Rooting the Boardroom: 35 Lessons over 35 Years

The cybersecurity industry is obsessed with the “new” — new vulnerabilities, new frameworks, and new buzzwords. But after 35 years of watching the perimeter move from a physical wire to a borderless cloud, the most critical lessons aren’t found in a CVE database. They are found in the friction between technology, business, and the human element. Sample Lesson: The Board doesn’t care about your firewall’s throughput; they care about the business’s heartbeat. If you can’t map a packet to a dollar, you’re just noise.

Assessing Security Operations

Operating a well-run security operations can be one of the biggest challenges for security teams. How do you measure it? What does a well-run program look like and how is it different from a basic program? In this talk we’ll address these questions and more.

Economic Outlook

Coming soon.

Why No One Trusts Us

About half the security leaders I talk to are quietly bleeding trust with their business and don’t know it yet. They have the audits. They have the metrics. They have the org chart. What they don’t have is anyone calling them before a decision gets made. Security teams spend a lot of time proving we’re right. The business is waiting for proof we’re trustworthy. Those aren’t the same thing, and the gap between them is where security programs go to die.

This talk is about the trust gap between security teams and the business we’re supposed to protect. Why it sticks around even when the controls are solid, even when the audits pass, and what each person in your org can actually do about it on Monday. Whether you’re the CISO, a manager, or the analyst closing tickets at 2am.

In a lot of industries, the business has no choice. They have to come to security. That’s the worst possible starting point for a relationship. Captive audiences resent their captors. Frameworks don’t fix it. Dashboards don’t fix it. Charm definitely doesn’t fix it. What fixes it is recognizing that trust is something a security team manufactures, on purpose, every day, at every level. Or doesn’t.

We’ll talk about how trust actually gets built between security and the business. Why the burden can’t sit on the CISO alone. And what concrete moves are available to executives, managers, and individual practitioners. Borrowing from Sabino Marquez, Amy Edmondson, and a pile of stories from financial services, healthcare, and energy, plus a few I probably shouldn’t tell.

You’ll leave with a sharper read on where your team is leaking trust, three moves you can make at your level, and one uncomfortable thing to do before Monday.

This isn’t a compliance talk. It’s a talk about being believed.

The Decision Bottleneck

Coming soon.

Demystifying the Agentic Stack: Lessons from Build it / Break it / Buy it

This talk will cover the basic components of agentic systems and answer some basic questions: What is a skill? What’s a harness? How do agents, sub agents, and tool calls operate? What does MCP do? We will cover common architectural patterns and pitfalls, and offer some experiential advice on getting the most out of your systems.

Panel Discussion

Lively Discussion.

Closing Statements