I vividly remember March like it was yesterday - that’s when I started thinking about how to bring value to Black Hat and what I’d be doing in Vegas this year.

I put my head down for one minute and here we are, about to head out to the airport for the West Coast.

Wild.

This year is going to be electric. We have a full line up of activities through the week - non-stop.

I want to see so many of you and I know some of you expressed interest in meeting up and hanging out, so I’m sharing my full itinerary with you.

I get into Vegas Sunday and head back home on Friday.

Below is the entire week. Every room I will be in, every table I will be at (excluding Blackjack).

If you can meet me where I already am, perfect. If none of it lines up, hit reply and we will book time.

Monday, August 3

Check in and badge pickup. I will be floating around Mandalay Bay most of the day. Pull my sleeve or stop me in my tracks if you spot me. Or hit me up on LinkedIn or email.

Tuesday, August 4

7 to 10 AM: CISO Games GYM

Everyone else is booking steak dinners, whiskey, and cigars. We booked the squat rack and the sauna. Recovery, a real breakfast, and the people you actually want to see at Black Hat.

25 spots left to get in the game. Come lift, come recover, or come stand around with a coffee. All of it counts. You don’t need to be an athlete or in shape to join us!

Sign up here: https://luma.com/ufk3yrmc

Thank you to our proud sponsors: Exaforce, Reflex Security, EC-Council, Cyturus, Gambit Security, SkillBit, Cequence Security, 360 Advanced, Grip Security, Aryon Security, Gin Security, CISO XC, Demo-Force, and Delvein.

11 AM to 5 PM: Visit Me at Booth 1839 with 7AI

I am on camera at the booth all afternoon talking Foundational AI Security. Come sit down and get on the record with me.

While you are there: take a demo, walk away with a limited edition 7AI shirt, and get your initials embroidered on it on-site. Live demos of the agentic security platform, plus the newest threat hunt and skills work.

And look up while you are in town. You won’t want to miss 7AI high up at The Sphere.

Want the executive team instead?

They are taking meetings at the private suite at the Four Seasons and in their space on the show floor: https://7ai.com/blackhat

Wednesday, August 5

7 to 10 AM: CISO Games GYM

Round two. Same place, same crew, same 7 AM. Join us on day 2 here: https://luma.com/ufk3yrmc

11 AM to 5 PM: Booth 1839 with 7AI

Hanging out at the booth with my friends at 7AI again, showing what Foundational AI Security is all about. Come visit us there and get your custom, limited-edition tee.

5:30 PM: THE Panel You Don’t Want to Miss

The AI SOC Was Just the Beginning: A CSO’s View of Where Agentic Security Goes Next.

Where: Mandalay Bay Ballroom J

The AI SOC was the opening move. Over two years, AI agents took over the work that used to bury analysts, starting with investigation and triage, then moving into response, detection optimization, and proactive threat hunting. Each step changed what a team could realistically defend.

So what comes next? Adam Fletcher, Chief Security Officer at Blackstone, sits down with Lior Div, CEO and Co-Founder of 7AI, for an honest conversation about where agentic security started and where it goes.

7:00 PM: Coming Full Circle with 7AI

7AI and GuidePoint Security are hosting CISOs and security leaders at Zero Bond at Wynn Las Vegas, closed for the evening. Dinner, a curated menu, craft cocktails.

Registration is closed, but if you are on the list, I will see you there!

Thursday, August 6

9 AM to 4 PM: Booth 1839 with 7AI

Last day to meet prospects, customers, and friends - let’s make it count!

4:30 to 5:30 PM: Swingers at Mandalay Bay

I'll be hanging out with my friend Trey Ford, Chief Strategy and Trust Officer at Bugcrowd. No agenda. Just real talk about strategic thinking, resilience under pressure, and how strong leaders turn setbacks into learning moments.

Plus a good game of chess so we can decompress from the week. Yes, chess. Wish me luck.

6:00 PM: Black Hat Happy Hour with CISO XC

​Black Hat week in Vegas calls for a proper sendoff and we’re kicking things off at The Chandelier inside the Cosmopolitan. If you’re a CISO or security leader in town for the conference, come grab a drink with us on Thursday evening before heading back home. J

oin us at one of the most stunning bars at the Cosmo for a cheers!

