Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

Dejan Kosutic
  • 0.0 (0)
  • Management

“Secure & Simple” demystifies governance and compliance challenges faced by CISOs, consultants, and other cybersecurity professionals. The podcast is hosted by Dejan Kosutic, an expert in cybersecurity governance, ISO 27001, NIS2, and DORA. The episodes present topics in an easy-to-understand way and provide you with insight you won’t be able to find elsewhere. To provide comments, suggest topics for the next episodes, or express your interest in participating in the show, contact us at podcast@advisera.com. Learn more about ISO 27001, NIS2, and DORA at https://advisera.com.

  1. 2d ago

    Should CTO and CISO Roles Converge in the Age of AI? | Interview with Ben Wilcox

    In this episode of the Secure and Simple Podcast, host Dejan Kosutic (CEO at Advisera) speaks with Ben Wilcox, who serves as both CISO and CTO at ProArk, about how AI is collapsing the traditional separation between technology transformation and security risk management. Ben explains that AI touches data, identity, permissions, apps, workflows, and decision-making, making every technology decision a risk decision and requiring CISOs to understand architecture and DevOps while CTOs embed security from the start. They discuss when merging CTO/CISO roles may work versus when separation is required by regulation, how Ben balances speed and risk using context such as data sensitivity and blast radius, and lessons from building an agentic product, including the need for better telemetry and technical governance controls. They conclude with recommendations for experimenting, ensuring compliance feasibility, and collaborating earlier in projects. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Ben Wilcox (00:57) - How AI Changes Roles (04:55) - Should Roles Merge (10:42) - Balancing Speed and Risk (13:36) - Benefits and Innovation (17:55) - Making the Merge Work (20:48) - AI Agents Governance Lessons (26:53) - Governance Reviews and Ownership (32:27) - Resources for Security Professionals

  2. Oct 20

    From Upwork to 100-Person Consultancy: How Subscriptions Fueled Growth | Taylor Hersom

    In this Secure and Simple Podcast episode, host Dejan Kosutic interviews Taylor Hersam, founder and former CEO of Eden Data, a compliance consultancy providing SOC 2, ISO 27001, CMMC and other framework services that grew rapidly after starting on Upwork during COVID, later scaling to nearly 100 people and being acquired by Riveron in 2025. Taylor explains how he gamified Upwork to build reviews, tested and refined a subscription-based consulting model, and positioned Eden as an external security and compliance team with clear scoping to avoid overreach. He discusses why subscription pricing appeals to clients needing ongoing compliance, key scaling challenges, KPIs like customer satisfaction and revenue per headcount, and how AI is shifting consulting away from time-and-materials toward value, requiring firms to use customer feedback, employee input, and market signals to focus services. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Taylor Hersom (01:20) - COVID Pivot to Freelancing (02:38) - Subscription Model Breakthrough (06:18) - Packaging Compliance Services (09:50) - Why Customers Stay (16:06) - Subscription vs Project Fit (21:41) - Scaling to 100 People (27:16) - AI Disrupts Consulting (33:51) - Skills Consultants Need Now (36:25) - Final Advice and Wrap Up (38:36) - Resources for Security Professionals

  3. Oct 6

    Strategic Human Firewall: Overcoming the Human Blind Spot | Interview with Robert Siciliano

    In this Secure and Simple Podcast episode, host Dejan Kosutic (Advisera) interviews Robert Siciliano, co-founder of ProtectNow and author of Strategic Human Firewall, about why organizations must address the “human blind spot” - people’s psychological need to trust that attackers exploit through impersonation, social engineering, and manufactured urgency. Siciliano explains why phishing simulations alone are not true security awareness training and introduces the AAA protocol (Analyze, Authenticate, Act) with out-of-band verification to stop scams like fake PayPal charges or CEO payment requests. He argues companies should build a “strategic human firewall” by shifting employees from passive targets to active detection layers through scalable, interactive dialogue (e.g., all-hands Q&A) that teaches personal security first, improving engagement and security behaviors measurable through better phishing results and increased adoption of practices like unique passcodes and password managers. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Robert Siciliano (01:20) - Beyond Phishing Training (04:10) - Understanding Human Blind Spot (08:27) - Manufactured Urgency Scams (11:28) - AAA - Analyze, Authenticate, Act (18:27) - CEO Fraud and Verification (22:56) - Building Strategic Human Firewall (30:28) - Getting Companies Onboard (38:00) - Security vs Paranoia (40:03) - Humanize the CISO (42:09) - Measuring Behavior Change (48:06) - Resources for Security Professionals

