-6 дн. · Видео

The EDR Was Running. The Ransomware Still Won.

Dave Chronister has been doing penetration testing and incident response since 2007 — back when Fortune 500 CIOs called it a novel concept. In the years since, he's walked into breached environments where the EDR was running, the MDR was installed, the SOC 2 audit had passed, and none of it mattered. This conversation covers the gap between what companies think they bought and what they actually have why tools become the program by default, why compliance audits and security programs are two different things, what AI is actually doing to enterprise risk profiles right now, and what the organizations that survived a ransomware encryption event had that the ones who didn't were missing. If you're responsible for a security decision, this is the conversation to have before the next one. Is your security program real, or is it just theater? The gap between a real security program and a collection of tools doesn't show up in an audit. It shows up during an incident — when it's too late to fix cheaply. These eight questions come straight out of this conversation with Dave Chronister, founder of Parameter Security. Each one maps to something he's actually walked into. Answer them against what you know to be true right now — not what your vendor told you at signing. 1. Do you know which findings from your last security assessment are still open? Dave has had a Fortune 100 client for four straight years. He pulled the year-one report and the year-four report side by side. Almost identical findings. Tools were bought, renewed, and re-certified the whole time — and the actual exposure never moved. If your remediation list looks the same as it did a few cycles ago, the program isn't the problem. The follow-through is. 2. When did your EDR last fire — and who responded? Not whether it's installed. Whether it's being acted on. In recent insurance data, more than 60% of ransomware encryption events happened at organizations running a leading EDR. Detection without response doesn't stop an attack. If you can't say when it last fired and what happened next, you don't know if your coverage is real. 3. Is your MDR running in active response mode, or monitored mode? These are not the same thing. Monitored means alerts get logged. Active response means someone acts on them. Dave has walked into environments where MDR sat in monitored mode for years while the client believed they had full coverage. Ask your vendor directly which one you're paying for, and get it in writing. 4. What does your SOC 2 certification actually cover — and what does it say nothing about? SOC 2 audits whether your processes are documented and followed. It does not evaluate whether those processes protect you. A company can pass SOC 2 every year and carry the same critical vulnerability the whole time. If SOC 2 is your primary answer to "are we secure," that's the gap. 5. Do you know which AI tools are already running in your environment — and what data they have access to? Shadow AI is already inside most organizations. A tool that entered your environment as a productivity assistant may now have access to email, internal documents, customer records, and approval workflows. If you don't have a current inventory of what's running and what it touches, you don't have an AI policy. You have AI usage. 6. Who actually owns the risk when something goes wrong — IT, the CISO, or the board? IT holds the tools. The CISO advises. The board carries the fiduciary responsibility. Dave's seen the scapegoating pattern up close: a CISO with no real authority gets blamed for a decision the board never seriously evaluated. If your C-suite treats security as an IT line item, nobody with budget authority is actually deciding what risk is acceptable. 7. Have you defined what a win looks like before your next renewal? Most companies don't know what "fixed" means before they buy. They implement, assume it worked, and move on. What specific risk reduction is this renewal supposed to buy, and how will you know if you got it? Walking into a renewal without that answer means negotiating blind. 8. What is your responsibility in this — specifically, in your seat? This is the question Dave wishes every client asked before the engagement even starts. Not "what's the vendor's responsibility" or "what's IT's responsibility" — yours. Most people outsource the answer to a vendor or a department and never come back to it. If you can't state your own responsibility precisely, that's the gap an incident will find for you. If two or more of these stung, that's the program talking, not the tools. Tools get bought in response to a checklist or a renewal deadline. Programs get built in response to a defined risk. The full conversation goes deep on where that gap actually comes from and what it costs the companies that don't close it. Chapters 00:00 — Why security awareness campaigns don't change buyer behavior08:14 — Theater clients versus clients who actually want help14:00 — What the pen test findings look like four years later19:30 — Why tools become the security program by default26:35 — What SOC 2 actually audits and what it ignores entirely37:20 — Why 60% of ransomware victims had a leading EDR installed44:50 — MDR in monitored mode versus active response — and why it matters52:00 — The real risk of AI inside your organization1:01:00 — Why the vendor selling the control shouldn't validate it1:09:00 — Who actually owns the risk when something goes wrong1:45:00 — The one question Dave wishes every company asked before buying anything What We Mentioned NIST Cybersecurity Framework (CSF) — nist.gov/cyberframeworkNIST 800 series — csrc.nist.govNIST AI Risk Management Framework — nist.gov/system/files/documents/2023/01/26/AIREF1.0.pdfSOC 2 / AICPA — aicpa-cima.comCMMC — dodcmmc.usPCI DSS — pcisecuritystandards.orgHIPAA / HITECHQualys — qualys.comTenable — tenable.comMicrosoft E5 / E7 security stack — microsoft.comYubiKey — yubico.comParameter Security — parametersecurity.comAbout Dave Chronister Dave Chronister is the founder of Parameter Security. He started doing penetration testing in 2007 when most companies hadn't heard the term and has spent nearly 20 years walking into environments after the breach to find the things the audit missed. He's unusually direct about what tools actually do and what they don't, and he's seen every version of the gap between what companies think they bought and what they actually have. LinkedIn: https://www.linkedin.com/in/davechronisterCompany: https://www.parametersecurity.com About Signed The IT market is built for sellers, not buyers. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised. New episodes weekly. An ITBroker.com podcast. Full Transcript Click here to view...

