Erick Rudiak

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

The State of Nevada systems have been crippled by ransomware. For weeks. Then so read this: The state of Nevada does not have a single Chief Information Security Officer (CISO); instead, a Chief Information Officer (CIO) role exists, and responsibility for information security is a collaborative effort involving multiple IT security and department leaders, according to this State of Nevada article. Alan Cunningham previously served as the State CIO and oversaw the Enterprise Information Technology Services Division, which supports state agencies, but the position of a dedicated State CISO is not present. Key Takeaways • No dedicated State CISO: Thoughts anyone?

72

89 Comments

90% of ISO 27001 projects look great on paper and change absolutely nothing. I’ve seen it hundreds of times. The certificate arrives. The team celebrates. Then… nothing. No faster sales. No stronger culture. No real control. Because most companies treat ISO 27001 as a compliance trophy not a commercial engine. Here’s what actually shifts the culture: ➤ When founders stop outsourcing responsibility and start owning the risk conversation. ➤ When engineers see controls as accelerators, not obstacles. ➤ When “security” becomes the language of delivery, not delay. ISO 27001 done right doesn’t just tick boxes, it changes how people think, decide, and sell. It makes your business audit-ready, deal-ready, and investor-proof every single day. That’s when the ROI kicks in. Fewer audit cycles. Faster procurement. More trust baked into every demo. Forget the paperwork. You’re not buying compliance. You’re buying credibility. The question is: does your certification live in your culture, or just on your wall? #ISO27001 #SaaSLeadership #CyberSecurityStrategy #StartupSecurity #B2BSales #FinTechSecurity #SecurityCulture #ComplianceThatWins #CISOLife #EnterpriseSales

11

1 Comment

Cybersecurity isn’t just an IT issue — it’s a fiduciary responsibility. The ‘NIST IR 8286r1’ helps bridge the gap between technical operations and the boardroom by integrating cyber risk into Enterprise Risk Management (ERM). Here: -> https://lnkd.in/gsXi5Vta This reframes the conversation: From vulnerabilities to business impact From technical metrics to financial exposure From reactive spend to risk-informed strategy A single ransomware event can cost millions of $ in downtime, legal, and reputational impact. That’s enterprise risk. Leadership starts with aligning cyber risk to mission objectives and enabling data-driven decisions at the board level.

119

5 Comments

Dragos, Inc. is estimating that OT Disruptions Could Cost $330B Globally. I had the chance to weigh in on the importance of having the right visibility when handling OT data (or really any data). Security Magazine

6

1 Comment

Clorox is suing Cognizant for $380M. The reason? A 2023 cyberattack that crippled their operations, allegedly caused by poor help desk controls and a botched incident response. - This wasn’t just a breach. It disrupted supply chains, damaged customer trust, and is now turning into a legal battle with one vendor blaming the other. As security professionals, we often say: "Third-party risk is your risk." But too often, those warnings get ignored… until it’s too late. This case raises questions that CISOs and boards must be asking: - Are our vendors following the same standards we require internally? - How strong are our controls against social engineering, especially at the help desk? - Do we have contractual clarity around incident response ownership? Link to the full article is in the comments. #Cybersecurity #RiskManagement #GRC #InfoSec #CISOs

99

27 Comments

Cyber Attack Impacting Oregon Environmental Department The Oregon Department of Environmental Quality has reported a cyber attack that is affecting communications and operations including vehicle inspections. Some services will be shuttered through the weekend. #Oregon #cyber #cybersecurity #cyberattack #government https://lnkd.in/exc6as2w

14

3 Comments

Physical access management is still treated like a badge problem. It’s not. It’s an identity problem. A risk problem. An audit problem. This short video breaks down why traditional approaches fail and what modern enterprises are doing differently to govern physical access with the same rigor as cyber. If you’re responsible for access, compliance, or risk, this one’s worth 5 minutes. 👇 #PhysicalSecurity #Identity #SecurityConvergence #AccessControl #RiskManagement

46