Razorwire Cyber Security & InfoSec Insights

In our latest episode, join me, James Rees, for a chat with Nick Palmer from Censys about the critical importance of attack surface management. With 25 years of experience in the industry, Nick explains how today's threat landscape has evolved dramatically, with attackers now discovering vulnerabilities within hours rather than weeks.

We explore the challenges of maintaining visibility across expanding digital footprints, particularly with cloud adoption creating new blind spots for security teams. Nick shares eye-opening real-world examples that illustrate the hidden vulnerabilities present in even seemingly secure environments.

We cover how organisations can gain continuous visibility of their assets, extend security monitoring to third party suppliers and build a security culture that protects customer data effectively.

A must-listen for security professionals seeking practical advice on protecting against modern cyber threats.

Key Talking Points:

1. Attack Surface Velocity: Learn how attackers can discover vulnerabilities within just hours instead of weeks, and how Censys's daily internet scanning helps organisations keep pace with this alarming speed. Nick talks about the mechanics behind this acceleration and what it means for your security strategy.
2. Supply Chain Security: Discover the hidden risks in your vendor ecosystem through Nick's shocking real-world example of compromised medical equipment. This is a key example on why monitoring your suppliers' security posture is just as crucial as your own.
3. 
   
4. Beyond Compliance: Understand why building a genuine security culture trumps mere regulatory compliance. Nick and I discuss practical approaches to embedding security consciousness throughout your organisation, from the C-suite to frontline staff.

Gain practical insights that will help you better defend your organisation. This conversation goes beyond theoretical concepts to deliver actionable security wisdom you can implement immediately.

"If you are looking at your external attack surface any less than daily, you're missing a trick. It has to be scanned at least daily, preferably in real time." 

-Nick Palmer, Censys

●     Attack Surface Management: Learn how to identify and manage your organisation's vulnerabilities to prevent cyber attacks.

●     Evolution of IT and Security: Gain historical perspective on how security challenges have evolved to better prepare for future threats.

●     Supply Chain Security: Discover techniques to protect your business from vulnerabilities introduced by third-party suppliers.

●     Legislation and Compliance: Understand how to navigate new regulations like DORA to avoid penalties and legal consequences.

●     Phishing Defence: Master strategies to protect your organisation from increasingly sophisticated social engineering attacks.

●     Rapid Response: Learn why and how to accelerate your security monitoring to match attackers' discovery capabilities.

●     Cloud Security: Acquire practical approaches to securing cloud and virtual environments against emerging threats.

●     Building Security Culture: Develop effective methods to embed security awareness throughout your organisation.

●     Continuous Monitoring: Implement cost-effective techniques for ongoing attack surface visibility to catch vulnerabilities before attackers do.

●     Security Tooling: Explore the latest technological innovations that can strengthen your security posture and response capabilities.

• Censys
• Black Hat
• Cyber Sentinels Handbook
• ZMap
• Chainalysis
• SWIFT network
• DigitalOcean
• Heroku

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

YouTube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

All rights reserved. © Razorthorn Security LTD 2025

In this episode of Razorwire, we’re looking into the contentious realm of AI and data privacy. This week, I’m joined by Amy Stokes Waters, CEO of The Cyber Escape Room Company, and Ryan Mangan, a chartered IT professional and Microsoft MVP, to explore the ethical implications of feeding our personal data into AI systems.

Join our discussion on recent controversies, including Adobe's T&C changes and Clearview's facial recognition technology, while questioning who truly benefits from AI data collection. We debate the balance between technological advancement and personal privacy rights, highlighting the disparities in how different organisations handle consent and transparency.

From medical research to creative rights, this episode addresses how AI development is outpacing both regulatory frameworks and organisational policies. As businesses increasingly rely on AI-powered tools, what safeguards should we demand, and how much of our digital footprint are we willing to sacrifice?

3 Key Talking Points:

1. The Opt-Out Illusion: Discover how major tech companies are quietly changing their terms of service to automatically opt users into AI training programmes using your data. We reveal the hidden challenges of truly removing your information once it's been absorbed into AI systems and what this means for your digital privacy. 
2. Policy vs. Protection Gap: Learn why most organisations lack proper AI usage policies, leaving customer data vulnerable. Our experts discuss how even well-intentioned employees are likely uploading confidential information to ChatGPT without realising the risks and what safeguards businesses should implement immediately. 
3. The Jurisdictional Minefield: Understand the complex legal landscape where regulations like GDPR and HIPAA struggle to keep pace with AI development. Our conversation explores the dangerous territory of international data jurisdiction and how conflicting regulations create loopholes that affect your privacy rights.

