Razorwire Cyber Security

Razorthorn Security
  • 5.0 (4)
  • TECHNOLOGY
  • UPDATED FORTNIGHTLY
Razorwire Cyber Security

Welcome to the Razorwire podcast where we share information, best practices and up to date news in cyber security and infosec. Our mission is to help you become a better cyber security professional and support our vision of creating an agile community of cyber professionals who are stronger than ever before. This show is first and foremost about sharing knowledge and benefiting from collaboration. We bring you the advice and wisdom of both your host, James Rees, and his guests to build on the strength and depth of your own knowledge and experience. Your host James Rees is an information security veteran with over 25 years of industry experience and is the founder of Razorthorn Security, delivering expert security consultancy and testing services on a day to day basis to some of the largest and most influential organisations in the world, including many in the Fortune 500. The Razorwire podcast is for cyber security professionals looking for new ideas and the drive to improve their response to cyber security events. Through collaboration, we can strengthen our defences. For more information about us or if you have any questions you would like us to discuss on the podcast email podcast@razorthorn.com or head to www.razorthorn.com This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

  1. 6 HR AGO

    The Cost of Being a CISO Part 2: Ethics, Leadership and Strategic Impact

    Welcome back to Razorwire! I'm your host, Jim, and in this second part of our CISO Dilemmas series, we welcome back security experts Oliver Rochford and Richard Cassidy. Moving beyond the challenges covered in part one, this episode explores the rewarding aspects of the role while taking a frank look at the ethical issues security leaders regularly face. The guests share personal experiences and practical actions for transitioning from technical expertise to strategic leadership, building effective teams and managing relationships across the business.  As regulations tighten and cyber threats evolve, we talk about how the CISO position has grown far beyond its IT roots to become a complex executive role requiring business knowledge, political savvy and strong moral judgement.  This conversation offers a valuable perspective on where the role is heading and what it takes to succeed. Stay til the end for our predictions about how the CISO position will transform over the next five years as organisations grapple with AI, automation and increasing regulatory scrutiny. We’re talking about: The CISO Role Beyond Technology Learn how modern security leaders are shifting from pure technical expertise to become strategic business enablers. Richard and Oliver share some great insights about balancing technical knowledge with leadership skills, and explain why successful CISOs need to master communication, relationship-building and business strategy alongside their security expertise. Navigating Ethical Challenges Get an insider's perspective on the ethical decisions that CISOs face, from breach disclosures to managing surveillance requests. Using some real world examples from Oliver and Richard, we talk about how security leaders can maintain their integrity while balancing business interests, regulatory requirements and moral obligations. Building Future-Ready Security Teams Discover practical approaches to developing high performing security teams in an era of rapid change. The conversation offers actionable guidance on mentoring new talent, improving resilience and creating a positive security culture - essential knowledge for both current leaders and those aspiring to senior  This episode is packed with practical advice and forward-looking perspectives that every cybersecurity professional can benefit from.  "CISOs often face ethical dilemmas... 52% of CISOs reported that they've faced situations where they felt pressured to compromise ethical standards for business interests. In cybersecurity, the hardest decisions aren't technical - they're ethical."  Richard Cassidy Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we covered the following topics:Role Definition of the CISO: Learn how to navigate different stakeholder expectations and position yourself effectively as a CISO.Transformational Changes: Gain insights on transitioning from technical expert to strategic business leader.Key Skills for CISOs: Master the essential skills that make modern CISOs successful—from boardroom communication to risk management.Ethical Dilemmas: Handle ethical challenges confidently with real-world strategies from experienced security leaders.Regulatory and Legal Knowledge: Build your knowledge of global security regulations and protect yourself from personal...