1 ч. 41 мин.

16 июн. · Видео

Playbook: AI Layoffs

You've read the post. A CEO goes on LinkedIn. Hard decision. I own this. Because of AI, we'll come out leaner, faster, stronger. Max Clark has written one of these. He's also been on the receiving end of one. In this Playbook, he breaks down what that post actually says — and what it's designed to leave out. Not to indict the people who write them, but to hand you one question: whenever a company or a vendor tells you why they're doing something, who was that explanation written for? It's the same question whether you're reading a layoff announcement or a renewal proposal. You're about to start asking it everywhere. What This Episode Answers How do I tell whether "AI" is the real reason behind a decision?Why do so many strategic announcements sound exactly the same?What other decisions get announced one way but are really doing something else?How does this apply to vendor decisions — pricing changes, AI upgrades, licensing restructures?What's the one question to ask before accepting any explanation? What We Get Into 00:00 — The post you've read a hundred times01:10 — Why the four-part format is worth taking apart03:30 — Why headcount is always the first thing cut04:15 — Why "AI" works as an explanation — and when it's actually true05:47 — RTO, unlimited PTO, keep your laptop — same move, different wrapper08:00 — What to do if you're on the receiving end09:20 — The one question that changes how you read any explanation10:20 — Why this is the same skill as reading a vendor pitch Related ReadingLayoff Announcements and Vendor Price Increases Are Built the Same Way. Here's How to Read Both. The Vendor's Policy Change Is Solving Their Problem, Not Yours About Signed The IT market is built for sellers, not buyers. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised. New episodes weekly. An ITBroker.com podcast. Full Transcript Click here to view the episode transcript.

9 мин.

9 июн. · Видео

AI Agents Are Already Inside Your Company. Nobody’s Watching Them.

