Authenticate This! The Cybersecurity Leadership Podcast

The episode contains a handful of genuinely useful operational insights - the 'no one gets to say no' enablement culture, on-clock learning mandates, PAM session-elevation auto-removal, and a prevention-last security philosophy - but these are buried under extended parenting anecdotes, Primitive Technology YouTube tangents, Ray Kurzweil digressions, and survival-skills analogies that eat a significant share of runtime.

“the rule I've given them is nobody in my organization gets to say no anymore”

“prevention to me is just one of the least important things in my stack now. Response, detection, resilience, far more important in our environment than prevention”

There are a few contrarian positions worth noting - treating prevention as the least valuable layer, and explicitly rejecting the autonomous SOC narrative on talent-pipeline grounds - but much of the episode recycles standard CISO advice (MFA everywhere, get the fundamentals, don't micromanage, take vacation) and well-worn book recommendations like The Cuckoo's Egg.

“prevention to me is just one of the least important things in my stack now”

“the AI will never be able to come up with that gut feeling that we sometimes have in cyber, especially operational cyber, that something just doesn't feel right”

Richard Henderson is a legitimate operational CISO running security at genuine scale - 106 hospitals, 150,000 staff, 250,000 endpoints, 5 million patients - with a credible career arc through provincial government and large vendors; he is clearly a practitioner who has done the thing, not a circuit thought-leader, though his public profile is modest.

“I'm responsible for cyber, all things cyber for 106 hospitals, about 900 other facilities, 150,000 staff, and a quarter of a million endpoints serving approximately 5 million people”

“we're the world's largest single instance in epic”

The episode is notably specific in places - a billion-dollar Epic deployment, 12 years and roughly 12 product launches, the blood-fridge trauma-unit scenario, the Saturday-night SharePoint on-prem response - but lacks financial security-budget figures, improvement metrics, or vendor contract data that would push the score higher.

“we spent close to a billion dollars on our advic install and a dozen years to get to where we are. We had like something like a dozen product launches inside of epic”

“of that 150,000 staff, maybe 5,000 of them are knowledge workers. The rest of them are frontline staff”

The hosts allow Richard to wander into lengthy parenting narratives, survival-skills tangents, and pop-culture digressions without redirecting; there are no challenging follow-ups or pushed-back claims, and Speaker A frequently pivots to personal anecdotes rather than probing deeper; Speaker C lands one genuinely good structural challenge about whether healthcare is actually simpler, but it's the exception.

“It is. It is 9 inches of copy paper that he's.”

“I often joke that I want to go mow lawns at a golf course”