How well do you know what’s happening in your cloud?
With so many people in an organization able to access it, managing and tracking every change can be a Herculean task.
So, it’s no surprise that so many organizations need help tracking drift across their cloud networks.
And the best person they could turn to is today’s guest, John Grange, Co-Founder and CTO at OpsCompass, a company making software that offers centralized visibility for security, cost management, and compliance from a single dashboard.
In this episode, we discuss: - Why you need centralized visibility to track drift in the cloud - How security, compliance and cost management drift are tracked by OpsCompass - The kinds of users leveraging OpsCompass
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Every CISO’s dreams is moving from reactive security to purely proactive security posture.
In an era of big data and technological advancements in machine learning is this dream finally a reality?
To find out, we charged today’s guest, Johnna Verry, Intern at Pivot Point Security, with putting machine learning to the test to see if it can really be the breakthrough we need in predictive security. She joins me to share the results.
In this episode, we discuss: - The challenge of — and tools necessary for — scraping and cleaning data for use in machine learning - The types of machine learning algorithms and how they work - The results of Johnna’s research and what they mean for the future
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Just because ISO 27001 suggests a control, doesn’t mean you have to have it – in fact, you could be hurting yourself if you do by wasting money and have more trouble in an audit than you would otherwise.
Your controls depend on your risk — not ISO suggestions.
That’s just one of the many misunderstandings people have about the ISO 27001 standard.
In this solo episode, host John Verry, CISO & Managing Partner at Pivot Point Security goes in depth on the most common misperceptions around ISO 27001 compliance.
Some notable examples: - Why your controls need to be in accordance with your risk - Why you don’t need to go crazy documenting absolutely everything - Why you shouldn’t overcommit on controls
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Traditional compliance approaches have served us well for years…
But they just don’t cut it anymore.
We need an approach to compliance that moves at the speed of DevOps.
Our guest today, Raj Krishnamurthy, is Founder, CEO and Engineer at ContiNube, where he is helping to bridge the gap between traditional compliance techniques and the agile, fast-paced world of DevOps.
In this episode, we discuss: - Why traditional compliance tools are outdated to manage today’s rapidly shifting risks - The 5 pillars of bridging compliance and DevOps - How Raj and ContiNube are helping to tackle the problem
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

In this special episode, we’re sharing a guest appearance John made on The Perfect Storm. During that episode, he shared how Pivot Point Security helps companies achieve security and compliance throughout different regulatory frameworks and a three-part process for validating your security processes.
Topics covered: -What services Pivot Point Security offers - Helping clients understand the importance of cybersecurity - 3-part framework to validate security
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Today’s special episode was inspired by a conversation we had with a then potential, now current client of ours at Pivot Point Security.
In discussing our Virtual CISO offering, we described our tried-and-true process for helping a client become provably secure and compliant. He loved it and wanted us to train him and his team on it. We've since had a similar conversation with a couple of boards.
What we've realized through these conversations is this process delivers a lot of value. So in this episode, we are going to share it with you.
Topics covered: - Defining a clear vision - Transforming a vision into an actionable plan - Validating your compliance
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

In the wake of the SolarWinds fiasco, a new executive order mandates practices to prevent future attacks…
How well does it address the threats?
And what does it mean for you?
To answer these questions, I invited Scott Sarris, Executive Vice President of Digital Transformation and Cybersecurity Advisory Services at Aprio, onto the show. Together, we break down the new EO into its most important components.

In this episode, we discuss: - Why the EO was necessary and what it means for cybersecurity - The role SolarWinds plays in the wording - The language acknowledging that Zero Trust is the most secure approach to cybersecurity
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

By the time you think of a ‘new’ password, attackers already have a way to crack it. Josh Amishav-Zlatin, Founder & Technical Director at BreachSense, is here to reveal the ugly truth about passwords, the risks they present, and how you can mitigate those risks.
What we talked about: - Breach timelines and scales of impact - How breaches work and how they’re identified - Is 2FA/MFA enough to protect you? - Protection vs. the right to privacy
Check out these resources we mentioned during the podcast: - Josh’s LinkedIn profile - BreachSense’s website - Have I Been Pwned website - The Infosec & OSINT Show (Josh’s podcast) - Josh’s Twitter profile
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Information governance is the solution to that irrational fear of deletion we all experience from time to time. Expert in the field and Chief Customer Officer at Encompaas, David Gould, breaks it down for us in the latest episode of Virtual CISO.
What we talked about: - What is information governance? - Data mapping potential and pitfalls. - The fear of deletion. - Value creation and information governance.
Check out these resources we mentioned during the podcast: - The California Consumer Privacy Act - David’s LinkedIn profile - Encompaas’ website - Encompaas.cloud
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Are you ready for your DIBCAC/CMMC audit? Let’s make sure.
We’re speaking to two of our best Security Consultants from right here within our ranks at Pivot Point Security. Joining me are George Perezdiaz, CMMC / NIST Security Consultant, & Caleb Leidy, CMMC Consultant/Provisional Assessor.
What we talked about:

• How to prepare for your DIBCAC/CMMC audit.
• What can you expect from an audit?
• George & Caleb’s pearls of wisdom for your next audit
  

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.