"I think it's really positive that actually these things are coming out and that there are court cases and legal action being taken against companies who are using data without consent." Amy Stokes Waters

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Spot stealth data collection – Identify how companies like Adobe and LinkedIn are changing their terms of service to automatically opt you into AI training programmes
• Protect your creative work - Understand the risks to your intellectual property when uploading content to cloud services with AI features
• Navigate consent manipulation - Recognise the tactics used to hide opt-out options and how to find them
• Safeguard sensitive information - Prevent employees from inadvertently exposing confidential data through ChatGPT and similar tools
• Understand data sanitisation - Learn what proper data anonymisation actually means and why it matters for your privacy
• Balance innovation with privacy - Discover how organisations can ethically use AI for advancements in healthcare while protecting personal data
• Create effective AI policies - Develop clear guidelines for your business on appropriate AI usage before data breaches occur
• Recognise AI's limitations - Identify when AI might present biased or false information, particularly in specialised fields like law
• Prepare for international data conflicts - Navigate the complex landscape of competing regulatory frameworks affecting your data (GDPR, HIPAA, etc.)
• Anticipate future privacy challenges - Get ahead of emerging concerns as AI technology continues outpacing regulatory frameworks

• The Cyber Escape Room Co - A business led by Amy Stokes Waters that creates cybersecurity-focused escape room
• Ether Assist - Ryan Mangan's AI platform designed specifically for IT professionals and security teams, providing technical assistance and support.
• OFFS Events - A conference series organised by Amy that hosts cybersecurity events in South Africa and the UK.
• The Cyber Sentinels Handbook – written by James Rees and described as "a primer for information security professionals", aimed at practitioners at all career stages, from beginners to experienced professionals.
• CoStar - A framework for creating effective AI prompts that helps users structure their queries with context, style, and other parameters to get better results from AI systems.
• Adobe's Terms of Service AI Training Controversy
• Clearview AI Dutch Data Protection Fine
• Microsoft Graph Security Information
• LinkedIn AI Training Suspension After ICO Concerns
• Slack's AI Features and Data Collection
• Model Autophagy Disorder (MAD) in AI
• Creating Effective AI Usage Policies

Amy Stoke-Waters

Amy has a decade of experience in sales and marketing and now acts as CEO at The Cyber Escape Room Co and CCO at Yellowstone Security. She is a founding member of RINA's Maritime Cyber Security Task Force and an active advocate for gender diversity in the industry. As a regular guest on podcasts and panels, Amy talks on a variety of topics including security culture and awareness, personal branding, and women in tech.

Ryan Mangan

Ryan Mangan is the CEO of EfficientEther Ltd, a Microsoft Startup focused on AI-driven IT solutions and cloud cost management. With a strong background in managed services, Ryan previously founded and led Systech IT Solutions, building successful technology businesses focused on Managed Services. A Microsoft MVP and Chartered Fellow of the British Computer Society (FBCS CITP), he is a recognised industry expert, author, and public speaker. Ryan is also an Editorial Advisory Board member for TechTarget, contributing to thought leadership in enterprise IT. His work has been featured in publications such as Computer Weekly, TechTarget, and BCS IT Now, and he regularly speaks at industry events, sharing insights on AI, cloud, and other IT topics.

• Humans vs AI: Building a Security Culture That Actually Works

YouTube: https://youtu.be/SNcpKrsWniY

Spotify: https://open.spotify.com/episode/53PxszWM34ZrpA9EnSHuJf 

• Hacking Cybersecurity Training: Escape Rooms & Entrepreneurial Thinking with Amy Stokes-Waters

YouTube: https://youtu.be/dpn8N4xfojA

Spotify: https://open.spotify.com/episode/5TWqagRzQdKZDQIxRjDOaP 

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

YouTube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Our latest episode brings in security expert Iain Pye, who shares military tales with me, your host James Rees, about what really happens when everything goes wrong. We get stuck into the nitty-gritty of incident response - the sleepless nights, the pressure from executives, and how to keep your team going when they're running on fumes. 

From ransomware attacks to system meltdowns, we chat about war games and escape room scenarios, exploring how organisations can build proper resilience rather than just ticking compliance boxes. We dig into why most incident response plans gather dust in drawers and what happens when you actually need to use them. Ian brings a refreshing military perspective to corporate incident management, showing how battlefield experience translates surprisingly well to handling information security crises. 

Whether you're dealing with compromised systems or insider threats, this episode packs practical wisdom for those moments when everything falls apart.

