The Rook

David Shaw
  • 5.0 (3)
  • Management

Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts. Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job. Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it. New episodes every other Tuesday.

Episodes

  1. Oct 27

    The Rook EP007 - What Should You Let AI Do at Work?

    Send us Fan Mail An AI tool drafts a reply to a customer. Fine. Now let it open the account, then issue the refund. Same chat window, very different job. In this episode I walk one customer message through three steps, the draft, the account and the refund, and show where AI goes from helpful to dangerous. I also look at what "a human reviews it" should actually mean, why a wrong AI answer can cost you more than the same mistake from an employee, and what I'd do tomorrow instead of banning AI. Chapters: 0:00 Riding along 1:23 Draft 1:47 Account 2:04 Refund 2:16 Where I draw the line 3:42 What "a human reviews it" means 4:59 Why mistakes cost more 5:58 Embrace it 7:16 Vet the vendor 8:39 What to do tomorrow Sources: UK NCSC, agentic AI blog, 20 Aug 2026 OWASP LLM06:2025 Excessive Agency Mata v. Avianca, S.D.N.Y., 22 Jun 2023 Dietvorst, Simmons and Massey, 2015, algorithm aversion Microsoft and LinkedIn, 2024 Work Trend Index IBM Cost of a Data Breach Report 2025 Anagram survey via HR Dive, 13 Aug 2025 DHS order on DeepSeek, Federal Register 91 FR 66346, 20 Oct 2026 The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP007 - What Should You Let AI Do at Work?

  2. Oct 15

    The Rook EP006 - Before You Approve the 2027 Security Budget

    Send us Fan Mail That cybersecurity budget request about to land on the CFO's desk is full of acronyms and tool names, and the number probably went up again. This episode gives you five questions that turn it into a business decision you can defend from either side of the table. Who it's for: CFOs and finance leaders who approve the budget, and the IT lead, security lead, MSP or vCISO who submits it. The five questions: What would hurt most if it stopped working or leaked?What do we own, and is it working for us?What is required from outside, and what is a business call?What becomes more likely if we cut this?Who is accountable for the outcome?Free one-page worksheet that follows the five questions: https://corvus-cyber.com/the-2027-security-budget-worksheet/   Chapters  0:00 The budget request about to land  2:03 Five questions and a one-page worksheet  3:01 1. What would hurt most  6:08 2. What do we own, and is it working  7:50 3. Required from outside vs a business call  10:10 4. What becomes more likely if we cut this  12:07 5. Who is accountable  13:47 The decision that fits on one page  15:13 Your move Sources  Verizon 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/ Sophos, The State of Ransomware 2026: https://sophos.com/ransomware2026 IANS and Artico Search, 2026 Security Budget Benchmark: https://www.ians.com/blog/security-budgets-stall-as-ai-reshapes-2027-spending The Rook is a show about the business decisions underneath cybersecurity headlines, by David Shaw of Corvus Cybersecurity. corvus-cyber.com The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP006 - Before You Approve the 2027 Security Budget

  3. Sep 30

    The Rook EP005 - The Leverage is the Data

    Send us Fan Mail Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure David Shaw explains that ransomware leverage is shifting from encrypting systems to stealing data and threatening public exposure, using Galaxy Warden’s report that Canadian immersive media company PHI Studio appeared on Nova Ransomware’s leak site on July 17 after data was exfiltrated. He argues this model particularly endangers creative and IP-heavy businesses because unreleased work, client contracts, and other confidential assets can be exposed without operational downtime. Shaw connects the threat to CISA’s Known Exploited Vulnerabilities Catalog, highlighting actively exploited flaws in edge-facing systems like remote access platforms, identity infrastructure (e.g., ADFS), collaboration tools (e.g., SharePoint), and critical apps. He stresses detection and monitoring (EDR and network visibility), tested response readiness, and insurance realities as carriers remove silent cyber coverage and scrutinize MFA and controls. He recommends executives ask about KEV patch status, phishing-resistant MFA compliance, and whether a 48-hour intruder would be detected. 00:00 Silent Ransomware Shift 01:22 Meet The Rook 02:30 PHI Studio Case Breakdown 03:11 Why Exposure Hurts Most 04:28 CISA KEV And The Door 06:07 From Downtime To Liability 06:59 Detecting Exfiltration With EDR 08:44 Vulnerabilities To Full Breach Chain 09:52 Insurance And Control Requirements 11:24 Three Questions To Ask Now 14:25 Wrap Up And Next Steps The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP005 - The Leverage is the Data