    50 min

  2. 22 JAN

    Cybersecurity 2025 – Predictions from the Experts

    Surviving and Thriving in the 2025 Cybersecurity Landscape: Predictions and Strategies Welcome back to Razorwire! Join me, Jim, as we forecast the major trends and changes for 2025 that are set to reshape the cybersecurity industry. Joining me are cyber veterans and regular guests Oliver Rochford and Richard Cassidy. As cybersecurity becomes increasingly complex and critical to business operations, understanding what lies ahead can provide an invaluable edge. In this episode, Richard, Oliver and I break down our predictions for 2025, focusing on market consolidation, the evolution of AI in security and the ever-tightening grip of global regulations. From the rising costs of consultancy services to the rapid proliferation of security technologies, we've got you covered. We'll also take a look into the potential rise of AI-powered hacktivism and what it means for organisations worldwide.  Key Takeaways: Strategic Investment Planning for 2025 - Get expert insights on why vendor consolidation may not be the answer and learn practical approaches to evaluating emerging security technologies against established solutions while managing rising costs.Practical Regulatory Compliance Tactics - Discover how organisations are using AI to efficiently manage overlapping regulations, with actionable strategies for meeting multiple regulatory requirements without duplicating effort.Future-Proofing Your Security Strategy - Learn how the threat landscape is evolving with politically motivated insiders, how organisations are using behavioural analysis in security and what AI can realistically do for security operations in 2025. From understanding emerging markets to decoding regulatory complexities, this episode offers critical insights to arm you for the future. Don’t miss out on these expert predictions and actionable advice! Consolidation of Regulation:  "A group of CISOs wrote to the G20 summit, the OECD member states, writing a letter crying out for some level of sanity on regulatory releases because it's just getting to the point where businesses are struggling." Richard Cassidy Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we’re talking about:● Consolidation of the Cyber Security Market Learn how to evaluate whether vendor consolidation makes sense for your organisation and identify which emerging technologies could add value to your security programme. ● AI in Security Operations Understand the practical applications of AI in security versus future possibilities, helping you make informed decisions about AI investment and implementation. ● Regulation Complexity Discover strategies for efficiently managing overlapping regulations and learn how other organisations are successfully navigating complex compliance requirements. ● Quantum Encryption Learn about forthcoming quantum encryption products and how to start preparing your organisation's encryption infrastructure for quantum resilience. ● AI Enabled Activism Understand how autonomous AI systems could be used in cyber campaigns and what defensive measures you should consider implementing. ● Increased Costs and Market Changes Get practical advice on managing rising security costs and maintaining effective security despite budget pressures. ● Vendor Pricing and Economic Pressures...

    48 min

  3. 8 JAN

    Supercharge Your Security Budget in 2025: Smarter Investments, Stronger Defence

    Ever wonder how to get the most out of your cybersecurity budget without leaving your company vulnerable? Hey there, it’s Jim from Razorwire! In this episode, I sit down with cybersecurity pros Chris Dawson and Iain Pye to chat about smart spending when it comes to your cybersecurity budget. Whether you’re a big enterprise with a hefty budget or a small business wanting maximum impact on a small budget, we’ve got some actionable insights for you. In this episode, we tackle one of the industry's most pressing challenges—how organisations allocate and manage their cybersecurity spending. Together with Chris and Iain, we examine the complex relationship between IT departments and security teams competing for resources, exploring perspectives from startups making their first security investments through to enterprises managing substantial security budgets. Drawing on our collective experience, we challenge conventional wisdom about security investment and explore whether current approaches truly serve organisations effectively. Through real-world examples and hard-earned lessons, we examine why traditional approaches often fall short and propose fresh perspectives on security strategy. Our debate around tools versus talent—and occasional heated disagreements—gives you multiple battle-tested perspectives to help shape your own security investment strategy, whether you're just starting out or running an enterprise security programme. Key Talking Points Get More Bang for Your Security Buck - Learn how successful organisations are stretching their security budgets by intelligently balancing people, tools and training - so you can stop wasting money on solutions that don't deliverBuild Security That Sticks - Discover how to create a security programme that works for your whole business, not just IT, with proven approaches that align security spending to genuine business risksSmart Security on a Budget - Get practical insights on maximising security with minimal spend, from leveraging free tools effectively to knowing when (and how) to bring in expert help Tune in to Razorwire for these tips and more, and start making your cybersecurity budget work harder for you, not the other way around! Decentralised Security Budgeting:  "Security doesn't need to be expensive. It just needs to be effective, and there's a million different ways to handle security in a million different organisations." Jim Rees Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, learn how to:●      Scale Security for Your Company Size: Implement the right cybersecurity strategy whether you're running a small business or large corporation. ●      Balance Your Security Investment: Make informed decisions between hiring security personnel or investing in software tools when working with limited resources. ●      Measure Security ROI: Effectively demonstrate and track the business value of your cybersecurity investments. ●      Choose Security Partners: Select and evaluate third party security providers that match your organisation's needs and budget. ●      Implement Continuous Security Testing: Set up a continuous penetration testing programme using global resources to maintain strong security. ●      Build a Security-Aware Culture: Create and run effective security awareness programmes

