managed security services too. It’s those three layers where innovation needs to be. Research and development can be applied to intelligent and managed security services to identify and respond to threats, giving us a proactive level of protection. 

There’s a lab in Silicon Valley that is the hub of innovation, not merely for Cyber Security. There are also labs in Israel and Japan, but Silicon Valley is still playing a huge part in global Cyber Security efforts because of the amount of investment that they’re able to attract. Everyone needs to invest in innovation and in hub centres for security. Silicon Valley aren’t the only one doing it, but they are still big players. 

What have the different places you’ve worked taught you in a business and leadership context?

Working internationally has given me the ability and agility to deal with challenges. Being a resilient leader is essential to what we do. The second thing is confidence. Moving from one country to another I’ve learned to build a community and a support system, which plays into that self confidence. The third lesson is humility. I’ve become a continuous learner, because the technology field in Cyber Security is rapidly changing, and I have to accept that I’m not going to stay an expert if I don’t learn from other people. The market is fast and furious, so to be fit for the future I have to learn skills and humility. 

To hear more about global Cyber Security efforts, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Spring is blossoming in San Francisco, the highly anticipated #RSAC2023 commences attracting leaders and companies from around the world.

Being my first conference, I embarked on this journey with a mix of excitement, nerves, and curiosity.

The big takeaways from the conference were the valuable insights into the cybersecurity industry, the strong sense of community and the hot topics of investments, the impact of AI and talent shortages. Additionally, we had the opportunity to explore the vibrant food scene of San Francisco, which added a cultural touch to the conference experience.

Grand Opening and Impressive Booths

The conference kicked off with great anticipation, as attendees gathered in the entrance hall, the atmosphere was electric, and the buzz of excitement was palpable. As the doors opened, a polite stampede of cybersecurity enthusiasts filled Moscone South Hall. The sight of numerous booths was awe-inspiring, with companies investing substantial resources to impress and display the immense potential of the cyber security world with exhibits highlighting the industry’s advancements and potential.

Networking calls and conversations up to this point had evolved around RSA Conference, emphasising its values as a place to connect and meet face-to-face.

Community – Diversity & Inclusion

The most profound takeaway from my first RSAC was the vibrant and supportive community within the cybersecurity industry.

As a newcomer, the community came across as surprisingly friendly and collaborative.

I had the privilege of attending the Women in CyberSecurity (WiCys) drinks event, where representatives from Microsoft, Amazon and Google gathered to promote diversity, the motto “not done yet” resonated strongly emphasising the importance of the continuous effort needed to enhance diversity in this tech space.

The next morning, I attended the Women’s in Cyber breakfast, featuring a panel discussion with founders, CEOs and CISOs. The conversation revolved around the challenges faced by successful women in maintaining work-life balance. It was inspiring to witness the support within the community, with ideas exchanged freely, fostering growth and empowerment.

Insights and trends

Apart from the community aspect, RSA Conference 2023 offered valuable insights into trends and concerns.

Investments

One notable takeaway was the significant investment in the Cybersecurity sector. Funding for Cybersecurity start-ups increased from $2.4 billion in Q4 2022 to nearly $2.7 billion in Q1 2023, underscoring the industry’s growth and the recognition of its importance in the digital landscape.

AI – Changing the landscape.

Discussions throughout the conference highlighted the transformative role of artificial intelligence in the Cyber security industry. AI technologies are reshaping the landscape, influencing threat detection, incident response, and overall security operations. The integration of AI into cybersecurity practices has become indispensable for organisations to stay ahead of evolving threats.

Talent shortage and calls for solutions.

Addressing the shortage of talent has become a top priority for organisations with discussions focussing on strategies to attract and retain skilled professionals. Collaborative efforts are necessary to bridge the talent gap and nurture a diverse and competent cybersecurity workforce.

Amid networking and business meetings, we took the opportunity to explore San Francisco’s renowned food scene, indulging in the famous Clam Chowder, Oysters, and the Buena Vista Irish coffee.

While RSAC is over, another key takeaway is that the fight is not over, so we look forward to next year to witness the continued growth in the industry and learn new and innovative ways to disrupt cybercrime.

Asset management is a growing area in the Cyber Security industry. On Episode 12 of The Cyber Security Matters Podcast we were joined by Huxley Barbee, a CISSP and CISM. He is currently a Security Evangelist at runZero, which is the latest role in a glowing career in the cyber security industry. We spoke to Huxley about the advancements he’s seeing in the asset management sector, including his predictions for the future.

How do you see Asset Management evolution over the next few years?

There have been a number of technological trends that have caused a divergence of environments. For example, smart speakers like your Alexa are changing our home environments, because this tech used to be simple, non-connected devices. Now they’re connected to the internet, which exposes you to a higher risk. There’s also been a rise of ‘bring your own device’ culture, where people bring their own phones and tablets to the corporate network. There’s also the move to cloud associated with the DevOps revolution. 

A lot of companies will see the cloud as a way of transforming their capabilities to both lower costs and increase speed and agility. Folks are empowered to just spin up new computing devices left and right, but the old devices are not actually decommissioned, so you have a sprawl of this attack surface out in the cloud as well. There are also more and more mergers and acquisitions happening, where a purchasing company has to take on the risks and vulnerabilities in the target company. All these different trends have led to this divergence of environments where companies are not just protecting their corporate IT assets, but also their OT, the factory, their IoT devices, your personal devices, the cloud and whatever else goes on in remote employees homes. 

Because of a need to find talent, organisations have started looking at a wider geographic spectrum, and a rise in this ‘work from home’ culture became compounded by the pandemic. That is now also part of what cyber security needs to protect. Over the last 20 years, this evolution of assets has resulted in a decentralisation of control. Meanwhile, it’s the same security team that’s being expected to protect all that. There are numerous statistics out there about how the number of devices connected to the internet is going to continue to go up. Security teams will be more and more challenged, which is a fundamental problem. If you don’t have this foundational capability of knowing what you have, you are absolutely not protected. We’re going to have to see some change in order to address this growing challenge. 

How can the industry address those issues? 

There are a number of different approaches that have been tried over the last 20 years. There’s the use of agents and authenticated active scans, but they don’t solve the problem of unmanaged devices. If you can put software on a machine, then it probably needs managing. There are other vendors who try and pull data from multiple other sources to try and cobble together some sort of asset inventory. The trouble is, if they’re pulling from limited data sources, they’re not really solving the problem of unmanaged devices either. There’s also a passive network monitor, which theoretically can learn about more devices on the network, but its ability to identify those assets correctly is limited, because it’s only looking at network traffic to make that determination. There’s another approach, which is using an unauthenticated scanner with a security research-based approach for fingerprinting alongside API integrations. We found that this is the winning combination to help you get both breadth and depth of your assets, no matter where they are, no matter what type they are. 

To learn more about asset management, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

An increasing number of ransomware attacks are coming through emails. It’s clear that the ease of attack vector is changing, and not for the better. On Episode 13 of The Cyber Security Matters Podcast we spoke to Ronnen Brunner, an SVP at Ironscales, about his work in selling the future of phishing protection. He shared his insights on the increase of ransomware attacks in emails and told us how we can identify and protect against these attacks.

You don’t need to be an expert in order to send a successful ransomware attack, because there are services you can just download on the dark web that will do all the hard work for you as a hacker. You can spam attacks directly to customers – you don’t need to be the sophisticated hacker sitting down and programming a credential theft or phishing attempt. You can use existing engines to attack people, and because of the ease of it, it’s become a lot more common. 

There’s a lot of variety when it comes to scammers who will spam hundreds or thousands of people and those who target specific individuals. A lot of hackers are just hoping that some of their attempts at phishing will be successful, and they’re the ones focussing on quantity.  Especially when you’re looking at credential safe, or Spear Phishing, they are targeting specific people by sitting in their mailbox, getting to know the regular interactions that they have and then designing a targeted attack that they won’t see coming.  

