Networking for Cybersecurity Experts

The most underrated skill in cybersecurity leadership isn't technical. It's translation. I was in a meeting with a CIO of a state during an active incident at a major US corporation that had just been attacked. While their team was managing the SOC, coordinating with law enforcement, and advising school districts on what technical indicators to hunt for, the governor was texting them. Not asking about lateral movement. Not asking about indicators of compromise. Asking: how many business offices does this company have in our state? How many people do they employ? How are our consumers impacted by this disruption? Three completely different audiences. Three completely different languages. One communicator. One incident. Real time. This is the reality of security leadership at the highest levels, and most of us were never trained for it. Here is what I think every security leader needs to hear and act on: You don't have one audience. You never did. You have executives, board members, technical teams, peer departments, regulators, law enforcement, and sometimes governors. Each one needs a different version of the same truth. The facts don't change. The frame does. Context switching at this level doesn't happen naturally. It requires process. The best security leaders build deliberate mechanisms for translation before the crisis hits:  not just the skill to do it in the moment, but structured approaches that let them distill technical reality into executive language and operational guidance simultaneously. Know your board version. Know your regulator version. Know your governor version. Draft them in advance. The incident is not the time to workshop the framing. Communication is not a soft skill. It is a defense capability. If your analysts can hunt a threat but your leadership can't translate the impact to the people who need to act on it, your organization is less secure. The gap between a contained incident and a catastrophe often lives in that translation layer. The best security leaders I know are not just the best investigators. They are the best translators. Ask yourself right now: if the governor texted me during an active incident, could I answer their questions in thirty seconds while simultaneously directing my SOC? If not, that is the gap worth closing next.

Cybersecurity is having its AI moment. Every security leader is now building, acquiring, and partnering to execute a dual strategy: 1) AI for Security: Using AI to detect threats 2) Security for AI: Protecting AI workloads While a flurry of acquisitions grabs headlines (Palo Alto Networks <> CyberArk, F5 <> CalypsoAI, Check Point <> Lakera, CrowdStrike <> Pangea), our CB Insights analysis reveals the massive scale of partnerships as the real accelerator, with security leaders racing to build AI partnerships at unprecedented scale, including 300+ in the last 5 years. Why? Partnerships deliver what building and buying can't: ✓ Speed to market when AI threats evolve daily ✓ Access to specialized AI expertise at the frontier ✓ Scale to match a $230B market opportunity by 2032 Already, partnership performance speaks volumes: ↳CrowdStrike: Record $221M net new ARR through AI partnerships ↳Zscaler: AI partnership-driven growth surpassed $1B ARR ↳Palo Alto Networks: Sold 3M+ browser licenses in Q4 for AI agent security ↳SentinelOne: Purple AI grew triple digits with 30%+ attach rates ↳Cloudflare: AI inference requests exploded 4,000% YoY via partnerships ↳F5: Hardware revenue up 39% YoY, driven by AI-ready infrastructure partners The cybersecurity leaders who thrive in the AI era will be the ones who are closest to the emerging frontiers of AI, driven by more partnerships and more acquisitions.

Over seven years, we have helped several newly appointed cyber leaders hit the ground running and establish credibility with senior stakeholders. Here are my top recommendations: 1. Neutralize Potential Dissenters - Whether hired externally or promoted internally, you will face individuals determined to sink your ship—peers who thought they deserved the role or C-suite members who believe you should report to them. You must move quickly to establish legitimacy. These people can cause serious damage. Your initial moves may be less about procuring tools and more about understanding grievances, healing wounds, and building consensus. 2. Deliver High-Profile Quick Wins - You only get one chance to make a first impression. Once you step into this high-profile role, you must identify and deliver 2-3 quick wins while developing your long-term strategy. This builds momentum and creates widespread belief that significant change is happening in the cybersecurity function. The first 100 days provide a rare opportunity to show the organization who you are. Your direct reports wonder if you will keep their jobs. Senior stakeholders question if they made the right choice. Long-term suppliers worry if you will delete them from the panel. Everything hinges on the tone you set and the initial bold but wise moves you make. 3. Slow Down, Shut Up, and Listen - While you must cement credibility through rapid delivery, a super busy first 100 days is a huge trap. If you were hired after a serious breach, you have no time to gently ease in. But soon after taking charge, you must become an information sponge. How does the organization make money? How are important decisions made? Who is the CEO's whisperer? What are the board dynamics? The worst thing is arriving assuming you know what needs to be done based on a one-pager job description and high-level interview discussions. I have learned the hard way: most organizations have unspoken cultural dynamics, hidden traps, and complex power structures. You uncover these only through candid conversations with key stakeholders. This requires a careful blend of executive confidence and genuine vulnerability that gets people to open up. What was your experience in your first 100 days as a leader? What would you do differently? #cyberleadership #first100days #careeradvice

