Razorwire Cyber Security & InfoSec Insights

How to Optimise Your GRC Tools

Improving Value, Efficiency & True Risk Management

Are your GRC tools really managing risk, or just creating noise?

Welcome to the latest episode of Razorwire, where we cut through the complexities of the cybersecurity world to deliver actionable insights. 

I'm your host, Jim, and in this episode, we're discussing the multifaceted challenges and opportunities surrounding Governance, Risk and Compliance (GRC) tools with none other than Jack Jones, creator of the FAIR risk model and a seasoned security professional with nearly 40 years’ experience.

In our conversation, Jack and I explore the intricate landscape of GRC tools, questioning their effectiveness in truly managing risk. We talk about the difference between controlling efficiencies and understanding genuine risks, shedding light on the often misleading contents of risk registers. 

In this episode, you'll learn invaluable insights that could transform how you approach risk management and compliance. From navigating price range vs efficiency, to the idea of developing a more effective and affordable GRC solution, this episode offers a treasure trove of useful takeaways for anyone in the cybersecurity field. 

1. The Real Cost of GRC Tools: Jack and I discuss the hidden expenses and renewal price hikes associated with existing GRC tools. If you're feeling the financial strain of your current GRC solutions, this segment is a must-listen to understand the true cost and value proposition of these tools.
2. Redefining Risk Management: We talk about the importance of differentiating between real risks and mere efficiencies and how many organisations can get this wrong. Learn how to avoid the ‘noise’ in your risk register to focus on genuine risk scenarios that matter to your business.
3. The Path to Better GRC Solutions: Tune in to hear our thoughts on the pressing need for innovation in GRC tool design. If you're looking for practical, cost effective solutions tailored to meet your risk management needs, you'll want to hear our insights and future plans.

Don't miss this conversation that could reshape your perspective on GRC tools and risk management.

"If I thought the [GRC tool] technology is actually provided anywhere near the value of their potential… if the GRC products and their implementations were actually doing the job they're intended to do, they should cost a lot of money because they would be providing a ton of value." - Jack Jones

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Cybersecurity Responsibilities Debate: We debate whether cybersecurity should fall under IT or infosec departments.
• Penetration Testing Management: How penetration testing could be subject to a conflict of interest depending on which department manages it.
• GRC Tool Costs: Maximising GRC Tool ROI: Gain insights on how to assess and optimise your GRC tool's value proposition through regular utilisation and cost reviews.
• Identifying GRC Tool Shortcomings: Understand the common pitfalls of popular GRC tools in addressing real world risks, enabling better tool selection and implementation.
• Proper Risk Register Management: Learn to distinguish between genuine risks and audit deficiencies for more accurate and useful risk registers.
• Third-Party Risk Management: Learn strategies for effectively managing the challenges posed by third party risks in modern business environments.
• Effective Risk Communication: Master the art of framing risk discussions around loss event scenarios, for better communication with executives.
• The Potential of GRC Tools': Recognising the potential of GRC tools to manage complex IT environments and consolidate security data effectively.
• Ineffective GRC Tools: Exposing how security budgets are heavily consumed by expensive and often inefficient GRC tools, limiting additional security measures. 
• Balancing Security Budgets: Learn to critically evaluate GRC tool costs and effectiveness to ensure balanced allocation of security resources.

• The FAIR model
• ISO 27001
• PCI compliance
• Book: "The Cyber Sentinels Handbook"
• GRC Tools

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: https://www.razorthorn.com/

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the podcast where I, James Rees, cover the cybersecurity topics that matter with expert guests from across the industry. We aim to help cybersecurity professionals enhance their skills, improve their work performance, and boost their overall quality of life in this demanding field.

The illustrious Lisa Ventura, MBE, award winning cyber security specialist and the founder of Cyber Security Unity, joins me in this episode. We talk about the pressing issues that cybersecurity professionals face on a daily basis, from mental health struggles to dealing with industry narcissists.

Lisa shares her insights on current industry developments and uses her personal experiences to offer practical advice and knowledge for cybersecurity professionals at all career stages.

Join us as we talk about:

1. Burnout and Mental Health in Cybersecurity: We talk about the root causes of burnout and mental health issues among cybersecurity professionals, and share practical strategies to protect your wellbeing in a high stress environment.

