Razorwire Cyber Security & InfoSec Insights

Razorwire Cyber Security & InfoSec Insights

By Razorthorn Security | Cybersecurity & InfoSecBusinessNewsTechnologyTech NewsCareers
Download on the App Store

Razorwire Cyber Security & InfoSec Insights episodes

  • The Razorwire Christmas Special 2025: Looking Back, Looking Forward

    What happens when you gather some of the sharpest minds in cybersecurity for an end-of-year chat about where we've been and where we're heading?

    Welcome to Razorwire's Christmas special. Today I’m chatting with some of our favourite guests from 2025: clinical traumatologist Eve Parmiter, cyber futurist Oliver Rochford, CISO and podcast host Marius Poskus and occupational psychologist Bec McKeown for roundup of the cybersecurity industry this year. This isn't a glossy year-in-review full of predictions and corporate optimism. We're talking about what's actually happened: how our teams are STILL burning out, the junior pipeline that's being hollowed out by premature AI deployment, the CISOs who are resigning because they're handed accountability without support and the businesses that want the appearance of security rather than the reality of it.

    Summary

    2025 has been a year of contradictions. Fewer ransomware victims are paying up, which suggests resilience is working. But burnout rates in cybersecurity remain above 59% and the systemic issues causing it aren't being addressed. Oliver brings data showing that AI-driven threat intelligence has been more marketing than reality. Marius shares why his CISO resignation letter post hit over 300,000 impressions and 3,400 comments. Eve explores whether there could be legal protections for cybersecurity professionals experiencing occupational trauma. Bec questions why security teams are expected to work under military-level pressure with none of the training or support.

    We’re also looking ahead to 2026. Oliver predicts salaries will rise. Marius sees organisations scrambling to fix the mess that AI has created. Eve and Bec discuss what the younger generation might teach us about boundaries and refusing to put up with workplace nonsense. And we all agree on one thing: gravity needs levity. If you're going to survive in this industry, you REALLY need to laugh.

    Three Key Talking Points:

    The Theatre of Security

    Understand why organisations hire CISOs for accountability but don't give them budget, support or a seat at decision making tables. Marius explains how this creates a cycle where security leaders are blamed when things go wrong, despite having no power to prevent them.

    The Junior Pipeline Crisis

    Discover why premature AI deployment is hollowing out entry-level roles across industries, including cybersecurity and law. We discuss the long term consequences of replacing junior analysts with AI before understanding what you're losing.

    Burnout as Occupational Trauma

    Learn why burnout in cybersecurity isn't just about individual resilience. Eve explores whether legal protections could be granted for work that causes inescapable harm, drawing parallels with content moderators and healthcare workers.

    If you want an honest conversation about the state of cybersecurity in 2025 and what's coming in 2026, this is it.



    On the appearance of security:

    "Companies do not want security. They want the appearance of security. They hire a CISO to be the person who's accountable, the person who's on insurance papers, the person's name who's on client contracts, the person who is a face of the company of doing security, but actually he's not supported in budgetary terms in any other way."

    Marius Poskus

    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    1. 2025 Year in Review Explore what actually happened this year, from falling ransomware payment rates to the continued rise in burnout and stress levels across the industry.
    2. Marketing-Driven Threat Intelligence Discover why claims about AI-enabled ransomware and nation-state AI usage turned out to be more hype than reality.
    3. The CISO Accountability Trap Understand why security leaders are handed responsibility without power, budget or support and why so many are choosing to step back from leadership roles.
    4. Burnout as a Systemic Problem Learn why organisations still treat burnout as an individual issue rather than addressing the systemic factors that cause it.
    5. Legal Protections for Occupational Trauma Explore whether cybersecurity professionals could gain legal recognition for work-related harm, similar to content moderators and healthcare workers.
    6. The AI Skills Shortage Coming in 2026 Find out why Oliver predicts salaries will rise as companies realise they've hollowed out their junior pipeline with premature AI deployment.
    7. Economics vs Security Spending Understand why businesses treat security breaches like shoplifting and why perfect security isn't the goal for most organisations.
    8. Cognitive Load and Dashboard Design Discover how principles from aviation flight deck design could reduce alert fatigue and improve security operations workflows.
    9. The Younger Generation's Boundaries Learn what Gen Z might teach us about setting limits, refusing workplace nonsense and reframing work around life instead of the other way around.
    10. Predictions for 2026 Hear what the panel thinks is coming next year, from salary increases to AI backlash and the potential consequences of neglecting security basics.


    Resources Mentioned
    1. Coveware (Ransomware Payment Data)

    Referenced by Oliver regarding the drop in ransomware payments in 2025.

    1. MIT Sloan (AI-Enabled Ransomware Claims)

    Referenced by Oliver as an example of retracted threat intelligence claims.

    1. Anthropic

    Referenced regarding claims about nation-state actors using their AI service.

    1. ISC2 Workforce Survey

    Referenced by Eve Parmiter regarding burnout statistics (59%) in cybersecurity.

    1. SolarWinds Breach and CISO Impact

    Referenced by Jim regarding the personal toll on the SolarWinds CISO.

    1. Health and Safety Executive (UK)

    Referenced by Bec McKeown regarding employer responsibility for workplace stress.

    1. Cloudflare Outages

    Referenced by Marius Poskus regarding organisations bypassing WAF protections during downtime.

    1. Anu AI (Foresight and Predictions Tool)

    Mentioned by Oliver Rochford as his startup with a free community edition.

    1. Mental Health in Cybersecurity Foundation

    Referenced in context of ongoing burnout discussions.

    1. Cyber Diaries Podcast

    Mentioned by Marius Poskus as his podcast.


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Instagram: Razorwire Podcast

    Twitter: @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    1 hr 16 min
  • Burnout in Cybersecurity: Preparing Cyber Staff for the Reality, Not Just the Role

    Is burnout in cybersecurity inevitable, or are we finally learning how to prevent it?

    Welcome to Razorwire. In this episode, I sit down with clinical traumatologist Eve Parmiter and occupational psychologist Bec McKeown to talk about what's really happening in high pressure cyber roles. This isn't about vague wellness advice or corporate tick-box exercises. We're looking at the actual mechanics of burnout: why CISOs are breaking under impossible expectations, how remote work has changed team dynamics and what the early warning signs look like before someone hits crisis point. If you work in cybersecurity, particularly in leadership or incident response, this conversation offers strategies you can use today.

    Summary

    Two-thirds of cybersecurity professionals say their jobs are more stressful now than they were five years ago. The pressure is mounting, but the support systems aren't keeping pace. In this conversation, Eve and Bec bring research, clinical experience and real examples to explain why burnout is becoming an occupational hazard in cyber teams. We talk about the gap between a CISO's responsibility and their actual authority, why technical skills alone won't protect your team from collapse and how to spot the signs that someone is struggling before it becomes a crisis. We also cover what actually works: building teams that can handle pressure, creating cultures where people feel safe to speak up and finding peer support through initiatives like the Mental Health in Cybersecurity Foundation.

    Three Key Talking Points:

    1. Human Factors and the Reality of Leadership Burnout
    2. Understand why burnout is becoming an occupational hazard for cyber leaders, especially CISOs, who are caught between responsibility and a lack of real power. Learn how unaddressed team dynamics, poor succession planning and social isolation create stress that technical controls alone cannot fix.
    3. Spotting Burnout Early - Inside and Around You
    4. Get practical advice on identifying warning signs in yourself and your colleagues. We discuss real strategies for managers and peers: recognising behavioural changes, loss of humour, withdrawal and other ‘red flags’ that are far more accurate than any policy checklist.
    5. Building Resilience and Finding Peer Support
    6. Discover actionable steps for resilience, beyond ‘just coping’, including the creation of peer communities like the Mental Health in Cybersecurity Foundation. Find out how a shared community is essential to surviving and growing in this field.

    If you want real answers about burnout, actionable insights for your career and lessons from the frontline of cybersecurity wellbeing, this is one episode you can’t afford to skip.


    On power vs responsibility:

    “CISOs are a great example. You only have so much power, but you've got a high degree of responsibility, and personal responsibility coming into it. So that can feel very unfair and very unbalanced and that can create a lot of resentment.”

    Eve Parmiter

    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    • Understanding Burnout Trends in Cybersecurity Learn why 66% of professionals report higher stress levels than five years ago and what's driving the increase across the industry.
    • Recognising Human Factors as Security Risks Discover how overlooking team wellbeing creates vulnerabilities that no technical control can fix.
    • Navigating the Working Location Debate Find out how remote, hybrid and office preferences impact team cohesion and what it means for your mental health.
    • Balancing CISO Responsibility Without Authority Understand why security leaders face mounting pressure without the power to create change and how this fuels burnout.
    • Spotting Burnout Before It's Too Late Learn to identify the subtle behavioural shifts that signal burnout in yourself and colleagues before it becomes a crisis.
    • Creating Teams That Can Weather the Storm See how managers can build resilience by recognising and responding to individual stress patterns.
    • Leveraging Different Perspectives Under Pressure Explore why mixing personalities and viewpoints strengthens problem-solving and team support during incidents.
    • Building a Culture Where People Can Speak Up Understand what psychological safety actually looks like and why it's essential for preventing burnout.
    • Finding Professional Support That Actually Helps Learn where to access peer support and resources designed specifically for cybersecurity professionals.
    • Getting Involved in Industry-Wide Solutions Discover how the Mental Health in Cybersecurity Foundation is creating practical frameworks and communities to address burnout collectively.



    Resources Mentioned 

    1. ISACA (Cybersecurity Research and Reports)

    • Referenced by Bec McKeown regarding global research on cybersecurity stress levels.
    • Website: https://www.isaca.org/

    2. NLP (Neuro-Linguistic Programming)

    • Mentioned as a resource for self-understanding and career development.
    • Overview: https://www.britannica.com/topic/neuro-linguistic-programming

    3. Major UK Brands Affected by Cyber Attacks

    • Harrods: https://www.bbc.co.uk/news/articles/cpq5w324pd3o 
    • Marks & Spencer:  https://www.bbc.co.uk/news/articles/c93x16zkl9do 
    • Jaguar Land Rover  https://www.bbc.co.uk/news/articles/ckg1w255gy1o 
    • Co-op:  https://www.bbc.co.uk/news/articles/ckgq9dke4e5o 

    4. ‘Be Left of Bang’ 

    • Used as a metaphor by Bec McKeown for proactivity in noticing stress and burnout.
    • Book Info: https://www.amazon.co.uk/Left-Bang-Marine-Combat-Program/dp/1936891301

    5. Maslach’s Research into Burnout 

    • Cited by Eve Parmiter about organisational factors driving burnout.
    • Overview: https://www.verywellmind.com/burnout-4157336
    • Christina Maslach Profile: https://psychology.berkeley.edu/people/christina-maslach

    6. Mental Health in Cybersecurity Foundation (Community and Support Resource)

    • Discussed by Bec McKeown as a growing support and best practice group; LinkedIn page only (no website yet).
    • LinkedIn: https://www.linkedin.com/company/mental-health-in-cybersecurity-foundation/

    7. The Cyber Sentinel's Handbook (by James Rees)

    • Mentioned as a resource for information security professionals at all levels.
    • Amazon link: https://www.amazon.co.uk/Cyber-Sentinels-Handbook-professionals-ebook/dp/B0CXTS3S7D/
    • Available as paperback, e-book and via Kindle Unlimited.