These scammers can learn your pattern of the behaviour, your invoices, forms, vendors etc, and create a legitimate invoice with different bank details on it. Once a payment has been made it’s often incredibly difficult to get back. Lots of these scammers are posing as big companies, because it’s easy to make an email look like it’s coming from a reliable source. You can emulate the domain name or make it look like it’s coming from a person in the company whose information you found on LinkedIn. From speaking to these companies we know that 60-70% of attacks are coming in through their emails. They’re being targeted because of the information they put online.  

We’ve seen customers trying to stop it. It’s incredibly hard because of the quantities of emails that go in and out. Some of these attacks look very sophisticated. It’s all about training people to identify what’s a ‘known dead’ and what’s a potential red flag. People need to understand malicious content and intent, then utilise machine learning or AI to sift through the information and flag any anomalies that could point to an attack. In the business we have something called ‘zero day attacks’, where there is no other indication that this email isn’t genuine. There’s no markers from our list of ‘known dead’ elements to tip you off, and that’s when these attacks are their most dangerous. 

Some things to look out for are language like ‘buy these amazon vouchers’ or requests to change bank details on an invoice. These could be very simple emails that look like legitimate communications from known senders. You should always question changes to your payments. Once bank details are changed and you make a payment, you’ll notice a massive increase in emails that ask you to change the bank details for other vendors, because these hackers have figured out how to effectively steal from you. 

Everybody’s seen an increasing number of attacks since the COVID pandemic, because hackers had the time to fine-tune these attacks. They’re becoming incredibly successful and sophisticated, which is why we need next generation solutions. Everybody we’ve spoken to has a fishing problem, because they’re not preparing for these attacks in their systems. Even though sometimes these attacks are stopped our email providers, there are still several getting through. People need to report phishing attempts if we’re going to get an accurate idea of the problem, and sadly that’s not happening either. We should be crowdsourcing suspicious behaviour and building a safer world together. 

To find out more about keeping yourself safe online, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On Episode 11 of The Cyber Security Matters Podcast we spoke to the incredible Dr. Rebecca Wynn about how we can all manage our privacy online. Dr. Wynn is an experienced global CISO and privacy expert, often named as one of the top women in Cyber Security. She has led large security teams in the investment and medical sectors and is currently consulting enterprise clients on their security strategies. 

Can you tell us about the challenges covid posed for the healthcare sector from a security perspective? 

Before covid we had a centralised workforce that was covered by certain policies and protocols within the business. Once people started working remotely, and in some cases in other countries, that situation changed. We were outsourcing our data protection and people didn’t have the same protections at home. People started working in shared spaces with people outside of the organisation. With these new conditions, companies need to look at how they are protecting their sensitive information, as well as that of their clients. 

One thing I did is look at cyber liability insurance. I met with external certification organisations, and we identified the safeguards I could put in place. I took our top 15-20 clients and walked them through our findings, and the majority of them asked me to quickly rebuild their security with a strategic plan, technical plan, and operational plan. It was a long process, and it cost me a lot of sleep, but we’ve helped protect people now. 

When you talk about the changes we’re seeing from covid, we’re still seeing fallout from leaders who didn’t realise the additional residual risks that they were accepting. One thing I do notice consistently, is people not sharing the information that you need to know or telling colleagues what their blast radius is in the organisation. It’s all about managing risk. That’s the one thing I still see from a younger generation, they don’t know how to communicate that risk and things along those lines. CISOs don’t want to be the scapegoat officer, so we need to be more watchful than we were before. 

How do you see the concept and the practical application of privacy evolving in this data-driven society?

One of the biggest problems with data privacy is developing a global set of privacy regulations. There’s so much red tape that you have to get through at the moment because everywhere has different legislation. 

Another challenge is that data is being created but it’s not tagged. Does it have sensitive information in it? We wouldn’t know. If we could tag information with expiration dates and a level of privacy, we could handle it better. If you’re talking about healthcare, you should be able to say ‘it’s printed on this day, and it will absolutely expire in seven years’. The other thing is that once that data is created somewhere, it’s in your environment. Data gets shared through companies’ internal systems, which is a massive problem unless you can embed some sort of privacy key. If you could do that it would act like a GPS signal in your database. You could follow that, expire it or see if the data went to someone who’s not supposed to get it. That’s the kind of thing you need to do if you want to get a handle on privacy. 

One of the scariest things right now is when people are creating avatars and stuff like that. To do that you upload 23 of your pictures, and then your biometrics are out there. People aren’t thinking about where their data goes when they do that. 

It’s really hard to be invisible in the world today. Even if I’m not personally on social media, if someone takes my picture and tags me in it, I’m there anyway. They’re commingling their data with mine, and so on. It’s scary how much of our data is out of our control. 

To hear more about how our data is being used, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On The Cyber Security Matters Podcast we were delighted to be joined today by Marco Pineda, an international CISO with a particular specialism in the finance industry. Episode 10 saw us unpacking Marco’s 20 years of experience in information security and talking about the security impact of DLTs. Read on for his insights into the changes coming to the industry following recent concerns around blockchain and crypto. 

What does distributed ledger technology (or DLT) and its applications mean for the future of the global financial industry?

As far as DLT is concerned, you need to understand what the application is. They’re great technologies for environments with a low trust atmosphere, such as cross-border cooperation or between companies where you need an intermediary to provide that trust. It’s a very interesting kind of technology. One of the best uses of DLTs is cross-border customs and documentation for bills of trading. Each government has their own systems, and people need to know how to get documents across that each government will trust. 

What are the security challenges that these technologies present?

It’s mostly the distribution, but understanding and the maths behind it is certainly a challenge too. There’s the additional concern that your system might be sitting on top of other systems that you don’t control at all. That’s an interesting risk facet that might be unique to the DLT area, because if I put a ledger out there, by definition, somebody else is managing that ledger. They’ve got their own machine. They’re taking care of it themselves. It’s their copy of it. I haven’t yet heard a good risk analysis on what that actually means for a company. 

How can security frame itself more positively to help enterprises reach their financial goals, instead of being viewed as a cost centre?

We can take a cue from our colleagues who are trying to see how they fit in with the overall business strategy. You need to show your value to the company, which comes from looking at your portfolio of services / products, and seeing how they can support the business’ strategy. Take some initiatives here and there, offer people proposals. At the end of the day, you need to prove your direct business impact. That means doing things like protecting documents so that your business can ship information and do secure collaboration. Those are the things that security professionals can do that helps a business directly. Get creative, take a look at what your skill sets are, what your services have, and see how they might be able to support the business in their goals. 

To hear more about the impact of Cyber Security in your business, tune into the full episode of The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On Episode 9 of The Cyber Security Matters Podcast we spoke to Jennifer Cox, the Head of Communications at Cyber Women Ireland, about her work with vulnerability management in the sector. Jennifer is a multi-award winning advocate for women in tech, using her knowledge to mentor women as they join the workforce. She also speaks at global events, bringing her expertise to a wider audience. 

Read on for Jennifer’s insights on vulnerability management in the Cyber Security industry.

What do you think are the three big takeaways on vulnerability management?

At the core of vulnerability management, you need to be able to identify where you’ve got problems. It’s not just laptops, it’s every device that’s possibly connected to the internet. You need to focus on what’s important to remediate first. Vulnerabilities are growing almost exponentially, but the teams that handle those issues aren’t growing the same way. The challenges are not always exclusive to the products that we sell – many times you’ve only got two people on the team, but 40,000 vulnerabilities that you need to fix. 

How do you think vulnerability management is changing in today’s world? 

What’s changed most dramatically since COVID is this overnight remote workforce. Companies no longer have control over every single device on the network, and more and more people are bringing their own device into the office. Companies still need to make sure that those devices are secure. When people are at home they often have wide open home networks. We’re improving education around vulnerabilities and teaching individuals how to put better practices in place at home. People forget that web applications are also vulnerability risks, so they haven’t included them when they’re doing the assessment of their mobile devices, which is a huge factor. Having a team to do vulnerability management within the team is probably the biggest change. 