2. Navigating Industry Narcissism: Gain insights on how to identify and handle narcissistic behaviours in the workplace, and work towards a healthier and more supportive professional atmosphere.

3. Cyber Skills Gap and Industry Trends: Lisa's shares her thoughts on the role of AI and VC money, and the ongoing challenge of closing the cyber skills gap, especially in smaller organisations.

Tune in to Razorwire and empower yourself with the knowledge and resilience essential for thriving in the cybersecurity arena.

Lisa on handling narcissists in the workplace: 

"If it gets too much, I have only one bit of advice. And it's not a good bit of advice to say, and that is to find something new as soon as you possibly can and leave because those individuals will never change."

Lisa Ventura, MBE

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Burnout and Mental Health: Discover strategies for managing burnout and maintaining mental health in cybersecurity.
• Cyber Skills Gap: Learn about the factors contributing to the cyber skills gap and how this can be addressed.
• Responsibility and Fear: Understand the psychological impact of responsibility and blame in security roles.
• Budget Reductions and Layoffs: Find out how budget cuts and layoffs are affecting the industry post-pandemic.
• Handling Narcissistic Individuals: Get practical advice on dealing with narcissistic individuals in the workplace.
• Infosec Industry Trends: Explore current and future trends in information security, including AI misuse.
• Legislation and C-Suite Attention: Learn how new legislation is increasing executive-level focus on cybersecurity.
• Experiences in Infosec: Hear firsthand accounts of dealing with negative behaviours in the industry.
• Targeting and Narcissism Among Women: Uncover insights on targeting and hypocrisy, even among diversity advocates.
• Challenges for Young Professionals: Find out how mentorship can help newcomers overcome challenges and impostor syndrome.

• Cyber Sentinels Handbook
• Who Wants to Be a Millionaire?
• Cyber Security Unity
• UK Cyber Security Association
• Titania Limited
• Nipper Studio
• Malvern cyber cluster
• Midland Cyber
• BT
• Pinson Mason
• Boost Technology Group
• Qualitest
• Autism awareness day
• Imposter syndrome awareness day

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Unlock the truth about using Large Language Models (LLMs) in cybersecurity - are they the next big thing or just another trend?

In this episode of Razorwire, your host, James Rees, brings together cybersecurity expert Richard Cassidy and data scientist Josh Neil to talk about the use of AI and large language models (LLMs) in cybersecurity and their role in threat detection and security. Join us for a discussion on the capabilities and limitations of these technologies, sparked by a controversial LinkedIn post. 

We bring you expert insights into AI in security applications and a frank discussion on always being open to learning and correcting misconceptions. Hear about real world examples and practical advice on how to integrate AI tools effectively without falling into common traps. This episode delivers a balanced, in depth look at an often misunderstood but crucial topic in modern cybersecurity.

3 Key Takeaways:

Anomaly Detection Challenges: We break down why traditional time series models are still king when it comes to anomaly detection, highlighting the limitations of LLMs. Learn why these models are better suited for identifying real threats without drowning in false positives.

Role of Critical Thinking in Cybersecurity: Richard Cassidy emphasises the irreplaceable value of human expertise in threat detection. Discover why relying too heavily on AI could stifle critical thinking and skill development, especially for junior analysts, potentially weakening your security team in the long run.

Practical Applications and Misconceptions: Hear a candid conversation about the real strengths and weaknesses of LLMs in cybersecurity. Both guests share practical advice on how LLMs can augment, but not replace, human-driven methods to ensure stronger, more reliable security measures.

Tune in to Razorwire for an episode that cuts through the hype and delivers actionable insights for cybersecurity professionals navigating the evolving landscape of AI in security.

The Downside of AI in the Workplace: 

"My concern with AI assistants or co-pilots with quick and easy answers, the junior analysts aren't learning the critical thinking required to become senior analysts, and therefore we're losing our bench. And we're going to end up with unskilled senior analysts that don't know when the LLM doesn't know what to do. Neither does the human."

Josh Neil

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

●      Anomaly Detection Challenges: Find out how experts approach the complex task of identifying unusual patterns in cybersecurity data.

●      LLMs vs. Traditional Methods: We explore different approaches to anomaly detection, comparing cutting-edge AI with established statistical techniques.

●      Organisational Understanding: Listen to insights on the importance of deep knowledge about critical systems for effective threat detection.

