Man In The Middle Podcast

The episode contains moderately useful business-applicable insights, particularly around CISO-as-a-service delivery models, separating IT from security functions, and aligning security to business objectives. However, much of the content consists of Sash explaining his background, philosophy, and business model rather than delivering novel, non-obvious claims. The CrowdStrike discussion adds little new substance beyond 'technology fails, plan accordingly.' Several sections involve extended anecdotes and motivational reflections that pad runtime without adding density.

“There is a requirement for some steering um, strategic direction within an organization around cyber security. How we can manage cybersecurity risks, but also how we can use that as competitive advantage”

“you can't check your own homework. Um, if I asked any technology function, um, IT department, however you want to refer to it, any technology function, have you deployed a system, some infrastructure, some technology? Have you deployed it securely? If we do that and ask that question 100 times, I'm going to get the same answer 100 times. Yes.”

While Sash articulates some sensible positions - separating IT from security, treating security as a business enabler rather than a blocker, risk appetite frameworks - these are not novel concepts in 2024. The CISO-as-a-service model is somewhat differentiated operationally (unlimited hours, org chart integration) but the underlying logic is not contrarian. The CrowdStrike take is generic ('tech fails, plan ahead'). There is little first-principles rethinking or counterintuitive argumentation; mostly sound professional practice explained clearly.

“Most organizations um, are not, do not exist because of cyber security. Ours does, but most don't.”

“You need to understand that those platforms, much like Crowdstrike, uh, Endpoint, uh product, they will have issues and um, that's not unknown. You, nobody could say that I couldn't forecast a technology issue.”

Sash Vasilevski is a legitimate practitioner with ~20 years in security and defense/federal government experience, plus founder of an active MSP-style firm. He has hands-on credibility and real client exposure. However, he is primarily a service provider/entrepreneur selling CISO services rather than a multi-company operator or transformation leader at enterprise scale. He speaks authoritatively but from a mid-market MSP lens. Not a tier-1 guest (e.g., CISO of major tech company, head of security at scale-up unicorn) but solid mid-tier practitioner caliber.

“I had seen the way information security was being implemented for large organizations. The largest, including the largest in Australia, the Department of Defense. 120 odd thousand employees.”

“We have clients that um, are in the legal space. We have clients that are in the dairy space. They milk cows and create products that consumers love.”

The episode lacks concrete numbers, named examples, and granular case studies. Sash references 'Department of Defense with 120k employees,' 'mid-market organizations between 100 and 1,000 seats,' and a generic anecdote about a contractor gaining 'visibility' - but no specifics on financial impact, timeline, metrics, or named clients. The Microsoft 365 example mentions 'PowerShell' and 'MFA bypass' but no specific breach or cost. The Harbour Bridge analogy and supermarket kiosks are illustrative but not evidentiary. CrowdStrike discussion avoids numbers entirely. Overall reliance on frameworks and soft examples rather than hard data.

“There is a requirement for some, some steering um, strategic direction within an organization around cyber security around cyber security”

“one off to get us to that point. Here is the Ongoing operational, uh, cost of that framework. And here is the market size that we were able to uh, open up because of that.”

Jeremy asks reasonable, logical follow-ups that move the conversation forward (e.g., 'how do you integrate a part-time CISO?', 'why separate IT from security?', 'how do you align security to business?'). However, he rarely pushes back, asks sharp clarifying questions, or challenges claims. When Sash makes broad statements ('technology will fail,' 'risk appetite frameworks'), Jeremy mostly accepts them and pivots to the next topic rather than drilling into specifics or exploring contradictions. The host is competent but not incisive; mostly facilitating a thought-leadership monologue rather than conducting investigative dialogue.

“Yeah. And is that where this um, you know, this concept which has you know sort of gained a bit more traction over the years of um SISO as a service really comes into play”

“Yeah. And how do you find that integration process within an organization?”