Communicating Cyber

In this episode of Communicating Cyber, host Robin Oldham sits down with Ash Hunt, VP Strategy at Cyera for an honest, wide-ranging discussion on the evolution of cyber risk quantification (CRQ), boardroom communication, and enterprise resilience.

Having spent years implementing quantitative risk models in the trenches, Ash shares why he has come full circle on the discipline—warning against dogmatic camps and mathematical scaffolding that lose sight of commercial goals. Together, Robin and Ash explore why the cyber security industry excels at detecting problems but struggles to remediate them, how to replace abstract "threat landscapes" with actionable "event landscapes", and what happens when an executive committee laughs an eight-figure risk model out of the room.

Key topics discussed in this episode:

• Why CRQ is a means to an end, not the destination: Focusing on the primary business functions of "build and sell"

• Ground truth vs colour charts: Why qualitative RAG ratings can’t disguise the underlying data

• The beer keg analogy: Managing operational friction and routine losses over speculative black swans

• Story selling and decision engineering: Translating actuarial models into narratives that resonate with the CFO and Board

• The Toyota model: Applying Total Quality Management, Kaizen, and the elimination of process waste (Muda) to cyber security

• The death of manual audit sampling: How continuous, machine-readable assurance is set to transform GRC over the next 24 months

Books & resources mentioned in this episode:

• How to Measure Anything in Cybersecurity Risk by Douglas W. Hubbard & Richard Seiersen

• The Flaw of Averages by Sam L. Savage

• Information is Beautiful by David McCandless

• Storytelling techniques by Matthew Luhn (former Pixar storyboard artist)

In this episode of Communicating Cyber, I’m joined by Jonny Mattey, CISO at Forge Holiday Group, for a conversation that pulls back the curtain on the true reality of stepping up into enterprise leadership. Jonny brings an incredibly grounded perspective, charting his unique journey from the heavy industrial safety of an oil refinery to managing risk for major UK staycation brands like Sykes Cottages and Forest Holidays.We explore the unspoken hurdles of a first-time directorship, challenging the idea that a CISO role is just a simple title bump. Jonny shares the unexpected psychological impact of simply moving his team's seating plan away from IT operations, and details how he uses powerful commercial metaphors - like asking if an executive would willingly close their shop front at 3pm -to make abstract cyber security risks immediately tangible to the business.Whether you are an aspiring CISO or a business leader trying to break the "invisible value" trap of your security function, this episode offers a practical blueprint on how to move past technical jargon and lead risk across the entire enterprise.

In this episode of Communicating Cyber, we explore what happens when you dismantle the traditional chain of command within a security function.

Stefano Mazzucco from Mindera discusses how they manage cyber security across a global team of 1,200 people without a single boss or hierarchy in sight. We dive into the realities of working in a "teal" organisation where peer-to-peer accountability and horizontal communication replace the standard top-down mandates.

Stefano explains how trading the traditional chain of command for a culture of psychological safety allows for faster incident reporting and deeper personal responsibility.

We also discuss the shift from being an enforcer to being a coordinator, using risk-based evidence to influence autonomous teams rather than relying on authority.

It is a thought-provoking look at whether a rigid chain of command is actually a barrier to building a truly resilient security culture.

In this episode of Communicating Cyber, Robin Oldham, Founder of Cydea sits down with Julian Meyrick, UK Managing Director at Eraneos, to discuss the evolution of cyber risk reporting.

For too long, cyber security has relied on subjective "Red-Amber-Green" status updates. Julian and Robin explore how the new government Cyber Action Plan and the move toward cyber risk quantification are changing how organisations prioritise their security investments and communicate with the board.

In this episode we discuss:

• The fundamental flaws of subjective risk reporting.

• What the government’s Cyber Action Plan means for public and private sectors.

• The "WannaCry factor": Using historical data to prove the value of cyber investment.

• How to engage plant managers and process owners to find the true cost of disruption.

• The growing pressure on the supply chain from the MoD and NHS.

In this edition of Communicating Cyber, we sit down with Fergus Hay, CEO of The Hacking Games and former global advertising leader, to discuss why the cyber security industry needs a radical shift in how it tells its story.Fergus shares his journey from running world-class marketing agencies to discovering the "parental paranoia" of youth hacking on gaming platforms like Roblox and Minecraft. We dive into the psychology of "lions and crocodiles" in the workplace, why we need to move past the "hoodie in the basement" stereotype and how we can attract more talent by recruiting for aptitude rather than just degrees.If you’ve ever felt that cyber security communication is too technical or too fearful, this conversation is a must-watch.

In this special episode of Communicating Cyber Live, we’re joined by cyber security journalist Joe Tidy to talk about how cyber crime is changing and why the way organisations respond to attacks is becoming more secretive, not more open.

From the disturbing rise of teenage cyber criminals to the growing lack of transparency after major incidents, Joe challenges us to rethink what good leadership and honest communication really look like in cyber today.

In this episode, Michelle Tolmay, CISO at Tracsis, reframes the security professional as an optimist and explores the art of ‘answering the so what’. She explains how to translate technical risks into the financial language of the board. From managing ‘security poverty’ in startups to fixing the talent pipeline at the grassroots level, she emphasises that effective security is about empathy, communication, and a genuine desire to help people.

In this episode of Communicating Cyber, Robin sits down with Simon Goldsmith, Chief Information Security Officer at OVO, to explore how to make security meaningful when change is constant and technology moves fast.

Simon shares lessons from a career that’s taken him from mechanical engineering in Turin, to electronic warfare for the MOD, to retail, financial services, and now leading security at a digital-first energy company.

We talk about why systems thinking beats simply “adding more armour”, how storytelling and analogies open doors with executives and the challenge of “good enough” security and how to reframe it.

In this episode of Communicating Cyber, host Robin Oldham sits down with technology leader Larry Tompkins to unpack the art of making complex cyber risks crystal clear. With over two decades of experience bridging the gap between IT and business, Larry shares how to earn trust, secure buy-in, and adapt your message for audiences from the boardroom to the warehouse floor.

From the “Why, So What, and What Haven’t I Told You” framework to the power of visuals, real-world M&A lessons, and the importance of empathy, this conversation is packed with actionable strategies for any cyber leader looking to connect, persuade, and lead with confidence.

In this episode of Communicating Cyber, we get into what it really takes to make security land with impact and clarity – even when that means sending a phishing email to the executive committee!

Our guest, Nisha Patel, CISO at Ocorian, has spent 20+ years on the front lines of cyber, and she’s here to share how she cuts through noise, wins boardroom buy-in, and builds security cultures that stick. From real-world incidents to bold new approaches, Nisha brings sharp, human insight into leading in high-stakes environments. If you've ever wrestled with getting your message heard, or making people actually care, this one’s for you.