●      Surgical vs. Brute Force Approaches: Discover the debate surrounding different methodologies in cybersecurity, and the role of human expertise.

●      Training and Critical Thinking: We examine how the increasing use of AI tools might impact skill development in the cybersecurity workforce.

●      Evolution of Threat Detection: Take the journey from manual processes to advanced automated systems, and learn how to take on the new challenges that have emerged.

●      LLMs' Role in Cybersecurity: Find out how we can integrate LLMs within existing security frameworks.

●      Misconceptions About LLMs: We explore common misunderstandings about AI capabilities in cybersecurity and their potential consequences.

●      AI's Impact on Security Practices: Get recommendations on how organisations can responsibly incorporate AI tools into their security strategies.

Los Alamos National Laboratory

Ernst and Young

Microsoft

Securonix

Alpha Level

Rubrik

"The Cyber Sentinel's Handbook"

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Are you ready for DORA and NIS2? Discover how these regulations could transform your security strategy!

Welcome back to another episode of Razorwire! Today we unpack the DORA and NIS2 regulations with esteemed cybersecurity expert Richard Cassidy. I’m your host, Jim Rees, and I’ll be guiding the conversation for anyone navigating the evolving landscape of digital security in the financial sector.

In this information-packed episode:

• Discover why organisations are dangerously behind in DORA and NIS2 preparation
• Learn how these EU regulations could impact global operations, including US companies
• Explore the potential for hefty fines and personal liability for executives
• Understand the critical role of third party providers in compliance
• Get practical advice on assessing your organisation's readiness
• Uncover the challenges of implementing cross border information sharing
• Gain insights on budget planning and vendor alignment for compliance

Whether you're a CISO, IT professional or business leader, this episode offers crucial information to help you stay ahead of regulatory changes. Don't miss Richard's expert analysis and insider tips on preparing effectively for compliance. This episode is packed with invaluable insights you won't want to miss.

" Don't be looking at this, head in your hands and worry that you haven't got the stack. You most likely do have the capabilities. Now you've just got to understand how you go about aligning to DORA." 

Richard Cassidy

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Regulatory Gap Analysis: Why organisations should start by analysing gaps between current performance and DORA and NIS2 regulations.
• Vendor Involvement: Why it’s essential to involve vendors and ensure they align with new regulations.
• Global Impact: Learn how DORA and NIS2 will impact organisations worldwide, especially those within the EU financial industry.
• Budget Implications: Advice on beginning regulatory analysis before budget renewal, for better allocation of resources.
• Contract Renegotiation: How to navigate the lengthy process and challenges of renegotiating contracts for compliance with new regulations.
• Third Party Security: Why we need to include audit rights and fine clauses in contracts with third party service providers.
• C-suite Accountability: Learn about the personal responsibility of the c-suite under DORA, including potential legal consequences.
• CISO Role Evolution: Find out how the CISO role is likely to gain more prominence and may replace the CIO in the future.
• Information Sharing Challenges: We discuss the difficulties organisations might face in sharing cybersecurity information.
• Implementation Recommendations: How to implement a simplified approach to aligning with DORA by assessing maturity and targeting domain-level improvements.

• DORA (Digital Operational Resilience Act)
• NIS2 (Network and Information Systems 2)
• PRA (Prudential Regulation Authority)
• PCI DSS (Payment Card Industry Data Security Standard)
• ISO 27001 (International Organisation for Standardisation 27001)

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome back to Razorwire! I'm Jim, your host, and joining me today are cybersecurity experts Richard Cassidy and Oliver Rochford.  

Following on from our last episode of Razorwire, where Oliver and I discussed the key issues that cyber professionals need to focus on in 2024, this episode centres on key takeaways from recent security conferences, particularly RSA and Infosecurity Europe, and explores the shift towards contextual security as highlighted in Byron Acohido's recent report. 

The conversation covers several critical topics: 

1. The potential transformation of long term cybersecurity planning 
2. Emerging trends in integration and standardisation among security solutions 
3. Fresh perspectives on supply chain risk management 
4. The debate over vendor accountability for security vulnerabilities 
5. Innovative approaches to security budgeting and prioritisation 

We discuss the necessity of proactive security approaches, the value of contextual information in threat detection and response, and the importance of considering customer impact when assessing security risks. They also touch on the potential implications of AI advancements for cybersecurity strategies. 

