The Quality Hub

The episode delivers several substantive ideas about security culture - shifting from negative metrics to behavioral tracking, localizing compliance to departmental contexts, and treating security as continuous rather than post-certification - but relies heavily on repetition of these core themes rather than introducing new framings. The advice is practical and grounded in the ISO 27001 context but not densely packed; there is noticeable filler (affirmations, throat-clearing) that dilutes insight per minute.

“don't look at the training completion rates. That just proves people are uh, taking the training and clicking next. It doesn't show anything about retention”

“you have to stop making it about security and make it about a day to day problem in that particular area”

The core insights - using behavioral metrics instead of compliance metrics, framing security as a cultural issue not an IT issue, and the brakes-on-a-racecar analogy - are sensible but not novel within the ISO/cybersecurity practitioner community. The emphasis on psychological safety and remote-work considerations is somewhat fresh, but the overall framing recycles well-worn security culture language without sharp contrarian takes or first-principles challenges.

“stop measuring compliance, the check boxes and start measuring human behavior”

“Brakes don't exist to make a car go slow. They may seem like they're there to make a car go slow, but in true form, it's so that the driver has confidence to go incredibly fast”

Tracy Baer is a Manager of Audit Services at Core Business Solutions, which positions her as a mid-level practitioner with audit experience rather than a C-level operator or exec who has scaled security at a large organization. She speaks competently about ISO 27001 implementation but lacks the visible track record (founding, leading major transformations, or operating at enterprise scale) that would elevate guest caliber. She is a credible ISO expert but not a standout practitioner.

“Manager of Audit Services here at Core Business Solutions”

“to me as well is something that I discuss in detail with customers”

The episode provides minimal concrete examples and no quantified data. The phishing simulation, home router password, and Excel-to-HR-platform migration examples are illustrative but generic; no specific companies, incident counts, timelines, or measured impact figures are cited. The advice remains at a moderate level of abstraction - useful for ISO practitioners but lacking the granular detail (e.g., specific metrics, timeframes, outcomes) that would ground claims in measurable reality.

“most organizations will track training. They may have a separate spreadsheet in Excel”

“mandatory lock screen times. If a courier knocks on an employee's front door and walks away, the laptop will lock after five minutes”

The host asks reasonable, open-ended questions that invite the guest to elaborate, but rarely pushes back, challenges claims, or probes nuance. Questions like 'what metrics should leadership look at?' and 'how can you align 27001 across teams?' are solid setup questions, but the host accepts answers at face value and mostly affirms rather than follow up with skepticism or deep drilling. The dialogue feels collaborative and friendly but lacks the intellectual tension that would deepen learning.

“That's a really interesting take because we talked about it being a maturing of the system”

“Okay, okay. So and you can look at that as a, you say continual improvement”