You bought the platform. You renewed the contract. And 80% of your breach risk is coming from the one thing the platform wasn't built to catch. Craig Patterson spent years inside the channel ecosystem that sits between what security vendors ship and what enterprise buyers actually receive — and he's unusually direct about where those two things don't match. In this conversation: the Microsoft "free SIEM" that isn't free once you turn it on, the insider threat blind spot baked into nearly every consolidated platform, and the AI agent problem your security team is about to inherit whether they're ready or not. If your renewal is coming up and your confidence in your coverage hasn't kept pace with your spend — this is the episode. One of these is probably on your roadmap right now. You already pay for Microsoft E5. Why did turning on Sentinel increase your security bill? The "free SIEM" pitch ends at the demo. The bill arrives after you turn it on → Your EDR, MFA, and SIEM are working exactly as designed. So why do credential-based breaches still succeed? The attacker didn't break in. They logged in → Your AI agents now have credentials, permissions, and access to business systems. Are they being monitored like employees? Most organizations have governance for people. Almost none have governance for AI identities → Every security vendor has AI in the deck. Which ones can prove it works outside the demo? Most can't answer it. That's the answer →WHAT WE GET INTO 10:30 — What you stop seeing when you consolidate security vendors 18:30 — How to prove security value without relying on tool counts 22:00 — The breach vector responsible for most incidents 29:00 — The four types of insider threats 34:00 — Why AI agents should be treated like insiders 38:00 — Finance bot #7 just accessed source code. Would you know? 43:00 — How AI reduces alert investigations from 60 minutes to 5 47:00 — The one question that exposes AI marketing hype 51:00 — Why every organization still needs a SIEM 53:00 — The CFO conversation: justifying security spend 01:08:00 — Why leading with cost savings is the wrong security strategy WHAT WE MENTIONED ExaBeam — exabeam.comLogRhythm (merged with ExaBeam, 2024)MITRE ATT&CK Framework — the attacker playbook ExaBeam's Outcomes Navigator maps againstExaBeam Outcomes Navigator — security posture measurement mapped to MITRE frameworkExaBeam Nova — AI engine for SOC analysts; reduces alert correlation from 60 minutes to 5ExaBeam UEBA — User and Entity Behavior AnalyticsExaBeam Agent Behavior Analytics (ABA) — behavior profiling for AI agents deployed inside your organizationSherpa — ExaBeam's AI-powered partner enablement and virtual coaching toolMicrosoft E5 / Defender / Sentinel stackEquifax breach — Craig's reference point for catastrophic data exfiltration: ~$600–700M in damageABOUT CRAIG PATTERSON Craig Patterson is the Global Ecosystem Chief at ExaBeam, where he rebuilt the company's entire partner ecosystem following the ExaBeam/LogRhythm merger — unifying two different channel programs across 3,000 partners and six continents. Before ExaBeam, Craig built and led channel organizations at multiple enterprise security companies. He's worth listening to because he sits at the intersection of what security vendors are building and what enterprise buyers are actually receiving — and he's unusually honest about where those two things don't match. LinkedIn:https://www.linkedin.com/in/globalchannelCompany: exabeam.comABOUT SIGNEDThe IT market is built for sellers, not buyers. Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised. New episodes weekly. An ITBroker.com podcast. Full Transcript Click here to view the episode transcript.

1 ч. 19 мин.

2 июн. · Видео

You Bought the Stack. You're Using Half of It.

