Cult Products

The episode contains substantive ideas about security as business partnering, risk quantification, and governance reframing - valuable for operators. However, it suffers from repetition (the 'crocodile nearest the boat' analogy used multiple times, similar points about assuming positive intent restated), and meandering philosophical tangents that dilute density. A smart founder would extract 4-5 core principles but sift through considerable padding.

“Can we quantify that? Can we be systematic about that?”

“I think the security is the same. Or that CISO mindset should be one of how can I provide? So how am I a solution provider? How m am I a business partner”

The framing of security as business partnership and the legal-team analogy are useful and relatively fresh. However, the core ideas - empathy in security, securing by design, risk-driven decisions, aligning security with business outcomes - are increasingly mainstream in progressive CISO thinking. The episode lacks contrarian takes or first-principles challenges; instead it reinforces existing modern security doctrine without sharp original angles.

“So I think the security is the same. Or that CISO mindset should be one of how can I provide? So how am I a solution provider? How m am I a business partner for the organization”

“If you see a brilliant building that's been designed beautifully, it's accessible for everyone...I think security is the same”

Matthew Tregas is an experienced practitioner with real operational exposure (children's services, manufacturing, cloud-first orgs, bank projects) and has contributed to the UK's Cyber Governance Code of Practice. He is credible and has done substantive work. However, he is not a founder/CEO of a major cybersecurity company, not a public company operator, and his current platform appears advisory rather than scaling a product at venture scale. For a B2B podcast focused on 'founders and leaders shaping the next wave', he is a thoughtful advisor rather than a high-caliber builder.

“I was one of those whiz kit geeky kids in the 80s”

“I was a contributing editor on that NCSE published called How CISOs Communicate with Boards”

The episode includes some concrete examples: the 94% patching metric revealing 6% of critical manufacturing machines unpatched (requiring £85,000 investment), the Google Search Appliance bank deployment surfacing unauthorized access, and the children's services client work. However, many claims lack specifics: no named companies (except Google), no performance metrics on outcomes, no revenue/cost figures beyond the £85k estimate, and frequent abstract language. Statements like 'I see businesses doing good, sensible stuff' or references to 'high profile attacks last year' offer no concrete detail.

“94% of the machines are patched and up to date they've all been 94% of machines patched in the last 14 days...the 6% are uh, some machines that are running in our manufacturing facility...We need £85,000 to upgrade a whole raft of out of date devices”

“Google used to make physical devices...They used to make rack mounted internal servers. Google search appliance it was called...We deployed a couple of these for clients...And one of them we deployed for a bank”

Phil asks good open-ended questions (role of CISO, how to reframe risk as value-add, startup challenge) and occasionally probes deeper ('talk to me about the 6%', drilling into the patching metric). However, follow-up questions are often shallow or allow long monologues without interruption or pushback. Phil does not challenge vague claims (e.g., 'people trick themselves', 'lack of imagination'), does not request specifics when examples are generic, and rarely creates productive tension. The conversation feels warm and collaborative rather than incisive; a sharper host would have extracted more concrete insights.

“Let's just dig into that a little bit. And this is a good example of governance of do people feel able to cross examine or question...Talk to me about the 6%.”

“If I said to you tomorrow morning you're going to wake up with this burning desire to start your own startup in the cybersecurity space...what would be the thing that you would say?”