We give you an overview of current industry trends, challenges and potential future directions. We challenge conventional ways of thinking and offer insights that may help reshape how listeners approach cybersecurity strategies so you come away with actionable insights and strategies. 

The Overwhelming Complexity of Choice at Tech Events 

"It's just unbelievable that at every stand you go to [the vendor says] “we're the best in application security.” “We are the best in UEBA.” And I try to put the customer hat on when I go to these events and go, oh my goodness, how does anybody make a decision in the midst of all of this complexity?" 

 Richard Cassidy 

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen 

In this episode, we covered the following topics: 

• Data Growth Management: Addressing the growing need for truly effective data management to secure the projected increase in data volume in the coming years. 
• Communication Challenges: The difficulties in communicating long term infosec plans to the C-suite, who focus on shorter term financial goals. 
• Cultural Shift: How the infosec industry has been impacted by post-lockdown advancements in technology as well as cultural changes. 
• Cybercrime Costs: The predicted increase in the financial cost of cyber attacks is likely to be a more significant financial threat than physical crimes by 2025. 
• Financial Challenges: Current investments in cybersecurity are not keeping pace with the evolving threat landscape. 
• New Strategies: Why we need to move from rules-based to contextual-based security. 
• Integration: How interoperability and synergy between vendors can help address evolving threats. 
• Cyber Senescence: Why we need a longer-term approach to cybersecurity planning. 
• C-Suite Communication: Why infosec professionals need to communicate risk and the importance of security investment to the c-suite effectively. 
• Vendor Relations: The challenges of vendor lock-in, tool obsolescence and the importance of stable, reliable vendor partnerships. 

Resources Mentioned 

The Byron Report  

The Last Watchdog  

RSA Conference 

Infosecurity Europe  

XDR Alliance 

Situational Awareness: The Decade Ahead Leopold Aschenbrenner, June 2024 

Gartner 

Exabeam  

Other episodes you'll enjoy  

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter 

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/ 

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black 

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/ 

Connect with your host James Rees 

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult. 

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights. 

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers. 

For more information about us or if you have any questions you would like us to discuss email [email protected]. 

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion. 

Linkedin: Razorthorn Security 

Youtube: Razorthorn Security 

Twitter:  @RazorThornLTD 

Website: www.razorthorn.com 

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the podcast that cuts through the noise of the information security industry. I'm your host, Jim, and today we're talking a look at the state of the infosec industry so far in 2024 with our guest, Oliver Rochford. If you're a cybersecurity professional taking on the evolving threats and challenges of our field, you won't want to miss this discussion.

From the rapid consolidation within the tech sector to the challenges of supply chain security and the limitations of today's infosec tools, we leave no stone unturned. We also discuss the role of AI in simplifying complex security solutions and whether current market trends are truly addressing the core needs of security teams.

Key Talking Points 

1. Tech Industry Consolidation: Discover how the acquisition spree by cybersecurity giants like CrowdStrike and Palo Alto is reshaping the industry landscape and what it means for smaller, niche security companies.

2. Supply Chain Security: Hear about the latest risks posed by third party involvement and how to ensure robust security tracking and management using various tools and solutions.

3. AI and Security Solutions: Oliver tells us how we can make use of AI to streamline and simplify the overly complex and jargon-filled security tools market, offering a fresh perspective on future developments.

Tune in to this thought-provoking episode of Razorwire for valuable insights that every cybersecurity professional needs to stay ahead in 2024.

The Future of Cybersecurity: 

"I expect there to be diversification under the formation of multiple markets with individual giants within these markets, because you can't be good at everything."

Oliver Rochford

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Tech Industry Consolidation: Discussion on the recent acquisition of smaller tech companies by larger firms and the impact of this on the industry.

- Growth and Specialisation Limits: Prognosis on large portfolio providers and the constraints imposed by specialisation and market share retention.

- Cyber Attack Speed and Aggressiveness: Examination of the increasing speed and aggressiveness of cyber attacks and how to prepare for the challenges they present.

- Supply Chain Security: How we can secure the supply chain and the inconsistencies in infosec vendor messaging.

- Complex Security Solutions: How to make use of AI to critique the complexity and confusing terminology in security solutions.

- AI and Core Security Issues: Exploration of the risks tied to AI, budget constraints and the persistent core security challenges.

- Affordability and Effectiveness: Highlighting the need for organisations to thoroughly investigate the most effective tools to make the most of tight budgets.