The average enterprise uses 44% of the Microsoft stack they're paying for. Denis O'Shea knows because he's measured it — the same 120-point assessment, hundreds of organizations, the number doesn't move. The other 56% is licensed and sitting idle while the same teams buy third-party tools to fill gaps that 365 already covers. Denis is the founder of Mobile Mentor and has managed 14.5 million enterprise devices across healthcare and financial services. He's seen what the stack looks like from the inside — the sprawl, the overlap, the security tools that got purchased because insurance required it. Never properly deployed. In this episode, Max and Denis work through the utilization problem, what it actually takes to go passwordless when your legacy apps will fight you, what the Digital Markets Act opened up in your mobile attack surface, and why the best security your employees will ever experience is the kind they never notice. If you're signing off on a Microsoft renewal in the next 90 days, or your security stack has grown every year and your confidence in it hasn't — this is the episode. Find your situation. Skip to the answer. We've been trying to go passwordless for two years and it keeps dying with leadership. What's the actual unlock? → 1:14:00 My IT team can't move on anything strategic because they're buried in maintenance. What specifically should we eliminate first? → 1:12:00 Are we buying tools we already own without realizing it? → 49:45 Why do we have 50+ security tools and still struggle to see what's happening in our environment? → 50:00 We're still relying on legacy Microsoft infrastructure. What is quietly becoming tomorrow's security risk? → 1:21:00In this conversation:00:01 — Why you're paying for technology your employees aren't using08:00 — BYOD vs. corporate-owned: where companies actually get into trouble14:00 — What the Digital Markets Act broke in your mobile security model20:00 — Why mobile threat defense is now a requirement, not an option28:00 — The ROI problem: how to justify security spend that has no obvious return33:00 — AI in the wrong hands: what unmanaged devices look like in 202641:00 — Why the MDM market is disappearing — and what replaces it46:00 — The DIY trap: why deploying Intune yourself costs more than you think50:00 — You're using 44% of your Microsoft stack — and buying tools to cover the rest51:00 — 52 security tools, mostly siloed: how enterprises accumulated the wrong defenses55:00 — The manual IT problem: two hours per device, every device, still happening01:12 — Three things to remove from your IT team's plate this year01:14 — Why going passwordless is a board decision, not an IT project01:16 — How to explain passwordless to a non-technical leader without acronyms01:21 — AI-enabled attacks and why your on-prem infrastructure can't keep up01:23 — Set your own end-of-life date before Microsoft sets it for you01:27 — How to sell security investment to a board that doesn't want to hear about it01:29 — Invisible security: what good looks like when it's working What We Mentioned: Mobile Mentor — mobilementor.comMicrosoft IntuneMicrosoft Entra / Entra SuiteMicrosoft DefenderMicrosoft SentinelMicrosoft PurviewMicrosoft 365 (E3, E5, E7)Microsoft Agent 365Windows AutopilotActive Directory (AD)SCCM (System Center Configuration Manager)JamfSOTI / Workspace One / Omnissa / AirWatchLookout, Zimperium, Wander (mobile threat defense vendors)Digital Markets Act (DMA)BYOD (Bring Your Own Device)COPE (Corporate Owned, Personally Enabled)MDM / UEM / MTD (Mobile Device Management / Unified Endpoint Management / Mobile Threat Defense)EDR (Endpoint Detection and Response)Zero-touch provisioningHot patching (Windows updates without restart)ServiceNowWindows 10 end-of-life (October 14, 2025)About Denis O'Shea Denis O'Shea is the founder and CEO of Mobile Mentor, a Microsoft-specialized managed services provider that has enabled 14.5 million devices across enterprise clients in healthcare, financial services, and beyond. He spent 15 years at Nokia running operations across seven countries before building a company around a problem he kept seeing: organizations paying for technology they couldn't fully use. He has served on Microsoft's Intune product advisory board and has spent the last decade helping enterprises close the gap between what they bought and what's actually protecting them. LinkedIn: https://www.linkedin.com/in/denisosheamobilementorMobile Mentor: mobilementor.comAbout the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

1 ч. 33 мин.

26 мая · Видео

Playbook: MSPs

MSPs sell their book. The vendors they're authorized on. The platforms they're certified on. The products they have margin on. The infrastructure they're about to recommend for your business is shaped by all of that before you walk in the room. This Playbook covers what that actually means for you: how to size the right MSP for your company, what security capabilities a small MSP genuinely cannot deliver regardless of what they tell you, why outsourcing IT decision-making to someone with a vested interest is one of the most expensive mistakes a growing company makes — and the one rule that keeps you from getting locked into the wrong stack for the next three years. You should be leading the MSP. Not the other way around. The Playbook00:00 — The danger of outsourcing IT decisions to someone selling their book00:45 — Why MSPs sell their book — and why that's the reality, not a criticism02:00 — Deal registration: how your project gets locked in before you've decided02:34 — Size mismatch: why a $100K project won't get attention from a large VAR03:30 — The security capability gap: what sub-50-person MSPs can't actually deliver04:47 — Platform-on-platform: the tools MSPs resell vs. real capability05:40 — Truck rolls, multi-site support, and what to ask before you sign06:10 — Rip and replace: the cost of getting it wrong while under contract07:00 — The play: define your infrastructure needs first, then find the MSP that fits Resources Mentioned Intune (Microsoft) — endpoint management platformDefender (Microsoft) — security platform frequently configured by MSPs About the ShowSigned is the podcast for buyers in a market built for sellers. Playbooks are the solo format — 10 to 15 minutes, one trigger, one specific play. New episodes weekly at itbroker.com/podcast. If the trigger in today's Playbook is one you're facing right now, book an intro call at itbroker.com. We help buyers make the right call the first time. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

9 мин.