What do you think is the biggest obstacle to vulnerability management as a whole?

Hands down it’s budgets and bodies. When you don’t get reports about anything going wrong and being fixed by the cybersecurity team, you often don’t appreciate that the team is doing a really great job. If you’re hearing from your cybersecurity team, then there’s a problem – they’re either understaffed or under-educated so they’re struggling to cope. That silence is a problem, because when companies are trying to strip back budgets, they’ll look at reducing that team because it’s quiet. That’s actually the worst thing that they can do, because that’s the team that’s protecting them the most.

The challenge has been resources all the way along. We don’t have enough people to remediate all these issues. What you’ll do in that case is educate your team on prioritisation using a scoring system called ‘CVSS score’. We also have an algorithm that we use called vulnerability prioritisation rating. It takes the CVSS score and a multitude of other different things into account. Based on all of these things, it tells us what is most likely to become a problem over X number of days. The struggle is that of 40,000 vulnerabilities, 30,000 of those are critical. I can’t remediate 30,000 vulnerabilities in a weekend, but that’s the only time I’m allowed to do it. Add to that things like needing a 99.9% uptime, restarting the server after patches, and that becomes a challenge in itself. 

To hear more about vulnerability management and the work that Jennifer is doing to improve diversity in the industry, listen to The Cyber Security Matters Podcast now. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On Episode 6 of The Cyber Security Matters Podcast we sat down with Chuck Herrin, the CTO of industry leading API security business WiB. Chuck has over 15 years of experience in senior and board level IT security roles, and now sits as an advisory board member for multiple organisations in the cyber security space. He’s acted as an attacker, defender, and most recently a builder. With so much knowledge and expertise in the space, we were fascinated to hear his insights into the API industry.  

What is your take on the state of the API security space at the moment? 

It’d be great if there was some API security. I’m being flippant, but it’s another example of history repeating. The most recent example of this phenomenon is when we knew for 10 to 15 years that adoption of the cloud was inevitable. There are so many benefits and cost savings, we all knew it was going to happen. For some reason, defenders didn’t try to figure out how to do it safely. They resisted the change. We saw all kinds of issues and eventually had to catch up. People are still really worried about cloud issues. I saw an article that said around 94% of companies anticipate having a cloud breach in the next 12 months.  

API’s are experiencing the same phenomenon. The adaptation is inevitable because the benefits are massive. There’s no way that we aren’t going to rapidly continue to adopt API and micro service based architectures. The point of business isn’t security, the point of business is delivering value. If you aren’t adopting APIs and micro services, you’re gonna be out-competed and you won’t survive, and if you adopt it incorrectly or insecurely, you’re exposing your back end systems, data and business logic. Adoption right now is rapidly outpacing security.  

We’ve been doing threat modelling for 20-25 years, and we know that you need to know your assets, actors, interfaces and actions in any environment or ecosystem. Then you see who’s doing what to what, via what, and the AI and API interface. Lots of API’s are completely unmanaged and unmonitored. APIs and their adoption made it around the world before security teams got their boots on. Now we’re frantically trying to help companies catch up and keep up. It’s like a one legged man chasing a rabbit, the longer it goes on, the further apart they’re getting. While we’re working really hard to solve these problems at a macro level, it’s only getting worse. We’re not catching up.  

Where do you see the API security space in 10 years time? 

I really hope that we can close these blind spots and treat API security the way we should.  API’s exist to make developers jobs easier, and they do a great job of that, but if you don’t know what’s exposed to the outside world, you can’t monitor it or manage it. We’ll catch up eventually because we have to.  

What I’m hoping for in the interim period is that we don’t have massive national crises, critical infrastructure implications or life safety issues. There are safety issues at the individual level where people’s data is exposed. Bad actors could figure out how to abuse these API’s and target API abuse at political figures.  We have critical infrastructure issues with with water treatment, or the power grid, or nuclear plants where a lot of companies that have been around a while are going to introduce APIs to their systems and there will be a risk. I worry about those attack surfaces more as a citizen than a software vendor, because if something goes wrong there we’re going to have to figure this out as a species. I hope we can address these security risks before that happens. 

To hear more about the state of the API industry and Chuck Herrin’s work in protecting it, tune into the full episode of The Cyber Security Matters Podcast.  

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On our first episode of The Cyber Security Matters Podcast, we were delighted to be joined by Girish Redekar, Co-Founder of Sprinto.  

His trajectory is incredible – from starting, scaling, and exiting RecruiterBox through to now growing Sprinto, all in less than a decade. 

We hope you enjoy listening to this episode as much as we did recording it.  

Why is India such a major innovation hub for the startup/cybersecurity space? 

“Great question. So, I’m definitely not an expert in the area. But basically, whatever I know, is just viscerally connecting with other Founders that I see in the ecosystem.  

And one of the things that’s really happening in India, is that there is a sudden exponential increase in just the sheer number of startups that you see in the space. They’ve entered mainstream, so to speak. So, you take a national daily and there’s basically a page which is dedicated to startups and the funding rounds that have happened and what’s going on over there.  

So, I remember the time when we started our previous company, which was back in 2008. And I didn’t know that what I was doing was a startup, we thought we were just doing a business and the word startup hadn’t entered our vocabulary yet.  

Fast-forward to about 14 years later, it’s really definitely entered the mainstream. You know, mindspace people talk about it, it’s very common – my neighbour next door in my apartment is another startup founder.  

Especially in some places like Bangalore and Pune and Gurgaon and some places, there are startup hubs, and it’s very common for you to find startups over there. And that sort of brushes over any aspect of startups. So, you have a very thriving consumer startup business. But we have a lot of b2b startups as well.  

And that touches on cybersecurity as well. So, I’m seeing a lot of interesting Cybersecurity startups coming from in the country, including those who are working in spaces like privacy. Some of them were working in spaces related to password protection, and so on, so forth. Therefore, that sort of grabs on to pretty much all the spaces that you can think of that makes sense in a b2b software scenario!” 

To listen to the full episode of The Cyber Security Matters Podcast click here.  

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On The Cyber Security Matters Podcast we were joined today by Isabel Bardley-Garcia. She is the Director of Information Security at Helion Energy, driving company wide security strategies, programmes and initiatives. They are currently building the world’s first fusion generators and enabling a future with unlimited clean electricity. Isabel has over 18 years of experience in the cybersecurity sector, including leading and driving the transformation and automation of National Cybersecurity consulting services. With all of that experience, Isabel has some fascinating views on the evolution of the cybersecurity industry, the highlights of which are below. 

How have you seen the role of security and risk management within cyber security mature and evolve during your career?

The role of security and risk management has gone from being just a compliance issue, either to a regulation like Sox or GLBA, or standard like PCI DSS due to more companies, and especially the government, taking it seriously. It’s more about protecting the organisation from major losses, crippling interruptions, or even failures of the organisation, and also about helping organisations to grow and to succeed. We’ve gone from doing things because we’re told to do it to doing something because it makes sense to actually do it.

Do you think that cybersecurity is taken more seriously in 2022, rather than the early 2000s of them when you were first starting out?

Back in the early 2000s it was very frustrating to be an information security consultant, or just a cybersecurity professional. Like I said, companies didn’t really take it that seriously if they didn’t have a regulation or standard. As professionals, we saw the attacks and we had to protect our companies against them. When we saw that the attackers or the threat actors were getting bolder and more sophisticated, our companies and even the government at that time felt further and further and further behind in this cyber warfare, to the point that many of them denied it was even happening. They were like an ostrich with their head in the sand. They just didn’t believe that they would be targets, because they sold blouses instead of missiles. They didn’t think they had anything that the threat actors wanted, and even the government thought of warfare as a physical thing and not a cyber thing. We were watching it all happen, and it was very frustrating. 