- Data Privacy and Encryption: Examination of growing encryption usage and questions over control and management of encryption keys.

- Disconnect in the Cybersecurity Market: Addressing the disconnect between user needs and market offerings, focusing on AI and the latest technologies.

- Economic and Regulatory Concerns: How financial and regulatory challenges are impacting security investments and implementations.

Events:

• Infosec conference
• RSA conference

Companies:

• CrowdStrike
• Palo Alto
• Zscaler
• Snowflake
• Pure Storage
• Databricks
• ClickHouse
• Splunk

Products/Technologies:

• EDR (Endpoint Detection and Response)
• SIEM (Security Information and Event Management)
• XDR (Extended Detection and Response)
• API security
• SOAR (Security Orchestration, Automation, and Response)

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

The deadline for financial entities is looming – get actionable information and advice on DORA compliance with industry expert Paul Dwyer!

Welcome to Razorwire, your go-to podcast for cutting edge insights and expert analysis in the world of information security. I'm your host, Jim, and in today's episode, we have the privilege of speaking with Paul Dwyer, returning Razorwire guest and veteran in cybersecurity risk and compliance, with over 30 years of experience and the head of the International Cyber Threat Task Force (ICTTF). 

In this episode, Paul and I discuss the operational resilience required by DORA legislation, touching upon substantial fines for compliance failures and the shift towards personal accountability at the business and boardroom levels. We cover the nuances of DORA and its intersections with NIS2, and talk about the importance of better communication within organisations and the growing responsibility of governing bodies and the c-suite. 

Paul shares invaluable insights on the risk-based approach that's overtaking traditional compliance methods, the business opportunities awaiting smaller players in the DORA compliance space, and the essential need for thorough and continuous training programmes.

Key Takeaways

1. Discover compelling real world examples of how compliance failures have led to significant fines for large organisations and why personal accountability at the boardroom level is becoming crucial.

2. Learn how DORA and NIS2 regulations are evolving to include a risk based approach and are pushing for proportionality in implementing controls, shifting the focus from mere compliance to a truly risk-centric perspective.

3. Find out about the new business opportunities that DORA presents for small and midsize players in the market, including offering compliance services and challenging large cloud providers. 

The Era of Accountability in Management: 

"Anybody can fill out a little compliance spreadsheet, oh, there we go tick, tick, tick, we're doing all that, it goes through. But those days are gone because you need to trust, verify everything, you need to get the evidence."

 Paul Dwyer

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Operational Resilience: Find out about fines and individual accountability for compliance failures under DORA and NIS2.

- Governance Focus: We talk about increased attention on cybersecurity from governing bodies and the c-suite.

- Risk Based Approach: Why the regulations’ emphasis is on proportional, risk centric controls over mere compliance.

- Business Opportunities: Identifying opportunities for small and midsize players in offering compliance services against large cloud providers.

- Regulatory Adaptability: Why we need DORA regulations to be adaptable to various organisational risks.

- Training and Awareness: Addressing the crucial need for thorough DORA awareness programmes for all levels of staff, especially non-tech leaders.

- Compliance Tools: Introducing tools like CyberPrism and AI-based solutions for assisting organisations in DORA compliance.

- Information Sharing: Discussing the importance of peer-to-peer intelligence sharing and distinguishing it from mere information sharing.

- Leadership Evolution: Emphasising the need for CISOs and other leaders to possess hybrid skills tying cybersecurity with business strategy and legal frameworks.

• ICTTF
• DORA
• NIST 2.0
• ISO
• PCI
• EU DORA Summit
• EU Cyber Summit (November 7-8 in Dublin)
• DORA community group
• CyberPrism
• GPT AI tool for DORA compliance
• DORA compliance specialist course
• Navigating DORA (book by Paul Dwyer)
• The Cyber Sentinels Handbook (book by Jim)
• TSB Service Failure

Cybersecurity Burnout and Organisational Culture with Yanya Viskovich & Eve Parmiter

https://www.razorthorn.com/cybersecurity-burnout-and-organisational-culture-with-yanya-viskovich-eve-parmiter/

The Art of Cyber Deception: How To Get Inside The Mind of A Hacker with Rob Black

https://www.razorthorn.com/the-art-of-cyber-deception-how-to-get-inside-the-mind-of-a-hacker-with-rob-black/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Unlock the secrets to successfully navigating the cybersecurity business landscape with insights from industry legend Jane Frankland on this episode of Razorwire.

Welcome to Razorwire, I'm your host, Jim and in today’s episode, we have the privilege of discussing the intricacies of running a successful cybersecurity business with none other than Jane Frankland. With over 26 years in the industry, Jane has built and sold businesses, influenced trends and mentored the next generation of cybersecurity professionals. 

In this episode, I chat with Jane Frankland about the challenges and most rewarding experiences of running a cybersecurity business. Jane tells us about her journey from the early days of cybersecurity in the 90s to becoming a prominent influencer and entrepreneur. We explore topics like managing growth, the shift towards freelance work and the importance of humility and mentorship in the industry. 

3 Key Talking Points:

1. Managing Business Growth: Jane shares her strategies for managing growth through the use of associates and outsourcing non-core functions. Learn how to scale your business efficiently while keeping your core operations robust.

2. Navigating Industry Trends: We talk about the increasing amount of freelance work in information security, the importance of a reliable pool of pentesters and the risks of crowdsourced pentesting companies. Gain insight on how to adapt your business model to include evolving industry practices.

3. The Role of Mentorship and Humility: Jane and I discuss why mentorship for young professionals is so important and the significance of humility in leadership. Discover why ditching egos and maintaining an approachable demeanour is crucial for building a successful cybersecurity business.

Don't miss out on these pearls of wisdom from one of cybersecurity's most respected voices. 

The Reality of Running a Business: 

"You are literally flying by the seats in your pants and navigating your company, at the helm, which is very, very stressful. Very stressful. And yet it is exciting and it is fun."

 Jane Frankland

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Business Growth Strategies: Discussing the challenges and careful expansion required to grow a cybersecurity business.

- Outsourcing and Associates: Managing growth by outsourcing non-core functions like marketing and accountancy and using associates.

- Pentesting Workforce: The shift towards freelance pentesters and the challenges of maintaining a reliable pool of talent.

- Revenue Diversification: The importance of diversifying revenue streams and adapting business focus to market changes.

- Industry Egos: Addressing the rise of egos in the information security industry and the importance of humility.

- Emotional and Mental Challenges: Exploring the emotional rollercoaster and loneliness experienced by business owners.

- Mentorship and Support: Highlighting the importance of mentors and coaches for guidance, especially during the early stages of business.

- Client Acquisition and Recruitment: The complexities of recruiting staff, especially pentesters and salespeople and the challenges of client acquisition.

- Financial Management: The critical importance of managing finances accurately and the common pitfalls at the tax level.

- Encouraging Young Talent: The significance of mentoring young professionals and actively supporting their entrance and growth in the cybersecurity industry.

Preventing Burnout in Cyber Security

https://www.razorthorn.com/cyber-security-professionals-shortage-burnout-how-to-protect-against-it-razorwire-podcast/

SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community

https://www.razorthorn.com/solarwinds-ciso-under-sec-scrutiny-the-impact-on-the-infosec-community/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

In a landscape where cyber attacks are constantly evolving, is your business insurance keeping pace?

Welcome to another episode of Razorwire! I'm your host, Jim, and today we dive deep into the dynamic world of cyber insurance. Neil Hare-Brown and Matt Clark, two industry experts, are with us to share their wealth of knowledge and insights on how cyber insurance has changed to address today's security challenges. 

In this episode, we cover the critical role of cyber insurance in modern security strategies, from mitigating the financial impact of cyber incidents to navigating the details of underwriting and premium setting. We also discuss the increasing trend of third party attacks and why companies must prioritise reviewing their vendors and suppliers. By the end of this episode, you'll have a clearer understanding of why cyber insurance is no longer a luxury but a necessity, and how you can leverage it to bolster your organisation's cyber resilience.

Key Talking Points:

1. Rising Costs and Frequent Threats: Neil explains why cyber insurance is crucial for mitigating significant financial impact of cyber crime.

2. Underwriting and Premiums: Matt tells us how insurers use data and tools like ransomware calculators to set premiums and how businesses can proactively improve their cybersecurity posture.

3. Vetting Third Party Vendors: We discuss why we must thoroughly assess third party providers, with insights into new insurance services and facilities aimed at helping businesses manage and recover from cyber incidents more effectively.