A small but market‑defining cohort of partners is now shaping where cybersecurity investment goes next. Out of nearly 300,000 partners that participate in the cybersecurity ecosystem worldwide, the top 500 generate more than $140bn in annual revenue from cybersecurity technology and services, representing over half of the addressable market. Their scale, expertise and service depth give them disproportionate influence over how organisations prioritise security, modernise architectures and select vendors. What sets this group apart is its strength in services. The Omdia Cybersecurity Partner 500 (CP500) captures 57% of all cybersecurity services revenue, far exceeding its share of technology resale. This reflects a structural shift in the market. Organisations are no longer buying point products; they are buying outcomes such as reduced risk, stronger resilience, improved operational maturity and sustained compliance. These outcomes are delivered through strategic advisory, design, deployment and integration, managed operations, incident response, continuous risk management and governance. Partners that deliver capabilities around the leading cybersecurity platforms are becoming the long‑term drivers of security transformation across their customer base. These top 500 partners are also redefining capability models. They are moving toward platform‑driven, AI‑augmented security, scaling SOC operations across hybrid environments, automating detection and response, converging IT and OT security, and embedding identity, compliance and industry‑specific expertise. Together, they are elevating cybersecurity from a defensive cost to a strategic enabler for organizations. The ecosystem remains diverse. GSIs represent just 7% of the CP500 but generate nearly half its revenue. Regional SIs, consulting firms, VARs, MSSPs, SPs and MSPs each play distinct roles, from global transformation to national‑level sovereignty and compliance. The top 30 account for 50% of CP500 revenue, each exceeding $1bn. Partners ranked 31–100 bring regional strength and deep specialisation, while 101–500 form the operational backbone of national cybersecurity across public sector, critical infrastructure and SMBs. The top 10 include: Deloitte Accenture NTT DATA IBM Consulting PwC Tata Consultancy Services EY Orange Cyberdefense KPMG World Wide Technology More detailed information is available to Omdia clients.

One thing I’ve been thinking about lately, and something I shared in a meeting yesterday: In cybersecurity, we sometimes get so focused on security and compliance that we forget what all of it is actually in support of…the business. Security does not exist for the sake of security. It exists to protect the: 👉🏾mission 👉🏾people 👉🏾operations 👉🏾customers 👉🏾outcomes the business is trying to achieve And the leaders who understand that shift how they communicate, how they prioritize, and how they influence decision-making. Early in my career, I understood our environments and our requirements….sure. But if I’m honest, I didn’t fully appreciate the importance of understanding the business itself until I stepped deeper into leadership. That changed everything. Because once you understand: ✔️what the organization is trying to accomplish ✔️where risk impacts the mission ✔️how timelines, funding, operations, and delivery connect …your perspective changes. Your conversations change. Your ability to influence changes. And honestly, this is one of the biggest gaps I see in cybersecurity professionals who want to move into leadership. Technical expertise matters. But if you want your voice to resonate with executives, stakeholders, and decision-makers, you have to understand the bigger picture. You have to understand the business. This is also one of the reasons I created my LinkedIn Learning course around security metrics and KPIs. Because data means very little if you can’t connect it back to business impact, risk, priorities, and outcomes in a way leadership can actually understand and act on. That’s where influence starts.

“Cybersecurity isn’t failing because of tech, it’s failing because of leadership.” Last year, my team and I were called in to support a company after a major ransomware incident. The tech stack looked strong on paper: – EDR across endpoints – 24/7 SOC monitoring – Regular red team assessments But within the first hour of the incident briefing, the CFO said something that stuck: “We had the best tools. Why did everything still go down?” And that’s when it became clear— They had tools. They had dashboards. But they didn’t have the leadership structure to act decisively when it mattered. 🚫 No executive-level crisis playbook 🚫 No shared understanding of critical business systems 🚫 No communication bridge between security and the board Infosec spoke in threat vectors. The board needed answers in financial and reputational impact. Two different conversations. 📊 PwC’s 2024 Global Digital Trust Insights found: 74% of executives say their security leaders struggle to connect cyber risk to business goals. That’s the gap. Not lack of talent. Not lack of budget. But lack of alignment at the top. So how do we fix this? Here’s what security leaders can do right now to build better alignment with the board: ✅ Translate threats into impact. Don’t say “log4j vulnerability” — say “potential $3.2M outage risk.” ✅ Map risk to operations. Identify which 3–5 assets the business cannot afford to lose. ✅ Create a board-ready playbook. Define roles, escalation paths, and executive impact scenarios. ✅ Make metrics meaningful. Don’t show patching rates — show how exposure has dropped over time. ✅ Embed cyber in decision-making. Join strategic planning, not just audit reviews. Cybersecurity is no longer a technical function. It’s a leadership mandate. And the companies that thrive will be the ones where leadership owns the risk, not just the report. #CyberLeadership #CyberResilience #BoardroomSecurity #MCS #SecurityThatDelivers #BusinessAlignment #DigitalTrust #CyberForGrowth

