The GC+CISO Connection

The episode is dominated by mutual promotion, network-building small talk, and well-worn generalities about the CISO needing to 'be a business leader.' A small number of practically useful points surface - negotiating D&O coverage at hire, liability as edge-case not norm, the 'three Gs' AI framework - but these are brief and underdeveloped amid significant filler.

“The best CISOs I've seen have legal as their champions at board meetings, at executive meetings. And those folks, they're getting more budget because the legal team's on their side.”

“Bill and I think you should put resilience. Resiliency, their officer. Because the business cares about risk, but businesses are willing to take risk”

Almost every claim recycles well-circulated industry consensus: CISOs need to be business leaders, humility matters, collaboration with GC is important. The CISR renaming idea and the 'three Gs' AI framework are mildly interesting but neither is developed with enough depth or evidence to constitute genuine fresh thinking.

“Are you a firefighter? Are you a builder? Are you a maintainer? Are you a transformer?”

“We need governance around AI... guidance... guardrails”

Andy Land has genuine aggregate intelligence from facilitating 400 - 500 CISO conversations across a four-week series, which is a real and unusual vantage point. However, he is a community organizer and former product manager - not a practitioner who has held a CISO role or led a security programme at scale - limiting the depth of first-hand operational insight he can offer.

“I get the privilege of doing that in 400. Uh, 400 to 500 in four weeks”

“I spent most of my career in product management. And I joke. I spent most of my career in the identity and access management industry.”

A handful of real references appear - Crowdstrike, the Uber and SolarWinds/Tim Brown CISO liability cases, NY DFS, SEC reporting rules, ChatGPT's timeline - but none are examined with actual numbers, outcomes, or lessons drawn in detail. The episode leans heavily on anecdote ('a member in Houston said') without naming companies, figures, or measurable results.

“go back in time a little bit after Uber and then, uh, right after Tim Brown. I can't tell you the amount of members that came to me and said, I don't want to be a CISO anymore”

“I mentioned it today at the roundtable when crowdstrike hit. I think a lot of our members realized how unresilient they were.”

The host's questions are consistently soft, open-ended, and leading ('What does resilience mean to you?', 'What are you hearing from them with AI?'), and there is no moment of genuine pushback or productive disagreement. The episode reads more like two colleagues promoting one another's work than a substantive interview designed to extract insight.

“What are you hearing from them with AI?”

“from the things you're learning from the CISO community. What does that mean to you?”