3 Key Talking Points and Reasons to Listen:

1. Building Resilience Through War Games: Discover why military-style drills and wargaming are crucial for effective incident response. Iain and I explore how regular team exercises - from realistic ransomware scenarios to creative "zombie apocalypse" simulations - help build the muscle memory and team dynamics needed when real crises hit. We share practical examples of how to run these exercises effectively.
2. Managing Team Stress in a Crisis: Learn the critical importance of managing your team during long running incidents. We break down the practical aspects often overlooked in incident response plans - from implementing proper shift patterns to ensuring your team stays fed, rested and functional during multi day crises. Find out why pushing your team to exhaustion is a recipe for disaster.
3. Turning Incidents into Improvements: Understand why post-incident analysis is where the real value lies. We discuss how to turn incident learnings into actionable improvements, including how to leverage serious incidents to secure necessary budget improvements. Learn why the "five whys" methodology is essential for preventing future incidents and strengthening your security posture.

On building muscle memory through repeated training: 

"It's drills essentially. It’s doing the same thing over and over again and having that natural reaction. So you train your body - your mind, essentially - so if the proverbial poo does hit the fan,  you can react in the right way and in accordance with what your SOPs [Standard Operating Procedures] might be."

Iain Pye

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Military Training for Incident Response: Learn how military-style drills can transform your team's ability to handle high-pressure security incidents with confidence and precision.
• Importance of Incident Response in Infosec: Master the essential skill of incident response and protect your organisation from data breaches and ransomware attacks effectively.
• Human Reactions to Emergencies: Discover practical techniques to keep your team calm and focused when emergencies strike, avoiding costly panic-driven mistakes.
• Role of Team Trust: Build unshakeable team trust that enables swift, coordinated responses during critical incidents.
• Communication During Incidents: Develop clear communication strategies that keep stakeholders informed and confident during crisis situations.
• War Games for Preparation: Create engaging war games and scenarios that prepare your team for real world incidents while building stronger team dynamics.
• Impact of Incident Stress on Teams: Protect your team from burnout during long-running incidents with proven strategies for managing stress and fatigue.
• Lessons Learned Post-Incident: Turn every incident into an opportunity for improvement by conducting effective post-incident reviews that actually strengthen your security.
• Importance of Documentation and Reporting: Create documentation and reports that drive real change and secure essential resources for your security programme.
• Scenario Planning for Various Risks: Build comprehensive scenario plans that prepare your organisation for any crisis, from common incidents to worst case scenarios.

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

All rights reserved. © Razorthorn Security LTD 2025

Welcome back to Razorwire!

I'm your host, Jim, and in this second part of our CISO Dilemmas series, we welcome back security experts Oliver Rochford and Richard Cassidy. Moving beyond the challenges covered in part one, this episode explores the rewarding aspects of the role while taking a frank look at the ethical issues security leaders regularly face. The guests share personal experiences and practical actions for transitioning from technical expertise to strategic leadership, building effective teams and managing relationships across the business. 

As regulations tighten and cyber threats evolve, we talk about how the CISO position has grown far beyond its IT roots to become a complex executive role requiring business knowledge, political savvy and strong moral judgement. 

This conversation offers a valuable perspective on where the role is heading and what it takes to succeed. Stay til the end for our predictions about how the CISO position will transform over the next five years as organisations grapple with AI, automation and increasing regulatory scrutiny.

We’re talking about:

The CISO Role Beyond Technology

Learn how modern security leaders are shifting from pure technical expertise to become strategic business enablers. Richard and Oliver share some great insights about balancing technical knowledge with leadership skills, and explain why successful CISOs need to master communication, relationship-building and business strategy alongside their security expertise.

Navigating Ethical Challenges

Get an insider's perspective on the ethical decisions that CISOs face, from breach disclosures to managing surveillance requests. Using some real world examples from Oliver and Richard, we talk about how security leaders can maintain their integrity while balancing business interests, regulatory requirements and moral obligations.

Building Future-Ready Security Teams

Discover practical approaches to developing high performing security teams in an era of rapid change. The conversation offers actionable guidance on mentoring new talent, improving resilience and creating a positive security culture - essential knowledge for both current leaders and those aspiring to senior 

This episode is packed with practical advice and forward-looking perspectives that every cybersecurity professional can benefit from. 

"CISOs often face ethical dilemmas... 52% of CISOs reported that they've faced situations where they felt pressured to compromise ethical standards for business interests. In cybersecurity, the hardest decisions aren't technical - they're ethical." 