  4. Sep 22

    How to Integrate Security Controls Across ISO 27001, NIST & SOC 2 | Interview with Aron Lange

    In this episode of Secure and Simple Podcast, host Dejan Kosutic (Advisera) speaks with Aaron Lange (GRC Lab, TÜV SÜD auditor) about combining security controls across multiple standards and frameworks, including ISO 27001/27002, NIST Cybersecurity Framework, NIST SP 800-53 and 800-171, TISAX, C5, SOC 2, and sector-specific regimes like PCI DSS and CMMC. They clarify the difference between requirements and controls, and how to handle cross-mapping, gap analysis, scoping, and phased implementation when adding frameworks. They discuss how standards typically complement rather than contradict each other (e.g., NIS2 incident reporting timelines) and why starting with a generic ISMS like ISO 27001 before adding specific frameworks often works best, illustrated by a startup achieving ISO 27001 and then C5 attestation. They also examine the purpose and common shortcomings of the ISO 27001 Statement of Applicability and close with advice to avoid perfectionism, start, and iterate. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview Aron Lange (01:29) - Requirements vs Controls (03:14) - NIST 800-53 vs 800-171 (06:46) - C5 And TISAX Deep Dive (10:38) - Control Mapping Across Standards (14:34) - One Integrated ISMS (19:59) - Pick A Core Standard (23:32) - Scoping And Real Examples (29:48) - Statement Of Applicability (43:37) - Free Resources for Security Professionals

  5. Sep 8

    Security as a Business Enabler: From Cyber Risk to Action | Interview with Matthew Webster

    Dejan Kosutic hosts Matthew Webster, founder and CEO of Cyvergence, to explain what “security as a business enabler” means in practice: aligning cybersecurity with business operations, priorities, and decision-making rather than siloed technical metrics. Webster emphasizes using business impact analysis, scenario analysis, and cost-benefit thinking to translate vulnerabilities into operational risk executives understand, including concepts like materiality and value at risk. He discusses how security can enable revenue through third-party/supply-chain risk expectations, certifications, and better governance, and how CISOs can overcome gaps in business understanding by learning business language, building trust, and collaborating with legal, HR, finance, and risk leaders. The episode also covers balancing speed, innovation, and acceptable risk, including AI guardrails, storytelling, and a “work towards yes” approach. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with 1043 Matthew Webster (00:56) - Security as Business Enabler (04:50) - From Cyber to Operational Risk (08:18) - Revenue and Third Party Risk (11:32) - Scenario Storytelling (13:48) - CISOs Learn Business (21:33) - Mission Critical Objectives (26:00) - Balancing Speed and Controls (29:31) - Innovation and AI Guardrails (34:41) - Human Trust and Stories (38:24) - Resources for Security Professionals

  6. Aug 25

    Positive Reinforcement & Gamified Security Awareness | Interview with Craig Taylor

    In this episode of the Secure and Simple Podcast, host Dejan Kosutic (CEO at Advisera) interviews Craig Taylor, CEO and co-founder of CyberHoots, about best practices and myths in cybersecurity awareness training. Taylor argues the industry’s biggest mistake is relying on punishment, shame, and deception-based phishing tests, saying psychology supports positive reinforcement and rewards to increase desired behaviors. He recommends teaching a clear phishing rubric, practicing in a browser-based environment rather than trick emails, using gamification such as levels and leaderboards, and fostering a safe culture where employees report mistakes quickly. The discussion covers short, frequent training content, useful KPIs like compliance and reporting, cautions about incentives, examples of real incidents, and how AI may increase breaches before security improves while human social engineering remains a key risk. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Craig Taylor (01:04) - Myth Of Punishing Clicks (05:05) - Why Fake Phish Backfires (11:28) - Tests After Training (13:25) - Culture Of Safe Reporting (16:47) - Real Incident Story (20:00) - Changing Culture With Incentives (23:25) - Gamification Beyond Leaderboards (26:07) - Training Formats And Cadence (31:04) - Metrics And KPIs That Matter (37:06) - Future Of Awareness And AI (42:54) - Resources for Security Professionals