    49 min

  4. 11/12/2024

    The Cost of Being A CISO Part 1: Personal, Professional & Organisational Challenges

    Join us for part one of our two-part series examining the world of Chief Information Security Officers. This episode welcomes back Richard Cassidy, Field CISO at Rubrik, and Oliver Rochford, former Gartner analyst and founder of Cyberfuturist. This episode offers insights that will give you insight into what makes security leadership successful - and what can lead to failure. Through real world experiences and practical examples, we explore where CISOs best fit in modern organisations, proven approaches for communicating risk to boards and how to handle increasing personal accountability under new regulations. Our guests share hard won lessons from building security programmes across different business cultures, revealing what works and what doesn't. We also examine why CISO tenures average just 18-24 months, and identify the changes needed to make the role sustainable. As cybersecurity becomes a pivotal aspect of business operations, the significance of CISO roles continues to grow - and so do the challenges. From justifying cybersecurity budgets to handling personal accountability for breaches, we take a look at the complexities and evolving duties of today's CISOs.  For security professionals, this discussion will help you prepare for senior leadership. For current CISOs, you'll gain strategies for navigating common challenges. And for business leaders, you'll learn how to better support and work with your security teams to protect your organisation effectively. Key Talking Points: The role and responsibilities of modern CISOs - understand how the Chief Information Security Officer position has transformed from a technical IT role into a complex business leadership position that spans multiple organisational functions Reporting structures and organisational challenges - discover how different reporting relationships (to CEO, CIO, CFO, etc.) impact a CISO's effectiveness and ability to implement security programmes across the business The personal and professional costs of being a CISO - learn about the realities and challenges that CISOs face, from stress and burnout to reputation management and legal liability, providing valuable insights for those considering or currently in the role Don't miss out on this deep dive into the cost, both personal and professional, of being a Chief Information Security Officer. Evolving Role of the CISO:  “A CISO today is essentially a senior executive that is responsible for designing, implementing, and overseeing any organisation's cybersecurity strategy... But it has significantly evolved from what used to be the old IT security director from simply managing technical security operations to actually acting as a key business partner... balancing risk and compliance and security whilst, and this is the hard part, aligning with organisational goals.” Richard Cassidy Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we covered the following topics:Learn proven approaches for justifying security investments - Discover how to effectively demonstrate the value of preventative security measures and build compelling business cases for cybersecurity budgets Master the language of business risk - Learn how to translate complex cyber risks into clear financial, operational, reputational and regulatory

    59 min

  5. 27/11/2024

    Humans vs AI: Building a Security Culture That Actually Works with Noora Ahmed-Moshe

    As AI reshapes cybersecurity threats, understanding how scams are evolving has never been more critical. Welcome to Razorwire. I'm Jim, and today I'm talking with Noora Ahmed-Moshe, VP of Strategy and Operations at Hoxhunt. We'll explore how AI is transforming cybersecurity threats and what that means for protecting ourselves and our organisations. We discuss how traditional scams have changed with AI technology and look at why phishing remains a persistent problem, along with practical ways to make security training more effective. Noora explains her approach to combining smart technology with human awareness and why building a supportive security culture works better than focusing on mistakes. Join us to gain insights into today's cyber threats and take away actionable tips for how organisations can better prepare their teams. 3 Key Talking Points: AI-Enhanced Phishing Techniques: Discover how AI, including tools like ChatGPT, has drastically increased the volume and sophistication of phishing emails, making them harder to detect and more culturally nuanced.Positive Reinforcement in Training: Learn why a supportive, non-punitive approach to security awareness training—using gamification and rewards—can lead to better internalisation of security practices among employees.Deepfake Challenges: Understand the emerging threats posed by deepfake technology, particularly in a remote work environment, and how organisations can adapt their security measures to validate identities effectively. Tune in to this vital discussion to stay ahead of cyber threats and foster a culture of security within your organisation. Motivating Through Gamification:  "It is about motivating people and how you do that. And that's why at Hoxhunt, when we do our training, for example, in terms of social engineering attacks, we reward people anytime they report something. Then they're on a leaderboard, and it's all gamified. So it gives people this real sense of engagement, and that makes it positive." Noora Ahmed-Moshe Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we covered the following topics:Power up your security training: Learn how to structure effective security training programmes that actually prevent data breaches, based on real-world examples of what works and what doesn't.Master the scammer’s playbook: Understand why "too good to be true" scams continue to succeed by exploring their evolution from the Love Bug virus to modern day frauds, helping you spot timeless patterns in social engineering.Outsmart AI-powered threats: Discover how AI is transforming phishing attempts with sophisticated language and cultural awareness and learn what makes these new attacks so challenging for staff to detect.Stay ahead of QR code attacks: Get ahead of emerging threats by understanding how criminals are exploiting QR codes in innovative ways and learn how to spot these often-overlooked security risks.Unlock human security potential: Understand why human behaviour is at the heart of most security breaches and learn practical ways to address these vulnerabilities in your organisation.Build a confident security culture: Discover why leading organisations are moving away from fear-based security cultures and learn how to create an environment where staff feel confident reporting potential...

    49 min

  6. 13/11/2024

    Mental Health, Organisational Culture & The Human Side of Cybersecurity

    Are layoffs increasing your cybersecurity risk and driving your team to burnout? This episode looks into the psychological underpinnings of infosec to navigate turbulent times at work. Welcome to Razorwire, the podcast that cuts through the complexities of information security with sharp insights and expert discussions. In this episode, I’m joined by Lisa Ventura (MBE), founder of Cybersecurity Unity, and Bec McKeown, a psychologist specialising in high-risk environments. Together, we explore the hidden psychological factors that shape cybersecurity practices and discuss essential strategies to safeguard your organisation. Join us as we discuss the impact of economic layoffs on cybersecurity, the efficacy and ethical concerns surrounding psychological profiling, and the sophisticated tactics employed by malicious actors in today's digital arena. Lisa, Bec, and I also unpack the importance of organisational culture in mitigating human error, the role of mental health in cybersecurity, and how to implement targeted security measures without overwhelming your team. This episode is a must-listen for professionals seeking to understand the human dynamics behind infosec challenges and cultivate a supportive, resilient security culture. 3 Key Takeaways: Protect Your Organisation Without Crossing Privacy Lines. Want to strengthen your security approach without relying on controversial psychological profiling? Discover practical, ethical alternatives as Bec McKeown walks you through smarter ways to assess and mitigate insider risks whilst preserving employee trust and privacy.Prevent Data Theft During Company Transitions. Is your organisation facing changes? Learn how to protect your critical assets during turbulent times. Lisa Ventura reveals proven strategies to identify and secure your most valuable data, particularly when your company is experiencing workforce changes or economic pressure.Build a Stronger, More Resilient Security Team. Ready to boost both your security effectiveness AND team morale? Get hands-on techniques from Bec McKeown to create an environment where your security professionals thrive. Walk away with practical steps to reduce burnout, increase psychological safety and build a high-performing team that stays sharp and engaged. Tune in to Razorwire for actionable advice and expert perspectives to fortify your cybersecurity strategy amid challenging times. On Psychological Safety & Blame Culture: "If people are constantly told off for not doing things in the right way, whether that's cybersecurity training or otherwise, they're never gonna fess up to it... if you haven't got that psychological safety within the culture, then these things are probably more likely to happen because it's not in the person's best interest to hold their hand up." Bec McKeown  Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we covered the following topics:Understanding Layoff Security Risks: Explore why workforce changes increase data theft risks and why organisations need heightened awareness during these transitions. Beyond Psychological Profiling: Learn more effective and ethical ways to assess security risks without compromising employee privacy - practical alternatives you can implement today. High-Value Target Protection: Understanding why certain roles face increased targeting and need additional security...

