The Cyber Security Matters Podcast

The episode contains a handful of genuinely useful IR-specific observations - decision authority gaps, tribal knowledge as organisational risk, the data-set ownership angle - but roughly half the runtime is career retrospection, comedy anecdotes, and generic founder-journey advice that adds no B2B operator value.

“no one yet owns incident response as a data set. No one can tell you, well, why did this incident take us four hours to resolve and why did this one take four weeks? That is still tribal knowledge”

“there is a difference between individual skill and organizational resilience...you have like a top decile team...those people can hide a huge risk”

The framing of IR as a structured data layer and the parallel to automated pen testing are fresh and worth hearing, but the core thesis ('response matters more than prevention') is well-worn in security circles, and the startup/VC-to-founder section recycles very standard narratives.

“A tabletop...is basically just a people pen test”

“this goes the way that automated pen testing did a few years ago...they were able to turn a point in time pen test into continuous tested”

Bryant is a credible insider - VP-level VC in cybersecurity, now early-stage founder - but he has not personally managed large-scale incidents or operated as a CISO; his practitioner insight is largely secondhand and the company has only just landed its first customers.

“I started as an investor in the space. You know, I've worked alongside former CISOs building their next big thing my entire career”

“we only just landed customers. Next is how do I build customer success?”

There is one solid data point (IBM's 60-day containment figure), named references to specific companies and individuals, and a concrete regulatory list, but the product's own outcomes are absent - understandably, given the company's stage - leaving much of the IR argumentation as assertion.

“It's about 60 days and that number hasn't moved in the last five years. It's gone from like 75 days to like 60”

“You've got the SEC with a four day disclosure rule. You've got Dora, NIST, SOC2 are all getting stricter”

The hosts ask reasonable topical questions and do follow up on specific tabletop gaps, but there is no meaningful pushback - no challenge to whether Reflex's simulations demonstrably change outcomes, no probing of competitive differentiation, and extended time given to the comedy and career-origin tangents that dilute substance.

“what are some of the gaps that become particularly obvious?”

“how do you see the tabletop market developing specifically over the next three, four, five years?”