19 мая

Nobody Owns Your Cloud Bill

Nobody in the building owns the cloud bill. Not IT, not finance, not engineering — and when a CEO finally gets desperate enough to set a hard ceiling, like getting spend below 9% of revenue or the business isn't viable, that's when everyone finds out the EDP they already signed made the target structurally impossible before the conversation even started. The problem wasn't technical. It was in the contract. Max sits down with Robby Gulri, Field CTO at RapidScale, to trace how companies end up there. Nobody owns the bill. Nobody can read the bill. Engineering won't reprioritize to fix the architecture because it's not their KPI. Finance wants a magic pill. And the cloud's biggest promise — that you only pay for what you use — disappears the moment you sign a multi-year commitment to pay whether you use it or not. If you're responsible for cloud spend, or you're about to sign a multi-year cloud commitment — watch this before you do. What We Get Into00:00 — The Daughter Analogy: Why Cloud Spend Feels Like Magic Money01:30 — How RapidScale Evolved from DaaS into Public Cloud05:00 — Why DaaS Never Became the Default (And Still Hasn't)09:00 — What Killed Early VDI Adoption — And Why That's Changed15:00 — The CapEx vs. OpEx Trap: You Escaped One Problem and Created Another20:30 — Multi-Cloud in Theory vs. What Companies Actually Run26:00 — Is AI Actually IT? The Question That Stumped a Room of CIOs30:00 — Is IT a Cost Center or a Profit Center?38:00 — Who Actually Owns Your Cloud Spend (Nobody Agrees)44:00 — Why Companies Can't Read Their Own Cloud Bills48:00 — Should FinOps Report to Finance or IT? (Still No Consensus)51:30 — The CEO Spending 15% of Revenue on Cloud — and Locked In55:00 — The EDP Trap: You Took the Discount. Now You Can't Spend Less.58:00 — Why the Cloud Ephemerality Promise Disappears Fast01:00:00 — Cost Tagging, Naming Conventions, and Why the Discipline Is Gone01:01:00 — Cloud Is Not Cheaper Than Bare Metal01:08:00 — Legacy Applications with No Source Code: The Migration Nobody Plans For01:15:00 — Why ROI and TCO Are the Wrong Language for IT Decisions01:17:00 — CFOs Blame IT. IT Says "It Depends." Nobody Moves.01:22:00 — Microsoft Licensing: You Need a PhD to Understand What You're Buying01:32:00 — Procurement Theater: The Magic 10% Was Already Priced In01:45:00 — What a Mature FinOps Practice Actually Looks Like01:59:00 — Agentic AI and What 2030 Actually Looks Like02:01:00 — AI Won't Kill Jobs — It'll Shift Them (The CNC Operator Analogy)02:05:00 — The Real Doomsday: Power and Water, Not LLMs What we Mentioned AWS Enterprise Discount Programs (EDPs) and commitment lock-inAWS MAP (Migration Acceleration Program)Reserved Instances and Savings PlansFinOps as a discipline — cost tagging, naming conventions, resource classificationVMware / Broadcom licensing changes and 3x price increasesMicrosoft 365 E1, E3, E5 licensing tiersAzure Virtual Desktop (AVD)Multi-cloud strategy vs. single-region realityCloud-to-bare-metal cost comparisonNutanix, Red Hat as VMware migration pathsAgentic AI and multi-agent orchestrationRapidScale's assessment and FinOps practiceAbout the Guest Robby Gulri is Field CTO at RapidScale, a managed cloud services provider owned by Cox Communications, with practices across AWS, Azure, GCP, and a dedicated FinOps discipline. He spends his time with partners, CIOs, and business leaders navigating cloud cost, modernization, and AI strategy — which means he hears the same expensive mistakes repeat across industries, company sizes, and funding stages. His job, as he puts it: make complex things simple. Connect with Robby: https://www.linkedin.com/in/robbygulri/ RapidScale on LinkedIn: https://www.linkedin.com/company/rapidscale/ About Signed Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.

2 ч. 10 мин.