    41 min

  7. 30/10/2024

    Insider Threats & Third Party Risk: How to Manage Security Threats

    Every vendor you trust and every employee you hire could be your next security crisis—explore the realities of third party risk and insider threats on this episode of Razorwire! Join us for a discussion on the multifaceted challenges of third party risk and how they can destabilise your organisation. From the growing complexities of cloud providers like AWS and Azure to detecting and dealing with insider threats, our conversation covers it all.  My esteemed guests, Razorwire favourites Iain Pye and Chris Dawson, share their perspectives on the right to audit third parties and how shifts in business models and changing workplace culture impact our security postures.  We also break down a case study involving indemnity and insurance settlements following a breach incident, providing you with practical takeaways for enhancing your own security protocols. Key takeaways: Strengthen Your Third Party Risk Management Implement contractual audit rights early in vendor relationshipsDevelop resilience plans for vendor service failuresUnderstand the risks of supply chain dependencies (third parties of third parties)Plan for scenarios where key service providers might fail or be compromised Understand and Mitigate Insider Threats Identify different types of insider threats (accidental, disgruntled employees, corporate espionage)Monitor for behavioural changes and suspicious activity patternsImplement ongoing background checks and security clearance reviewsBalance monitoring with employee privacy and company culture considerations Address Modern Security Challenges Evaluate the cost-benefit trade-offs between in-house and outsourced servicesImplement monitoring solutions that correlate data from multiple sourcesDevelop security strategies that account for both human and technical factorsCreate comprehensive risk assessments that include both internal and external threats Join us on Razorwire as we untangle the complexities of third party risk and insider threats, providing you with actionable insights to fortify your organisation's cyber defences. On the inevitability and scale of third-party breaches:  "It's inevitable. You're gonna have a third party breach. There's about, what, 10 a day... You could do all the due diligence in the world and all the security checks about this. You could have a very robust vendor risk management, whatever you wanna call it. At the end of the day, it's gonna take one little, maybe insider threat on the third party side, and that will cause a breach."  Iain Pye Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we discuss:● Implementing Third Party Audit Rights: Secure your organisation by establishing robust audit rights in vendor contracts before engagement begins. ● Evaluating Cloud Provider Stability: Assess and mitigate risks when selecting cloud providers by verifying their financial stability and data migration capabilities. ● Preventing Insider Security Breaches: Distinguish and protect against both intentional and accidental internal security threats through targeted controls. ● Building a Strong Security Culture: Foster an environment where employees actively report and respond to security warnings rather than normalising them. ● Managing Employee-Related Risks: Develop strategies to...

