The vCISO Chronicles

The episode is dominated by biographical backstory and generic entrepreneurship observations (work-life balance, delegating, trusting your team). The one genuinely interesting idea - matching vCISO seniority to a company's maturity stage like a 'hopscotch' progression - is fleeting and underdeveloped, with almost no actionable depth around it.

“a business can basically hopscotch along the path, leveraging experience and guidance of the women and men that have done this job based on what their time in the seat has been for where the company is in their growth cycle”

“I've had to discipline myself as to the right times to work on my business so that I'm not so consumed with it that my family and everybody else that I should be paying attention to that they don't think that I'm just this person that spends all my waking hours working on a company”

The maturity-matching framing for vCISO hiring is mildly novel, but the rest is standard vCISO sales logic, generic AI-as-hot-potato commentary, and borrowed phrases like 'be brief, be bright, and be gone.' No contrarian claims or first-principles reasoning appear.

“it's challenging as a business if you have on staff a CISO who it's hard for them to grow as the business grows in their competencies without putting your business at risk”

“I'm going to steal your term, because I think it's a fantastic term, of responsible AI, especially from a CISO perspective”

Greg Reitz is a genuine practitioner - 30+ years in IT leadership, a CMU CISO credential, CMMC assessor certification, and real founding experience - but C-Society has only six partners and is just beginning to scale, so his experience is at a modest level of organizational scale.

“I became a certified professional as well as certified assessor So that gave me the skills I need to navigate through work in the defense industrial base”

“There's six partners in the business and we have relationships with individuals that come to us under contract to work as VC SOS”

There are some concrete data points - Carnegie Mellon 2019, R20 launched 2020, CMMC work from 2021, NY State K-12 CSF mandate, CMMC 2.0 as a pipeline driver, and a named tool (1Password) - but claims about market size, client counts, revenue, and impact are entirely absent, keeping this in the vague-practitioner range.

“New York State, where we're based out of, where we're founded from, has laws on the books that require school districts, K-12 school districts, to comply with this CSF framework”

“if it was 100% or when I was doing R20, if I was spending 80% of my time on clients and 20% on administrative, it's probably shifted to about a 70, 30 right now”

The host does attempt structured follow-ups - probing the CMU-to-launch timeline and the R20-to-C-Society transition - but the questions remain biographical and never challenge a substantive claim. The 'give us a little bit more of the sales pitch' framing exemplifies the softball register throughout.

“when you went to Carnegie Mellon, were you thinking to yourself that you were going to launch? Because you said it had always been a dream of yours”

“give us a little bit more of the sales pitch”