The Rook

Send us Fan Mail

An AI tool drafts a reply to a customer. Fine. Now let it open the account, then issue the refund. Same chat window, very different job.

In this episode I walk one customer message through three steps, the draft, the account and the refund, and show where AI goes from helpful to dangerous. I also look at what "a human reviews it" should actually mean, why a wrong AI answer can cost you more than the same mistake from an employee, and what I'd do tomorrow instead of banning AI.

Chapters:
0:00 Riding along
1:23 Draft
1:47 Account
2:04 Refund
2:16 Where I draw the line
3:42 What "a human reviews it" means
4:59 Why mistakes cost more
5:58 Embrace it
7:16 Vet the vendor
8:39 What to do tomorrow

Sources:
UK NCSC, agentic AI blog, 20 Aug 2026
OWASP LLM06:2025 Excessive Agency
Mata v. Avianca, S.D.N.Y., 22 Jun 2023
Dietvorst, Simmons and Massey, 2015, algorithm aversion
Microsoft and LinkedIn, 2024 Work Trend Index
IBM Cost of a Data Breach Report 2025
Anagram survey via HR Dive, 13 Aug 2025
DHS order on DeepSeek, Federal Register 91 FR 66346, 20 Oct 2026

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

That cybersecurity budget request about to land on the CFO's desk is full of acronyms and tool names, and the number probably went up again. This episode gives you five questions that turn it into a business decision you can defend from either side of the table.

Who it's for: CFOs and finance leaders who approve the budget, and the IT lead, security lead, MSP or vCISO who submits it.

The five questions:

1. What would hurt most if it stopped working or leaked?
2. What do we own, and is it working for us?
3. What is required from outside, and what is a business call?
4. What becomes more likely if we cut this?
5. Who is accountable for the outcome?

Free one-page worksheet that follows the five questions: https://corvus-cyber.com/the-2027-security-budget-worksheet/  

Chapters
 0:00 The budget request about to land
 2:03 Five questions and a one-page worksheet
 3:01 1. What would hurt most
 6:08 2. What do we own, and is it working
 7:50 3. Required from outside vs a business call
 10:10 4. What becomes more likely if we cut this
 12:07 5. Who is accountable
 13:47 The decision that fits on one page
 15:13 Your move

Sources
 Verizon 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/
Sophos, The State of Ransomware 2026: https://sophos.com/ransomware2026
IANS and Artico Search, 2026 Security Budget Benchmark: https://www.ians.com/blog/security-budgets-stall-as-ai-reshapes-2027-spending

The Rook is a show about the business decisions underneath cybersecurity headlines, by David Shaw of Corvus Cybersecurity. corvus-cyber.com

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure

David Shaw explains that ransomware leverage is shifting from encrypting systems to stealing data and threatening public exposure, using Galaxy Warden’s report that Canadian immersive media company PHI Studio appeared on Nova Ransomware’s leak site on July 17 after data was exfiltrated. He argues this model particularly endangers creative and IP-heavy businesses because unreleased work, client contracts, and other confidential assets can be exposed without operational downtime. Shaw connects the threat to CISA’s Known Exploited Vulnerabilities Catalog, highlighting actively exploited flaws in edge-facing systems like remote access platforms, identity infrastructure (e.g., ADFS), collaboration tools (e.g., SharePoint), and critical apps. He stresses detection and monitoring (EDR and network visibility), tested response readiness, and insurance realities as carriers remove silent cyber coverage and scrutinize MFA and controls. He recommends executives ask about KEV patch status, phishing-resistant MFA compliance, and whether a 48-hour intruder would be detected.

00:00 Silent Ransomware Shift
01:22 Meet The Rook
02:30 PHI Studio Case Breakdown
03:11 Why Exposure Hurts Most
04:28 CISA KEV And The Door
06:07 From Downtime To Liability
06:59 Detecting Exfiltration With EDR
08:44 Vulnerabilities To Full Breach Chain
09:52 Insurance And Control Requirements
11:24 Three Questions To Ask Now
14:25 Wrap Up And Next Steps

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

The $200,000 Security Leadership Gap: CISO, Internal Promotion, or Fractional vCISO

There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem. It's what the 2026 CISO Report from Cybersecurity Ventures and Sophos calls a market failure.