It is of no surprise that since I started my position as Cybercrime Director at INTERPOL, I get asked every week what law enforcement needs to combat cybercrime more effectively. While money and access to tools are accurate answers, I would argue that having the right tag team partners to fight alongside us is critical, too. My Cyber Strategy and Capabilities Development team diligently works to onboard new private sector partners to provide INTERPOL and its 196 member countries the ability to leverage specialized expertise that exists outside of typical law enforcement channels. What makes these partnerships essential? ▪️ They bridge jurisdictional gaps that criminals exploit ▪️ They combine technical and legal expertise ▪️ They enable rapid, coordinated responses to emerging cyber threats These collaborations take many forms: information sharing agreements, expert secondments, intelligence analysis support, and specialized training. Each partnership strengthens our global response capability. Operations Serengeti and Grandoreiro were successful, in large part, because of our private sector partners. My team and I recently had the opportunity to discuss these successes and much more. To read further, check out: ➡️ https://lnkd.in/eR6WGPCn ➡️ https://lnkd.in/e9eapWKq #INTERPOL #Cybercrime #PublicPrivatePartnership #Teamwork

Laws with #cybersecurity requirements: time for the lawyer to wear a hoodie and for the CISO to put on a lawyer's gown. [because we all know that's how the other profession dresses 100% of the time] For years I have been stressing the need for cybersecurity and legal teams to work as one - and to ensure that cybersecurity isn't left to technical teams but made into a core company-wide strategy discussed at Board/Management level. Recent laws increasingly contain technical cybersecurity obligations. The UNECE Regulations for cybersecurity & software updates in the automotive sector were a good example [read here a piece I wrote while at my previous law firm: https://lnkd.in/dA9-ucgj ]. The newest one is an EU Commission Delegated Regulation of 11 March 2024 "establishing a network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows", which complements and is aligned with the #NIS2 Directive. This Delegated Regulation covers *a lot*, such as: - Broad objectives for a cybersecurity management risk system (including a requirement for "senior management [to be] informed of relevant legal obligations and [to] actively contribute[...] to the implementation of the cybersecurity management system through timely decisions and prompt reactions") - Requirements to comply with any "minimum cybersecurity controls", covering a wide range of topics, from background checks (which must be "proportionate and strictly limited to what is necessary" and in accordance with the #GDPR / #dataprotection rules) to "traceability of the application of the cybersecurity specifications from the development through production until delivery of ICT products, ICT services or ICT processes" - An obligation for authorities to collaborate on a "matrix to map the controls set out in [Art. 28(1)(a) & (b) of the Delegated Regulation] against selected European and international standards as well as relevant technical specifications" + much more Recommended reading even if you aren't in that specific sector (electricity), as it shows what might be coming to other sectors too. What does this mean? *WORK TOGETHER*: Ensure you have a conversation with all stakeholders, as you need each other's expertise *GET ADVICE*: Your usual advisor/legal/consultant is unlikely to have the full breadth of expertise to cover all aspects (legal & infosec in particular), so get people involved who *can* help. *MAKE IT FUTURE-PROOF*: You need a cybersecurity strategy that will work in the long run (internal structure, resources, etc.). *GET BUY-IN*: Everyone need to be involved: top to bottom, all contribute to the strategy. Link to Delegated Regulation: https://lnkd.in/e4Krgu5T Need help? Reach out!

A call to a regulatory alignment by several CISOs of key companies 👍🏻… « Expect no change » but the discussion is starting at last ! My key takeaways. By collectively urging the G7 and OECD to align international cybersecurity regulations, a CISO coalition are, in effect, escalating our role from mere custodians of internal security controls to influential voices on the global stage. This appeal to heads of state and global institutions underscores the recognition that systemic cybersecurity risks require not just technical solutions, but also political and regulatory ones. However, as we assess the potential impact of this letter, let’s temper our expectations… Historically, good intentions have not always translated into tangible government action, even in a long timeframe. Therefore, anticipate that this initiative may not yield immediate, demonstrable changes to global regulatory policy. In light of this, our focus should remain on proactive, pragmatic measures to mitigate regulatory exposure and build resilience. To achieve this, we must continue to closely collaborate with our (geopolitical) risk team to: 1. Map regulatory exposure: Develop a comprehensive understanding of the regulatory landscape applicable to our business (and Tech) operations. 2. Identify regulatory overlap: Recognize areas where regulations converge or conflict, enabling us to simplify and streamline our compliance efforts. Automation is needed to support this effort. 3. Design a harmonized control framework: Standardize risk and control language to facilitate global audit readiness, ensuring that our security posture is both robust and adaptable. Automation is needed here again to support this effort.