20 years later, after so many breaches and after learning about all the foreign actors from different countries who are trying to cripple other nations, down to their infrastructure, to steal intellectual property. The regular threat actors who are trying to steal intellectual property to sell credit cards, social security numbers, personal identifiable information for identity theft… they’re still there, but having breaches is being taken more seriously. It’s reactive more than proactive, and now more and more companies, as well as the government, have really gotten into beefing up their security. They’re seeing it more as a risk management issue instead of a compliance issue. 

We still have a way to go, because there’s still a lot of companies that have that old mentality that is still very pervasive. Some companies still think that they can just offshore or push off securities, saying ‘we have service providers taking care of that, we have third parties taking care of that, we don’t have to worry about it’. Now we’re getting more and more breaches, where the third parties are being breached in order to be able to get to their whole client base. That’s starting to be taken more seriously, and companies are being more proactive, which is a great direction to go to. We’re still a couple of decades behind, so we need to hurry this up.

How do you see the industry developing in 10 years time?

I think that with all the different frameworks that we have now, companies don’t really have much of an excuse to not know what they’re supposed to be doing. And a lot more of them are taking those frameworks and implementing them into their own organisations, and they’re using the risk assessment management approach a lot more than just checking the box for whatever compliance, so it’s become more holistic. Companies are becoming more educated as to what cybersecurity is and how it pertains to their company, the C level are educating themselves about it, and realising that it’s not an IT problem, that it really is a risk management problem. Even boards of directors are bringing on people with security experience to advise them. It’s becoming more mature and more known in companies. 

The way that I see this going for the cybersecurity profession is that cybersecurity roles are going to become more focused and better defined. I think that the workforce framework is going to really help with that. We won’t have cybersecurity professionals being asked to perform three or more roles, so the firewall administrator isn’t also expected to be the database administrator, they’re just strictly the firewall administrator. A lot of the burnout we’re having in the profession is that we were expecting our professionals to wear many different hats that are very different from each other. From an education perspective, we’re going to start having more places of education with a wider variety of more mature cybersecurity degrees and training programmes to choose from. I’m hoping that by that time, cybersecurity will be its own separate department with its own head that then reports to like the CEO, or legal or something that makes a bit more sense than like the CIO. 

From a vendor perspective, it’s going to keep growing, we’re going to get more tools and platforms. Because the buyers are going to be a lot more sophisticated in their knowledge of threats, vulnerabilities, control frameworks and how it pertains to their domain’s responsibility, they’re going to be a lot more discerning and selective in their purchasing decisions. They’re going to be looking for products that fix a specific problem, which then will force the vendors to start focusing on the core functions of their products instead of trying to build them all-in-ones. Vendors are going to have a harder time getting people to buy the shiny new thing, because the sophistication of the buyers will be much greater by that time. 

To hear more about the future of the cybersecurity industry and Isabel’s unique perspectives, listen to the full episode of The Cyber Security Matters Podcast here.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On Episode 3 of The Cyber Security Matters Podcast we were delighted to be joined by Caleb Barlow. He’s an entrepreneur with a technical background and he’s equally comfortable presenting at TED talks or primetime news as he is consulting the board of a major health care provider. As VP of threat intelligence at IBM, he built one of the largest incident response platforms, including the world’s first immersive cyber range. He went on to be President and CEO of supply chain security business Redspin, helping them become the DoD’s first approved third party assessor, at the same time as taking the helm at parent company Synergist Tech, a cyber services firm with an emphasis on health care. He’s currently heading up his own business, Cylete, where he advises private equity firms on the right cyber businesses to target. It’s an impressive professional history! 

We covered topics from diversity in the industry to the ways that Covid has impacted the landscape of cybersecurity. Here are some of the highlights from that conversation. 

What one piece of advice would you give someone entering the industry?

This is an industry that has a language to it, and you really need to understand that language to be credible. This is an industry where information has a shelf life, because attacks and defences are constantly changing. I mean, this is not an industry that you could easily pack up and leave for a year or two and come back, because everything’s going to have changed. What I tell people is they have to stay informed of the news of the industry every single day. I think of it like Game of Thrones, right? If you’re a Game of Thrones fan, the first few episodes, you have no idea what’s going on. It takes a season or two before you start to get that all these things are connected. I think the cybersecurity industry is the same way. Whether it’s through the cyber wire or your podcast or a threat feed, you have to stay informed about this stuff, and you have to do it every day. What I’ve always said to my teams is that if you haven’t read the news, don’t come into work today. I test because if you don’t know what the latest attack was and what it means, and you get asked by a customer, you’re totally not credible.

How has the term critical infrastructure broadened in recent years?

I think we need to redefine it. When most people talk about critical infrastructure, they refer to health care, energy, finance… It’s a very World War Two mentality in terms of ‘what is critical infrastructure’. Let me ask you this, at the start of the pandemic, what did you really need? I don’t know about your household, but the critical infrastructure in my household was getting access to goods and materials during a supply chain crisis and being able to communicate with friends and colleagues and being able to send my kids to school. One of the things we have to do is realise that the pandemic brought us a whole new way to work and a whole new way to educate, so our critical infrastructure has to change. We’ve got to look at cloud providers like Microsoft, Amazon and Google; that’s critical infrastructure. Now, we’ve got to look at things like zoom, which is how my kids went to school and how I went to work. It’s an absolutely critical infrastructure. I couldn’t care less about my phone system, I need my Zoom. Suppliers that deliver things like Amazon and Instacart and large retailers that were able to keep supply chains moving like Walmart – they were critical. A lot of what we have to do is really rethink how we think about critical infrastructure and what critical infrastructure is. 

You’ve made high profile media appearances over the years and also specialised in consulting the C suite on information security, is there a major or unifying message that you strive to get across?

It’s really all about having a capability model versus just having procedures and documentation. You need to build capability in four key areas. The first is obviously cybersecurity skills and incident response. Number two – and this is surprising to most people – is communication skills. If you don’t know how to communicate internally, externally, with your partners and with your customers, things aren’t going to end well. If, during a crisis, you can’t communicate what to do, people are going to fill that void with their own speculation. I would argue that the vast majority of high profile breaches we’ve seen over the last 10 years are down to poor communication. Lacklustre communications in decision making causes more damage than the threat actor in most companies, because people either don’t communicate, which is a decision in and of itself, or they communicate bad data, not knowing what to say and how to say it, or they go sideways with regulators. The third area you need is legal, and the fourth capability you need (and this is the tough one), is business resiliency skills. On any cybersecurity response team, it is critical to have business skills that can understand what can the business handle, what alternatives might we have and how could we stand up the business in another way. Our threats aren’t any different than a fire or a flood or a natural disaster. You have to think about resiliency if you can’t get access to your IT systems.

What do you see as the prospects for cyber during the next decade? 

The simple fact of the matter is that we are still in an industry where we do not have enough people to fill the open jobs. The need for those skills only continues to grow. We are starting to solve some of the problems though, we’re starting to become a more diverse industry, which is great. Some of the pipeline of getting skills is starting to get solved, but like any industry, the next round of innovations may, in some cases, be repeats of things we’ve seen before. Ultimately what I do think we’re likely to see now is kind of the second generation of companies starting to step in. A great example of this would be as the EDR market moves to XDR, we’re starting to see the next generation companies coming in and solving the same problem but with a very different business model. Like any industry, those optimization companies will probably be the ones that win in the long term as the industry turns over.

To hear more about the future of the cyber security industry, tune into the full episode of The Cyber Security Matters Podcast here.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In our second episode of The Cyber Security Matters Podcast we sat down with intelligence specialist AJ Nash. He is the VP of intelligence for external cybersecurity company ZeroFOX, and he spoke to us about his journey through the Intel sector and how that’s lead him to where he is today. Read on for his perspectives on accessing the cyber security and intelligence industry. 

