Securities

Welcome to Episode 11 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 11: "People Are the Perimeter: Culture". We examine why employees are not the weakest link in cybersecurity, but rather the outer edge of your organization's defenses, and how leadership choices shape whether that perimeter is weak or strong.Key Topics Covered in This Episode:

• Why Culture Beats Tools: How technology alone has limits, and why a strong security culture—defined as what staff do when nobody is checking—provides an adaptable defense.
• Tone From the Top: How small, visible actions by senior executives set the standard across the business, and why leaders must accept the same security controls as everyone else.
• Pulling the Alarm Without Fear: The critical importance of a blame-free reporting culture where honest mistakes reported promptly are treated as learning opportunities rather than disciplinary events.
• Training That Changes Behaviour: Shifting from annual tick-box online courses toward short, job-relevant practice, and measuring active reporting rates rather than mere completion percentages.
• Incentives & Making the Secure Way Easy: Identifying hidden conflicts in performance metrics (such as call-center handling times) and implementing tools like single sign-on to make the secure path the easiest path.
• Leading with Steadiness: Why reacting with calm gratitude when staff verify instructions or report suspicious events reinforces security habits far better than fear or frustration.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 10 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 10: "The AI Question". We examine how artificial intelligence is transforming cyber governance—from everyday productivity gains and data-leakage risks to AI-driven impersonation fraud and executive oversight of corporate AI tools.Key Topics Covered in This Episode:

• A New Kind of Tenant in the Building: Sorting AI into three distinct governance buckets—a tool staff use, a weapon criminals use, and a capability built or bought into products.
• When Staff Paste Secrets Into Chatbots: Managing data leakage when well-meaning employees use public AI tools, and why providing an approved, business-grade AI tool works better than an outright ban.
• AI-Assisted Fraud & Deepfakes: How voice cloning and video manipulation bypass traditional red flags, and why "process beats perception" through strict call-back rules and dual approvals [405–408].
• Writing an Acceptable-Use Policy: Creating a 1-to-2 page policy that clearly names approved tools, defines restricted data, enforces human accountability, and encourages early reporting [411–414].
• Governing the AI You Build or Buy: Setting up a simple register of corporate AI applications with named business owners, risk tiering, and pre-launch security testing.
• Keeping Proportion — Opportunity vs. Threat: Balancing risk management with the immense productivity benefits AI provides to both operational teams and security defenders.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 9 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 9: "Living in the Cloud". We explore how moving to the cloud changes the nature of executive responsibility, what the "shared responsibility model" means for leadership, and how to manage provider outages, data residency, and unapproved software tools.Key Topics Covered in This Episode:

• What "The Cloud" Really Is: Moving from owning server infrastructure to renting computing capacity, platforms, and software (IaaS, PaaS, SaaS).
• The Shared Responsibility Model: Why the cloud provider secures the infrastructure "of the cloud," but your organization remains fully accountable for data settings and access "in the cloud".
• Data Residency & Sovereignty: Knowing where your company's data physically lives, whose legal jurisdiction applies, and how location impacts regulatory compliance and customer trust.
• When the Landlord Has a Bad Day: Preparing for major cloud provider outages, defining Recovery Time Objectives (RTO), and establishing secondary communication channels when primary tools go down.
• SaaS Sprawl & Shadow IT: Addressing the quiet accumulation of unapproved cloud tools adopted by staff, and bringing them safely into single sign-on (SSO) and central governance without stifling productivity.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 8 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 8: "Your Suppliers Are Your Risk Too". We explore how modern companies extend their security perimeter to external vendors, contractors, and software providers, and why managing third-party risk requires sharp, proportionate governance rather than endless questionnaires.Key Topics Covered in This Episode:

• Who Holds a Key to Your House?: How software tools, marketing agencies, and IT vendors quietly gain access to sensitive systems, and how to build a tiered inventory of critical third parties.
• Due Diligence Without the Theatre: Moving away from 300-question generic forms toward focused questions, verifying independent evidence (SOC 2, ISO 27001), and matching evaluation effort to actual risk tiers.
• Concentration Risk — Many Eggs, One Basket: Understanding how relying heavily on a single cloud, payroll, or payment provider creates single points of failure, and how to prepare workable fallbacks.
• Writing Contract Rules Before You Need Them: Key contractual clauses every leader must insist on—including strict breach notification timelines in hours, audit rights, clear SLAs, and data exit strategies.
• You Ship Other People's Code: How modern software relies on third-party and open-source libraries, why a Software Bill of Materials (SBOM) matters, and how to manage software supply chain vulnerabilities.
• Governing Managed Service Providers (MSPs): Why outsourcing IT or security operational tasks does not outsource accountability, and how to verify that your MSP enforces multi-factor authentication, patching, and strict access controls.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 7 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 7: "Spending Wisely — Budget and the Return on Security". We unpack why there is no magic percentage for cyber spending, how to evaluate spending requests using risk-based budgeting, where the first dollars should always go, and how to measure value when the best outcome is that "nothing happened".Key Topics Covered in This Episode:

