Cyber Security Sauna

There are a handful of genuinely useful practitioner insights - particularly the 'if you do your job perfectly you can't justify the budget' paradox and the CISO-as-profit-centre framing - but most of the runtime is consumed by agreeable platitudes about speaking business language and aligning to goals, which any mid-career security leader already knows.

“if we are really, really good at what we do, bad things don't happen. And if bad things don't happen, why am I investing more money in you?”

“every dollar made from that tier, that CISO can say that's attributed back to security”

The airline VPN upsell anecdote as a lived illustration of CISO-as-profit-centre is the most original moment in the episode; the rest recycles well-worn CISO communication advice (speak their language, empathy, align to business goals) without genuinely challenging any of it or offering a contrarian frame.

“CISOs who only focus on regulatory compliance and um, attack prevention, they're not going to survive”

“they had to have had the vernacular to be able to sell that. Right. They had to understand marketing strategies. They had to understand upsell and margins and good, better, best”

Both guests are credible working CISOs who draw on real operational experience - Christine's CEO-background observation about how the CISO title signals 'what did I do?' is an authentic practitioner insight - but neither is identifiably operating at a recognisable company at scale, limiting the weight their claims carry.

“I advise CISOs, and then I also get brought in by CEOs and boards to come in and evaluate security”

“when you ping people, they were like, okay, yeah, so let's talk about things now. When you ping people, they were like, what did I do?”

A handful of real data points (the 9 - 20% annual budget growth figure, the SolarWinds/Uber SEC cases, the 40% time-allocation heuristic) give the episode some grounding, but the vast majority of advice is delivered without named organisations, internal metrics, or documented outcomes from the guests' own tenures.

“it's typically between 9 and 20%. The uh, estimated for the next five years is about 20% increase year over year”

“two big cases, one for Uber and the one that was currently announced towards solar winds”

The host makes a couple of smart pivots - flipping 'speaking their language' into 'listening their language' and pushing back lightly on the doom-and-gloom framing - but broadly accepts every claim without probing for evidence, and the SEC ruling thread is dropped quickly despite being the most substantive policy territory in the episode.

“is there a component here of sort of listening their language as well?”

“you oversold the dark clouds there a little bit”