In our recent webinar, "Don’t DIY Your Defenses,” I sat down with two of the sharpest people I know. Jen Anthony, who leads our advisory services and spent 20 years in the Air Force, including as CISO of the Air Force Cyber Operations Center, and Joey Bejarano, who helps run the security operations center, watching our clients' environments 24/7/365, and we had a real conversation about how much has changed over the last 30 years, and how much hasn't.
If you missed it, here are the themes that stuck with me.
The Moat Doesn't Work Anymore
Anyone who knows me knows I love a good analogy. So we framed the whole discussion around the idea of a moat around your castle.
For decades, that's exactly how we treated cybersecurity: dig the moat, raise the drawbridge, and post guards at the gate. You just had to keep the bad guys outside the perimeter, and you were safe.
Jen put it perfectly: “The world used to be simpler, even if it was never truly safer.”
But today, your staff works from kitchen tables, airports, and coffee shops. The front door to your organization isn't an office door you can lock anymore. The real perimeter now is your people's identities, and protecting a workforce that can log in from anywhere in the world requires a fundamentally different mindset than the one most of us grew up with.
"We're Too Small to Be a Target" is a Dangerous Myth
Every time a cyberattack makes the Wall Street Journal, it's a Fortune 100 company. Unfortunately, that creates a false sense of security for everyone else.
Jen challenged that thinking head-on: “Attackers aren't targeting organizations for who they are. They're looking for opportunity. It's a business for them, and chaos is their product. Small and mid-size companies are targets because they're often resource-constrained, stretched too thin to do the basic blocking and tackling like patching, vulnerability management, and multi-factor authentication.”
As Joey reminded us, there are 24 hours in a day and 45 things to do. The bad guys are counting on cybersecurity being item number 46.
The Threats Haven't Changed, but the Speed Has
Surprisingly, the core attack tactics and techniques haven't changed dramatically over the years. What has changed is velocity.
Joey shared a striking data point: “It used to take a year or more for a newly discovered vulnerability to be exploited in the wild. Today, we're seeing vulnerabilities exploited the same week they're found. AI has given threat actors the ability to find and weaponize gaps in your armor faster than ever. The moat hasn't moved, but the attackers got a lot faster at building bridges over it.”
Six Boxes Every Leader Should Be Able to Check
The heart of the webinar was Jen's walkthrough of a modern cybersecurity program, built on six functions (drawn from the NIST CSF framework):
-
Know what you have: You can't protect assets you don't know exist.
-
Protect what matters: MFA, training, access control, and knowing where your crown jewels are.
-
Detect when something's wrong: Having security tools doesn't mean someone's watching. If an attacker gets in at 2 a.m. on a Saturday, who knows?
-
Know how to respond: Who's in charge? Who do you call? What decisions get made, and by whom?
-
Recover your business: It's not if an incident happens, it's when. Can you run your business in the face of one?
-
Govern all of it: The unglamorous but essential glue.
The key insight Jen shared: “This isn't a collection of products you purchase. It's a capability you build, practice, and continuously improve.”
Your Security Tool Isn't a Security Program
Joey told a story that I think will resonate with a lot of business leaders. A company deployed an endpoint protection tool on every computer and considered itself protected. His response: "Do you just deploy Salesforce and expect it to create contracts on its own?"
Of course not. You have a Salesforce admin and a VP of Sales working in it daily. Security tools are the same. Gone are the days of installing antivirus and sleeping peacefully next to the green checkmark. Tools need people continuously monitoring, tuning, and ready to respond around the clock.
Shadow AI Is Already Inside Your Organization
One of the liveliest moments came from an audience question about AI tools like ChatGPT and Claude. Jen's advice was refreshingly pragmatic: “Your employees are going to use AI whether you permit it or not, and simply blocking it just drives the behavior underground, where you lose all visibility.”
Her suggested framework included governance, visibility, and education. Set ground rules, maintain visibility into what's being used, and, critically, help your staff understand why pasting sensitive client data into an open-source model is a problem, rather than just issuing a policy letter that says "don't."
I'll add my own eye-opener. When we ran a shadow AI audit for a client, the list of tools employees were using included AI applications I had never heard of, and I'm the nerd who tries every model that launches. It wasn't just sales and marketing, either. You'd be surprised what shows up on those reports.
The Part Nobody Talks About
Finally, Jen shared something I think every executive should hear. When a ransomware event hits an organization, there's the technical work, and then there's the emotional and psychological toll.
People are scared. They feel grief, panic, or despair. Someone is asking, "Who made the mistake?" And the leadership burden of carrying an organization through that is, in Jen's words, one of the most stressful experiences of her professional life.
This is why it is important to practice your response before you need it. Have the plan, assign the roles, and rehearse them because having a plan you've never exercised is barely better than having no plan at all.
Watch the Full Conversation
This blog only scratches the surface. The full webinar goes deeper on every one of these topics, including what really happens inside a 24/7 SOC, how proactive assessments and Pen Tests establish your baseline, and practical advice for prioritizing security investments when budget isn't unlimited.
Watch the full webinar on demand here, and if any of these themes hit close to home, our team is happy to continue the conversation.