    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Instagram: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    1 hr 8 min
  • The Death of Passwords: The Future of Authentication

    Is passwordless authentication finally ready for prime time, or are we just replacing one set of problems with another?

    Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, we're tackling one of the oldest challenges in information security: identity and access management.

    I'm joined by David Higgins, CTO at CyberArk and Murtaza Hafizja, Senior Technical Product Marketing Leader from OneSpan, who bring decades of combined experience from the front lines of identity, authentication and access control. Together, we explore how the industry has evolved from simple username/password combinations to biometrics, passkeys and continuous authentication and where the technology is heading next.

    Summary

    We examine the persistent challenges around identity management, from the struggle between security and user convenience to the explosion of non-human identities that now need managing. David explains why privilege access management has evolved from credential vaulting to zero standing privileges and how cloud environments have created both opportunities and complexities with their tens of thousands of granular permissions. Murtaza tells us about the passwordless evolution, why risk-based authentication is making a comeback and the real barriers to rolling out modern authentication at scale.

    Whether you're a CISO wrestling with third-party access, an IT manager trying to balance security with productivity or just someone interested in where authentication is heading, you'll get honest perspectives on what works, what doesn't and what's actually achievable.

    Key Talking Points 

    1. The Passwordless Evolution and What It Really Means Learn why passwords are finally on their way out (mostly), how passkeys and biometrics have moved from niche to mainstream and why the technology that failed 20 years ago is now becoming the de facto standard for authentication.
    2. Zero Standing Privilege and the Cloud Permission Problem Discover how cloud environments have paradoxically made privilege management both more granular and more complex, why organisations are moving away from permanent permissions and how just-in-time access is becoming essential for modern infrastructure.
    3. Continuous Authentication and Behavioural Analysis Understand why a single login authentication isn't enough anymore, how attackers are owning identities by exploiting help desks and why monitoring user behaviour patterns might be the key to stopping credential-based attacks before they cause damage.

    On the security of key documentation: 

    "Attackers aren't breaking in anymore, they're logging in."

    David Higgins, CyberArk

    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    • The Evolution of Identity Management How authentication has cycled through different approaches over 30 years, from basic username/password to biometrics that failed, then succeeded and why we're finally at a point where passwordless is achievable at scale.
    • From Too Little Granularity to Too Much Why early operating systems forced an all-or-nothing approach to permissions, how cloud providers now offer tens of thousands of different roles and entitlements and why this has made principle of least privilege almost impossible to implement upfront.
    • Zero Standing Privilege as the New Normal How organisations are moving away from permanent permissions toward just-in-time access, why no one should have standing privileges anymore and how this approach aligns with modern cloud environments.
    • The Passwordless Movement Goes Mainstream What's changed to make passwordless authentication viable now, why passkeys are moving from hype to implementation and the real challenges of rolling out modern authentication to millions of users.
    • Third Party and Non-Human Identity Challenges The growing problem of managing identities for contractors, suppliers, automated systems and AI and why this volume of identities is creating new security and access control headaches.
    • Continuous Authentication and Risk-Based Approaches Why logging in once isn't enough anymore, how behavioural analysis can detect when an owned identity is being misused and why risk-based authentication is making a comeback after years of being overlooked.
    • The Help Desk as Attack Vector How attackers are purchasing stolen credentials then simply calling help desks to reset MFA tokens, why context matters as much as credentials and what this means for authentication strategies.
    • Balancing Security Friction with User Acceptance Why completely frictionless security is impossible, how to find the right balance between protection and productivity and why users will find workarounds if authentication becomes too painful.
    • Privilege Access Management Evolution How PAM has evolved from simple credential vaulting to addressing root causes, why managing secrets at scale remains challenging and the shift toward eliminating standing privileges entirely.
    • The Privacy vs Security Dilemma Concerns around government databases for digital ID verification, the risks of centralised identity storage and why securing authentication data is becoming more critical as we move toward digital-first validation.


    Resources Mentioned 

    CyberArk

    OneSpan 

    Gartner Hype Cycle for Digital Identity 

    FIDO Alliance

    Principle of Least Privilege

    AWS (Amazon Web Services)

    Microsoft Azure 

    Google Cloud Platform (GCP)

    WebAuthn 

    CTAP (Client to Authenticator Protocol)

    UK Digital ID Verification


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Instagram: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    56 min
  • How to Build Effective & Affordable Cyber Defences for SMEs

    How can small and medium businesses protect themselves from cyber threats without spending a fortune or just ticking boxes for compliance?

    Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I’m Jim and in this episode, we’re taking a look into the challenges faced by SMEs on the journey through cybersecurity compliance and insurance.

    I’m joined by Lewis Lockwood from Incursion and Josh X of Capsule, who bring experience from the front lines of offensive security and insurance broking. Together, we tackle the misconception that security is prohibitively expensive and explore how smart strategies can strengthen your defences without breaking the bank.

