Most business owners treat cybersecurity as a technical problem — something for IT to handle. Stan Alhadeff sees it differently. As a fractional CFO with 30+ years in financial leadership and four company exits under his belt — including one at $180 million at 11x EBITDA — Stan has watched cyber risk show up in the numbers that actually matter: valuations, due diligence, and deal terms.

In this episode, Stan and Raffi dig into how buyers price cyber posture into an acquisition, what financial-viability questions every business owner should be asking their IT provider, and how to actually put a dollar figure on cyber risk instead of treating it as an abstract threat. They also tackle a question every CFO is fielding right now: is AI spend cannibalizing cybersecurity and SaaS budgets, or is it genuinely net-new investment?

Stan closes with the core idea behind his book, Run the Business, Don't Become It — a reminder that the same strategic discipline that prevents founders from getting consumed by day-to-day firefighting is exactly what protects a business's long-term value, cyber risk included.

If you've ever wondered whether your security spend is actually building enterprise value — or just checking a box — this conversation reframes the question.

Most small business owners think of cybersecurity as an expense — something you pay for and hope you never need. Robert Maxwell, CEO of TGT Solutions and author of Cyber Model Dividends, sees it differently: as an investment that compounds over time, much like a portfolio.

After nearly three decades running a systems integration firm serving small and mid-sized businesses, Maxwell has watched the same pattern play out again and again — a company runs on one person, one account, one set of credentials, and never questions it until a single phishing email or compromised login brings the whole operation to a halt in minutes. His core argument isn't really about technology at all. It's about cash flow, client trust, and business continuity — the things an SME actually stands to lose, and the reason most owners don't think they're a target until it's already too late.

In this conversation, we dig into that reframe: why treating cybersecurity like a dividend-generating asset changes the decisions owners make, what a single point of failure looks like inside a real business, and the smallest, cheapest steps that actually move the needle — no jargon, no fear-selling.

Link to book: Cyber Model Dividends

Aimee Ritell is Founder & Principal of Intwinely, a Fractional COO who steps into SMBs to diagnose operational bottlenecks driving employee/client churn, typically starting with a flat-fee discovery assessment. In this episode we dive into what leads to employee and client churn and if its avoidable or invevitable.

Mike Reed has seen cybersecurity from every angle — launching Exchange and Active Directory at Microsoft, early enterprise at Apple, leading the managed-security ISV business at AWS, and serving as a Field CISO at Fortra before co-founding Realis Solutions Group, a boutique AI and emerging-risk advisory. That builder-and-practitioner background makes him one of the few voices who can separate genuine capability from vendor marketing.

In this episode, we dig into his clear-eyed take on Anthropic's Claude Mythos and Project Glasswing — why AI that finds vulnerabilities faster than anyone can patch them doesn't automatically make you safer, and why "the limiting factor isn't model access, it's remediation capacity." We also get into the security metrics leadership will actually act on, how a mid-market firm should think about state-sponsored threats without falling for FUD, and what MSPs and CISOs each get wrong about the other.

After nearly two decades in financial services — including nine years at Charles Schwab and a background in algorithmic and statistical-arbitrage trading — Emil Aldaddah left the enterprise world in 2024 to co-found Momentum Wealth Management, a boutique SEC-registered RIA serving family offices, trustees, and private foundations. On this episode, Emil and Raffi cover what disappears when you walk away from a major platform's security and compliance infrastructure, the unique threat profile of UHNW and family-office clients, advisor-impersonation wire fraud, and how the new SEC cybersecurity rules landed squarely on his launch timeline.

A former SEC enforcement director on the difference between being secure and being defensible. Ana Petrovic (Kroll) on what examiners really look for, how infosec became an insider-trading control, and where a lean firm should spend its next compliance dollar.

Most cybersecurity conversations happen with practitioners—the people building and defending the systems. This one is different. Jeffrey Fidelman, CEO and Founder of Fidelman & Company, sits on the other side of the table:, the one with the checks.

With a background at Morgan Stanley and HSBC and a firm that helps startups and emerging funds raise capital, Jeffrey brings an investor's lens to security. We dig into how cybersecurity actually shows up in due diligence, what a company's security posture signals to a serious investor, and the gaps that quietly kill deals. He explains why founders who frame security as a cost center may be hurting their own fundraise—and how to talk about it as an asset instead.

Most business leaders approach cybersecurity the way they approach every other operational problem: buy the right tool, check the box, move on. It's a reasonable instinct — and in most areas of business, it works. But cybersecurity doesn't behave like other purchases, and the companies that learn this the hard way usually learn it during a client questionnaire, an insurance renewal, or an incident they weren't prepared for. In this solo episode, we dig into why the purchase mindset feels so right — and why it consistently falls short. You'll hear why a tool isn't a control until it's configured, monitored, and owned. Why static security is decaying security. And why the right question isn't "are we secure?" but "are we improving — and can we demonstrate it? "We'll walk through what continuous improvement actually looks like in practice, the rhythm of a mature security program, and the clear signs that tell you whether your organization is in process mode or still stuck in purchase mode. You'll also get five diagnostic questions every leader should be able to answer about their security program. If you can't answer them quickly, you have a starting point. If you can, you're already ahead of most of your peers. Whether you run a five-person firm or a five-hundred-person company, this episode is about shifting how you think about security — from something you buy to something you practice.

In this episode of the podcast we talk to Bobby Tahir. Bobby has a broad knowledge of technology as a multi-company CTO both for Private Equity and their Portfolio Companies. Bobby has a blog and podcast at Technocratic | Substack

In this episode we talk about responding to an incident response process. We talk to Chris Loehr, a leading incident responder.