Razorwire Cyber Security & InfoSec Insights

In this episode of Razorwire, I sit down with Rob Black, a dynamic figure in the world of cybersecurity with a unique background in military strategy and defence. From the realms of computer game design to the high stakes world of defusing IEDs, Robert brings unparalleled insight into how we can revolutionise cybersecurity by understanding and manipulating the psychology of our adversaries. This episode is packed with outside-the-box strategies that will transform your approach to defending your network.

In our conversation, Robert and I explore the intersection of human psychology and cybersecurity, emphasising the impact of deception and misinformation on attackers. Robert shares parallels to military tactics and offers practical advice on psychological tools to gain an upper hand in infosec. We discuss real world studies and notable cyber incidents like Stuxnet to underscore the importance of strategic thinking beyond mere technological solutions. Tune in for an engaging discussion that could reshape your cybersecurity practices.

Key Talking Points:

1. Deception Tools and Strategy - Robert explains how to slow down attackers using deception technology, inspired by military tactics, causing them to mistrust their tools and make erratic decisions.

2. Psychological Influence on Threat Actors - Learn how to improve the effectiveness of your network defence by understanding and engaging with the decision making processes of threat actors.

3. Real World Case Studies - We discuss impactful examples, including the NSA's deception studies and the infamous Stuxnet attack, to illustrate how psychological and strategic insights can be applied to bolster cybersecurity efforts.

Join us on Razorwire and arm yourself with revolutionary tactics to stay ahead in the constantly evolving landscape of cybersecurity. 

Deception 2.0: Envisioning the Future of Cybersecurity

"So attackers believe the systems they're using because they've got no reason to believe the computer won't lie. So how do we make it, inside our manmade network, that they have to tread carefully because they don't know what to trust and what not to trust?" Robert Black

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Psychological Defence in Cybersecurity: How we can use psychological tactics, such as inducing paranoia, in defending against cyber threats.

- Effectiveness of Deception: We discuss an NSA study which demonstrates how knowledge of deception impacts penetration testers' speed and decision making.

- Human Factors over Technology: We talk about the merits of using human behaviour analysis and psychology alongside technology for cybersecurity strategies.

- Corporate Espionage and Misinformation: How to use misinformation and disrupt attackers’ expectations as part of your defence strategy.

- A Multidisciplinary Approach to Cybersecurity: We discuss the merits of incorporating diverse perspectives, including arts and philosophy, into cybersecurity education and strategy.

- Vendor and CISO Relationships: Why vendors must understand and address the real problems faced by CISOs.

- Proactive Defence Strategies: Why we need to move beyond assurance to proactive measures in cybersecurity defence.

- Shift in Cybersecurity Mindset: How to progress the growing recognition of cybersecurity as a critical business threat and the importance of improved risk assessments.

- Influence of Deception Technology: How we can use fake networks and behavioural economics techniques to manipulate attackers' behaviour.

Rob left the UK government in 2014 after over a decade supporting the development capabilities for British and allied military and cyber operations. Since then, Rob has been a lecturer in Information Activities at Cranfield University, part of the UK Defence Academy and teaches on the UK MoD’s Cyberspace Operations MSc. From 2020 to 2024, Rob was the Director of the UK Cyber 9/12 Strategy Challenge leading on the development of the next generation of cybersecurity leaders. He was also Deputy Director of the UK National Cyber Deception Laboratory since its inception in 2019 to 2022, where he encouraged the development of a proactive approach to cyber defence through the use of deception techniques and other novel measures to confuse and disrupt cyber attackers. He remains involved in shaping policy dialogue on issues such as national security, cyber and intelligence through his role as an Associate Programme Director at Wilton Park, part of the UK Foreign Commonwealth and Development Office, and also acts as a senior adviser to the International Information Integrity Institute (i-4), owned by KPMG. 

- Pimlico Plumbers

- NSA's study on deception

- Stuxnet cyber attack

- LinkedIn (Robert Black's profile)

- Cyber Sentinels Handbook

The Human Psychology Behind Cybersecurity With Bec McKeown https://www.razorthorn.com/the-human-psychology-behind-cybersecurity-with-bec-mckeown/

Criminal Minds: How the Cyber Crime World Works https://www.razorthorn.com/criminal-minds-how-the-cyber-crime-world-works/ 

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome back to Razorwire, the podcast slicing through the tangled world of cybersecurity! I'm your host, Jim and in this episode we’re talking about the crucial balance between trusting your workforce and exerting control over your security ecosystem. 

Joining me are Iain Pye, sharing his insights into privacy roles, and David Higgins from CyberArk, who will discuss the challenges and strategies of effective cybersecurity. Whether you're managing remote teams or integrating third party services, this episode is packed with expert analysis and actionable advice.

We discuss: 

1. Discover how ISO and SOC certifications are shaping the way organisations approach security, as David Higgins analyses the paradigm shift towards a consumer-empowered landscape within cybersecurity.

