The Cybersecurity CEO Podcast

What happens when a cyber incident stops being a security problem and becomes a leadership problem?

Robbie O'Brien is joined by Joe Sullivan, CEO of Joe Sullivan Security and former Chief Security Officer at Facebook, Uber and Cloudflare.

Joe's federal conviction following Uber's handling of its 2016 data breach made him one of the most consequential figures in the debate around cybersecurity accountability. In this episode, he reflects on what happened, what organisations still misunderstand about incident response, and why the decisions that matter most are often made long before a breach occurs.

They discuss why no security leader can promise an organisation is "safe", how CEOs and boards should approach disclosure, the value of rehearsing for the incident that gets through, Cloudflare's approach to transparency, and why leadership cannot simply delegate cyber accountability to the CISO.

They also explore the limits of security awareness training, the need to design organisations that can survive human error, and how AI is beginning to change vulnerability management and security operations.

As Joe says: "We all know we're going to have incidents. And I think what my case shows is that those are the days that we get judged on."

A conversation about cybersecurity, accountability and what leadership looks like when things go wrong.

A security leader running security across fifty countries told me cybersecurity does not come above everything, and he was right.

In episode four of The Cybersecurity CEO Podcast, Robert O'Brien talks with Steve Lorimer, Group Privacy and Information Security Officer at Hexagon, who runs privacy and security across around fifty countries. The two first met when Steve was a customer of MetaCompliance, and this conversation picks up fifteen years later. Steve has a name for the habit that quietly sets the standard in most organisations: the blind acceptance of risk, carrying on with something because nobody has been able to point at the damage yet.

They discuss what security first means when it meets profit, why Steve says security does not come above everything, and where Robbie parts company with him over who cybersecurity should report to.

If you lead a business or sit on a board, this one's for you.

About the guest: Steve Lorimer is Group Privacy and Information Security Officer at Hexagon, the measurement technology group, and has spent his career building security and privacy programmes that hold up across languages, cultures and jurisdictions.

About the host: Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join him here:

Subscribe on Substack - https://substack.com/@cybersecurityceo

Follow on LinkedIn - /thecyberceo

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

Most security training dies quietly, months after somebody ticked the box that said it worked. In episode three of The Cybersecurity CEO Podcast, I speak with Martin Smith, MBE, founder of SASIG and the man who wrote the British military's first computer security training back in 1981. He was handed the chapter to fill and found a single line waiting for him on the page: this page left intentionally blank. He has spent four decades filling it. Martin is best known for building one of the largest security communities in the UK and for arguing that the human layer is where the risk actually sits. We discuss why the bulk of the budget guards technology while the bulk of breaches walk in through people, why boards hear the cyber message and still fail to act, and why Martin puts that squarely on the profession rather than the boardroom. If you lead a business or sit on a board, this one's for you. About the guest: Martin Smith MBE is the founder of The SASIG, the Security Awareness Special Interest Group, and has spent more than forty years working on the human side of security. Find him here on LinkedIn and at https://www.thesasig.com/.

About the host: I am the Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. I have spent over 20 years helping private and public sector organisations build cyber resilience, and I write under the banner The Cybersecurity CEO. My forthcoming book, Cyber First: Security Above All, is due for release in January 2027. Join me here:

• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/

• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

Most businesses are still catching up with the cybersecurity threats of five years ago. AI just moved the goalposts again.

In episode two of The Cybersecurity CEO Podcast, Robbie O'Brien sits down with Professor Kevin Curran, Professor of Cybersecurity at the University of Ulster and one of the most widely cited researchers in his field. Kevin is Executive Co-Director of the Legal Innovation Centre, a tech entrepreneur, and a passionate advocate for practical, real-world cybersecurity solutions.

Anthropic's Mythos model has changed the cybersecurity threat landscape permanently, and most businesses have no idea what that means for them yet. Robbie and Kevin cut through the noise on what AI-powered vulnerability discovery actually looks like in practice, why the controls that have always protected you still matter, and why the single biggest risk right now is leadership teams that are watching from the sidelines while the game changes around them.

If AI feels like a threat you haven't fully got to grips with yet, this episode is the right place to start.

About the guest: Professor Kevin Curran is Professor of Cybersecurity at the University of Ulster, with over 13,500 citations and more than 1,100 peer-reviewed publications. He is Executive Co-Director of the Legal Innovation Centre and co-founder of Ultri. Find him here on X and on YouTube here.

About the host:Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in September 2026. Join him here:

• Subscribe on Substack - https://substack.com/@cybersecurityceo
• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/
• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

What happens to a business the moment its network goes dark?

In the first episode of The Cybersecurity CEO Podcast, Robbie O'Brien talks with Jane Frankland, MBE, a cybersecurity and leadership expert with nearly three decades in the industry. Jane built one of the world's first penetration testing firms and helped shape major industry initiatives including CREST and Cyber Essentials. She's best known for reframing cyber resilience as a leadership responsibility, not a technical one.

They discuss why the CISO has become what Jane calls the Chief Information Scapegoat Officer, carrying accountability for risks they often have no authority to fix. They cover the difference between security and resilience, how AI is widening the gap between finding vulnerabilities and fixing them, and what businesses can learn from car safety regulation when it comes to mandating cyber hygiene.

It all lands on one question every CEO should be asking: how badly do you want your business to survive a cyber breach?

If you lead a business or sit on a board, this one's for you.

About the guest: Jane Frankland, MBE, is a cybersecurity and leadership expert and author trusted by boards, governments, and organisations navigating complex risk. She is currently writing a new book on cyber resilience and survivability for CEOs and boards. Connect with Jane at jane-frankland.com or on LinkedIn.

About the host: Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in September 2026. Join him here:

• Subscribe on Substack - https://substack.com/@cybersecurityceo
• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/
• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.