    Summary

    We tackle a topic at the heart of SME cybersecurity struggles - from box-ticking compliance to negotiating cyber insurance and surviving data breaches. Lewis Lockwood explains why Cyber Essentials is more than a paperwork exercise and how agility can be a secret weapon for smaller companies. Josh X talks about the realities of selling cyber insurance to resource-stretched businesses, the importance of aligning insurance with actual security posture and the real risks hidden even in smaller businesses.

    Whether you’re a founder, IT manager or just curious about how attackers think, you’ll get practical advice, cautionary tales and actionable steps you can take today.

    Key Talking Points 

    • Cyber Essentials as Practical Defence, Not Just Compliance Learn why basic frameworks like Cyber Essentials shield SMEs from common attacks, offering affordable, actionable protection that goes well beyond box-ticking.
    • How Insurance and Security Must Work Together Discover the realities of cyber insurance for small businesses, including why your security posture affects premiums and claims, and what actually happens if you’re hit by ransomware or invoice fraud.
    • Learning from Real-World Breaches and SME Pitfalls Hear first hand stories about high profile incidents, negotiation tactics with threat actors and how even a local florist or butcher can be targeted. Understand why continuous education, simple security controls and the right insurance mix can prevent both financial disaster and sleepless nights.

    Tune in for a conversation that’s honest, insightful and practical - with takeaways you can put into action immediately, no matter your company size.

    On the security of key documentation: 

    “Where are you storing your insurance documents? If someone wants to get into your network, the easiest thing to do is to look at their insurance documents and be like, okay, they've got a million pound limit, let me ask for £2 mil.”

    Josh X, Capsule


    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    • Cybersecurity Cost Perceptions Why the belief that security is prohibitively expensive for SMEs is misleading and what actually drives costs.
    • The Role of Cyber Essentials How Cyber Essentials provides a practical, affordable security baseline for small and medium businesses without breaking the bank.
    • Insurance as a Safety Net Why cyber insurance can't replace proper security measures and how to understand its role as a last resort, not a first line of defence.
    • SME Agility in Security How smaller organisations can use their size as an advantage to quickly implement fixes and adapt to security recommendations compared to larger enterprises.
    • Rise in Cyber Insurance Adoption What's driving growing awareness and uptake of cyber insurance among SMEs and why certain sectors are slower to adopt.
    • Practical Security Measures Simple, cost-effective steps SMEs can take to drastically reduce risk, including patching, access control and MFA.
    • Fraud and Social Engineering Threats Real-world attack scenarios targeting SMEs, from invoice fraud to phishing, and why user awareness matters more than you think.
    • Incident Response and Business Impact The wider consequences of a cyber incident beyond financial loss, including operational disruption, PR crises, regulatory fines and personal liability for directors.
    • Insurance Document Security Why you need to secure your insurance documentation and how attackers use policy details to calibrate ransom demands.
    • The Value of Security Accreditation How frameworks like ISO 27001 and Cyber Essentials can lower your insurance premiums and deliver tangible business benefits beyond compliance.


    Resources Mentioned 
    • Incursion Cyber Security (incursion-security.co.uk)
    •  Capsule (capsulecover.com)
    • Cyber Essentials
    • Cyber Essentials Plus
    • IASME
    • ISO 27001
    • DORA
    • NIST2
    • PCI DSS
    • HITRUST
    • Jaguar Land Rover Cyber Attack
    • Harrods Cyber Attack
    • Co-op Cyber Attack
    • NHS Cyber Attack
    • Sony Cyber Attack
    • ICO (Information Commissioner's Office)
    • SOC2
    • DMARC
    • Blockchain technology


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Instagram: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    49 min
  • How Cybercriminals are using AI - and How to Defend Against It

    What happens when the dark side gets its hands on cutting-edge AI and why might even seasoned defenders find themselves playing catch-up?

    Welcome back to Razorwire, where I’m joined by Oliver Rochford and Richard Cassidy to discuss how criminals are using AI, what's actually working and how the threat landscape is changing. We explore how adversaries are using AI, what’s actually working in the wild and how professionals can prepare for the unsettling pace of change.

    Summary:

    We discuss AI-powered phishing, deepfakes in recruitment and self-evolving malware. The conversation moves beyond the classic image of lone hackers, unveiling an economy of cybercrime with advanced automation, international collaboration and ruthless incentives. The real tension lies in whether AI is simply sharpening existing attack tools or if we’re on the brink of something genuinely new and autonomous. We dissect economic shifts in attack and defence and raises questions about resilience, readiness and just how quickly the future may arrive.

    3 Key Talking Points:

    • AI in current attacks: Discover how attackers are already automating phishing, password cracking and social engineering at scale, with some criminal campaigns boasting success rates that would have been unthinkable without AI.
    • Deepfakes and infiltration: Hear real cases of attackers using AI-generated identities and language tools to pass job interviews and access company systems, including documented North Korean operations.

    • The autonomy debate: Join the debate over whether we’re seeing the emergence of fully autonomous AI attacks or just more sophisticated versions of existing threats,  and what it means for risk management and defending against a fast-paced, well-funded adversary.

    Ideal for any cybersecurity professional looking for sharp perspectives and real-world examples on the present and future impact of AI in the hands of attackers. 



    The New Question for Cybersecurity:

    "We don't need to ask anymore, ‘Do we have good security?’ What we have to say, and what the question should be is, ‘Are we resilient when AI is being used against us? And how do we do that from a technology perspective?’ And there's no one answer."

    Richard Cassidy



    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen



    In this episode, we covered:
    • AI as the New Adversary Learn how criminals are using advanced AI tools to make cyber threats less predictable and harder to control.
    • Phishing Supercharged by AI Discover why AI-generated phishing campaigns achieve significantly higher success rates than traditional attempts and what makes them harder to spot.
    • Deepfakes and Recruitment Fraud Hear how attackers use deepfakes and voice-changing technology to impersonate job candidates and infiltrate organisations under false identities.
    • Automation and Evolving Malware Explore the debate around whether malware can autonomously adapt and rewrite itself, reducing the need for human hackers to intervene directly.
    • Limits of Current AI Threats Understand why truly autonomous, intelligent cyber attacks aren't widely observed in the wild yet, despite AI amplifying certain attack vectors.
    • Economic Shift in Cybercrime See how AI has lowered costs and barriers to entry for cybercriminals, allowing attacks to scale rapidly without nation-state resources.
    • Social and Psychological Impacts Consider how AI's rapid advancement is outpacing society's ability to adapt, leading to new forms of manipulation and radicalisation.
    • Defence Strategies Lagging Behind Find out why most defensive tools still rely on older methods and haven't matched the sophistication of AI-powered attacks.
    • Importance of Cyber Resilience Learn why resilience measures like robust backup, disaster recovery and regular risk assessments are now critical as AI heightens attack speed and scale.
    • Ethics, Regulation and the Future Race Examine how the race to adopt AI technologies by criminals and corporations alike is happening without adequate regulation or ethical boundaries.





    Resources Mentioned 
    • MIT Sloan
    • Safe Security
    • VirusTotal
    • PromptLock
    • Firewood (Malware)
    • Mirai (Malware / Botnet Variant)
    • HackerOne
    • Expo (LLM Project)
    • Anthropic
    • OpenAI
    • Europol
    • ChatGPT
    • GenTek AI
    • Arctic Wolf
    • SQL Slammer
    • Morris Worm
    • The Zizians
    • Future Shock (Book)


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    58 min
  • What Actually Works in Cybersecurity (And What Doesn't)

    Are you making career moves in cybersecurity or is cybersecurity making moves around you?

    Welcome to Razorwire. In this episode, I sit down with Marius Poskus - CISO, consultant, podcaster and all-round cyber expert - to how to succeed in cybersecurity. We discuss career paths, why security culture fails in most organisations and the risks of rushing into AI without understanding what you're doing. Whether you're trying to break into the industry or you're leading security strategy, this conversation covers what works and what doesn't.

    Summary:

    Want to break into cybersecurity without wasting time on the wrong certifications? Wondering why your security programme keeps failing despite all the tools you've bought? We have the answers.

    From physical security in Lithuania to CISO at a global fintech, Marius explains why pen testing is a terrible entry route for juniors, why compliance doesn't stop breaches and why giving AI control of your SOC is riskier than most people realise.

    We discuss how to build actual security skills (not just a collection of certificates), why punishing people for clicking phishing links backfires and why you need to stop firefighting incidents and start preventing them. Marius also shares why so many organisations buy expensive tools that solve nothing and what happens when you remove humans from security decisions.


    Key Talking Points:

    1. The Truth About Career Pathways:
    2. We debunk common myths about entry routes into cybersecurity, explains why starting in a SOC makes strategic sense and shares advice for hands-on learning that goes beyond certifications.
    3. Security Culture and Human Factors:
    4. We discuss why technologists and business leaders often miss the mark on culture, how reward (not punishment) transforms security behaviours and what happens when compliance is mistaken for genuine protection.
    5. AI, Emerging Threats and Resilience:
    6. Marius reflects on the dangers of autonomous AI-driven security, the future of continuous assessments and why building resilience matters more than chasing perfection. If you want a blunt take on what’s coming next in cyber risk, this episode will challenge your thinking.

    Tune in for real world stories, hard-won lessons and clever insights you can use right now, whether you’re climbing the infosec ladder or shaping your organisation’s security future.



    The Future of AI in Software Development: 

    “Everyone thinks that pen testing is sexy. How many pen testing roles are you going to find in a junior space? So if I'm playing numbers game, go in a SOC, learn cyber defence, build up all of your skills and then you pivot to wherever you want because that's the easiest path.”

    Marius Poskus



    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen



    In this episode, we covered the following topics:
    • Choose your entry point strategically: Why starting in a SOC gives you more options than chasing pen testing roles straight away and how to play the numbers game when breaking into the industry.
    • Focus on skills that actually get you hired: Why hands-on experience with home labs matters more than stacking certifications and what employers really look for in junior candidates.
    • Understand why pen testing isn't an entry-level path: Most junior roles are in Security Operations Centres, not penetration testing. Learn why the sexy-sounding jobs aren't where beginners should aim.
    • Stop buying tools to solve people problems: Why organisations waste money chasing technology instead of fixing processes and how this approach guarantees poor security outcomes.
    • Recognise that compliance doesn't mean you're secure: How mistaking audit requirements for actual protection leaves your business exposed and why ticking boxes won't stop breaches.
    • Build a security culture that works: Why punishing people for clicking phishing links backfires and how rewarding reporting creates collaboration instead of fear.
    • Question autonomous AI in security: Why removing humans from security decisions is riskier than most people realise and what happens when AI makes critical choices without oversight.
    • Shift from firefighting to prevention: How to identify root causes instead of just responding to incidents and why this approach saves time and money.
    • Use your network to accelerate your career: Why the relationships you build in the infosec community matter and how asking for help from people who've solved your problems before is a professional skill, not a weakness.