2. Discussion on the interplay between trust and control in the era of remote work, with insights on the importance of effective incident response capabilities, even when resources are lean.

3. Learn about pragmatic approaches to vendor risk assessment and understand why a tiered method for evaluating vendor criticality could be pivotal for your cybersecurity strategy.

Prepare to challenge your perspectives on cybersecurity's conventional wisdom and join us on Razorwire, where we cut through complexity to bring clarity to the professionals on the digital frontlines.

“We've got devices that we no longer own. We've got platforms that we no longer run. We've got data stored in locations we're not responsible for and we've got employees working in environments that would that we've got zero control over. So moving to zero trust so that was it a ‘never trust, always verify mindset’? Makes a lot of sense."

David Higgins

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Adjusting Control to Criticality: The more critical the processing and servicing, the greater the expectation of control.

- Certifications as Trust Indicators: The importance of obtaining certifications to demonstrate commitment and investment in establishing trust.

- Consumer Empowerment Through Software as a Service: How the shift to SaaS models puts more power into consumers' hands, necessitating service providers to meet their security expectations.

- Remote Work Security Challenges: How to tackle concerns about trust, control and security in home working environments.

- Sensitive Data in Risk Zones: Identifying and dealing with risks associated with employees working in red-listed countries.

- Cybersecurity Budgets and Risk Games: How to manage budgets and risk assessments effectively.

- Third Party Risk Management: How to implement third party assurance programmes for managing risk and ensuring thorough vulnerability assessment with vendors.

- The Evolving Cyber Threat Landscape: How to effectively deal with the rise in targeted phishing attacks through a balance of trust and control for detection and response.

- Zero Trust and Continuous Authentication: Why we should focus on implementing zero trust architecture and continuous authentication methods like MFA and biometrics.

- Economic Impact on Security Measures: Increasing costs and the economic downturn are major concerns affecting the budgets for security tools, certifications and overall organisational security measures.

David is the Senior Director – Field Technology Office at CyberArk. Since joining in 2010, Higgins has worked to help the world’s leading - and most complex - organizations secure and protect their privileged access. Today, he advises clients on threats associated with privileged escalation, lateral movement and credential theft and discusses best practices and driving innovation around privileged management processes.

- ISO certification

- SOC certification

- SaaS (Software as a Service)

- GDPR (General Data Protection Regulation)

- BlackKite

- CyberArk Software

Security vs Privacy: The Ethics of Data Collection https://www.razorthorn.com/security-vs-privacy-the-ethics-of-data-collection/  

The Use Of AI In Cybersecurity – Consultants Roundtable

https://www.razorthorn.com/the-use-of-ai-in-cybersecurity-consultants-roundtable/

Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall

https://www.razorthorn.com/lessons-from-an-infosec-icon-a-fireside-chat-with-pci-guru-jeff-hall/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

On this week's edition of the Razorwire podcast, Jim sits down with Amy Stokes-Waters, CEO of The Cyber Escape Room Co. Amy brings her unique entrepreneurial perspective from a non-traditional background, transitioning into cybersecurity.

The conversation provides valuable insights for security leaders as Amy candidly discusses her innovative approach to security awareness training through immersive, gamified escape room experiences. She shares her views on critical issues facing the industry today, such as combating AI-enabled disinformation campaigns, addressing the cybersecurity workforce shortage driven by unrealistic job requirements and improving strategic communication between security teams and business executives.

Amy's experiences building her company and developing engaging training programmes make for a compelling discussion. Security professionals will gain new insights into creative methods for better educating end users and elevating cybersecurity's importance across the organisation. Her frank opinions and fresh mindset provide a thought provoking perspective for security leaders navigating the evolving threat landscape.

Key Talking Points

1. Innovative Security Training: Discover how Amy's company uses escape room experiences to teach important cybersecurity concepts, from phishing to insider threats, making learning engaging and memorable.

2. Changing Threat Landscapes: Hear about the impact of ransomware on businesses big and small, the evolution of insider risks and how AI is shaping the future of information security.

3. The Human Element in Cybersecurity: Gain insight into the importance of strategic leadership in cybersecurity roles and how businesses can navigate the challenges of educating teams and customers about the growing complexity of threats.

Tune in for a fascinating discussion that sheds light on new methods of strengthening cybersecurity awareness and the vital role human factors play in protecting our digital worlds.

"I don't know many people that proactively undertake security awareness training, you know, sitting watching videos and animations and all that kind of thing. I genuinely don't know anyone that does that as a hobby, but I think it's something that's super important."

Amy Stokes-Waters

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Cybersecurity Awareness via Escape Rooms: How immersive escape room experiences can be more beneficial than traditional methods utilised in cybersecurity education.

- Insider Risk Management: Overcoming the challenges businesses face from internal threats and the risks of employees being exploited by ransomware attackers.