How did you first get into the Cyber Intelligence industry?

That’s a good question, and like a lot of people, I didn’t have a straight path. It wasn’t intentional, but I frankly don’t know if there’s a single thing in my career that’s got me here. I originally joined the Air Force, my intent was to be a police officer and go to law school, and my test did relatively well. I was in the Air Force for nine and a half years, then I medically retired and moved into defence contracting. And so I started doing traditional Intel work in counterterrorism, counterinsurgency, things like that. 

I was recruited for an opportunity. I had an interview with a defence contractor, and I literally interrupted them about five minutes into the interview, and said ‘I think I’m in the wrong room’, because all we were talking about was maths, science, computer science, operations research and cybersecurity. I didn’t know anything about most of the stuff. I told them ‘I’m an intel guy, where’s the terror? Where are the bombs?’ And they said, ‘No, no, we got people for all these things. What we need is some intel folks, we’re trying to build a new concept for how to do intel analysis specifically for cyber, and we need to have experts. We need people who can translate this to make sure this is useful.’ That ended up becoming what we called at the time cyber intelligence preparation of the battlespace. 

It was a great opportunity, and I accidentally got into cyber and helped work and develop that programme with amazing, smart, brilliant people. I was one of the folks who helped write the book along with my five or six colleagues. A couple of folks did the training. This ended up becoming foundational training for contracts at NSA and Cyber Command for a lot of cyber work. And so I learned a lot from a lot of people much smarter than myself. And that’s how I ended up in cyber, which was very much accidental like I said. So you know, from a career standpoint, it’s great to do terror and terrorists, there was certainly funding there, and then you go into cyber and it was a lot of funding there too. And so that led to a career doing cyber intelligence work at the agency and cyber command. I went into the private sector also by accident to be honest. A friend of mine convinced me to join LinkedIn, although I had never had a social media account for obvious reasons with my career, I would have been immediately compromised. That was always fun! But somebody recruited me through LinkedIn, and I moved to the private sector. 

I had a really winding path from a kid who’s gonna be a competent lawyer to a guy who does cyber intelligence work with one of the greatest companies in the world. So I’m a lucky guy, they say you put yourself in the right position. Maybe I own a little bit of it, but people have helped me along and I’ve just ended up in really good spots. 

We talk a lot about barriers to entry into cybersecurity. Is security intelligence still a good route into the industry? 

I guess it was for me. Intelligence is enduring, Intel feeds everything. I don’t think it’s going anywhere, so I think it’s a great way to work in this industry. I don’t know if it’s the easiest way to get in, necessarily, but for folks who are coming out of government and military we’ve already got the background and experience. That’s actually where private sector companies probably should be hiring their first Intel leaders. For those who are in university right now, wondering ‘how do I get into cyber?’, it may or may not be the easiest route, because again, only maybe 10% of companies out there have Intel teams, but there is a lot of demand. So if they’ve done the research, if they’ve got the education to back it up, and they can make the pitch, there’s opportunity there. But I also think there’s nothing wrong with somebody who’s coming in and wants to be a SOC analyst or do threat hunting or incident response, they’re all great ways to get in, as long as people understand those are different careers. If you want to transition from one of those to Intel, it isn’t just changing a title and moving desks. There’s some study and work that needs to go into that. From what I’ve seen, most folks who are getting into cyberspace are not coming in through Intel.

Is diversity improving within cybersecurity?

I think diversity is better now than it was, but we have a long way to go. So you know, I think if you go look at any panel discussion, chances are you’re gonna find four white guys on it. If you look at most Intel teams, most cyber security teams, the majority of them are likely to be white males especially in the US and UK areas. But I do think it’s changing. Our teams are great – we have three senior directors on the team, two women and a guy. They do all happen to be white, but one was an immigrant, so we’re not all Americans. I think part of the challenge is the talent that we still have to grow, right? There’s still a challenge in many ways, women are still not being encouraged enough as girls to go into STEM, so there’s still a lot of cultural challenges. The trouble we have is where do you hire the people from if they don’t go through the funnel, if we don’t build people with these skill sets? I think we really need to encourage young people, all ages, races, genders, to, you know, to embrace technology and embrace these opportunities. And we need to put funding in place for them and give them opportunities to do it so that we have more diversity across the board. So that’s a challenge. For people in my position, if you’re hiring folks, you have to keep in mind, I don’t want 10 people on my team that are the same person 10 times over. There’s a value to it for the team standpoint. I think a lot of folks are putting a lot of effort into this. But it’s hard, and it’s a long way to go. So better, yes, but not nearly good enough yet.

You mentioned a few really interesting things there about potential barriers to entry into the sector. So what would you say are the barriers to entry? And what practical steps can we take to reduce those?

Access to education is a barrier. I’ve talked about this around the world. There’s a privilege that I’ve had to get where I am, and certainly access to education has been there. I think we have to develop programmes that give people opportunities, regardless of their socio-economic standing. There are there are great programmes that do these things, other mentorship programmes, and there are other education programmes, that give people some of these options, but we need more of that. We’re seeing at least in this industry a move away from the bias towards everybody having to have a degree. Certifications are really valuable, and being able to demonstrate you have a skill is really valuable. On the other side, I know self taught people who are brilliant but they have a hard time getting the interview. I think folks are trying to do a better job of saying, ‘let’s get them in the room. They say they can do things, let’s test them out.’ We can be more creative in our education, but also much more creative in our hiring. 

I think that the biggest barrier to entry right now is still having the resources, funding and opportunity to get the education, skills or certifications needed. We then need to have the creativity on the hiring side to look beyond a paper and a resume and say, ‘who is this person? What do they bring to the team? Can we give them a position and a shot?” That is tough because we’re for profit companies, and a lot of companies don’t want to invest in training, they would prefer to hire somebody who’s plug and play, because it saves them time and energy and money. I think we have some challenges to solve in that area as well, especially as we keep saying that we’re 3 million people short in cybersecurity, and the number goes up every year, so it’s gonna take a collective effort to get there. Some of that might involve the industry buckling down and saying ‘we’re gonna hire people we know are qualified, we’re going to train them up.’ I think we’re seeing some of those areas improve as well.

What one piece of advice would you give to someone who is entering the cybersecurity industry? 

My one piece of advice is to be bold. I think a lot of people self-select themselves out of opportunities. Confidence is a challenge. Imposter syndrome is real – I can attest to it. I think be bold, and don’t undersell yourself. If it’s something you think you can do, and you want to do it, even if your resume says nothing about it, try to throw your hat in the ring, Try to get into the interview, try to have a discussion. The worst thing that could happen is you’re right where you left off. You gotta go do the thing, right? Try to get in there and find a way and be persistent with it. If you don’t get it one time, try another time, you know, talk to people. That includes things like just reaching out to somebody on LinkedIn. Don’t stop yourself by thinking ‘that person is really important, they don’t have time for me’. Reach out! That’s how I did a lot of it. I built a lot of my connections just by saying ‘let’s have a conversation’. Now people do that with me, I have had tons of folks reach out to me. They always seem surprised when I answer and I say ‘yeah, let’s have a conversation instead of a call.’ And people seem shocked by that. Listen, I’m not that important. I’ve got time for you, and if it’s something I can help with I will. I think a lot of people think that these people with these great titles and great roles and great amazing things won’t be interested. But you reach out, and you realise they’re awesome, and they’re happy to talk to you, they want to help. If you’re not bold, you don’t ask the question. So what if they don’t answer and move on to the next person? A lot of them will, though. People want to help each other. My best advice is always to be bold. 

To hear more from AJ Nash and other industry experts, tune into the Cyber Security Matters podcast from neuco here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In episode #77 of The Tech That Connects Us, we were delighted to be joined by John Spiegel, CTO at Axis Security.  

