In this episode, Prabh sits down with Dr. Eric to break down what most organizations get wrong about cybersecurity: they over-focus on “prevention” and under-invest in building a resilient security program.This conversation is designed for CISOs, security leaders, and anyone responsible for creating or fixing an enterprise security function — especially in environments with limited budget, limited maturity, or limited executive attention.What This Podcast CoversThis 30-minute podcast focuses on how to build a cybersecurity program from the ground up, including:What an information security program actually includesThe real difference between security strategy vs security programHow to prioritize security work without trying to “secure everything”How to gain executive trust when you're new in the roleWhy people + process come before toolsHow to build a security program even when budgets are tightSecurity Program vs Security Strategy (Most People Confuse This)Dr. Eric explains that a strategy is the direction — what you want to achieve and why.A program is how you execute consistently: operating model, processes, governance, reporting, and repeatable outcomes.If you only have strategy without a program, you get slides — not security.🎯 The Prioritization Method That WorksInstead of trying to secure the entire organization at once, Dr. Eric recommends:Pick one critical process or data setIdentify its risk toleranceMap the biggest threatsFix the largest vulnerabilities firstRepeat in small, measurable stepsThis “focus-and-repeat” approach can secure 80% of critical processes within a year, compared to the traditional method that fails due to overload and complexity.🤝 Executive Engagement: Start With Legal + CFO (Not CEO)One of the strongest leadership lessons in this episode:If you're building a security program from scratch, don’t start by pitching the CEO.Start with:Chief Legal Counsel (risk, liability, compliance)CFO (funding, business impact, risk tolerance)Building credibility with these stakeholders creates momentum and trust — which makes later CEO alignment easier and faster.🗣 CISO Communication That Gets AttentionDr. Eric shares what separates successful security leaders from technical-only leaders:✅ Speak in the language executives care about:financial riskoperational downtimerisk tolerancereputational exposureregulatory consequences💰 Building Security in Budget-Constrained OrganizationsIf funding is limited, Dr. Eric recommends a simple approach:start with small investmentsdemonstrate measurable valueshow outcomes and risk reductionthen request bigger budgets with credibilityThis is how security programs survive and scale in real enterprises.🎯 Who Should Watch This?This episode is ideal for:CISOs and security leadersSecurity managers and architectsGRC leaders and risk teamsSOC leaders and security engineersAnyone building a cybersecurity program from zeroCISO talkshttps://www.youtube.com/playlist?list=PL0hT6hgexlYwPTD-wC3oFBe27VGEiizg1NIST Serieshttps://www.youtube.com/watch?v=VcC_KabV_Ho&list=PL0hT6hgexlYy0vBwMv0eteiyAxB48RQzy&pp=gAQBiAQBGRC Serieshttps://www.youtube.com/watch?v=mq_vSLHm4r0&list=PL0hT6hgexlYztA41j1bceTfVagP9mtq28&pp=gAQBISO 27001 Videohttps://www.youtube.com/watch?v=sQqJH2naU6I&t=1454s&pp=ygUeaXNvIDI3MDAxIGltcGxlbWVudGF0aW9uIHN0ZXBzISO 27001 Implementation Guidehttps://www.youtube.com/watch?v=GBfwk10Hh-o&pp=ygUeaXNvIDI3MDAxIGltcGxlbWVudGF0aW9uIHN0ZXBzGRC Practical Serieshttps://www.youtube.com/playlist?list=PL0hT6hgexlYztA41j1bceTfVagP9mtq28GRC Interviewhttps://www.youtube.com/playlist?list=PL0hT6hgexlYz1Usn1Nrnur6OzVoz59zylInternal Audithttps://www.youtube.com/playlist?list=PL0hT6hgexlYyNWBcGYfabwumCr0GKmLWvStudy with MeTelegram Grouphttps://t.me/Infoseclearning#cisos #ciso #cissp #cism #infosec
New Zealand