Cybersecurity at ViVE Podcast

The episode delivers moderate insight density with some substantive takeaways (compliance vs. security distinction, project vs. program mentality, framework consolidation), but relies heavily on broad generalizations and lacks deep analytical content. While the guest explains HITRUST assessment types and practical recommendations, there is considerable filler around introductions, product plugging, and surface-level discussion without granular evidence or surprising revelations.

“The biggest misconception that I hear, Sandy, is that people think, uh, compliance and security are equal. They're absolutely not. That's probably the biggest myth in our industry. Compliance is really the minimum, right? It is the baseline.”

“The biggest risk in compliance is not failing the audit, it's passing the audit while still being insecure.”

The core insight - compliance is not security - is valuable but well-established in the compliance world and not particularly novel. The project vs. program framing is conventional advice, and recommendations around AI governance and GRC tools are standard industry talking points. The episode lacks contrarian takes or first-principles thinking; it mostly reinforces conventional wisdom.

“Compliance is really the minimum, right? It is the baseline. Now compliance can really help you build a strong security posture, no question, but it does not guarantee one.”

“So the one that treat it like a project. It's your typical organization that is scrambling right before the exam, right? Three months before the audit.”

Srish Badarai is a legitimate practitioner with 9+ years at Align and prior Big Four experience (Ernst & Young), giving him real operational exposure to compliance audits across many organizations. However, he is primarily a service provider/auditor, not a client-side operator who has built security programs at scale from the inside. This limits depth of hands-on insight into day-to-day security trade-offs and implementation challenges.

“So I started my career at the big four, worked at Ernst Young for about three and a half years. Then I did a lot of Sox 404 testing, a lot of SoC1, SoC2 reviews, HIPAA, what have you, internal audit. Then I transitioned over to align in 2017.”

“when I joined though, the hitrust program was just getting started. It was in its infancy stage. We had, I think three people at the time trying to build it because the adoption wasn't as, you know, what it is today. But you know, over the course of the last nine years we really built it to really performing one of the highest volume assessor, you know, certifications in the M market now.”

The episode contains some concrete details (HITRUST versions 11.5-11.7, assessment control counts: E1=43, I1=182, framework names like GDPR/FedRamp), but sparse named examples or real data. The Butterfly Network mention (9 audits in 5 quarters with 5 people) is the closest to a specific case, but lacks granular metrics or deeper analysis. Most claims remain generic without supporting numbers, timelines, or dollar figures.

“E1, 43. Controls i1, 182.”

“Butterfly Network, just for a background, they have completed nine different audits, nine different attestations and certifications in the last five quarters with a team of five people total.”

The host Sandy Vance asks competent questions that follow the guest's points, but rarely pushes back, challenges assumptions, or explores contradictions in depth. Questions are largely confirmatory rather than investigative (e.g., 'shouldn't everybody in healthcare choose R2?' gets a brief directional answer without hard challenge). There is little productive disagreement or follow-up that tests the guest's reasoning.

“Yeah, I mean, that's what I was thinking to myself. Like, shouldn't everybody that is dealing with healthcare Data be choosing R2?”

“So start small and build as your advice on that.”