  4. Sep 23

    The Rook EP004 - The $200,000 Gap

    Send us Fan Mail The $200,000 Security Leadership Gap: CISO, Internal Promotion, or Fractional vCISO There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem. It's what the 2026 CISO Report from Cybersecurity Ventures and Sophos calls a market failure. Most companies under $50 million in revenue never close that gap with a full-time hire; the math doesn't work at that scale. Instead, security decisions get made informally: an IT director carrying a second job, a compliance program built to pass audits rather than manage risk, or no one at all. Host David Shaw (CISSP, GLEG) walks through what actually fills the gap: a full-time CISO, an internal promotion, or a fractional vCISO, what each one costs, where each one works, and where each one fails. In this episode: The 10,000-to-1 CISO-to-business ratio, and why the 2026 CISO Report calls it a market failureThe three informal models that fill the gap when there's no security leader, and why each one breaks down under pressureFull-time CISO vs. internal promotion vs. fractional vCISO: honest costs and tradeoffs for eachThe revenue thresholds where each option actually makes senseAn illustrative example of what an unaddressed gap costs when a known, escalated risk goes unfixedThe Security Leadership Readiness Check, five questions: Who is accountable to the CEO or board for security risk, by name, as a primary responsibility?When was security last on the board agenda as a standalone item, not folded into an IT update?Do you have a documented security roadmap with budget attached, reviewed at least annually?In the last 12 months, has an executive overridden an IT security recommendation, and do you know why?If you had a material security incident tomorrow, who makes the notification and response decisions, and have you rehearsed it?Sources referenced: Cybersecurity Ventures — 35,000 Chief Information Security Officers Employed Globally in 2026Sophos — 2026 CISO Report (with Cybersecurity Ventures)Cybersecurity Ventures — 2026 CISO Salary and Compensation DataNote: the healthcare-acquisition scenario referenced in this episode is an anonymized composite illustration, not a specific named case. The Rook is board-ready security intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk but don't have a dedicated security function. New episodes every other Tuesday. Work with David: corvus-cyber.com Now, it's your move. The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP004 - The $200,000 Gap

  5. Sep 7

    The Rook EP003 - Notice Is the New Negligence

    Send us Fan Mail CISA adding a vulnerability to its Known Exploited Vulnerabilities catalog isn't a patch reminder anymore. It's the moment your insurer and your counterparty's diligence team start treating you as someone who was on notice, and if you didn't patch, that's on you. In this episode, David Shaw walks through how the KEV catalog moved from a federal compliance tool to a market-facing liability standard, the exploited vulnerabilities in Oracle, SonicWall, VMware, Microsoft, and Citrix systems that drove that shift across July, August, and early September, what insurers and diligence teams now read into a KEV listing, and the three conversations every executive needs to have this week. In this episode: What the KEV catalog is, and why it moved from government plumbing to a market liability standard The exploited flaws behind that shift: Oracle E-Business Suite Payments, SonicWall SMA1000, VMware vCenter, Microsoft AD FS and SharePoint, and Citrix NetScaler How insurers and incident response firms cite KEV entries to build a documented record of notice What KEV exposure means in M&A diligence, rep and warranty coverage, and escrow The vendor-risk lesson from the Suno breach The three conversations to have this week: with your IT lead or MSP, your insurer or broker, and your diligence team Resources mentioned: CISA Known Exploited Vulnerabilities (KEV) Catalog CISA Binding Operational Directives 22-01 and 26-04 Beazley Security and eSentire advisories Connect with David Shaw: Website: corvus-cyber.com LinkedIn: linkedin.com/in/djshaw Email: david@corvus-cyber.com The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP003 - Notice Is the New Negligence

  6. May 19

    The Rook EP002 - Your Compliance Program Is Not a Security Program

    Send us Fan Mail A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what executives read into it is where most companies are quietly carrying real risk. In this episode, David Shaw walks through what compliance audits actually evaluate, the three places where compliance and real security pull apart inside companies (access management, detection, out-of-scope creep), what someone running a real security practice will tell the board, and the two questions every board should be putting on the agenda at the meeting after the next audit closes. In this episode: What an audit actually answers, and what it doesn'tWhy the gap between the report and reality isn't a failure of the auditThe three places compliance and real security pull apart: access, detection, scopeWhat a real security practice looks like, versus a compliance programWhat someone running a real program will tell the boardThe two questions to put on the agenda after the next audit closesResources mentioned: SOC 2, ISO 27001, PCI, NIST, HIPAA frameworksConnect with David Shaw: Website: corvus-cyber.comLinkedIn: linkedin.com/in/djshawEmail: david@corvus-cyber.comThe Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook EP002 - Your Compliance Program Is Not a Security Program

  7. Apr 27

    The Rook EP001 - The Deal You Didn’t Know You Made: Cyber Risk in M&A

    Send us Fan Mail In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs. In this episode: How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligenceHow Marriott bought a four-year-old, undetected breach when it acquired StarwoodWhy the standard M&A cybersecurity questionnaire fails to catch material riskHow R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teamsThe four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisionsWhat sellers should be doing now to protect deal valueThree artifacts every buyer should require, not just three questions to ask The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

  • 7 Episodes

Ratings & Reviews

5
out of 5
3 Ratings

About

Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts. Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job. Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it. New episodes every other Tuesday.

Information

  • Creator
    David Shaw
  • Years Active
    2026
  • Episodes
    7
  • Rating
    Clean
  • Copyright
    © 2026 Corvus Cybersecurity - The Rook
  • Show Website
    The Rook