Outside the Perimeter

Aruga Cyber

This podcast is for IT and cybersecurity leaders who are busy, under pressure, and just want straight answers.   Each episode, we will talk about the latest innovations in cybersecurity that are changing the game with expert guests from across the industry.   You’ll get straightforward takeaways you can use right away to build better defences. 

Episodes

  1. Oct 31

    Your Cyber Posture Is Now Part of Your Business Valuation

    The uncomfortable truth about what investors, acquirers and boards are now looking for, from a former FTSE-250 CISO For years, cybersecurity was treated as an IT problem. Something to manage, budget for, and hand off to a provider. A cost of doing business rather than a driver of it. That is no longer true. In this episode of Outside the Perimeter, David is joined by Amy Lemberger, fractional CISO. Amy has spent 18 years in cybersecurity, including CISO roles inside FTSE-250 organisations, and now works with investors, boards and growing businesses on the side of security that most people do not think about until it is too late. When carrying out due diligence investors or those looking to acquire assess cyber security maturity, they use specialists like Amy to do this. Failure to show adequate maturity or worse finding an ongoing incident can (and has) paused deals. The investors consider it a material ‘flag’. The process then pauses, gets extended by months while warranties are put in place and revaluations occur. All of which is avoidable. If you are building a business, seeking investment, or planning an exit, this episode is not optional listening. What You Will Take Away Why poor cyber hygiene is now a direct risk to your business valuation, not just your IT infrastructureWhat investors and acquirers are actually looking for during due diligence, and the questions most businesses cannot answerWhen a growing business should bring in proper security leadership, and what good looks like at different stages of growthHow to hold your MSP or IT provider accountable for the security they claim to be deliveringNo waffle. No jargon. Just the stuff you actually need to know.

  2. Oct 12

    You Pay for a Pen Test. You Get a Scan Report.

    A former GCHQ operator on what real security testing actually looks like Most organisations have pen testing on their security checklist. They scope it, budget for it, sign it off, and file the report. Job done. But what if most of what gets sold as pen testing isn't actually pen testing at all? In this episode of Outside the Perimeter, David is joined by Nathan Jones, co-founder of SecuraNova and a former member of the active cyber team at GCHQ. Nathan has spent his career at the sharp end of offensive security, and he has seen the same story play out more times than he can count. A business pays for a pen test, receives a report full of scan output, and files it away believing they are covered. They are not. Nathan breaks down what separates genuine security testing from a glorified vulnerability scan, why the rise of AI in this space has made the problem worse rather than better, and what the shift toward proper security assurance actually means for organisations trying to make their budgets work harder. If you have signed off a pen test in the last two years and assumed the job was done, this one is worth 30 minutes of your time. No waffle. No jargon. Just the stuff you actually need to know.

  3. Aug 6

    £25 Million Hiding in Plain Sight

    Most organisations think their biggest cyber security risk is the next attack. Louis Holt thinks it's something much closer to home. Louis spent years in cyber forensics, counter-terrorism and high-tech policing before founding ESprofiler - a platform built to answer a question almost nobody can: what security tools do you actually have, what are they costing you, and are they even switched on properly? In this episode of Outside the Perimeter, David is joined by Louis to talk about the millions of pounds enterprises are quietly wasting on overlapping, underused, or completely forgotten security tools - including one organisation that was still paying storage fees on hardware that had reached end of life and was never deployed. Louis explains why this happens, why "nobody gets fired for buying the big name" thinking makes it worse, and what genuinely good security spend actually looks like. This isn't about more tools. It's about knowing what you've already got. No waffle. No jargon. Just the stuff you actually need to know.

  4. Jun 30

    Your Breach Plan Has a Blind Spot

    Most organisations have spent serious money on cybersecurity tools. EDRs, next-gen SIEMs, vulnerability management platforms. The prevention and detection stack has never been better. But when something gets through (and it will) what happens next? In this episode of Outside the Perimeter, David is joined by Will Poole and Ollie Fletcher, co-founders of Strand Intelligence, an AI-powered platform built to automate the digital forensics and incident response that most organisations are completely unprepared for. Will spent years as a technical director of an insurance-backed incident response company - parachuted into businesses at their worst moments. Ollie has seen the same story play out from the commercial side. Together they have a clear-eyed view of where the industry is falling short, and what needs to change. In this episode we will cover: • Why incident response has barely changed in a decade despite the explosion in tooling • What your cyber insurer actually expects when you make a claim • How AI is finally closing the gap between getting breached and getting back on your feet - without destroying your evidence in the process. Straight talk. No hype. Just the stuff you actually need to know.

  5. Jun 1

    No One Ever Gets Fired for Buying CrowdStrike

    Luke Collinson is a Royal Academy of Engineering Enterprise fellow, former Head of Cyber, and founder of Cybersecurity Stack - and he's got some things to say that most people in this industry won't. In this episode, Luke breaks down why the perimeter-based tooling most organisations are relying on is fundamentally flawed, how CISO pack mentality is creating dangerous blind spots, and why the compliance frameworks designed to protect you might actually be slowing down the innovation that would. No fluff, no vendor pitches. Just a practitioner who's been on both sides of the table telling it like it is. What you'll take away: 1. Why "nobody gets fired for buying CrowdStrike" is a security problem - the herd mentality shaping CISO buying decisions, and why it's leaving gaps that attackers are actively exploiting 2. How ransomware actually spreads inside your network - and why most current solutions are addressing the wrong part of the problem, causing operational downtime when it matters most (yes, think M&S) 3. A practical framework for evaluating newer, smaller security vendors - without compromising your baseline compliance requirements or taking on unacceptable risk

  • 5 Episodes

About

This podcast is for IT and cybersecurity leaders who are busy, under pressure, and just want straight answers.   Each episode, we will talk about the latest innovations in cybersecurity that are changing the game with expert guests from across the industry.   You’ll get straightforward takeaways you can use right away to build better defences. 

Information

  • Creator
    Aruga Cyber
  • Years Active
    2026
  • Episodes
    5
  • Rating
    Clean
  • Copyright
    © 2026 Aruga Cyber
  • Show Website
    Outside the Perimeter