Having a cybersecurity plan is one thing. Knowing what happens when your firm actually has to use it is another. For RIAs, that difference can expose practical gaps that have little to do with buying another security tool: unclear responsibilities, providers assuming someone else owns a task, missing response information, communication breakdowns, and continuity plans that haven't been tested under pressure. In this episode of The Advisor’s Edge Podcast, Chad Ramberg and Charles “Chuck” Failla, CFP® sit down with Lyman Terni, Partner at Havoc Defense, LLC, to explore what happens when an RIA takes its cybersecurity and incident-response planning off the page and actually tests it. Lyman walks through tabletop or “bench” exercises designed to simulate real incidents and uncover problems before the firm has to respond to an actual event. The conversation goes beyond the exercise itself, exploring how IT, compliance, insurance and firm leadership coordinate during an incident and what firms can learn by testing scenarios involving compromised email accounts, ransomware, backups, system outages and alternative communication. IN THIS EPISODE, WE COVER: - Why a successful tabletop exercise can be one that finds problems - How assumed responsibilities can create gaps between IT, compliance and firm leadership - What a tabletop or bench test actually looks like - Why incident response requires coordination beyond the IT team - Why an IT provider's standard response may not account for an RIA's operating environment - What firms should think through when testing business email compromise and ransomware scenarios - Why backup and recovery planning needs to be understood before an incident - What happens when a critical system such as Office 365 becomes unavailable - Why firms need another way to communicate when their normal communication channel is down - How smaller RIAs can begin improving preparedness without assuming every improvement requires another technology purchase The goal isn't to prove that a cybersecurity plan is perfect. As Lyman explains, finding problems is part of what makes the exercise useful. Testing gives the firm an opportunity to uncover assumptions, clarify responsibilities, and understand how its response would actually work before the plan is needed for real. ABOUT THE GUEST Lyman Terni is Partner at Havoc Defense, LLC. Havoc Defense is a managed service provider focused on security-first IT management and security services. The firm works with RIAs, broker-dealers, accounting firms, lawyers, and high-net-worth families. Lyman's background includes financial services, regulatory compliance, cybersecurity advising, and IT. Connect with Lyman: LinkedIn: https://www.linkedin.com/in/lymanterni/ Website: https://havocdefense.com/ ABOUT THE HOSTS Chad Ramberg President, Box Professional Insurance https://www.linkedin.com/in/chad-ramberg-71278533/ Charles “Chuck” Failla, CFP® Founder, Sovereign Financial Group & GoRIA https://www.linkedin.com/in/charlesfailla/ https://www.goria.com The Advisor’s Edge Podcast brings together practical conversations for financial advisors, RIA leaders, fiduciaries, and firm builders navigating the decisions that shape their firms, clients, risk, compliance, and long-term durability. SPONSOR Special thanks to Box Professional Insurance for supporting The Advisor’s Edge Podcast. Box Professional helps RIAs understand where operational and risk exposure actually shows up before it becomes a claim. Learn more: https://www.boxproinsurance.com CHAPTERS 00:00 — Introduction: Lyman Terni of Havoc Defense 02:00 — What Is a Bench Test or Tabletop Exercise? 05:03 — How Testing Exposes Assumed Responsibilities 08:00 — Why Coordination Gets Harder as an RIA Grows 09:10 — Who Should Be Involved in an Incident Response Test? 14:23 — What Actually Happens During a Tabletop Exercise? 18:06 — Who Gets Called First After a Cyber Incident? 20:00 — Understanding the Incident-Response Timeline 22:23 — Why RIAs May Need More Than a Generic IT Response 25:20 — Ransomware: What Lyman Is Seeing 30:07 — Cloud Storage, Backup, and Redundancy 32:50 — What Happens If Office 365 Goes Down? 38:35 — What RIAs Should Take Away From the Conversation 40:40 — Lyman’s Path Into Cybersecurity and RIAs 43:39 — What Lyman Wants to Be Known For DISCLAIMER This podcast is for educational purposes only and should not be considered investment, legal, tax, or insurance advice. The views expressed are those of the hosts and guests and do not necessarily reflect the views of their firms or affiliates.