Most companies under $50 million in revenue never close that gap with a full-time hire; the math doesn't work at that scale. Instead, security decisions get made informally: an IT director carrying a second job, a compliance program built to pass audits rather than manage risk, or no one at all. Host David Shaw (CISSP, GLEG) walks through what actually fills the gap: a full-time CISO, an internal promotion, or a fractional vCISO, what each one costs, where each one works, and where each one fails.

In this episode:

• The 10,000-to-1 CISO-to-business ratio, and why the 2026 CISO Report calls it a market failure
• The three informal models that fill the gap when there's no security leader, and why each one breaks down under pressure
• Full-time CISO vs. internal promotion vs. fractional vCISO: honest costs and tradeoffs for each
• The revenue thresholds where each option actually makes sense
• An illustrative example of what an unaddressed gap costs when a known, escalated risk goes unfixed

The Security Leadership Readiness Check, five questions:

1. Who is accountable to the CEO or board for security risk, by name, as a primary responsibility?
2. When was security last on the board agenda as a standalone item, not folded into an IT update?
3. Do you have a documented security roadmap with budget attached, reviewed at least annually?
4. In the last 12 months, has an executive overridden an IT security recommendation, and do you know why?
5. If you had a material security incident tomorrow, who makes the notification and response decisions, and have you rehearsed it?

Sources referenced:

• Cybersecurity Ventures — 35,000 Chief Information Security Officers Employed Globally in 2026
• Sophos — 2026 CISO Report (with Cybersecurity Ventures)
• Cybersecurity Ventures — 2026 CISO Salary and Compensation Data

Note: the healthcare-acquisition scenario referenced in this episode is an anonymized composite illustration, not a specific named case.

The Rook is board-ready security intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk but don't have a dedicated security function. New episodes every other Tuesday.

Work with David: corvus-cyber.com

Now, it's your move.

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

CISA adding a vulnerability to its Known Exploited Vulnerabilities catalog isn't a patch reminder anymore. It's the moment your insurer and your counterparty's diligence team start treating you as someone who was on notice, and if you didn't patch, that's on you.

In this episode, David Shaw walks through how the KEV catalog moved from a federal compliance tool to a market-facing liability standard, the exploited vulnerabilities in Oracle, SonicWall, VMware, Microsoft, and Citrix systems that drove that shift across July, August, and early September, what insurers and diligence teams now read into a KEV listing, and the three conversations every executive needs to have this week.

In this episode:

What the KEV catalog is, and why it moved from government plumbing to a market liability standard
The exploited flaws behind that shift: Oracle E-Business Suite Payments, SonicWall SMA1000, VMware vCenter, Microsoft AD FS and SharePoint, and Citrix NetScaler
How insurers and incident response firms cite KEV entries to build a documented record of notice
What KEV exposure means in M&A diligence, rep and warranty coverage, and escrow
The vendor-risk lesson from the Suno breach
The three conversations to have this week: with your IT lead or MSP, your insurer or broker, and your diligence team

Resources mentioned:

CISA Known Exploited Vulnerabilities (KEV) Catalog
CISA Binding Operational Directives 22-01 and 26-04
Beazley Security and eSentire advisories

Connect with David Shaw:

Website: corvus-cyber.com
LinkedIn: linkedin.com/in/djshaw
Email: [email protected]

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what executives read into it is where most companies are quietly carrying real risk.

In this episode, David Shaw walks through what compliance audits actually evaluate, the three places where compliance and real security pull apart inside companies (access management, detection, out-of-scope creep), what someone running a real security practice will tell the board, and the two questions every board should be putting on the agenda at the meeting after the next audit closes.

In this episode:

• What an audit actually answers, and what it doesn't
• Why the gap between the report and reality isn't a failure of the audit
• The three places compliance and real security pull apart: access, detection, scope
• What a real security practice looks like, versus a compliance program
• What someone running a real program will tell the board
• The two questions to put on the agenda after the next audit closes

Resources mentioned:

• SOC 2, ISO 27001, PCI, NIST, HIPAA frameworks

Connect with David Shaw:

• Website: corvus-cyber.com
• LinkedIn: linkedin.com/in/djshaw
• Email: [email protected]

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Send us Fan Mail

In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs.

In this episode:

• How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligence
• How Marriott bought a four-year-old, undetected breach when it acquired Starwood
• Why the standard M&A cybersecurity questionnaire fails to catch material risk
• How R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teams
• The four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisions
• What sellers should be doing now to protect deal value
• Three artifacts every buyer should require, not just three questions to ask

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG