Our Cybersecurity Mission

The episode is mostly introductory-level vulnerability management content - patching cadences and asset inventory - with a large portion devolving into consumer phishing advice ('don't click') that adds little value for B2B operators. The few actionable data points (patching timelines) are brief and widely known.

“you can't protect what you don't know you have”

“criticals and highs um, will have to be updated within 30 days for most of the major frameworks”

Nearly every point made - continuous monitoring, asset inventory, phishing vigilance, patch testing on a subset - is standard cybersecurity boilerplate. There are no contrarian arguments, first-principles reasoning, or novel frameworks; even the 'we're our own worst enemy' observation is a familiar trope.

“I think the biggest change that I've seen, um, is that it's not as much in the industry that has changed, um, but in the people's awareness”

“we're our own worst enemy sometimes”

Mike Petucci is a genuine practitioner - 25 years in healthcare IT, former Director of IT and CISO - who has done the work on both sides of the audit table, which gives him credibility. However, he is not a particularly high-profile operator and represents a mid-market auditor role rather than someone who has scaled security programs at a notable organisation.

“I've got over 25 years in, uh, healthcare, information technology and security”

“for the last eight or nine years, uh, in that career, I was their Director of Information Technology over all of it, as well as the Information Security officer”

The episode provides a handful of concrete patching timelines (15 - 30 days for criticals/highs, 60 days for mediums, 90 days for lows) and a passing reference to 20,000 reports to 2,000 clients, but there are no named client examples, breach case studies, cost data, or framework citations beyond vague references to 'major frameworks.'

“highs and criticals. Normally between 15 and 30 days should be um, implemented and then you can do, your mediums can go out to 60 days or 90 days for your lows”

“We've issued over 20,000 reports to 2,000 clients worldwide”

The host structures the conversation reasonably but asks predominantly soft, leading questions and offers effusive praise mid-interview rather than pushing for depth or evidence. There is no meaningful pushback, no challenge to vague claims, and the conversation is redirected toward consumer-level advice rather than operator-relevant detail.

“You know it's not very often that we get the chance to sit down with Somebody who has such a wealth of experience”

“How do you maintain um, that impartial kind of non biased attitude when you are going into an audit like this?”