In this episode we unpacked everything from his career trajectory through to the nitty gritty world that is cybersecurity. 

We hope you enjoy this episode as much as we did recording it. 

What challenges does the internet being the network now create in the cyber security space? 

“Oh, my, the internet really is is the is the is the future for connectivity.  

And it’s good and it’s also bad. The good is that you have this ubiquitous connectivity out there that for the most part is is inexpensive.  

If you think about the cost per megabit of an internet line versus an MPLS line, it’s significant. And, as a result, it’s enabling this incredible amount of productivity from companies. 

You don’t have to do constant maintenance, or patch upgrades, and the ability to access that from anywhere is amazing. But, on the other hand, we have this challenge of if businesses can get to any application at anytime, anywhere.  

The same thing is true for the bad cyber actors, you know, they can easily get into your network. Maybe because you misconfigured everything or something or maybe you know, you left something open. And that’s that’s a huge challenge.  

What I’m excited about is this rise of this concept called zero trust. And I know there’s a lot of marketing around it.  But it’s probably, in my mind, the most important thing that has happened. we had an opportunity to interview interview John Kinder bog a few days ago, he was one of the fathers of, of zero trust.  

And, his whole journey started because he started working on a pix firewall. And, he did not like the concept that there was one side that was untrusted and one side was untrusted. And he’s like, “come on, this is a computer. A computer is not a human.” You know, we built a society built on trust.  you know, we trust one another that, you know, when you pay for something you trust that person.  

Every interaction you do is built on this concept of trust. Computers don’t understand trust, they are built of silicone, rare metals, and they think in zeros and ones, trust is not a concept for them. So, that kind of started sparked him on this journey of zero trust.  

And if you think about how wins are built and what I did with SD win what I did in my past, building out these networks, these global networks for Columbia, sportswear and others.  

And I spent my career building these these artefacts, artefacts of of trust, and to me that was completely wrong. I should have gone a different way. And I think the future about branch connectivity is not good. it’d be about interconnections between a branch and, and a location, it’s going to be about building islands.  

Essentially companies are going to be building these islands. And the connections going out are going to be these almost you could say “zero trust” connections out to a SaaS application, or it’s a remote worker. Those sorts of things!” 

To listen to the full episode, click here. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In episode #69 of The Tech That Connects Us, we were excited to be joined by Chris Strand, Chief Risk and Compliance officer at CyberSixGill. 

With 20 years of experience, he’s a subject-matter expert in cyber risk and compliance and a regular conference speaker, most recently holding a Chief Compliance Officer role. 

Earlier in his career, Chris founded and built the global compliance and risk strategy arm of carbon black, which became a fast-growing and critically important business unit. 

We hope you enjoy this episode as much as we did recording it. 

How has the relationship between risk compliance and securities changed over the past few years?  

I’ve experienced the good and the bad with this – a bit of both. I would say, “they’ve” – and it’s not by choice, but they have converged. And this is where I say there’s the good and the bad. There are a lot of folks in the industry that for obvious reasons, see the Risk and Compliance angle as a negative thing.  

And I understand why –  they’ve grown together, out of necessity. You fast-forward to today, and there are a lot of regulations, in fact, there’s too many regulations and frameworks, it’s confusing and mind-boggling. But, it’s still a necessity. 

Look at the state of the security industry right now. I mean, we’re under a barrage of threats, they’ve grown more than I could ever imagine when I started out in my career. So, you know, with that, you can observe almost a 45-degree angle of increase in the number of regulations, frameworks, and mandates; the privacy laws that we see  the national and regional types of mandates around privacy and data that have grown. So, they’re all in one place, because we have a need to try to measure our effectiveness to protect that data.  

And again, I don’t view it as a negative, but sometimes it is a negative because we’re under such threat, right? It’s sort of like, why do you have five locks on your door now, whereas, you know, 10 years ago, you only had one – and now we do this because there have been more break-ins, it’s the same thing. We don’t like to see the world becoming a more dangerous place.  

How have you found getting back into things such as conferences?  

So, I found it extremely refreshing. I think most of us are social creatures. And I actually tend to be a very introverted person. I’m uncertain if that would surprise people because I love being in front of people, but on the other hand, I am a bit of an introverted person. So, it’s sort of a weird mix. But,  since I’ve been able to get out in back into the public, back face to face and speaking with people, I can never look back.

I mean, it’s the most refreshing thing I’ve ever experienced, and a very surprising feeling as well, it was a euphoric feeling at the time! 

What has the ubiquity of cloud platforms and services for enterprises meant in terms of risk management? 

It’s thrown a wrench into risk management for sure. Because the accessibility of the cloud alone, I mean, there are so many security themes that we can talk about such as the move to the cloud, and what’s happened over the last five, six years or so. It’s definitely created a lot of stress for risk managers that are trying to work with what they used to see as closed systems.  

But one of the main themes that have become a huge thing and has helped evolve and create a lot of data privacy laws is the fact that data now is much more accessible than has ever been with the cloud.  

Now, that data is way more accessible, there are so many different threat vectors to that data that we’ve never ever had before we’ve never had to deal with. So, it’s made risk managers’ lives much more difficult, because there are a million more variables that you have to consider when you’re measuring the threat to that data.  

What major lessons do you feel that organisations need for this decade to better manage risk and compliance? 

When I think of lessons, it’s hard for me to say what a particular lesson is because I don’t want to sound like I’m preaching to organisations, and to say, you know, you should have learned this, you should have been doing this from day one etc.  

But I do think that there are a few lessons that we can look at. And one of the big things is, and this is very hard to talk about with different businesses is the transparency of their business process.  

The more transparent you can be with how secure your data is, the easier it can be to find faults. But, you’re basically asking someone to talk about their weaknesses.  

And businesses think “I don’t want to make it sound too weak”. Because, hey, if I’m an assessor, and I’m in an assessment with a retailer, let’s say, you know, and I’m asking them, where are all your faults and such? They’re thinking, Hmm, I don’t know if I want to tell you this. Because the minute I do, what if this gets out? What if I don’t trust this individual? Right? What if we don’t have a trusting relationship between us, and this gets out, and my brand gets damaged.  

But, the lesson is to be transparent as it’s done good for many organisations. 

To listen to the full episode click here. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In episode #69 of The Tech That Connects Us, we were excited to be joined by Chris Strand, Chief Risk and Compliance officer at CyberSixGill.

With 20 years of experience, he’s a subject-matter expert in cyber risk and compliance and a regular conference speaker, most recently holding a Chief Compliance Officer role.

Earlier in his career, Chris founded and built the global compliance and risk strategy arm of carbon black, which became a fast-growing and critically important business unit.

We hope you enjoy this episode as much as we did recording it.

How has the relationship between risk compliance and securities changed over the past few years? 

I’ve experienced the good and the bad with this – a bit of both. I would say, “they’ve” – and it’s not by choice, but they have converged. And this is where I say there’s the good and the bad. There are a lot of folks in the industry that for obvious reasons, see the Risk and Compliance angle as a negative thing. 

And I understand why –  they’ve grown together, out of necessity. You fast-forward to today, and there are a lot of regulations, in fact, there’s too many regulations and frameworks, it’s confusing and mind-boggling. But, it’s still a necessity.

Look at the state of the security industry right now. I mean, we’re under a barrage of threats, they’ve grown more than I could ever imagine when I started out in my career. So, you know, with that, you can observe almost a 45-degree angle of increase in the number of regulations, frameworks, and mandates; the privacy laws that we see  the national and regional types of mandates around privacy and data that have grown. So, they’re all in one place, because we have a need to try to measure our effectiveness to protect that data. 

And again, I don’t view it as a negative, but sometimes it is a negative because we’re under such threat, right? It’s sort of like, why do you have five locks on your door now, whereas, you know, 10 years ago, you only had one – and now we do this because there have been more break-ins, it’s the same thing. We don’t like to see the world becoming a more dangerous place. 