Richard Cassidy

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Role Definition of the CISO: Learn how to navigate different stakeholder expectations and position yourself effectively as a CISO.
• Transformational Changes: Gain insights on transitioning from technical expert to strategic business leader.
• Key Skills for CISOs: Master the essential skills that make modern CISOs successful—from boardroom communication to risk management.
• Ethical Dilemmas: Handle ethical challenges confidently with real-world strategies from experienced security leaders.
• Regulatory and Legal Knowledge: Build your knowledge of global security regulations and protect yourself from personal liability.
• Leadership Impact: Develop leadership techniques that inspire and retain top security talent.
• Collaboration and Communication: Improve your influence across the organisation through proven communication approaches.
• Future of CISO Role: Prepare for the future of security leadership and upcoming industry changes.
• Incident Response and Crisis Management: Build effective incident response capabilities and crisis management skills.
• Positive Aspects of Being a CISO: Discover what makes the CISO role uniquely rewarding and how to find personal satisfaction in security leadership.

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cybersecurity professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cybersecurity—from seasoned professionals with years of experience, triumphs and lessons learnt under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Surviving and Thriving in the 2025 Cybersecurity Landscape: Predictions and Strategies

Welcome back to Razorwire! Join me, Jim, as we forecast the major trends and changes for 2025 that are set to reshape the cybersecurity industry. Joining me are cyber veterans and regular guests Oliver Rochford and Richard Cassidy.

As cybersecurity becomes increasingly complex and critical to business operations, understanding what lies ahead can provide an invaluable edge. In this episode, Richard, Oliver and I break down our predictions for 2025, focusing on market consolidation, the evolution of AI in security and the ever-tightening grip of global regulations. From the rising costs of consultancy services to the rapid proliferation of security technologies, we've got you covered. We'll also take a look into the potential rise of AI-powered hacktivism and what it means for organisations worldwide. 

Key Takeaways:

1. Strategic Investment Planning for 2025 - Get expert insights on why vendor consolidation may not be the answer and learn practical approaches to evaluating emerging security technologies against established solutions while managing rising costs.
2. Practical Regulatory Compliance Tactics - Discover how organisations are using AI to efficiently manage overlapping regulations, with actionable strategies for meeting multiple regulatory requirements without duplicating effort.
3. Future-Proofing Your Security Strategy - Learn how the threat landscape is evolving with politically motivated insiders, how organisations are using behavioural analysis in security and what AI can realistically do for security operations in 2025.

From understanding emerging markets to decoding regulatory complexities, this episode offers critical insights to arm you for the future. Don’t miss out on these expert predictions and actionable advice!

Consolidation of Regulation: 

"A group of CISOs wrote to the G20 summit, the OECD member states, writing a letter crying out for some level of sanity on regulatory releases because it's just getting to the point where businesses are struggling."

Richard Cassidy

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

● Consolidation of the Cyber Security Market Learn how to evaluate whether vendor consolidation makes sense for your organisation and identify which emerging technologies could add value to your security programme.

● AI in Security Operations Understand the practical applications of AI in security versus future possibilities, helping you make informed decisions about AI investment and implementation.

● Regulation Complexity Discover strategies for efficiently managing overlapping regulations and learn how other organisations are successfully navigating complex compliance requirements.

● Quantum Encryption Learn about forthcoming quantum encryption products and how to start preparing your organisation's encryption infrastructure for quantum resilience.

● AI Enabled Activism Understand how autonomous AI systems could be used in cyber campaigns and what defensive measures you should consider implementing.

● Increased Costs and Market Changes Get practical advice on managing rising security costs and maintaining effective security despite budget pressures.

● Vendor Pricing and Economic Pressures Learn negotiation strategies for vendor relationships and how to evaluate the true value of security investments in today's economic climate.

● Insider Threat Intelligence Explore new approaches to behavioural analysis and risk profiling that can enhance your insider threat programme while maintaining privacy considerations.

● Future Threat Landscape Understand emerging threat actor motivations and behaviours to better prepare your organisation's defensive strategy.

● Technology for Regulatory Compliance Learn how to leverage AI and automation to streamline regulatory compliance while improving operational efficiency.

• DORA
• Gartner
• OECD
• NIS 2
• PCI DSS
• HIPAA
• Cyber Essentials
• ISO
• PIPL
• CCPA
• GDPR
• Three Mile Island
• Journal of Psychological Research in Cyberspace
• Journal of Strategic Security
• Taylor and Francis Online
• Popular Mechanics
• Neuralink
• Rubrik
• CrowdStrike
• Palo Alto
• Fortinet

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Ever wonder how to get the most out of your cybersecurity budget without leaving your company vulnerable?

Hey there, it’s Jim from Razorwire! In this episode, I sit down with cybersecurity pros Chris Dawson and Iain Pye to chat about smart spending when it comes to your cybersecurity budget. Whether you’re a big enterprise with a hefty budget or a small business wanting maximum impact on a small budget, we’ve got some actionable insights for you.

In this episode, we tackle one of the industry's most pressing challenges—how organisations allocate and manage their cybersecurity spending. Together with Chris and Iain, we examine the complex relationship between IT departments and security teams competing for resources, exploring perspectives from startups making their first security investments through to enterprises managing substantial security budgets.

Drawing on our collective experience, we challenge conventional wisdom about security investment and explore whether current approaches truly serve organisations effectively. Through real-world examples and hard-earned lessons, we examine why traditional approaches often fall short and propose fresh perspectives on security strategy.

Our debate around tools versus talent—and occasional heated disagreements—gives you multiple battle-tested perspectives to help shape your own security investment strategy, whether you're just starting out or running an enterprise security programme.

1. Get More Bang for Your Security Buck - Learn how successful organisations are stretching their security budgets by intelligently balancing people, tools and training - so you can stop wasting money on solutions that don't deliver
2. Build Security That Sticks - Discover how to create a security programme that works for your whole business, not just IT, with proven approaches that align security spending to genuine business risks
3. Smart Security on a Budget - Get practical insights on maximising security with minimal spend, from leveraging free tools effectively to knowing when (and how) to bring in expert help

Tune in to Razorwire for these tips and more, and start making your cybersecurity budget work harder for you, not the other way around!

Decentralised Security Budgeting: 

"Security doesn't need to be expensive. It just needs to be effective, and there's a million different ways to handle security in a million different organisations."

Jim Rees

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

●      Scale Security for Your Company Size: Implement the right cybersecurity strategy whether you're running a small business or large corporation.

●      Balance Your Security Investment: Make informed decisions between hiring security personnel or investing in software tools when working with limited resources.

●      Measure Security ROI: Effectively demonstrate and track the business value of your cybersecurity investments.

●      Choose Security Partners: Select and evaluate third party security providers that match your organisation's needs and budget.

●      Implement Continuous Security Testing: Set up a continuous penetration testing programme using global resources to maintain strong security.

●      Build a Security-Aware Culture: Create and run effective security awareness programmes that actually reduce organisational risk.

●      Structure Your Security Budget: Establish and manage a dedicated security budget separate from IT spending.

●      Unify Physical and Digital Security: Create a cohesive security strategy that bridges physical and IT security measures.

●      Access Expert Security Guidance: Leverage consulting services to get CISO-level expertise without the full time cost.

●      Optimise Security Tools: Combine open source and paid security solutions to maximise protection on a limited budget.

The Cyber Sentinel's Handbook: A Primer for Information and Security Professionals by James Rees

ISO 27001/27002

PCI DSS

GDPR

DORA

HIPAA

EU Cybersecurity Certification Scheme

OpenVAS

Greenbone

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cybersecurity professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cybersecurity—from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Join us for part one of our two-part series examining the world of Chief Information Security Officers. This episode welcomes back Richard Cassidy, Field CISO at Rubrik, and Oliver Rochford, former Gartner analyst and founder of Cyberfuturist. This episode offers insights that will give you insight into what makes security leadership successful - and what can lead to failure.

Through real world experiences and practical examples, we explore where CISOs best fit in modern organisations, proven approaches for communicating risk to boards and how to handle increasing personal accountability under new regulations. Our guests share hard won lessons from building security programmes across different business cultures, revealing what works and what doesn't. We also examine why CISO tenures average just 18-24 months, and identify the changes needed to make the role sustainable.

As cybersecurity becomes a pivotal aspect of business operations, the significance of CISO roles continues to grow - and so do the challenges. From justifying cybersecurity budgets to handling personal accountability for breaches, we take a look at the complexities and evolving duties of today's CISOs. 

For security professionals, this discussion will help you prepare for senior leadership. For current CISOs, you'll gain strategies for navigating common challenges. And for business leaders, you'll learn how to better support and work with your security teams to protect your organisation effectively.

Key Talking Points:

• The role and responsibilities of modern CISOs - understand how the Chief Information Security Officer position has transformed from a technical IT role into a complex business leadership position that spans multiple organisational functions 
• 
  
• Reporting structures and organisational challenges - discover how different reporting relationships (to CEO, CIO, CFO, etc.) impact a CISO's effectiveness and ability to implement security programmes across the business 
• 
  
• The personal and professional costs of being a CISO - learn about the realities and challenges that CISOs face, from stress and burnout to reputation management and legal liability, providing valuable insights for those considering or currently in the role

Don't miss out on this deep dive into the cost, both personal and professional, of being a Chief Information Security Officer.