  7. Aug 10

    CMMC Level 2: Documentation, Costs, and Audit Readiness | Interview with Bruno Lecoq

    Dejan Kosutic hosts Bruno Lecoq (co-founder, CEO, and CISO at BEMO) to explain CMMC compliance for Department of Defense contractors and suppliers, including those outside the U.S. They cover CMMC basics (levels, CUI vs. FCI, C3PAO assessments, phase 1 boundary review and phase 2 audit), current capacity challenges (about 93 C3PAOs vs. roughly 200,000 contractors), and why many companies fail early due to incomplete documentation. Bruno shares BEMO's experience (29 policies, 46 procedures, 14 configuration documents, 700+ pieces of evidence, and a 300-page SSP) and emphasizes leadership buy-in, parallel technical and documentation work, proof-based evidence, ongoing monthly/quarterly reviews, and maintaining compliance after certification. They discuss scoping CUI boundaries, tooling constraints (e.g., GCC/GCC High), subcontractor requirements varying by contract, and typical assessment costs ($45K–$55K plus ~$10K mock). Note: This interview was recorded in June 2026, before the U.S. Department of Defense suspended the planned rollout of CMMC Phase 2. Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Bruno Lecoq (01:00) - Who CMMC Applies To (05:31) - Assessors Capacity Bottleneck (08:30) - Audit Phases Evidence Review (15:12) - CMMC vs NIST 800-171 (16:25) - Best Practice Implementation Steps (18:55) - How Does the Audit Look? (22:16) - Project Success Factors (23:50) - Defining CUI Scope (28:58) - Subcontractors And Contracts (33:21) - Risk Flexibility (36:21) - Costs And Timelines (39:47) - Resources for Consultants and Security Officers

  8. Jul 28

    Securing the Agentic Enterprise | Interview with Charlie Lewis

    Host Dejan Kosutic interviews McKinsey & Co. partner Charlie Lewis about how agentic AI will reshape cybersecurity by reinventing existing categories — especially identity, detection, operations, and vulnerability management — rather than creating entirely new ones. Lewis argues every company will manage a massive digital workforce of dynamically created, short-lived agents with constantly changing permissions, pushing traditional IAM beyond its design and requiring workforce-plus-agent identity, stronger data governance, and an “agent registry.” They discuss the need to strengthen foundational controls like IT asset management, map business processes to prioritize attack paths, and shift security from periodic detection to continuous runtime governance with real-time policy enforcement. Lewis predicts more machine-operated, human-supervised SOC work, highlights in-demand skills, and advises CISOs to embed with the business, fix processes before automating, and pilot agentic use cases in security. (00:00) - Interview with Charlie Lewis (01:11) - Why Cyber Reinvention (02:46) - Nonhuman Identity Frontier (06:00) - Vendor Readiness Today (08:20) - Org Change Data Governance (11:40) - Asset Management Agent Registry (14:38) - Mythos Runtime Governance (17:53) - Future SOC Human Role (27:37) - Consulting Role Evolution (29:56) - Vendor Recommendations Summary (33:44) - Buying Beyond The CISO (40:07) - Security as Business Enabler (43:27) - Top CISO Recommendations

See All (47)

About

“Secure & Simple” demystifies governance and compliance challenges faced by CISOs, consultants, and other cybersecurity professionals. The podcast is hosted by Dejan Kosutic, an expert in cybersecurity governance, ISO 27001, NIS2, and DORA. The episodes present topics in an easy-to-understand way and provide you with insight you won’t be able to find elsewhere. To provide comments, suggest topics for the next episodes, or express your interest in participating in the show, contact us at podcast@advisera.com. Learn more about ISO 27001, NIS2, and DORA at https://advisera.com.

Information

You Might Also Like