    Resources Mentioned 
    • MP Cybersecurity
    • Cyber Diaries Podcast
    • Ctrl Alt Defend (YouTube channel)
    • CompTIA Security+
    • CompTIA Network+
    • CompTIA A+
    • ISO
    • SOC2
    • Cyber Sentinels Handbook
    • Microsoft Copilot
    • Montinu
    • Greg van der Gaast
    • Jack Jones
    • Jane Frankland


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    42 min
  • The Hidden Costs of Security Stack Consolidation (That Vendors Don't Mention)

    Is your security stack making you safer or just adding to the chaos?

    Welcome to Razorwire, the podcast where we unravel the mess, myths and market realities behind today’s cybersecurity challenges. I’m your host Jim and in this episode, I’m joined by our favourite regulars Oliver Rochford and Richard Cassidy to tackle a topic that irritates every CISO: the security solution stack. We discuss the big questions about vendor motivations, tool sprawl and why consolidation so often promises more than it delivers.

    In this episode, we set aside the sales buzzwords and look at what it really means to consolidate your security stack. Oliver and Richard share straight-talking insights from both the vendor and CISO perspectives. We debate why security platforms so often fail to reduce complexity and whether AI is about to solve - or simply mask - the underlying pain.

    Three key reasons to listen:

    • “Noise in depth” versus defence in depth: Discover why having dozens of overlapping tools can actually increase risk and burnout, rather than improve your security posture. Hear insights on “noise in depth” and how it impacts the choices CISOs face.
    • Vendor incentives and the truth behind “consolidation”: Get an insider’s take on why vendors push for consolidation only when it benefits their stack, how lock-in happens and why most platforms are stitched together from half-baked acquisitions.
    • The hard reality of AI, integrations and future-ready strategy: Find out why AI and automation aren’t the magic fix the industry claims and what you actually need to do to keep your stack effective, adaptable and under control in a shifting market.

    If you want honest, practical advice on managing cybersecurity complexity and want to hear what real CISOs wish they'd known before their last renewal, this episode is worth your time.


    Welcome to the Future: Solving Problems, Not Just Selling Tools

    "If you're coming to market, remember the product is only half the game.

    Security teams, GRC compliance teams - they're drowning. Support, deployment, tuning and post-sales success – they really make or break from my organisations and ones that I talk to. So be the vendor that doesn't just sell the product, be the one that really helps operationalise it. 

    If you're just here to sell a tool, you're already obsolete. If you're here to solve a problem and remove complexity, then welcome to the future.

    Richard Cassidy


    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen



    In this episode, we covered the following topics:
    • Tool Sprawl vs. Defence in Depth Learn why organisations with dozens of overlapping security tools end up with noisy environments instead of effective layered defence and what CISOs actually see happening on the ground.
    • Vendor Incentives and Lock-In Discover how security vendors push you into consolidation within their own ecosystems while prioritising customer lock-in over real interoperability and simplification.
    • Platform Consolidation Cycles Understand why the industry keeps repeating the same consolidation mistakes and what you should consider instead of chasing the perfect platform that doesn't exist.
    • The Role and Myth of AI in Security Stacks Find out why AI won't magically fix your complexity problem and how it often just adds another noisy layer without reducing tool sprawl.
    • Integration Challenges and Data Standards Find out why lack of shared standards makes integration painful, and how to use your purchasing power to demand vendors support open standards and data portability.
    • Cost Fallacies of Consolidation Discover why promised cost savings from consolidating tools rarely appear once you factor in migration, retraining, integration and operational complexities.
    • System Integrators and Rising Complexity Learn why systems integrators and resellers often profit from complexity rather than simplification, and how to spot when you're being sold more than you need.
    • Shifting Vendor Strategies: Acquisitions and Synergy Understand how large vendors grow through acquisitions that never get properly integrated, and what to look for when evaluating whether a "platform" is actually unified or just a collection of separate products.
    • Staying Flexible as Things Change Learn why security leaders need agile, modular strategies and should avoid long-term commitments to match the pace of change in technology and security threats.


    Resources Mentioned 
    • Gartner
    • cyberfuturist.com
    • Agoria
    • Rubrik
    • DORA
    • NIS 2
    • Microsoft Copilot
    • McAfee
    • Wiz
    • AWS S3
    • Iceberg Data
    • ClickHouse
    • Goldman Sachs
    • LangChain
    • The Cyber Sentinels Handbook


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security - from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    X:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    49 min
  • The Psychological Toll of Working in Cybersecurity - When You Can't Unsee What You've Seen

    Are you prepared for the psychological toll that comes with handling disturbing content in the cybersecurity world?

    Welcome to Razorwire, where today we’re exploring into the realities behind a career in cyber, from technical warfare to the often-overlooked human cost. 

    In this episode, I’m joined by therapist and consultant Eve Parmiter to examine the real psychological impact of repeated exposure to distressing material that many of us face during incident investigations, content moderation and threat research.

    Eve draws on her background in trauma therapy and real-world experiences both inside and outside of cybersecurity. Together, we discuss why even seasoned professionals struggle to talk about their experiences, how secondary trauma manifests in our daily lives and what can actually help in environments that don’t provide enough support.

    If you've ever had to investigate colleagues, review disturbing material, or make impossible decisions under pressure, this conversation will resonate. We don't shy away from hard truths, but we do focus on practical ways to build resilience and find some measure of satisfaction in doing the right thing - even when it's difficult.

    In this episode:

    1. Understand the true impact of secondary trauma in cyber roles.

    We break down the difference between stress, burnout and trauma specific to cybersecurity professions, exploring how exposure to disturbing content changes your outlook - and why it’s not a personal weakness.