    45 min

  8. 16/10/2024

    How to Optimise Your GRC Tools

    How to Optimise Your GRC Tools Improving Value, Efficiency & True Risk Management Are your GRC tools really managing risk, or just creating noise? Welcome to the latest episode of Razorwire, where we cut through the complexities of the cybersecurity world to deliver actionable insights.  I'm your host, Jim, and in this episode, we're discussing the multifaceted challenges and opportunities surrounding Governance, Risk and Compliance (GRC) tools with none other than Jack Jones, creator of the FAIR risk model and a seasoned security professional with nearly 40 years’ experience. In our conversation, Jack and I explore the intricate landscape of GRC tools, questioning their effectiveness in truly managing risk. We talk about the difference between controlling efficiencies and understanding genuine risks, shedding light on the often misleading contents of risk registers.  In this episode, you'll learn invaluable insights that could transform how you approach risk management and compliance. From navigating price range vs efficiency, to the idea of developing a more effective and affordable GRC solution, this episode offers a treasure trove of useful takeaways for anyone in the cybersecurity field.  Key takeawaysThe Real Cost of GRC Tools: Jack and I discuss the hidden expenses and renewal price hikes associated with existing GRC tools. If you're feeling the financial strain of your current GRC solutions, this segment is a must-listen to understand the true cost and value proposition of these tools.Redefining Risk Management: We talk about the importance of differentiating between real risks and mere efficiencies and how many organisations can get this wrong. Learn how to avoid the ‘noise’ in your risk register to focus on genuine risk scenarios that matter to your business.The Path to Better GRC Solutions: Tune in to hear our thoughts on the pressing need for innovation in GRC tool design. If you're looking for practical, cost effective solutions tailored to meet your risk management needs, you'll want to hear our insights and future plans. Don't miss this conversation that could reshape your perspective on GRC tools and risk management. "If I thought the [GRC tool] technology is actually provided anywhere near the value of their potential… if the GRC products and their implementations were actually doing the job they're intended to do, they should cost a lot of money because they would be providing a ton of value." - Jack Jones Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen In this episode, we covered the following topics:Cybersecurity Responsibilities Debate: We debate whether cybersecurity should fall under IT or infosec departments.Penetration Testing Management: How penetration testing could be subject to a conflict of interest depending on which department manages it.GRC Tool Costs: Maximising GRC Tool ROI: Gain insights on how to assess and optimise your GRC tool's value proposition through regular utilisation and cost reviews.Identifying GRC Tool Shortcomings: Understand the common pitfalls of popular GRC tools in addressing real world risks, enabling better tool selection and implementation.Proper Risk Register Management: Learn to distinguish between genuine risks and audit deficiencies for more accurate and useful risk registers.Third-Party Risk Management: Learn strategies for effectively managing the challenges posed by third party risks in modern business environments.Effective Risk Communication: Master...

    44 min
See All (65)

Trailer

Ratings & Reviews

5
out of 5
4 Ratings

About

Welcome to the Razorwire podcast where we share information, best practices and up to date news in cyber security and infosec. Our mission is to help you become a better cyber security professional and support our vision of creating an agile community of cyber professionals who are stronger than ever before. This show is first and foremost about sharing knowledge and benefiting from collaboration. We bring you the advice and wisdom of both your host, James Rees, and his guests to build on the strength and depth of your own knowledge and experience. Your host James Rees is an information security veteran with over 25 years of industry experience and is the founder of Razorthorn Security, delivering expert security consultancy and testing services on a day to day basis to some of the largest and most influential organisations in the world, including many in the Fortune 500. The Razorwire podcast is for cyber security professionals looking for new ideas and the drive to improve their response to cyber security events. Through collaboration, we can strengthen our defences. For more information about us or if you have any questions you would like us to discuss on the podcast email podcast@razorthorn.com or head to www.razorthorn.com This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

Information

  • Creator
    Razorthorn Security
  • Years Active
    2022 - 2025
  • Episodes
    65
  • Rating
    Explicit
  • Copyright
    © Copyright 2025 Razorthorn Security
  • Show Website
    Razorwire Cyber Security

You Might Also Like

To listen to explicit episodes, sign in.

Stay up to date with this show

Sign in or sign up to follow shows, save episodes and get the latest updates.
Select a country or region

Africa, Middle East, and India

Asia Pacific

Europe

Latin America and the Caribbean

The United States and Canada