- Impact of Cloud Migration on Security: How the shift to cloud computing during the lockdown affected the security of supply chains.

- Artificial Intelligence and Disinformation: The dangers of AI in creating and spreading disinformation in geopolitical contexts and its potential risks in cybersecurity.

- Cybersecurity in Small Businesses: We discuss the vulnerability of small businesses as integral parts of larger supply chains and the specific security challenges they face.

- Career Reflections and Advice: Insights on personal growth in the cybersecurity field and the importance of reflecting on one’s mistakes and learning from them.

- Evolving Role of CISOs: How the role of Chief Information Security Officers is changing.

- Legal and Regulatory Aspects in Cybersecurity: Discussion on the emergence of cyber law, the importance of effective communication during security breaches and the evolving landscape of cybersecurity regulations.

- Challenges in Cybersecurity Hiring Practices: We talk about the issues with unrealistic job descriptions and the unethical behaviours of recruiters in the cybersecurity job market.

- Future of AI in Cybersecurity: A sceptical perspective on relying solely on AI for cybersecurity, stressing the essential need for human supervision and interpretation of AI-generated outputs.

CEO, Esc - The Cyber Escape Room Co

 Amy has a decade of experience in sales and marketing and now acts as CEO at The Cyber Escape Room Co and CCO at Yellowstone Security. She is a founding member of RINA's Maritime Cyber Security Task Force and an active advocate for gender diversity in the industry.

As a regular guest on podcasts and panels, Amy talks on a variety of topics, including security culture and awareness, personal branding and women in tech.

- Cyber Escape Room company

- Microsoft security stack

- LinkedIn

- Cyber Sentinels Handbook

Preventing Burnout in Cyber Security

https://www.razorthorn.com/cyber-security-professionals-shortage-burnout-how-to-protect-against-it-razorwire-podcast/

SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community

https://www.razorthorn.com/solarwinds-ciso-under-sec-scrutiny-the-impact-on-the-infosec-community/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire! In today’s episode, we take a look at the often-overlooked issue of professional burnout within the cybersecurity field. Joining us are two esteemed guests: Yanya Viskovich, a cyber resilience authority, and Eve Parmiter, a clinical traumatologist and consultant, both of whom bring their interdisciplinary insights to our discussion.

Today's conversation uncovers the critical yet not-often-discussed crisis of burnout amongst our cyber defenders. Yanya shares her personal journey through the throes of burnout and her subsequent passion for addressing the human factors in cybersecurity and Eve gives us her clinical perspective, providing an in depth understanding of the steps that lead to burnout and how we can move towards prevention and recovery. Together, we explore strategies for cultivating an organisational culture that is resilient against burnout and the positive repercussions this can have on cybersecurity effectiveness. 

Key Talking Points

Personal Insights from the Field: Yanya recounts her dynamic career path and the vulnerable moments of burnout she encountered during the global pandemic, offering listeners a glimpse into the human side of the cybersecurity equation.

Clinical Wisdom for Cyber Warriors: Eve, with her therapeutic background, maps out the psychophysiological terrain of burnout and provides actionable tactics for information security professionals to identify and manage their stressors before they escalate.

-Building a Burnout-Resilient Culture: Gain critical advice on creating strong, collaborative and health-focused workplace cultures that prioritise learning and vulnerability to fortify against cybersecurity threats as well as professional burnout.

Don’t miss out on this conversation, which is more relevant now than ever. Tune in to unlock techniques that will not only defend your organisation’s digital assets but also safeguard the wellbeing of its most valuable guardians - its people.

Embracing Failure for Cybersecurity Improvement: 

"We need to have a tolerance for failure, but an intolerance for incompetence. We need to invite cultures that invite questions and difficult ones, and that invites people to challenge the status quo, to invite people to say, ‘yeah, I've noticed that something's wrong here’, or ‘I see this as a potential risk and I'm raising it.’"

Yanya Viskovich

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Appreciation of Crisis Management: A look into how the efforts of infosec professionals are often undervalued, especially when resolving critical issues during crises.

- Post-Lockdown Loss of Mentorship: An exploration of the pandemic's impact leading to the exit of experienced professionals from the cybersecurity field and the subsequent loss of mentorship for up-and-comers.

- Organisational Culture and Failure: The importance of creating supportive cultures within organisations that encourage learning from mistakes and destigmatising failure.

- Human Factor in Cybersecurity: Highlights the crucial role of considering human behaviour and psychology in cybersecurity strategies, alongside technology and process optimisation.

- Stress and High Burnout Rates: Insights into the abnormally high stress levels within the cybersecurity industry, leading to significant burnout among professionals.

- Industry's Perception on the 'Department of No': Discusses the challenging perception of infosec teams as constructionistic.

- Power of Recognition: We discuss the role of recognition and appreciation in mitigating work-related stress and improving employee satisfaction.

- Burnout and Operational Effectiveness: The use of the Critical Incident Technique as a framework for understanding work-related stressors and developing strategies to improve burnout and operational effectiveness.

- Burnout Recovery and Resilience: How individuals can recover from burnout and leverage the experience to grow stronger and more resilient to future stressors.

- Risk and Response to Burnout: Arguments are made for including professional burnout as a significant risk in organisational risk registers and developing multifaceted strategies to prevent and respond to it in the cybersecurity sector.

Yanya Viskovich is a cybersecurity expert specialising in the human factor. A TEDx and Fortune 500 keynote speaker and Senior Manager in Security Consulting at Accenture Switzerland, Yanya advises and presents to CISOs, C-Suites and Boards on how to reduce human security risk and enhance security cultures, and conducts executive cyber crisis simulations. Her March 2023 TEDx talk, "Why Burnout Culture is a Cyber Risk", has been instrumental in raising awareness about the impacts of stress and burnout on organisational cyber risk and resilience. She is a former cybercrime prosecutor, has advised the Australian Federal Privacy Commissioner, trained law enforcement agencies, and held diverse senior in-house roles in large multinationals and international organisations, including the United Nations, where she strategised and implemented crisis plans and data protection policies. Yanya also serves as Chair of Cyber Law & Governance at the Swiss Cyber Institute and as an expert ethics advisor to the European Commission. She regularly guest lectures at Swiss and European universities, and contributes to publications and professional standards on cybersecurity, AI, data protection, privacy, and data ethics. Yanya is an Australian Bar-admitted attorney and holds a Bachelor of Laws, a Bachelor of International Relations, and a Master of Laws from the Australian National University; a Data Protection Officer certification from the European Centre on Privacy and Cybersecurity at Maastricht University; executive certificates in cybersecurity management from MIT Sloan School and the Geneva Centre for Security Policy, and in applied computer science from EPFL. 

Eve works as a therapist, coach, and consultant. She focuses on power, potential, and performance, and the things that get in the way, like the misuse and abuse of power, and the wear and tear of what we choose to do, including workplace burnout.

She runs a successful private practice, and has worked with the military, public, and private sectors, with new recruits to C-suite and founders, and with world-class performers in sports and the arts.

Organisations and individuals work with Eve to make meaningful changes in their teams and lives. Improving performance, developing resilience, and building wellbeing all contribute to achieving high hard goals, rich connection, deep fulfilment, and have a positive impact on the bottom line.

She graduated with a First Class BScEcon in International Relations, and a Master’s Distinction from LSE. She holds a Black Belt in Jeet Kune Do, has worked as a professional actor, and is a trained Cognitive Hypnotherapist, clinical traumatologist, and NLP Master Practitioner.

- Accenture

- United Nations

- UN High Commissioner for Refugees

- International Committee of the Red Cross

- "The Cyber Sentinels Handbook, A Primer for Information Security Professionals"

- World Health Organisation

Preventing Burnout in Cyber Security

https://www.razorthorn.com/cyber-security-professionals-shortage-burnout-how-to-protect-against-it-razorwire-podcast/

SolarWinds’ CISO Under SEC Scrutiny: The Impact On The Infosec Community

https://www.razorthorn.com/solarwinds-ciso-under-sec-scrutiny-the-impact-on-the-infosec-community/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the cutting-edge podcast where we slice through the complexity of cybersecurity and risk management to bring you insights from industry leaders. I’m your host, Jim and in today’s episode, we unravel the intricacies of FAIR (Factor Analysis of Information Risk) risk methodology with none other than its creator, Jack Jones. Jack’s groundbreaking approach has revolutionised how organisations perceive and approach information security risks. So, buckle up as we dive deep into the mind behind this transformative model.

In a fascinating session, Jack shares his journey in developing the FAIR risk methodology and its impact on the business landscape. From facing initial industry scepticism to achieving global recognition, Jack's story is a testament to innovation and perseverance. Alongside the creation of the FAIR Institute and the adoption of his standards across various sectors, Jack also teases his upcoming book focused on the controls analytics model. We discuss the evolving landscape of risk management and the potential for FAIR to automate and improve cybersecurity practices. Get ready to have your perspective on risk quantification transformed!

Key Talking Points:

1. Demystifying FAIR - Discover how Jack Jones broke new ground with the FAIR risk methodology, demystifying risk management for businesses worldwide and why industry giants are adopting his model to navigate the complexities of cybersecurity.

2. Resistance and Triumph - Hear the compelling tale of how Jack overcame industry resistance, with some even suggesting criminal negligence, to establish a new paradigm in risk assessment now embodied in the FAIR Institute and the Open FAIR standard.

3. Risk Beyond Cybersecurity - Learn how the versatile FAIR model transcends cybersecurity, influencing financial product design, operational risk measurement and even natural disaster assessments - a testimony to its adaptability and Jack's vision for its future potential.

For cybersecurity professionals eager to stay ahead of the curve and to refine their approach to risk management, this episode is not to be missed. Join us on Razorwire to hear the insights and backstories directly from the experts shaping the field.