Evolving Role of the CISO: 

“A CISO today is essentially a senior executive that is responsible for designing, implementing, and overseeing any organisation's cybersecurity strategy... But it has significantly evolved from what used to be the old IT security director from simply managing technical security operations to actually acting as a key business partner... balancing risk and compliance and security whilst, and this is the hard part, aligning with organisational goals.”

Richard Cassidy

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Learn proven approaches for justifying security investments - Discover how to effectively demonstrate the value of preventative security measures and build compelling business cases for cybersecurity budgets 
• Master the language of business risk - Learn how to translate complex cyber risks into clear financial, operational, reputational and regulatory impacts that resonate with senior leaders 
• Navigate the new regulatory landscape - Understand how recent regulations like the SEC Cybersecurity Disclosure Rule affect your accountability and what this means for your role 
• Secure board-level investment - Learn strategies for overcoming common challenges when seeking security funding and how to build persuasive investment cases 
• Manage professional pressures effectively - Gain practical insights into handling accountability demands whilst avoiding burnout in high pressure security leadership roles 
• Balance competing demands successfully - Learn from experienced CISOs about managing the 24/7 nature of the role whilst maintaining personal wellbeing 
• Communicate security risks effectively - Master techniques for explaining complex security concepts in ways business stakeholders truly understand and act upon 
• Adapt your approach for different organisations - Learn how security attitudes and approaches vary across small, medium and large businesses, and how to adjust your strategy accordingly 
• Navigate organisational politics successfully - Understand how reporting structures and internal dynamics affect security programmes and learn how to operate effectively within them 
• Prepare for future challenges - Get ahead of how AI and evolving regulations will reshape the CISO role and what this means for your career development

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

As AI reshapes cybersecurity threats, understanding how scams are evolving has never been more critical.

Welcome to Razorwire. I'm Jim, and today I'm talking with Noora Ahmed-Moshe, VP of Strategy and Operations at Hoxhunt. We'll explore how AI is transforming cybersecurity threats and what that means for protecting ourselves and our organisations.

We discuss how traditional scams have changed with AI technology and look at why phishing remains a persistent problem, along with practical ways to make security training more effective. Noora explains her approach to combining smart technology with human awareness and why building a supportive security culture works better than focusing on mistakes. Join us to gain insights into today's cyber threats and take away actionable tips for how organisations can better prepare their teams.

3 Key Talking Points:

1. AI-Enhanced Phishing Techniques: Discover how AI, including tools like ChatGPT, has drastically increased the volume and sophistication of phishing emails, making them harder to detect and more culturally nuanced.
2. Positive Reinforcement in Training: Learn why a supportive, non-punitive approach to security awareness training—using gamification and rewards—can lead to better internalisation of security practices among employees.
3. Deepfake Challenges: Understand the emerging threats posed by deepfake technology, particularly in a remote work environment, and how organisations can adapt their security measures to validate identities effectively.

Tune in to this vital discussion to stay ahead of cyber threats and foster a culture of security within your organisation.

Motivating Through Gamification: 

"It is about motivating people and how you do that. And that's why at Hoxhunt, when we do our training, for example, in terms of social engineering attacks, we reward people anytime they report something. Then they're on a leaderboard, and it's all gamified. So it gives people this real sense of engagement, and that makes it positive."

Noora Ahmed-Moshe

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Power up your security training: Learn how to structure effective security training programmes that actually prevent data breaches, based on real-world examples of what works and what doesn't.
• Master the scammer’s playbook: Understand why "too good to be true" scams continue to succeed by exploring their evolution from the Love Bug virus to modern day frauds, helping you spot timeless patterns in social engineering.
• Outsmart AI-powered threats: Discover how AI is transforming phishing attempts with sophisticated language and cultural awareness and learn what makes these new attacks so challenging for staff to detect.
• Stay ahead of QR code attacks: Get ahead of emerging threats by understanding how criminals are exploiting QR codes in innovative ways and learn how to spot these often-overlooked security risks.
• Unlock human security potential: Understand why human behaviour is at the heart of most security breaches and learn practical ways to address these vulnerabilities in your organisation.
• Build a confident security culture: Discover why leading organisations are moving away from fear-based security cultures and learn how to create an environment where staff feel confident reporting potential incidents.
• Harness the power of psychology: Learn how behavioural science principles can transform your security awareness programme, with practical insights into how to offer positive reinforcement.
• Maximise security engagement: Explore successful examples of how organisations are using gamification and rewards to motivate staff, with practical tips you can apply to your own security programme.
• Tackle the deepfake challenge: Prepare for the future by understanding how deepfake technology is creating new authentication challenges, particularly for remote teams, and learn how organisations are adapting.
• Future-proof your training: Gain insights into creating adaptable security training that evolves with technology while meeting diverse employee needs, helping you build a more resilient security culture.