How have you found getting back into things such as conferences? 

So, I found it extremely refreshing. I think most of us are social creatures. And I actually tend to be a very introverted person. I’m uncertain if that would surprise people because I love being in front of people, but on the other hand, I am a bit of an introverted person. So, it’s sort of a weird mix. But,  since I’ve been able to get out in back into the public, back face to face and speaking with people, I can never look back. 

I mean, it’s the most refreshing thing I’ve ever experienced, and a very surprising feeling as well, it was a euphoric feeling at the time!

What has the ubiquity of cloud platforms and services for enterprises meant in terms of risk management?

It’s thrown a wrench into risk management for sure. Because the accessibility of the cloud alone, I mean, there are so many security themes that we can talk about such as the move to the cloud, and what’s happened over the last five, six years or so. It’s definitely created a lot of stress for risk managers that are trying to work with what they used to see as closed systems. 

But one of the main themes that have become a huge thing and has helped evolve and create a lot of data privacy laws is the fact that data now is much more accessible than has ever been with the cloud. 

Now, that data is way more accessible, there are so many different threat vectors to that data that we’ve never ever had before we’ve never had to deal with. So, it’s made risk managers’ lives much more difficult, because there are a million more variables that you have to consider when you’re measuring the threat to that data. 

What major lessons do you feel that organisations need for this decade to better manage risk and compliance?

When I think of lessons, it’s hard for me to say what a particular lesson is because I don’t want to sound like I’m preaching to organisations, and to say, you know, you should have learned this, you should have been doing this from day one etc. 

But I do think that there are a few lessons that we can look at. And one of the big things is, and this is very hard to talk about with different businesses is the transparency of their business process. 

The more transparent you can be with how secure your data is, the easier it can be to find faults. But, you’re basically asking someone to talk about their weaknesses. 

And businesses think “I don’t want to make it sound too weak”. Because, hey, if I’m an assessor, and I’m in an assessment with a retailer, let’s say, you know, and I’m asking them, where are all your faults and such? They’re thinking, Hmm, I don’t know if I want to tell you this. Because the minute I do, what if this gets out? What if I don’t trust this individual? Right? What if we don’t have a trusting relationship between us, and this gets out, and my brand gets damaged. 

But, the lesson is to be transparent as it’s done good for many organisations.

To listen to the full episode click here.

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

In episode #62 of The Tech That Connects Us, we were excited to be joined by Hash Basu-Choudhuri. He is the current GM at Cribl, and has held advisory and senior roles across the world, mostly in the EMEA region. 

We touched on his career so far, as well as specific topics around data challenges, crypto, and D&I.  

We hope you enjoy this episode as much as we did recording it. 

What would you say are the major IT data challenges currently facing enterprises and government? 

“Just complexity, look at the rate of change, I think if you look at the rate of change from 2000, it was not that high. Things weren’t being innovated at the rate they’re being innovated today.  

The problem today is that every three years there’s a new cycle riding. You had the mobile cycle, the cloud cycle, now you have the container cycle. And now, we’re moving into completely trustless environments using blockchain technology.  

Airbnb disrupted travel, and not even seven years later, Airbnb is probably going to get disrupted by blockchain! I think the biggest challenge is that.” 

How has the UAE handled COVID differently to other parts of the world? 

“This is a great question. So, this has literally been a business case study in probably how to do it right. The UAE has looked at the impact, looked at the facts, looked at the science, and been ahead of the game.  

I deal a lot with Emirates Airlines and Dubai airports. I would say 70 to 80% of the world’s vaccines fly through Dubai, because they’re manufactured in India. This is their distribution hub. And then from here, Emirates Airlines repurposed god knows how many planes into vaccine carriers. And then from here, they’re distributed globally. So, they’ve got the distribution for the world sorted.” 

What novel cybersecurity challenges does the growth of cryptocurrency prevent present? 

“When you’re talking about cryptocurrency, it gives you immense power, you do not have to trust the third party, there is no centralised system. But the problem with security from a blockchain perspective is that you are responsible for your keys, for your wallet, for your assets right now.  

Sounds simple, but how do you secure it? You just have to be very, very careful with the way you manage such assets. There are a couple of tech players out there that are trying to solve it with escrow accounts, and the ability to have extensive multi-party certificates.” 

What is your assessment of how well tech industries are tackling diversity? 

“So for me, obviously, you know, I fall into that category. But for me, it’s not about this, It’s about the diversity of thought. My background is not going to be exactly the same as your background.  

But, if you can attract talent and have multiple different mindsets, it’s good for business. Look at your target audience, which is the world, right? If you want mass adoption, it’s everyone. So, you kind of have to mirror that. And you can’t mirror it if you don’t have a diversity of thought.  

I think a lot of these companies are leading with just hard metrics. And it’s like a sales process, right? You can do metrics one, two, and three, and you don’t do anything at the end of that, right? When really, it’s the way you interpret that data. It’s the way you apply it. And it’s really what you do with it once you have met those targets.  

I think a lot of companies are just laser-focused on “we need to have this many Asians this many, you know, blah, blah, blah” right. And I don’t particularly like the topic because I think it’s an over-rotation, it should always be merit-focused. And it should always be diversity of thought that you get from it over anything else.” 

You can listen to the full episode here.

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

What’s in store for the Cyber Security industry?

2022, where’s it going to go, what does it have in store?

We’ve collated key trends from some of the influential figures across the 4 sectors we recruit into – Cyber Security, Connectivity, Content & Media and Satellite & NewSpace.

We’ve spoken to experts from companies such as Sky, Orbit Fab, Casa Systems, and A5G Networks.

If you want to find out what we think will be the key trends for cyber security this year, then just click the link below to download now!

Click here to download now.

Joining us for episode 50 of The Tech That Connects Us was David Brown Vice President and General Manager, International Sales – ZeroFOX. We heard his insights on the OT domain – where he’s headed up both IPOs and acquisitions, what really keeps CISOs up at night, alternative models for industry events, how to recognise the potential in new hires and that’s just the tip of the iceberg.

One question Jake Sparkes and John Clifton put to David was ‘What does the threat landscape look like right now for OT?’ Here’s what he had to say.

“There’s no doubt that there are more types of attacks now on OT. We’re seeing ransomware popping up a lot more commonly, or at least we’re hearing about that more now. 

One of the interesting bits about OT is actually when you look at the infrastructure it’s built on. I’d still say that Windows NT and XP are probably the most prevalent operating systems in an OT environment around the world. 

So what does that mean? It means that there’s a tonne of exploits available straight off the internet, you don’t need to be that smart. But if you work up through the levels of sophistication and if we’re talking about large organisations they’ve got quite a sophisticated security posture. 

The two things that I think are really interesting at the moment in that space is the consolidation of the technology to see what’s going on in your OT network. Because if you are a CESO or an information security director then you’ve got more flashing lights than you know what to do with. You may also have an ageing workforce without the domain expertise to understand what’s going on. 

So I think there’s going to be a bigger drive for how do you consolidate all that stuff into a single pane of glass, there’ll be a drive to provide either AI or a managed service that provides recommended actions and remedial work for the top three to five actions that the organisation needs to be focused on. And those actions will be evidenced by what’s going on outside in the rest of the world. 

The second thing that’s of interest at the moment is risk. So you’re seeing now there are new bills going through in the US, and CESOs are looking at what’s the risk across all of my platforms IT and OT. A drive for this is that it’s not been so easy to understand what’s going on with OT, because you’ve had all these flashing lights and an unconnected system, with a lot of tech but it’s just not connected.  

The reason they want to know what their risk is because there’s also a developing insurance market where a number of insurers are getting together and looking at how they can take IT and OT cyber risk and turn that into a sellable product. When we look at the potential of that market it’s probably 30-40 times the size of the complete OT market. What I can see we will get to in the next 2-3 years is a similar system to the black boxes currently being used by vehicle insurers, so you’ll have a premium and it will vary depending on your attitude to risk and your controls that are in place across the whole estate. That then allows organisations to make an economic decision because you might say I will stand the increase in premium which justifies me doing these things across my plant. 