“I did get some positive reactions from people in the industry, but I also got an email from someone in the industry … with a significant following and they wrote me a letter saying that I should be prosecuted for criminal negligence for having published this, that in his view, the word risk should be stricken from the English language.” 

- Jack Jones

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Fair Risk Methodology Overview: A novel approach to risk assessment that simplifies risk management by addressing subjective probability factors and incorporating control efficacy.

- Development and Inspiration: The origins of the methodology and how inspiration from physics led to a new model for measuring control effectiveness in risk management.

- Industry Reaction and Growth: An exploration of the initial pushback against the methodology, followed by its adoption by the Open Group and the subsequent rapid expansion globally.

- Founding of the FAIR Institute: The establishment of a dedicated institute to provide resources and community engagement around the FAIR methodology.

- Advancement through Collaboration: How input from various industry professionals has contributed to the enhancement of the FAIR model, exemplified by the new materiality assessment.

- Communication and Misunderstandings: The challenges faced in conveying the principles of FAIR, leading to some recommendations to alter the model and the need for clearer communication.

- Widespread Adoption and Consistency: The pride in the widespread application of the FAIR methodology across different business domains and its consistent framework over time.

- Future Expansions and Applications: The anticipation of new additions to the FAIR model and its application beyond security, including financial, operational and natural disaster risk assessments.

- Automation in Risk Quantification: The evolving trend towards using technology such as AI to automate cyber risk quantification for timelier and mainstream industry applications.

- Resources and Further Engagement: Information on resources for learning more about the FAIR methodology, upcoming publications and ways to connect with thought leaders in the field.

Jack Jones

Chairman Emeritus of the FAIR Institute

Jack has worked in information security for over 35 years, 10 years of which as a CISO with three different companies, including a Fortune 100 company. His work was recognised in 2006 with the ISSA Excellence in the Field of Security Practices. Jack has received the CSO Compass award for risk management leadership and also had the privilege of participating in the ISACA task force that created the original RiskIT framework and led the development of ISACA’s CRISC certification programme. An adjunct instructor at Carnegie Mellon University, he teaches in the CISO executive programme. Jack also

created the Factor Analysis of Information Risk (FAIR) and FAIR-CAM models which have been adopted as international standards for measuring risk. In 2015, he co-authored a book on FAIR entitled Measuring and Managing Information Risk, a FAIR Approach, which was inducted into the Cyber

Security Canon in 2016.

- FAIR risk methodology

- Jim's recently released book, "The Cyber Sentinels Handbook"

- Kindle Unlimited

- RMI Solutions

- FAIR Institute

- FAIR controls analytics model (Faircam)

Cybersecurity in 2024: Expert Predictions You Need to Know

https://www.razorthorn.com/cybersecurity-in-2024-expert-predictions-you-need-to-know/

The Rise of Cyber Mercenaries: Governments’ Secret Weapons in Cyber Warfare

https://www.razorthorn.com/the-rise-of-cyber-mercenaries-governments-secret-weapons-in-cyber-warfare/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the cutting-edge podcast for cybersecurity professionals, where we unravel the world of information security and peek into the future of technology. I'm your host, Jim, and in today's episode, we're joined by our esteemed guests, Richard Cassidy and Oliver Rochford. We’re taking a deep dive into the recent Lockbit takedown, dissecting the movements in the global cybercrime landscape, and analysing the ongoing conflicts within the commercial industry. 

Our guests, both veterans in the field, share their insight on the takedown of the notorious Lockbit ransomware group, raising critical questions about the efficacy of such law enforcement actions. We explore the pervasive issues of ransomware as a service, the evolving role of threat intelligence, and the significance of industry collaboration. 

Additionally, we take a look at the challenges of finding your niche within the hyper-competitive tech market, dissect the misconceptions surrounding threat intelligence and confront the stark realities of the cybersecurity industry's marketing frontlines. 

Whether you're well into your cybersecurity career or contemplating your next move in the field, this episode of Razorwire is tailored for you.

Key Talking Points:

1. Inside the Lockbit Takedown: What the headlines don't tell you about the resilience of ransomware groups and why we should remain cautious post-takedown efforts.

2. Navigating Cyber Misinformation: Our guests tear apart the misleading marketing tactics in cybersecurity and advocate for a truth-centric industry approach.

3. Collaborate to Fortify: Discover the vital importance of cross-organisation intelligence sharing in combating sophisticated cyber threats and promoting stronger defences across the board.

Don’t miss out on this candid and informative discussion. 

"There's a cultural problem when half the industry beats up on someone who discloses a breach. There's a disincentive to disclose breaches or intelligence. And so we need a cultural change there."

Oliver Rochford

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Education and Skills Gap: outdated courses and underscores the necessity for ongoing training and adaptability in the information security domain.