12 мая · Видео

You’re Scaling on Infrastructure You Don’t Control

You're making infrastructure decisions on a system you can't see. It's fast, stable, and invisible. That's the problem.Underneath it, global capacity is planned years in advance, routes are shaped by geopolitics, and resilience depends on infrastructure you don't control. Max Clark sits down with TS Narayanan, CTIO of EXA Infrastructure, to explain the layer most enterprise buyers never see — and why it quietly determines whether your cloud strategy, your regional expansion, and your infrastructure commitments actually deliver what you paid for. They get into why AI isn't driving the traffic spike everyone assumes, what geopolitical risk actually does to a network route, why adding nodes costs more than buyers expect, and where the real constraint is right now (hint: it's not bandwidth). If you've ever signed a provider contract without fully understanding what sits underneath it, this is the episode that fills in the gap. WHAT WE GET INTO00:00 — The network layer your vendor isn't explaining to you04:00 — Why capacity is locked in years before you make a decision09:30 — The AI traffic myth: what's actually growing on the backbone12:30 — Why your cloud usage growing doesn't mean what you think it does15:40 — Bandwidth announcements and what they're not telling buyers17:50 — How traffic patterns are shifting — and what that means for your architecture20:40 — What hyperscalers are doing to the build equation (and what it means for everyone else)23:50 — How subsea cable routes get planned and why it's harder than it looks27:50 — Geopolitical risk is real: what the Mediterranean actually shows31:30 — Why LATAM and Africa are underserved — and what's finally changing35:20 — Data sovereignty: what compliance actually requires from your infrastructure41:00 — Capacity vs. latency: which one should be driving your vendor decision46:50 — The complexity cost of every node you add52:30 — What you're actually buying when you buy network capacity57:30 — Control vs. outsourcing: how buyers are splitting on this decision1:02:00 — Power is the real constraint. Not bandwidth.1:08:30 — Why infrastructure is always in upgrade mode and what that costs buyers1:18:30 — Network as a Service: what it actually means and where it's going WHAT WE MENTIONED EXA Infrastructure — https://www.linkedin.com/company/exa-infrastructure/TeleGeography subsea cable maps — https://www.submarinecablemap.comGÉANT (European R&D network, referenced in EU connectivity context)AMS-IX, DE-CIX (European internet exchange points)IRU (Indefeasible Right of Use) — the long-term capacity lease structure common in subsea contractsOVH, Hetzner (EU-based cloud providers referenced as demand drivers)ABOUT TS NARAYANANTS Narayanan is the Chief Technology and Information Officer at EXA Infrastructure, one of the largest fiber and subsea backbone networks spanning Europe and North America. He's spent his career across enterprise IT, systems integration, and telecom — which means he's seen infrastructure decisions from both sides: the buyer who has to live with them and the operator who builds and maintains them. That makes him unusually direct about where capacity planning goes wrong and what buyers should have asked before they signed. LinkedIn: https://www.linkedin.com/in/ts-narayanan-62b3617/EXA Infrastructure: https://www.linkedin.com/company/exa-infrastructure/ ABOUT THE SHOWSigned is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom FULL TRANSCRIPTClick here to view the episode transcript.

53 мин.

7 мая · Видео

Playbook: Be Careful With Your SOC2 Controls

SOC 2 certification has become shorthand for security. It isn't. Max Clark breaks down what SOC 2 actually demonstrates — and the costly mistake most buyers make when building their controls: anchoring them to a specific vendor's tool. When you replace that tool, the control breaks. And you won't find out until your auditor does.

4 мин.

Signed

The EDR Was Running. The Ransomware Still Won.

Playbook: AI Layoffs

AI Agents Are Already Inside Your Company. Nobody’s Watching Them.

You Bought the Stack. You're Using Half of It.

Playbook: MSPs

Nobody Owns Your Cloud Bill

You’re Scaling on Infrastructure You Don’t Control

Playbook: Be Careful With Your SOC2 Controls

Оценки и отзывы

Об этом подкасте

Информация

Signed

Выпуски

The EDR Was Running. The Ransomware Still Won.

Playbook: AI Layoffs

AI Agents Are Already Inside Your Company. Nobody’s Watching Them.

You Bought the Stack. You're Using Half of It.

Playbook: MSPs

Nobody Owns Your Cloud Bill

You’re Scaling on Infrastructure You Don’t Control

Playbook: Be Careful With Your SOC2 Controls

Оценки и отзывы

Об этом подкасте

Информация