    2. Learn why most pros don’t talk about their struggles and how to break the silence.

    Eve explains why lacking the right language keeps many from processing what they experience and offers insight into building peer support systems and practical organisational responses.

    3. Discover tested strategies for coping and recovery.

    You’ll leave with actionable advice straight from the worlds of therapy and cyber on how to protect yourself, when to seek help and the importance of cultivating supportive communities.

    Tune in for a genuine, valuable discussion that puts the mental health of cybersecurity professionals front and centre and find out how to make a tough job more sustainable for yourself and your team.



    Why Self Care Isn't Enough for Trauma

    "You can't self care your way out of trauma. There is no amount of bubble baths or ice baths that are going to remove certain images or certain experiences."

    Eve Parmiter



    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    • The Psychological Impact of Difficult Materials. Why exposure to traumatic or distressing digital content leads to anxiety, depression and long term negative outlooks.
    • Challenges Discussing Trauma in Cybersecurity. How professionals can overcome their reluctance to discuss experiences when they lack the language or organisational support.
    • Primary vs Secondary Traumatic Stress. Learn how to identify when direct and indirect exposure to disturbing content creates real psychological effects that often resemble PTSD.
    • Addressing Vicarious Trauma and Worldview Shifts. How to cope when repeatedly witnessing other people's trauma changes how you perceive the world and interact with your environment.
    • Moral Distress and Injury in Decision Making. Find out how to manage situations where you face ethical dilemmas with no clear 'right' choices.
    • Overcoming Isolation in Infosec Roles. Learn ways to tackle the solitary nature of many cybersecurity positions and find methods for sharing and processing difficult experiences.
    • Building Organisational Support Structures. Explore how to create better support systems, clearer policies and access to therapy or community resources for those regularly exposed to harmful material.
    • Implementing Practical Coping Strategies for Daily Exposure. How using visual and audio moderation tools can reduce the impact of reviewing distressing content.
    • Building Resilience and Finding Meaning. How community, positive reinforcement and focusing on 'doing good' help professionals recover and maintain motivation.
    • Resources for Mental Health in Cybersecurity. Find organisations and peer networks dedicated to improving mental health for cybersecurity professionals. 




    Resources Mentioned 
    • Mental Health and Cybersecurity Foundation
    • eveparmiter.com


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security - from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com. We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    X: @RazorThornLTD

    Website: www.razorthorn.com

    All rights reserved. © Razorthorn Security LTD 2025

    58 min
  • Hacking AI: The Risks for Businesses

    Understanding AI security threats before they become your next crisis

    On this episode of Razorwire, I explore the emerging frontier of AI security with leading experts Jonathan Care and Martin Voelk. We examine the latest risks, show you how adversaries are exploiting AI systems and share practical advice for professionals working with these rapidly advancing technologies.

    We move past the marketing speak to reveal how attackers are using generative AI, what it really takes to test these complex systems and what the rise of agentic, self-operating AI means for defenders. Security leaders, penetration testers and anyone implementing business technology need to understand these threats before committing to new AI solutions.

    This conversation addresses real incidents, examines practical realities and highlights why many enterprises are dangerously unprepared for what's ahead in AI security.

    Key Topics

    1. Inside the Mind of the Attacker: Learn how both ethical hackers and financially motivated criminals are already using AI to automate attacks, spread misinformation and create new vulnerabilities. Martin and Jonathan share examples of prompt injection, data poisoning and “model jailbreaking” - all tactics reshaping the cyber threat landscape right now.
    2. Pen Testing AI: What’s Different and What’s Still the Same: Go behind the scenes with insights into penetration testing for large language models and agentic AI. The episode discusses fresh attack surfaces, why classic testing skills are still vital and the new OWASP Top 10 for LLMs. If you’re considering buying AI-powered tools, take away concrete advice on how to stress-test these systems before attackers do.
    3. Business Risk, Legal Headaches and What to Demand from Vendors: With AI now touching everything from customer bots giving dodgy medical advice to autonomous agents able to cause chaos, the conversation gives practical advice about reputational, legal and operational risks. Listen for the must-ask questions every business should take to their vendors as well as new regulatory requirements that mean robust AI testing can’t be left as an afterthought.

    If you want to stay ahead of AI and cybersecurity developments and avoid building tomorrow's biggest headache, this episode is essential listening.

    AI Model Bias Debate: 

    " 77% of enterprises are reporting at least one AI related security incident. 62% of enterprises lack any dedicated testing programme.”

    Jonathan Care



    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen



    In this episode, we covered the following topics:
    • Test Your AI Before Attackers Do - With 77% of enterprises already hit by AI security incidents but 62% lacking testing programmes, discover what specific vulnerabilities to check for and how to implement proper AI red teaming.
    • Stop AI Hallucinations From Damaging Your Business - Understand how AI systems fabricate information and create legal liability, plus practical steps to identify and mitigate these risks before they affect customers or operations.
    • Protect Against Medical and Legal AI Disasters - Learn from real cases where AI gave dangerous advice and created legal obligations, including what liability questions you need to address with vendors and internal teams.
    • Secure Agentic AI That Can Take Real Actions - Discover why AI agents that can invoke APIs, modify data and trigger real-world changes require completely different security approaches than traditional chatbots.
    • Defend Against Prompt Injection Attacks - Get specific techniques for testing and protecting against AI-specific vulnerabilities that traditional cybersecurity controls cannot address.
    • Identify Poisoned Training Data and Supply Chain Attacks - Understand how attackers manipulate AI training data and learn what questions to ask about data sources and model provenance.
    • Implement Automated and Continuous AI Testing - Explore new tools and frameworks for always-on adversarial testing of AI systems, including what capabilities to build in-house versus buy.
    • Navigate AI Model Bias and Censorship Issues - Understand how different AI models reflect their creators' biases and learn strategies for getting balanced information across multiple sources.
    • Meet New Regulatory Requirements for AI Testing - Prepare for mandatory adversarial testing under the EU AI Act and US executive orders, including what documentation and processes you'll need.
    • Build AI Security Skills and Career Paths - Identify the specific certifications, training and technical skills needed for AI security roles, plus advice for both newcomers and experienced professionals transitioning to AI security.