Tune in to discover how cyber insurance can be an integral part of your organisation's defence strategy and ensure you're prepared for whatever comes your way.

Cyber Risk Management: 

"I think there is still quite a long way for businesses to go, for boards to appreciate that cyber risk management is not an operational problem."

 Neil Hare-Brown

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Impact of Cyber Incidents: How to accurately estimate the financial repercussions of cyber attacks.

- Ransomware and Business Email Compromise: We discuss the current trend for ransomware and business email compromise, and how to protect your organisation from the increased frequency and severity of the attacks. 

- Double Extortion and Data Breaches: The evolution of cyber threats which includes tactics like double extortion and significant reputational harm.

- Using Data to Inform Insurance: How data from insured cyber events helps give risk insights for setting premiums.

- Proactive Cyber Risk Management: Why it’s essential to have a cyber champion on the board.

- Third Party Risks and Cyber Insurance: Third party attacks can severely impact businesses, highlighting the need for comprehensive cyber insurance.

- Evolving Insurance Facilities: New offerings such as breach response services are becoming more accessible and affordable.

- Post-Incident Actions: Breach experiences often lead companies to enhance cybersecurity measures and seek appropriate insurance coverage.

- SMEs and Cybersecurity: Smaller enterprises struggle with maintaining effective cybersecurity processes and benefit greatly from cyber insurance.

- Continuous Learning in Cybersecurity: Why we must continue to learn and evolve for effective cybersecurity strategies.

• The Cyber Sentinels Handbook
• ISO 27001 certification
• Cybercare
• Breach response service
• Multifactor Authentication (MFA)
• Cyber essentials certification

Cyber Insurance: Is It Fit For Purpose? 

https://www.razorthorn.com/cyber-insurance-is-it-fit-for-purpose-razorwire-podcast/ 

SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community

https://www.razorthorn.com/solarwinds-ciso-under-sec-scrutiny-the-impact-on-the-infosec-community/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Unmask the reality of the information security world in this week's episode of Razorwire! Join me, Jim, and my guests, Chris Dawson and Iain Pye, as we talk about our daily frustrations working in infosec and the pressing issues facing cybersecurity professionals. We dissect the gripes, pet peeves and laughable clichés that saturate our industry.

From the hype of award ceremonies to the absurdity of exaggerated credentials on LinkedIn, this conversation is packed with insights and anecdotes that will resonate with every cybersecurity professional. Stay tuned and subscribe for this candid look at the ups and downs of our industry.

Key Talking Points:

1. Real Talk on Compliance and Regulations: Discussing the hype around compliance requirements like GDPR and DORA, we break down the importance of understanding and managing these regulations without falling for marketing gimmicks.

2. Vendor Exaggerations vs. Reality: Discussing the overblown claims around GDPR and DORA compliance and the serious implications for cybersecurity.

3. Grandstanding Egos: The rise of self-proclaimed thought leaders and influencers and their role in fuelling fear, uncertainty and doubt within the infosec community.

Tune in for a frank and entertaining discussion on the gritty realities of information security!

The Struggles of Simplicity: 

"Your average user will go out their way to circumnavigate the controls that you've put in place."

Iain Pye

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Annoying Infosec Practices: This satirical podcast dives into some of the most irritating practices in the infosec industry.

- Auditor Issues: The frustrations of dealing with auditors. Enough said.

- Integrity at Work: We talk about significance of acting professionally in workplace settings.

- Infosec Vendor Marketing: The creative license taken by vendor marketing departments and how to stay wise to exaggerations.

- Risk Management Complexity: We talk about the overwhelming abundance of acronyms, and the importance of clear communication and documentation.

- Compliance and Regulations: We look into the implications of compliance requirements such as GDPR and the upcoming DORA.

- Exaggerated Professional Profiles: We lament the trend of elaborate and often exaggerated LinkedIn profile titles and qualifications.

- The Cyber Sentinel’s Handbook

- GDPR (General Data Protection Regulation)

- DORA (Digital Operational Resilience Act)

- LinkedIn

- Chat GPT

Preventing Burnout in Cyber Security

https://www.razorthorn.com/cyber-security-professionals-shortage-burnout-how-to-protect-against-it-razorwire-podcast/

SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community

https://www.razorthorn.com/solarwinds-ciso-under-sec-scrutiny-the-impact-on-the-infosec-community/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

gdcr3sq9