The Rook

David Shaw
  • 5.0 (3)
  • Management

Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts. Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job. Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it. New episodes every other Tuesday.

Episodes

  1. 4d ago

    Notice Is the New Negligence

    Send us Fan Mail CISA adding a vulnerability to its Known Exploited Vulnerabilities catalog isn't a patch reminder anymore. It's the moment your insurer and your counterparty's diligence team start treating you as someone who was on notice, and if you didn't patch, that's on you. In this episode, David Shaw walks through how the KEV catalog moved from a federal compliance tool to a market-facing liability standard, the exploited vulnerabilities in Oracle, SonicWall, VMware, Microsoft, and Citrix systems that drove that shift across July, August, and early September, what insurers and diligence teams now read into a KEV listing, and the three conversations every executive needs to have this week. In this episode: What the KEV catalog is, and why it moved from government plumbing to a market liability standard The exploited flaws behind that shift: Oracle E-Business Suite Payments, SonicWall SMA1000, VMware vCenter, Microsoft AD FS and SharePoint, and Citrix NetScaler How insurers and incident response firms cite KEV entries to build a documented record of notice What KEV exposure means in M&A diligence, rep and warranty coverage, and escrow The vendor-risk lesson from the Suno breach The three conversations to have this week: with your IT lead or MSP, your insurer or broker, and your diligence team Resources mentioned: CISA Known Exploited Vulnerabilities (KEV) Catalog CISA Binding Operational Directives 22-01 and 26-04 Beazley Security and eSentire advisories Connect with David Shaw: Website: corvus-cyber.com LinkedIn: linkedin.com/in/djshaw Email: david@corvus-cyber.com The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    Notice Is the New Negligence

  2. May 19

    The Rook Ep. 002: Your Compliance Program Is Not a Security Program

    Send us Fan Mail A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what executives read into it is where most companies are quietly carrying real risk. In this episode, David Shaw walks through what compliance audits actually evaluate, the three places where compliance and real security pull apart inside companies (access management, detection, out-of-scope creep), what someone running a real security practice will tell the board, and the two questions every board should be putting on the agenda at the meeting after the next audit closes. In this episode: What an audit actually answers, and what it doesn'tWhy the gap between the report and reality isn't a failure of the auditThe three places compliance and real security pull apart: access, detection, scopeWhat a real security practice looks like, versus a compliance programWhat someone running a real program will tell the boardThe two questions to put on the agenda after the next audit closesResources mentioned: SOC 2, ISO 27001, PCI, NIST, HIPAA frameworksConnect with David Shaw: Website: corvus-cyber.comLinkedIn: linkedin.com/in/djshawEmail: david@corvus-cyber.comThe Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

    The Rook Ep. 002: Your Compliance Program Is Not a Security Program

  3. Apr 27

    The Deal You Didn’t Know You Made: Cyber Risk in M&A

    Send us Fan Mail In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs. In this episode: How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligenceHow Marriott bought a four-year-old, undetected breach when it acquired StarwoodWhy the standard M&A cybersecurity questionnaire fails to catch material riskHow R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teamsThe four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisionsWhat sellers should be doing now to protect deal valueThree artifacts every buyer should require, not just three questions to ask The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

  • 3 Episodes

Ratings & Reviews

5
out of 5
3 Ratings

About

Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts. Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job. Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it. New episodes every other Tuesday.

Information

  • Creator
    David Shaw
  • Years Active
    2026
  • Episodes
    3
  • Rating
    Clean
  • Copyright
    © 2026 Corvus Cybersecurity - The Rook
  • Show Website
    The Rook