• How Much Is "Enough"?: Why relying strictly on industry benchmark percentages can be misleading, and why spending must be proportional to your specific business exposure and risk.
• Risk-Based Budgeting: How to start with the top business risks, evaluate the cost of reducing expected loss, and present leaders with clear budget options.
• Where the First Dollars Should Go: Why essential cyber hygiene — multi-factor authentication (MFA), tested backups, patching, practical training, and logging — must always be funded before buying exotic tools.
• Prevention vs. the Cost of a Breach: A practical method for weighing prevention costs against real operational disruption, lost revenue, and recovery expenses.
• Evaluating Spending Requests & Avoiding Shelfware: How to ask clear questions about full cost of ownership, expected risk reduction, and avoiding software that ends up unused.
• Measuring Value When "Nothing Happened" Is the Goal: How to shift from outcome metrics to measuring readiness (coverage, speed of response, and results from restore tests and tabletop exercises).

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 6 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 6: "Frameworks Without the Fog". We examine how security frameworks act as the "building codes" of cyber risk, lifting the fog of technical jargon and showing leaders how to organize their security program without getting buried in endless paperwork.Key Topics Covered in This Episode:

• Why Frameworks Exist: How frameworks provide completeness, a common language, a way to measure progress, and credibility so your security strategy is driven by deliberate business choices rather than random incidents.
• NIST CSF 2.0 (The Six Functions): A plain-language tour of Govern, Identify, Protect, Detect, Respond, and Recover, highlighting why the "Govern" function sits at the center to steer executive oversight.
• ISO 27001 & What Certification Signals: What an Information Security Management System (ISMS) certification truly proves (discipline and auditability) versus what it doesn't (total invulnerability), and why checking the exact scope of certification is critical.
• The CIS Controls for Practical Hygiene: How the CIS Critical Security Controls offer a concrete, prioritized checklist (starting with Implementation Group 1) for organizations wondering where to begin.
• Steering, Not Drowning: How to use a framework as a navigational compass, setting targets based on the board's risk appetite and reporting progress on a single concise dashboard.
• Maturity vs. Capability: Why having a documented, repeatable process (maturity) is not the same as actual operational readiness (capability), and why capability must be proven through exercises, restore tests, and real-world testing.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 5 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 5: "Rules of the Road — Regulation and Compliance". We examine the growing web of legal and regulatory obligations facing modern businesses, distinguishing between mere "compliance theatre" and genuine operational security, and exploring what board members and senior executives must know about breach disclosure and personal liability.Key Topics Covered in This Episode:

• Why Regulators Now Care: How data loss and cyber incidents impact individuals, financial markets, and critical infrastructure—shifting regulatory focus directly onto boardroom governance.
• Data-Protection Frameworks Around the Globe: A general tour of major privacy regimes—including GDPR, Japan's APPI, and US state-level patchworks—and the strict notification clocks they impose.
• Breach Disclosure & Materiality: Understanding market disclosure expectations (such as US SEC rules) and how leadership teams define and document whether an incident is "material" before a crisis occurs.
• Sector-Specific Rules & Supply Chain Pass-Through: Navigating rules across finance, health, and critical infrastructure (DORA, PCI DSS, HIPAA, NIS2) and how customer contracts pass regulatory standards down to mid-market suppliers.
• Compliance vs. Security: Why "passing the audit" is a floor rather than a ceiling, and how to avoid the trap of paper-based compliance theatre.
• Director and Officer Liability: Understanding executive duty of care and oversight, personal liability trends, and how documented board oversight serves as your strongest protection.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 4 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 4: "Who Owns Security — Roles and the Org Chart". We examine how organizations move past the common trap of assuming "the IT department handles security" and build a governance structure where executive roles, reporting lines, and board oversight are clearly defined.Key Topics Covered in This Episode:

• Why "The IT Guy Handles It" Fails: How placing security responsibility solely on the IT team creates a conflict of interest with operational speed, a gap in business authority, and a gap in board visibility.
• The Role of the CISO and Reporting Lines: What a Chief Information Security Officer actually does, the trade-offs of reporting to the CIO, CEO, or CRO/CFO, and why direct access to the board is non-negotiable.
• Board vs. Management (Owners vs. Managers): Distinguishing between the board's duty to set risk appetite and oversee governance versus management's role in running daily operations.
• Eliminating Ambiguity with a RACI Chart: How establishing a Responsible, Accountable, Consulted, and Informed (RACI) framework prevents critical security tasks from falling through organizational cracks.
• The Three Lines of Defence: A simple breakdown of the first line (business and IT operations), the second line (security and risk oversight), and the third line (independent internal audit).
• Fast-Tracking Bad News: Why traditional corporate hierarchy slows down bad news, and how explicit escalation rules and bypass channels ensure critical warnings reach senior leadership quickly.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 3 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 3: "Cyber Risk Is Just Business Risk". We unpack why cyber risk shouldn't be treated as an isolated, mysterious IT issue, but as an ordinary business risk evaluated using the exact same principles as financial loss, warehouse fires, or product recalls.Key Topics Covered in This Episode:

• Likelihood vs. Impact: How to evaluate threats by asking "how likely is it?" and "how bad would it be?" to balance technical risks with financial realities.
• Risk Appetite & Tolerance: How the board sets clear, measurable boundaries for how much risk the organization is willing to carry (such as maximum acceptable days of operational downtime).
• Integrating Cyber into Enterprise Risk Management (ERM): Why cyber scenarios belong on the main corporate risk register owned by business executives (CFO, COO, Head of Marketing) rather than buried deep inside IT queues.
• The Four Choices (Accept, Reduce, Transfer, Avoid): A breakdown of the four levers leaders can pull for any risk, why collecting less data ("avoidance") is the most overlooked cost-saver, and why zero risk cannot be bought.
• Putting Risk in Money Terms: How converting potential loss into rough annual financial figures allows leadership teams to compare prevention costs directly against potential business impact.
• Meridian Foods Case Study: A look at how Meridian's leadership team maps out their top risk scenarios, assigns executive owners, and makes practical trade-offs.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or system configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.Key Highlights of the Book:

Welcome to Episode 2 of the podcast series exploring The Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda.In this episode, we cover Chapter 2: "The Threat Landscape in Business Terms". We unpack who actually attacks companies, why most cybercriminals operate for financial gain, and how understanding the business model of cybercrime helps executives protect their organizations without getting bogged down in technical jargon.Key Topics Covered in This Episode:

• Who Comes Through the Door: A breakdown of common threat actors — from organized criminal groups and opportunists to insiders, activists, and nation-states — and why money is the primary driver.
• Cybercrime as a Business: How modern cybercrime operates like a mainstream industry with specialized roles (access brokers, ransomware-as-a-service, negotiators), and why your defensive goal is simply to make your company an unprofitable target.
• Ransomware vs. Data Theft: Understanding the critical difference between locked systems and copied files, and why saying "we have backups" only addresses availability, not data exposure.
• Payment Fraud & Email Impersonation: How Business Email Compromise (BEC) and fake supplier bank changes drain corporate funds, and why simple process controls like phone call-backs are your strongest defense.
• Side Doors & Honest Mistakes: Why third-party suppliers, insider access, and ordinary employee errors represent major exposure points, and how a blame-free reporting culture protects the business.

• Plain-Language Governance: Translates complex threats like ransomware, supply-chain vulnerabilities, and AI into clear business decisions.
• Practical Frameworks: Features a running case study of Meridian Foods, an Appendix of Board-Level Questions, a One-Page Board Dashboard Template, and a ready-to-run tabletop exercise.
• The 90-Day Board Cyber Action Plan: Concludes with a concrete, week-by-week roadmap that leadership teams can put to use immediately.

About the Book: The Boardroom FirewallThe Boardroom Firewall: What Every Executive Must Know About Cyber Risk, Ransomware, and AI by Sho Shimoda is a calm, plain-language guide written specifically for chief executives, board members, founders, and senior leaders in finance, operations, legal, and risk.Rather than teaching technical skills or configuration, the book equips non-technical leaders with the judgment and confidence needed to manage cyber risk as an ordinary business risk. It cuts through industry jargon with everyday analogies, real-world boardroom vignettes, and actionable governance tools.