Security Threats and Tools

• Hoxhunt’s Security Awareness Training
• Love Bug virus (early 2000s)
• Y2K preparedness systems
• Antivirus software and firewalls (early countermeasures)

Statistics and Data

• 4,151% rise in malicious emails since ChatGPT launch
• 68% of breaches start with a human element
• 80-90% of human-related breaches begin with phishing
• Average cost of a breach was approximately $4.76 million USD last year
• 69% of people deliberately bypass their company's security guidance

• QR code scams, particularly in parking spots and car charging stations
• Package delivery scams
• Ransomware-as-a-service available on dark web
• Social engineering attacks targeting healthcare companies

Training Tools

• Hoxhunt's gamified security training platform with leaderboards and reward systems
• Traditional CBT (Computer Based Training) systems
• Phishing simulations

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Are layoffs increasing your cybersecurity risk and driving your team to burnout? This episode looks into the psychological underpinnings of infosec to navigate turbulent times at work.

Welcome to Razorwire, the podcast that cuts through the complexities of information security with sharp insights and expert discussions. In this episode, I’m joined by Lisa Ventura (MBE), founder of Cybersecurity Unity, and Bec McKeown, a psychologist specialising in high-risk environments. Together, we explore the hidden psychological factors that shape cybersecurity practices and discuss essential strategies to safeguard your organisation.

Join us as we discuss the impact of economic layoffs on cybersecurity, the efficacy and ethical concerns surrounding psychological profiling, and the sophisticated tactics employed by malicious actors in today's digital arena. Lisa, Bec, and I also unpack the importance of organisational culture in mitigating human error, the role of mental health in cybersecurity, and how to implement targeted security measures without overwhelming your team. This episode is a must-listen for professionals seeking to understand the human dynamics behind infosec challenges and cultivate a supportive, resilient security culture.

3 Key Takeaways:

1. Protect Your Organisation Without Crossing Privacy Lines. Want to strengthen your security approach without relying on controversial psychological profiling? Discover practical, ethical alternatives as Bec McKeown walks you through smarter ways to assess and mitigate insider risks whilst preserving employee trust and privacy.
2. Prevent Data Theft During Company Transitions. Is your organisation facing changes? Learn how to protect your critical assets during turbulent times. Lisa Ventura reveals proven strategies to identify and secure your most valuable data, particularly when your company is experiencing workforce changes or economic pressure.
3. Build a Stronger, More Resilient Security Team. Ready to boost both your security effectiveness AND team morale? Get hands-on techniques from Bec McKeown to create an environment where your security professionals thrive. Walk away with practical steps to reduce burnout, increase psychological safety and build a high-performing team that stays sharp and engaged.

Tune in to Razorwire for actionable advice and expert perspectives to fortify your cybersecurity strategy amid challenging times.

On Psychological Safety & Blame Culture:

"If people are constantly told off for not doing things in the right way, whether that's cybersecurity training or otherwise, they're never gonna fess up to it... if you haven't got that psychological safety within the culture, then these things are probably more likely to happen because it's not in the person's best interest to hold their hand up."

Bec McKeown 

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

Understanding Layoff Security Risks: Explore why workforce changes increase data theft risks and why organisations need heightened awareness during these transitions.

Beyond Psychological Profiling: Learn more effective and ethical ways to assess security risks without compromising employee privacy - practical alternatives you can implement today.

High-Value Target Protection: Understanding why certain roles face increased targeting and need additional security considerations.

Maximise Security Training Impact: Transform your training approach with engaging methods that stick - discover how to boost participation while strengthening your security posture.

Navigating Return-to-Office Security: Insights into balancing necessary monitoring with employee trust, and why two-way dialogue matters in implementing security measures.

Strengthen Your Team's Mental Resilience: Tap into valuable resources from the Mental Health and Cyber Security Foundation and build a supportive environment that keeps your security team performing at their best.

Enhance Human Expertise: Balance automation with human insight - learn practical ways to maintain sharp situational awareness whilst leveraging technology effectively.

Understanding Security Regulations: Explore how legislation like DORA and certifications like Cyber Essentials are pushing organisations to take security more seriously.