    Resources Mentioned 
    • OWASP Top 10 for LLM
    • ChatGPT
    • Gemini
    • Grok
    • Claude
    • Anthropic
    • Retrieval Augmented Generation (RAG)
    • Reddit
    • Wikipedia
    • Hugging Face
    • GitHub
    • Deepseek
    • Gwen (Alibaba)
    • Burp Suite
    • Model Scan (Hidden Layer)
    • Terra Security
    • NIST Generative AI Profile
    • EU AI Act
    • US Executive Order 14110
    • NIST AI RMF
    • Expo.com
    • SecOps School
    • Learn Prompting
    • CISO Intelligence (Newsletter)
    • Cyber Sentinels Handbook
    • Pliny the Prompter


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.


    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com. We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    LinkedIn: Razorthorn Security

    YouTube: Razorthorn Security

    TikTok: Razorwire Podcast

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    57 min
  • Streamlining the Compliance Journey - An End-to-End Approach

    Is your compliance strategy making life easier or just adding more chaos?

    Welcome to Razorwire, where we take you to the heart of cybersecurity with voices that have seen it all. I’m Jim, your host and in this episode, I’m joined by Martin Davies (Audit Alliance Manager at Drata) and Patrick Sullivan (VP of Strategy and Innovation at A-LIGN). Together, we explore how to cut the compliance overhead, eliminate duplication across multiple frameworks and turn compliance into a competitive advantage that actually speeds up sales cycles.

    Compliance is rarely anyone’s favourite topic, yet it’s unavoidable and organisations are under more pressure than ever to do it well. We explore why compliance keeps getting more complex, what’s actually driving value and how the right blend of people, processes and technology can transform it from a painful cost centre into a genuine strategic asset.

    Key topics:

    1. Cutting Compliance Overhead: Discover practical ways to avoid duplication of effort, map overlapping controls across frameworks and use technology to bring order to compliance chaos.
    2. Compliance as a Value Generator, Not Just a Cost: Hear real world perspectives on shifting the mindset around compliance, from being a necessary evil to a competitive differentiator that can support new business, speed up sales cycles and add commercial value.
    3. The Road Ahead: Continuous Monitoring and Emerging Pressures: Explore the shift from annual audits to ongoing assurance, the impact of AI on compliance frameworks and the new reality of management liability in regulations like DORA and NIS2.

    If you’re ready to rethink compliance and turn it into a source of strategic advantage, this is an episode you won’t want to miss.

    On duplication of effort: 

    "The words ‘compliance overhead’ - when I hear that, I hear duplication of effort. If someone's doing the same control twice, that's objectively a bad thing." 

    Martin Davies


    Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen


    In this episode, we covered the following topics:
    • How to tackle the complexity of compliance - Understand why compliance requirements keep growing and discover strategies for managing multiple frameworks without getting overwhelmed.
    • How to turn compliance from cost centre to value generator - Learn practical approaches for positioning compliance as a competitive advantage that can speed up sales cycles and create business value.
    • Practical ways to streamline your compliance processes - Discover methods to eliminate duplication of effort, reduce time waste and support more agile business operations.
    • How to identify and eliminate overlap across frameworks - Learn techniques for mapping overlapping standards and consolidating controls to avoid doing the same work twice.
    • How to leverage technology and GRC tools effectively - Understand how platforms like Drata can transform evidence management, reduce audit stress and bring order to compliance chaos.
    • What auditors actually look for during assessments - Learn why auditors focus on intent and sound processes rather than box-ticking, and how to prepare effectively for audits.
    • When to shift from annual to continuous monitoring - Understand the growing trend towards ongoing assurance and when point-in-time assessments aren't enough.
    • How to manage third party and supply chain compliance risks - Learn strategies for validating and managing external risks as organisations rely more heavily on third parties.


    Resources Mentioned 
    • CTEM
    • Drata
    • A-LIGN
    • PwC
    • PCI DSS
    • ISO 27001
    • DORA
    • NIS 2
    • HITRUST
    • HIPAA
    • PCI SSC
    • EU AI Act
    • SOC 2
    • AICPA
    • SafeBase
    • Cyber Sentinels Handbook (book)


    Connect with your host James Rees

    Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.


    Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

    With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

    For more information about us or if you have any questions you would like us to discuss email [email protected].

    If you need consultation, visit www.razorthorn.com. We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.


    Linkedin: Razorthorn Security

    Youtube: Razorthorn Security

    Twitter:   @RazorThornLTD

    Website: www.razorthorn.com


    All rights reserved. © Razorthorn Security LTD 2025

    59 min

About Razorwire Cyber Security & InfoSec Insights

From the publisher's feed

Cybersecurity is evolving — and so should you. Razorwire brings the open conversations that give you the edge.