Security & GRC Decoded

In this episode of Security & GRC Decoded, host Raj Krishnamurthy, CEO of ComplianceCow, sits down with Abhay Kshirsagar, Director of Security Services and Tools at Salesforce, to explore the evolving landscape of security, compliance, and customer assurance.

Abhay shares his journey from IT audit and risk advisory to leading compliance automation, continuous monitoring, and customer assurance at industry giants like Cisco and now Salesforce. They discuss how compliance programs can move beyond checkboxes to become strategic enablers of business growth, unlocking new markets, influencing revenue, and strengthening customer trust.

Key takeaways include:
✅ Compliance Automation & Risk Reduction: How automation is transforming GRC processes and reducing engineering burdens.
✅ Customer Assurance as a Competitive Advantage: Why transparency and trust are becoming business differentiators.
✅ Metrics That Matter: How compliance teams can track and demonstrate their impact beyond regulatory requirements.
✅ Future of GRC: The shift towards predictive security, self-service platforms, and risk-driven compliance models.

Tune in to hear practical insights, real-world strategies, and a fresh perspective on the intersection of security, compliance, and business success in today's fast-changing regulatory landscape.

🎙️ Security & GRC Decoded is brought to you by ComplianceCow. Subscribe now for expert insights from industry leaders shaping the future of security & compliance.

Learn More About How ComplianceCow Can Help Your GRC Team Today!

00:00 - Introduction

• Host Raj Krishnamurthy introduces the episode and guest Abhay Kshirsagar, Director of Security Services & Tools at Salesforce.

02:15 - Abhay’s Background & Journey into Security & GRC

• From Temple University to IT Audit & Cybersecurity.
• Early career in risk advisory and SOX ITGC.
• Transition to Silicon Valley and working on SOC 2 & ISO 27001.

08:45 - Joining Cisco & Building the Cloud Controls Framework (CCF)

• Creating Cisco’s CCF and open-sourcing it.
• Moving from compliance into product security and automation.

13:30 - Defining Security, Compliance & Customer Assurance

• Security = Protection, Compliance = Following Rules, Assurance = Transparency.
• How these functions overlap and why customer assurance is critical.

18:50 - GRC & Its Role in Business Growth

• How compliance unlocks market access & revenue growth.
• The real value of security & compliance programs beyond checkboxes.

23:20 - Customer Assurance & Measuring Customer Trust

• “What makes customers sad” – tracking gaps in compliance programs.
• Why SOC 2 isn’t enough for modern supply chain security.

28:00 - Industry Trends: Automation, Transparency & Supply Chain Security

• The rise of compliance automation and reducing engineering burdens.
• The role of SBOM (Software Bill of Materials) & SSDF in supply chain security.

34:10 - The Challenge of Security Transparency

• How to

In the premiere episode of Security & GRC Decoded, host Raj Krishnamurthy sits down with Mosi Platt, Senior Security Compliance Engineer at Netflix, to explore his unconventional journey into security and governance, risk, and compliance (GRC). From his first exposure to computers in his aunt’s home lab to becoming a leader in IT audits and compliance, Mosi shares the pivotal moments that shaped his career.

Together, they unpack the realities vs. myths of security governance, why risk quantification is still an unresolved debate, and how security and GRC teams can move from reactive compliance to proactive trust-building. They also dive into the SEC’s cybersecurity materiality rules, digital transformation in compliance, and the shift from risk-based to trust-based security models.

This episode is packed with insights for security leaders, compliance professionals, and anyone looking to understand the evolving landscape of security and GRC. Tune in to learn how leading with truth, adapting to change, and embracing value creation can transform the way organizations approach compliance and security assurance.

🎧 Listen now and decode the future of Security & GRC!

Learn more about ComplianceCow and how we can help your GRC teams!

Mosi Platt
Senior Security Compliance Engineer at Netflix
🔗 LinkedIn: https://www.linkedin.com/in/mosi-k-platt/

⏱ Timestamps:

0:00  Introduction & Host
0:38  Mosi’s Journey (IT Training to Security Consulting)
6:50  Early Career in Compliance (IT Audits)
10:44 Defining Security & GRC (3 Pillars)
12:38 Myth of Security Governance (CISO Oversight)
14:48 State of GRC Today (Risk Quantification & SEC Regs)
19:30 SEC Cybersecurity Materiality Rules
24:12 Adapting GRC Strategies (People, Process, Tech)
30:10 Building a Security GRC Program (ISO 27001 Steps)
35:00 Risk-Based vs. Trust-Based Security
41:55 Getting Executive Buy-In (Truth vs. Fear)
45:28 Inheriting a GRC Program (Evaluate & Optimize)
49:17 Future of GRC & Digital Transformation
52:37 The Perfect GRC Solution (Automated Compliance)
56:00 Recommended Books & Podcasts
58:30 Final Thoughts & Key Takeaways

📚 Books:

• Investments Unlimited by IT Revolution: https://itrevolution.com/product/investments-unlimited/
• Emergency Skin by N.K. Jemisin (Audiobook): https://www.audible.com/pd/Emergency-Skin-Audiobook/1978650841
  

🎧