- Misleading Marketing: the impact of hyperbolic marketing which often overstates the novelty and effectiveness of cybersecurity solutions.

- Threat Intelligence: the significance of deriving context from intelligence data and promoting its exchange within the sector.

- Cybersecurity Community Strength: the information-sharing culture and reciprocal support among information security professionals.

- Understanding Ransomware Complexities: a general lack of awareness around ransomware intricacies, including legal repercussions of ransom payment refusals

- Emphasis on Threat Modelling: the importance of businesses understanding their unique threat landscapes and preparing for worst-case scenarios.

- Cybersecurity Startups Proliferation: the sheer number of startups entering the cybersecurity space and the concerns about their effectiveness.

- Ransomware's Robust Ecosystem: the professional network that underpins ransomware operations, which includes a mix of criminals and nation-state involvement.

- Lockbit Ransomware Group

- Cyber Volunteer Group (mentioned in relation to COVID-19)

The Rise of Cyber Mercenaries: Governments’ Secret Weapons in Cyber Warfare

https://www.razorthorn.com/the-rise-of-cyber-mercenaries-governments-secret-weapons-in-cyber-warfare/

Cybersecurity in 2024: Expert Predictions You Need to Know

https://www.razorthorn.com/cybersecurity-in-2024-expert-predictions-you-need-to-know/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

In this episode, we tackle some of the most pressing issues in the convergence of cyber warfare, information security and political strategy. Our guests, Iain and Chris, share their frontline insights on how the digital realm has become a playground for clandestine operations, where cyber mercenaries are the new knights, rooks and perhaps even the kings. 

We examine the repercussions and complexities of engaging third party cyber groups for state-sponsored operations, debate the seemingly lucrative appeal of cybercrime and look at real-world examples where the cyber realm has been militarised. Discussions range from the effect of bot networks on democracies, to the specific roles of organised criminal cyber divisions and the evolution of digital espionage.

Talking Points:

1. The Intricate Web of Cyber Mercenaries: Discover the hidden connections between governments, political factions and cyber mercenaries. We unravel the complex tactics and consequences of outsourcing cyber warfare and the ethical lines that get blurred along the way. 

2. The Business of Cyber Conflict: We talk about the paradoxical profitability of cybercrime versus the costs of robust defence. We discuss the art of balancing offensive strategies and cybersecurity defences, drawing comparisons between private sector incentives and government backed digital warfare. Professionals keen on risk assessment and cyber strategies will find this conversation particularly interesting.

3. Navigating Cybersecurity Governance: Dive into a crucial debate on managing the cyber mercenary phenomenon, filtration in intelligence gathering, and the quintessential role of governance in preventing operational downfall. As we explore the undeniable need for quality defence mechanisms, the insights shared here are invaluable for any professional aiming to stay ahead of cyber threats.

Join us on Razorwire, your go-to podcast for cutting through the digital noise, as we delve into a world where cyber conflict is omnipresent and the concept of warfare is forever altered. This is one episode you'll want to replay, decrypt and safeguard in your mental arsenal.

"It's not like a physical mercenary group where you can see them. They're not blowing anything up. Nothing's going to go bang so people actually notice. So unless a government gets hacked or something happens, unless they shut down the national grid, unless there’s collateral damage that comes with it - they can pretty much hide it away, can't they?"

Chris Dawson

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Government and Media Control: Exploring the intersections of government ownership of media and its implications for information security and cyber warfare.
• Corporate Espionage and Cyber Warfare: Debating the ethical and strategic considerations of engaging in corporate espionage and cyber warfare.
• Cyber Mercenaries: Examining the rise of cyber mercenary groups willing to conduct cyber warfare operations for hire.
• Digital Infrastructure Security: Discussing the technical and strategic challenges associated with detecting and defending against compromises in digital infrastructures.
• Plausible Deniability and Cyber Attacks: Considering the strategy of plausible deniability and its potential to shield governments from the fallout of cyber operations.
• Monetisation of Cyber Crime: Analysing the profitability and incentives driving skilled cybercriminals and how crime pays in the cyber realm.
• Cyber Warfare and Political Influence: Delving into how cyber warfare can be a tool for political manipulation and influence, referencing historical and recent events.
• Mercenary Tactics in Cyberspace: Comparing the operations of traditional mercenary groups to digital equivalents and their impact on modern conflicts.
• Legal and Ethical Challenges of Cyber Warfare: Discussing the complex legal and ethical landscape of cyber warfare, including the difficulty in predicting outcomes and avoiding collateral damage.
• Defence and Upskilling in Cyber Mercenary Groups: Highlighting the importance of continuous training and developing trust to scale commercial cyber mercenary operations effectively.