This then becomes a very much return on investment decision. It’s not about fear, uncertainty and doubt it’s actually about economic imperative.” 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Joining us on episode 47 of The Tech That Connects Us was Trish Cagliostro Head of Worldwide Alliances at Wiz. Trish joined Laurie Scott and Andrew Ball. They only scratched the surface in a conversation that spanned Cloud Security, threat intelligence, the partner landscape, Cyber’s diversity challenge, the joys of softball and much more!

Trish is a thought leader in the cyber security industry, so whilst we had her on the podcast we needed to find out if the industry was getting cloud security wrong as is mentioned by commentators in the industry. Here’s what Trish had to say. 

“Cloud security is hard. It’s hard and it’s a little bit different from what the rest of the industry says. Cloud security isn’t so much of a problem for the born in the cloud companies, such as Netflix, they’re fine. Where this does become an issue is when a traditional enterprise goes to the cloud. Organisations go to the cloud for innovation, the costs savings are nice, but it’s the elasticity and the ability to endlessly expand and instantly expand globally that is powerful. 

However, the way these traditional organisations go to the cloud typically looks like this. They look at their applications on-premise, they go with what’s easy and upload some VMs into the cloud and expect to take their on-premise security structure with them. 6 months then go by, and the customer is thinking that they can’t innovate and they aren’t saving much money. So they want to look at what they can do differently from here. They’ll then start to refactor some of their applications, containerise, embrace some more modern application architecture, replatform and kick the Oracle legacy databases to the curb. 

Now the organisation will have a stopping point on their cloud adoption, they have their legacy on-premise tools supporting the legacy workloads. So now they need to go out and use some cloud-native services as all the cloud providers have cloud-native services. But they’ll have some very different types of computing that are very different in the cloud than they are on-premise. Then there’s the idea of a managed service which comes with the complication of the shared responsibility model. So at this point, the company will be looking at different tools from different vendors for niche cloud security. This is where the breach happens, all of a sudden, there are three separate data silos, the traditional on-premise tools, the cloud-native services from the cloud providers and the new types of security tools that were brought in to deal with the new types of cloud computing. 

So now these organisations still can’t innovate, they’re probably spending just as much money as they were in the first place, Then the cloud provider comes in and says ‘let me tell you about serverless’. The whole model is then broken. So in this instance, I don’t think it’s fair to blame the cyber security industry. It’s a shared responsibility between the industry and the customers as well, to think differently about security in the cloud. 

I meet with partners all the time, and they’ll say to me ‘Okay got it, it’s the same way we dealt with data centre security. But you can’t think that way. You have to think of a customer and the entire cloud journey they’re going on, and then understand how to build a security strategy that supports them across that. 

The other part of this is beyond just helping them with the security strategy and explaining that the customer will need to have an unusually long term vision with this and that we need to be transparent, understanding and really dig into what we’re doing in the cloud. A lot of time to the customers it’s not obvious, they’re normally using a managed service and think they’re good. You need to have a clear understanding of what your responsibilities are as a vendor, then make sure you have the controls and mitigation in place to account for what’s really important.  

I really do think that when we think about this we can’t just think about it in phases, we have to think about it holistically through the journey. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

On episode 42 of The Tech That Connects Us John Clifton and Jake Sparkes were joined by global Cyber marketing expert Reuben Braham. 

In the episode, we heard Reubens thoughts on the marketing trends that are emerging in the cyber industry. 

“Anything that we talk about regarding marketing trends, is actually a bit different to what we’d be talking about 18 or 19 months ago before we had the COVID 19 pandemic. 

Before the pandemic, it was different because we could travel and meet people face to face and be present. What I’m seeing now is that the world is ready for a more hybrid model of business, so our marketing needs need to focus on gearing up and being part of the virtual events and conversations, we’re having over Zoom right now. It’s something that is now more acceptable even for business meetings with CEOs, CMOs etc. So, we have to be ready for a hybrid business model.  

On the other side, we need to understand that people are going to be hit with a lot of virtual requests and that ‘Zoom fatique’ is real. All the different vendors and suppliers will want to have virtual briefings which will start to take its toll on our customers. 

The best strategies I’m seeing currently are around creating thought leadership content that can be circulated to your target audience, companies need to be building more blogs, building more thought leadership content and educating your market. 

When you’re building content you should be focusing on your perfect customers, understanding their pain points and doing your best to help them by being consultative with your approach. 

As a marketing department, you must be doing targeted research, and then use an account-based marketing approach, not just a shotgun approach trying to hit everybody. If you can build a library of very good content that can educate your audience and continue to educate them then that’s something that will have a massive impact on your business. 

In my first 6 months at Cyberint, our first task has been to build up our content library, I really believe that creating great engaging content will work wonders for not only engaging with your current and potential clients, but it’ll really help with our website SEO. Once you’ve built up that library of content potential customers will understand that you’re a player in the marketing, and they’ll start to differentiate your business from the competition.  

Virtual meetings and virtual events are starting to have their toll on people, and people would rather consume content at their leisure rather than at a set time. 

There’s also a lot to be said too for building out good automation and allowing 70-80% of your customers journey to be done through marketing automation. The more content you can give your potential client the more they’ll know about you and the more they’ll see you as the business to work with over your competition.” 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Investors have been chomping at the bit so far in 2021, creating a record-breaking* 12 galloping Unicorns to fight global cyber criminals.

Most recently, the end of April saw Vectra AI join the club, winning $130M in their latest funding round and a valuation of $1.2B.

In other news, UK stallion Darktrace went public, after a very thorough examination of its dental records.

*“A record was set in the first quarter of 2021, with 12 cybersecurity unicorns created globally, which is more than double the previous quarterly ” PitchBook (Private market data provider)

Vectra gains $130M funding and $1.2B valuation

Vectra AI, a cyber security, threat detection and response firm has announced an additional $130m round of funding.

---

Darktrace shares jump 32% in IPO

Cambridge-based cyber security company Darktrace and its backers raise £165m in London debut.

---

A unicorn on steroids

Wiz raises $130 million series B to reach $1.7 billion valuation a year after its launch

---

Aqua Security hits unicorn valuation after completing $135 million series E

The Israeli cybersecurity company has stayed ahead of the cloud revolution, refuses to be sold and has it eyes on some acquisitions of its own.

---

Orca Security raises $210 million, becomes ‘unicorn’ with $1.2 billion valuation

Google’s growth fund leads investment in the Tel Aviv-based cybersecurity firm set up 2 years ago by former execs of Check Point Software Technologies.

---

New unicorn Axonius raises $100M to expand its cybersecurity asset management platform

Cybersecurity asset management startup Axonius Inc. today revealed it has raised $100 million in new funding on a unicorn valuation of above $1 billion.

---

Automation for the people

Snyk raises $150 million at $1 billion valuation for AI that protects open source code.

---

Lacework Banks $525 Million as Cloud Security Market Heats Up

Lacework, a five-year-old cybersecurity company that automates security across enterprise cloud deployments, has reached unicorn status with the closing of a $525 million round of Series D financing.

---

These latest additions mean that there are now 31 Cyber Security Unicorns due to go public.

So what’s behind these huge valuations, is it set to continue – and what does it mean for the Cyber market in general?

Rather than dampen cyber spending, the rapid digitalisation caused by the pandemic has revealed worrying gaps in IT Infrastructure – further exposed by the accelerated move to Cloud and home working.

And it’s this exponential growth in demand that is causing investors to feel bullish and make sure they are on the right side of these major technological shifts.

Cyber is a huge growing market with healthy competition and – so far –  few monopolies to keep a lid on sky-high valuations, so the trend certainly seems set to continue.