The New CISO

There are genuine, actionable ideas scattered throughout - strategic debt, the CFO green-arrow analogy, the 30-60-90 plan during interviews, asking about D&O insurance pre-hire - but these are buried under extended CISSP test-reminiscing, book-writing war stories, and the host narrating his own career for long stretches. The insight-to-filler ratio is below average for a 58-minute run time.

“there's a term that I coined some years back, I call it strategic debt. It's kind of the opposite of technical debt. So if technical debt's all the stuff you should have gotten rid of and didn't, strategic debt's all the stuff you should have done 10 years ago”

“I would tell you to write your 30, 60, 90 plan after the second interview. Like, if it looks like it's serious and you're headed down that path”

The CFO green-arrow analogy for exposing CISO board communication failures is sharp and memorable, and 'strategic debt' as a coined framework is a genuine contribution. Most other material, however, recycles standard CISO career orthodoxy: speak the language of business, use carrots not sticks for phishing, build your personal brand.

“If the CFO walked into the boardroom and said, I can't tell you what last month's financials were, but I can tell you that they're, uh, up Green Arrow...He'd be drummed out...We come in and we do that stuff all the time”

“the two big strategic debts that I find almost every organization have are identity governance and data governance. And they're impeding folks now”

Walt Powell is a genuine practitioner with real credentials - ISC2 exam development, authored two niche books, runs a multi-person field CISO program, and has observed dozens of security programs up close. He is not a career conference speaker, but he has transitioned to the vendor advisory side, which mutes some practitioner sharpness.

“I've written a couple of books. I wrote a book called CISO 3.0 about how to be a good CISO basically”

“I'm part of the ISC Squared exam development group now”

Named references to Matt Sharp at Crocs, Gary Fish and Fishnet, John Candillo, ciso3o.com downloadable resources, and a $300 token bill all add texture, but the episode's core advice on board communications, skills gaps, and program measurement floats almost entirely at the conceptual level with no hard data, budget ranges, or outcome metrics cited.

“my friend Matt Sharp, who I worked with back in a former life, became the CISO of crocs”

“I accidentally spent $300 one night and tokens and didn't see that coming”

The host occasionally lands a sharp follow-up ('lose money - unpack that'; pressing on how the four pillars translate to traditional CISOs) but routinely hijacks the floor to narrate his own CISSP experience, book-writing thoughts, and career history for minutes at a time. There is no meaningful pushback on any of the guest's claims.

“Lose money. Like I wouldn't expect that you would...But you say lose money, uh, unpack that”

“can you take or do you recommend These four pillars and one sort of measure into a traditional ciso. Can you overlay that thematically?”