- Vulkan files

- Colonial Pipeline attack

- Dark Side - Hacking group

- Wagner Group

- Cambridge Analytica

- Cozy Bear

- APT 29

- NHS (National Health Service)

The reality of cyber warfare

https://www.razorthorn.com/the-reality-of-cyber-warfare/

The Impact of Compliance and Legislation

https://www.razorthorn.com/strengthening-cyber-security-the-impact-of-compliance-and-legislation/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Hello Razorwire listeners! It's your host Jim here, and in today's fascinating episode, we sit down with cybersecurity veteran Simon Moffatt. With two decades under his belt in the dynamic field of identity and access management, Simon unpacks the complexities of cyber protection in our modern age. From the evolution of technology to the murky waters of liability and insurance in cybersecurity, Simon's insights shed light on the challenges and trends we face. 

As the founder of The Cyber Hut, Simon taps into his experience with giants like Oracle and ForgeRock and his startup stints to guide organisations through the labyrinth of cybersecurity strategies. 

We talk about the seismic shifts in industry practices, highlighting the advent of cloud technologies and "as a service" models and the post pandemic rise of remote work. We explore the forefront of passwordless technology, the challenges of IoT security, and the critical nature of defence in depth strategies.

You’ll hear about a significant legal battle that a sizable organisation won against its insurers, highlighting the larger uncertainties in cyber liability insurance. Find out about Simon's predictions for the industry's trajectory, combined with his first hand accounts of working in various sectors of the tech world, to provide a rare glimpse into the past, present and future of cybersecurity.

Key Talking Points:

1. The Transformation of Cyber Liability Insurance: Discover why a major organisation's legal victory signals a critical juncture for cyber liability coverage and what this means for businesses navigating today's risk landscape.

2. Passwordless Futures and Biometric Booms: Tune in as Simon forecasts the rise of biometric authentication over the next few years, discussing how behaviour tracking could redefine threat detection and response.

3. Cloud Confusion and Shared Responsibilities: Uncover the intricacies of cloud service models and how shifting boundaries have resulted in complex challenges for CISOs and CIOs in pinpointing control and ownership amidst a virtual landscape.

Ready for a deep dive into cybersecurity's evolving realm with Simon Moffatt? Join us on Razorwire to unravel the enigma of cyber protection in our interconnected world.

“Cyber's a top priority, maybe even more so than it was 3 or 4 years ago. By that, I mean people are quite familiar with protecting their own identities, or PII protection. People are aware of hackers, you know, the bad guys, nation state threats."

Simon Moffatt

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Concerns and challenges surrounding data protection liability
• The problems of uncertainty due to the constantly changing landscape of cyber liability insurance
• Incomplete picture of cybersecurity with third party intelligence companies
• The limitations of third party intelligence companies in the cybersecurity space 
• Trends in identity and access management 
• Introduction to The Cyber Hut, a business focused on tracking cyber trends and aiding organisations in navigating the cybersecurity landscape
• The shift towards cloud technology, remote work and changes in software delivery
• The blurred lines of responsibility in cloud services are explored, raising questions about data ownership and control
• The need for agility, modularity and preparedness in systems following the pandemic

Simon is a recognised expert in the fields of digital identity, access and information security who assists organisations in the venture capitalist, public, private and government sectors with the selection, use and design of products and strategies to help keep information assets secure. He is also the Founder of The Cyber Hut - a global cyber security industry analysis and advisory practice based out of the UK.

With over 20 years’ experience in a broad array of security design and architecture domains, Simon has a deep specialism within identity and access management. Simon is a published author, contributor to standards at NIST and the IETF and is a regular keynote speaker. He holds several accolades including Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Cloud Security Professional (CCSP) and is a Fellow of the Chartered Institute of Information Security (F.CIIS). He also holds a Post Graduate Diploma from the GCHQ certified Information Security Group at Royal Holloway, University of London.

Oracle

ForgeRock 

The Cyber Hut 

Sun Microsystems 

Azure 

Google Cloud 

SaaS applications 

Vayu 

Sarbanes-Oxley (SOX) 

PCI DSS (Payment Card Industry Data Security Standard) 

IoT (Internet of Things) 

GDPR (General Data Protection Regulation)

CCPA (California Consumer Privacy Act)

Breaking Into Cybersecurity: Essential Tips for Newbies

https://www.razorthorn.com/breaking-into-cybersecurity-essential-tips-for-newbies/

What To Do If You Are A Victim Cybercrime: The Anatomy Of High Profile Incident

https://www.razorthorn.com/what-to-do-if-you-are-a-victim-cybercrime-the-anatomy-of-high-profile-incident/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security, from seasoned professionals with years of experience, triumphs, and lessons learned under their belt, to those in relatively early stages of their careers, offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals, providing insights, news, and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss, email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

LinkedIn: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the podcast dedicated to exploring the complex and evolving world of cyber security legislation. I'm your host, Jim, and in today's episode, we delve into the intricate landscape of cyber security legislation with our guests Steve Applegate and Phil Tonkin from Dragos.