Prevent Security Team Burnout: Implement proven strategies to support your infosec professionals and maintain peak team performance through challenging times.

The Importance of Security Culture: Why organisational support for security teams matters and how leadership attitudes impact security effectiveness.

• Cybersecurity Unity: Founded by Lisa Ventura, focusing on cybersecurity awareness and culture change.
• Mind Science: Founded by Bec McKeown, bringing psychological insights into high-risk industries, including cybersecurity.
• Mental Health in Cybersecurity Foundation: An organisation addressing burnout and mental health issues in cybersecurity professionals.
• Cyber Essentials: A certification program for businesses to ensure basic cybersecurity standards.
• Companies House: A UK government agency that could potentially integrate cybersecurity standards into its registration processes.
• The FAIR Institute: Although not directly mentioned in this podcast, it is referenced in the context of discussing risk management methodologies in cybersecurity.
• The FAIR Methodology: Not directly mentioned but relevant to the broader discussion of risk management in cybersecurity.
• DORA: A regulatory framework that could impact cybersecurity practices in financial institutions and their suppliers in Europe.

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Every vendor you trust and every employee you hire could be your next security crisis—explore the realities of third party risk and insider threats on this episode of Razorwire!

Join us for a discussion on the multifaceted challenges of third party risk and how they can destabilise your organisation. From the growing complexities of cloud providers like AWS and Azure to detecting and dealing with insider threats, our conversation covers it all. 

My esteemed guests, Razorwire favourites Iain Pye and Chris Dawson, share their perspectives on the right to audit third parties and how shifts in business models and changing workplace culture impact our security postures. 

We also break down a case study involving indemnity and insurance settlements following a breach incident, providing you with practical takeaways for enhancing your own security protocols.

Key takeaways:

Strengthen Your Third Party Risk Management

• Implement contractual audit rights early in vendor relationships
• Develop resilience plans for vendor service failures
• Understand the risks of supply chain dependencies (third parties of third parties)
• Plan for scenarios where key service providers might fail or be compromised

Understand and Mitigate Insider Threats

• Identify different types of insider threats (accidental, disgruntled employees, corporate espionage)
• Monitor for behavioural changes and suspicious activity patterns
• Implement ongoing background checks and security clearance reviews
• Balance monitoring with employee privacy and company culture considerations

Address Modern Security Challenges

• Evaluate the cost-benefit trade-offs between in-house and outsourced services
• Implement monitoring solutions that correlate data from multiple sources
• Develop security strategies that account for both human and technical factors
• Create comprehensive risk assessments that include both internal and external threats

Join us on Razorwire as we untangle the complexities of third party risk and insider threats, providing you with actionable insights to fortify your organisation's cyber defences.

On the inevitability and scale of third-party breaches: 

"It's inevitable. You're gonna have a third party breach. There's about, what, 10 a day... You could do all the due diligence in the world and all the security checks about this. You could have a very robust vendor risk management, whatever you wanna call it. At the end of the day, it's gonna take one little, maybe insider threat on the third party side, and that will cause a breach." 

Iain Pye

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

● Implementing Third Party Audit Rights: Secure your organisation by establishing robust audit rights in vendor contracts before engagement begins.

● Evaluating Cloud Provider Stability: Assess and mitigate risks when selecting cloud providers by verifying their financial stability and data migration capabilities.

● Preventing Insider Security Breaches: Distinguish and protect against both intentional and accidental internal security threats through targeted controls.

● Building a Strong Security Culture: Foster an environment where employees actively report and respond to security warnings rather than normalising them.

● Managing Employee-Related Risks: Develop strategies to identify and address employee dissatisfaction before it becomes a security threat.

● Controlling Access Privileges: Implement strict access management protocols to prevent credential misuse and unauthorised access sales.

● Managing Supply Chain Security: Build resilience into your supply chain by mapping dependencies and establishing clear liability frameworks.

● Implementing Comprehensive Behavioural Monitoring: Deploy systems that analyse multiple data sources (login patterns, email access, data transfers) to identify suspicious user behaviour patterns.

● Protecting Against Espionage: Apply updated legal frameworks like the UK National Secrets Act to safeguard intellectual property and sensitive information.

● Deploying Dynamic Security Monitoring: Establish continuous monitoring systems for both employees and third parties to detect threats early.

• "The Cyber Sentinel's Handbook" by Jim
• AWS (Amazon Web Services)
• Azure
• GCP (Google Cloud Platform)
• CrowdStrike
• UK National Secrets Act (updated 2024)

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025