In this episode, our guests shed light on the challenges and intricacies of navigating the cyber security legislature, focusing on the impact on critical infrastructure and the evolving landscape of compliance. From managing connectivity safely to the complexities of integrating IT and OT in modern manufacturing, we explore the key factors influencing cyber security legislation and its practical implications.

Key Talking Points:

1. The importance of managing connectivity safely and ensuring proper segmentation and visibility in the Niz legislation.

2. Challenges faced by organisations, such as Sellafield, in implementing controls and recognising legacy challenges in OT environments.

3. The impact of conflicting regulations on consumers and the need for practical compliance requirements in cyber security legislation.

“We can't let FUD be the guide, right? If every time we hear a thing, we start panicking and we deviate from our processes and start making a whole bunch of new mandates, even internally, all the people within a company that have to track that and follow it and meet with people, and it's a distraction, I think, from real security."

Steve Applegate - Dragos

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

• Managing Connectivity Safely: Emphasising the need to ensure proper segmentation and visibility in cyber security legislation.
• Challenges Faced by Organisations: Discussing the difficulties in implementing controls, recognising legacy challenges, and the importance of proportional controls.
• Conflicting Regulations and Consumer Impact: Raising concerns about conflicting regulations and the impact on consumers due to compliance costs.
• Information Exchange Hesitance: Discussing the hesitance of information exchange for cyber security purposes and its impact on managing threats.
• Reporting Dilemma: Describing the challenge of eradicating cyber events and the dilemma of reporting to the public versus mitigating further attacks.
• Third-Party Oversight Frustrations: Addressing the frustration with third-party involvement in security oversight and assessment processes.
• Transparency in Security Relationships: Advocating for transparent and trust-based relationships with third parties, emphasising actionable intelligence, and fostering transparency.
• Evolving Skill Set of Security Professionals: Describing the evolving skill set of security professionals, particularly the increasing specialisation and separation from GRC.
• Legislative Impact on OT Environments: Expressing concerns about the impact of legislation and compliance on operational technology environments and the difficulty of implementing changes in systems with old technology.
• Challenges of Sudden Legislative Changes: Discussing the challenges of sudden legislative changes, public outcry influencing legislation, and the need for realistic expectations of change in a legacy industry.

- Dragos

- Sellafield

- Azure Active Directory (AD)

- Microsoft Active Directory

DORA Compliance Made Clear: Essential Training for Safeguarding Financial Institutions w Paul Dwyer

https://www.razorthorn.com/dora-compliance-made-clear-essential-training-for-safeguarding-financial-institutions-w-paul-dwyer/

Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall

https://www.razorthorn.com/lessons-from-an-infosec-icon-a-fireside-chat-with-pci-guru-jeff-hall/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025

Welcome to Razorwire, the podcast for all things cybersecurity and information security. I'm your host, Jim, and today we have a thought-provoking discussion with industry experts Iain Pye and Chris Dawson about emerging cybersecurity threats and trends to watch out for in 2024.

In this episode, we dive into three key talking points that are essential for cybersecurity professionals to listen in on:

1. The accelerating risk of ransomware and data breaches, including the increasing need for continuous security testing and the challenges of balancing security tool costs with limited budgets and the speed required to adapt.
2. The use, impact and potential threats of artificial intelligence on major global events including the elections coming up in 2024, in the context of societal and political manipulation, as well as the rising risks of identity theft, sophisticated disinformation and deep fake technology.
3. The importance of operational resilience plans, the challenges of compliance and auditing processes, and the need for improved cybersecurity standards and training.

Tune in to gain insights from leading experts in the field on how organisations can prepare for the cybersecurity challenges of 2024. 

"What's your operational resiliency plan? How is your organisation going to have to learn the hard truths? Take a really hard look at what you're doing and go: if that falls over or it gets breached, can we keep running our business?"

Iain Pye

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

- Technology vs. training: security advancements outpacing public knowledge

- Complex compliance: regulation challenges for smaller organisations

- Cybersecurity testing shift: from annual to continuous

- Offensive and defensive AI use anticipated to increase in 2024

- Reviewing technical security solutions and policies

- Budget struggles: balancing security tools and costs

- Call for government prioritisation in security training

- Importance of basic security measures

- Mistrust in mainstream media and information sources

- Artificial intelligence: potential risks and benefits

GDPR

SEC

AI

Cyber Essentials

CSFI

The Use Of AI In Cybersecurity – Consultants Roundtable

https://www.razorthorn.com/the-use-of-ai-in-cybersecurity-consultants-roundtable/

Lessons from an InfoSec Icon: A Fireside Chat with PCI Guru Jeff Hall

https://www.razorthorn.com/lessons-from-an-infosec-icon-a-fireside-chat-with-pci-guru-jeff-hall/

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

Linkedin: Razorthorn Security

Youtube: Razorthorn Security

Twitter:   @RazorThornLTD

Website: www.razorthorn.com

Loved this episode? Leave us a review and rating here

All rights reserved. © Razorthorn Security LTD 2025