Register: https://luma.com/tsh7cwvg

6:30 PM: CISO XC Dinner at Superfrico

CISO XC returns to Black Hat with an evening for CISOs and senior security executives who want to step off the conference floor and talk to peers.

Three-course dinner at Superfrico, with live performance and theatrical elements running through the night. Last year was AMAZING. I’m really looking forward to this one!

Register: https://luma.com/2ffe4497

Friday, August 7

Cyber Links on the golf course with Infolock

Golf and cybersecurity in the same frame. Cyber Links puts IT and security professionals on the course, where the conversations actually happen. Shop talk, deal talk, and the kind of relationship building no webinar has ever pulled off. Yes, golf, too. I’ve never played, but I’m super excited to come decked out in some golf dear.

Also…wish me luck, again.

Watch the episodes: https://www.youtube.com/@playcyberlinks

4:00 PM: We are OUT! See you next year.

That is the week.

If you want to get on camera, talk shop, or just stand somewhere quiet for ten minutes and commiserate together on how our feet and backs hurt, reply to this email and tell me which day works.

I will do my best make it happen.

If you are skipping Vegas this year, reply anyway. We will find time after.

See you out there!

Dani

Black Hat is brutal on the body. Late nights. Recycled, dry, hot casino air. Long days on your feet. Coffee treated as a food group.

After back to back meetings, the last thing a security leader wants is another vendor steak dinner. They tell us the same thing. They just want to go back to their room, because they are burnt out and their feet hurt.

(Their words, not mine.)

So Cecil Pineda and I are giving this community something it actually wants. A morning to recharge before the day starts. A real workout with peers, recovery, a healthy breakfast, and a go-bag for the day ahead.

This is the CISO Games GYM.

For Cybersecurity Leaders

This is a healthy way to start your Black Hat days.

• Energy, clarity, and recovery instead of burnout.

• Connection built on a little healthy competition.

• A relationship heavy space where CISOs and security leaders are humans first.

• Community around health, wellness, and showing up for each other. The heart of CISO Games.

• The best networking of the week.

Christopher Russell, Brent Forrest, and Chase Cunningham will be on the floor to guide you through your workouts.

Reserve your spot →

For Cybersecurity Vendors

We are opening the GYM to a select group of founding sponsors. Limited slots, real exclusivity.

Here is what you get:

• Brand association with health and community.

• Authentic proximity to CISOs and security leaders in a non transactional setting they actually want to be in.

• Co-branded gear in their hands and their gym bags. Tanks, towels, shakers.

• Your moment to welcome the room.

• Earned attention, not interrupted attention.

• Content and footage you can ride all year.

This is what experiential is supposed to be.

Explore sponsorship →

How Much Does it Cost to Sponsor?

Founding sponsorship of the CISO Games GYM is $7,500 per day. Or $12,500 for both days.

That covers everything above.

Your logo on co-branded gear in every leader’s hands, your moment to welcome the room, a full year of content and footage, and authentic proximity to CISOs in the one setting they actually asked to be in.

No booth. No badge scan. No steak dinner.

Just earned attention at the start of one of the most important weeks of the year.

Explore sponsorship →

Interested in Joining Us in the GYM?

Reply to this email or schedule time with me to get in the game.

A special thank you to Exaforce, our proud sponsor for CISO Games GYM, for getting in the game.

Best Kept Secret - the new docuseries I produced, brought to you by 7AI - premieres on LinkedIn Live tomorrow on Audience 1st at 12pm Eastern and I want to tell you why it exists before you watch it.

Somewhere along the way, cybersecurity content got safe.

Like, UBER safe. Predictable. Beige.

The same talking heads, the same recycled threat stats, the same on-brand soundbites that don’t really make you feel anything.

We built an entire industry of content designed to be inoffensive and in doing so, we made it forgettable.

I didn’t want to add to that pile. I didn’t want more of the messy, boring middle.

Best Kept Secret is my answer to that.

The premise is simple:

The most interesting thing about a security leader is almost never their title or their tech stack.

It’s them.

Their decisions, their bets, the person behind the role that everyone in the organization leans on but almost no one actually knows.

So we go find out.

We get close.

Radically close.

Watch Best Kept Secret, featuring Ravi Thatavarthy, CISO of Rite Aid

🗓 Tomorrow - Wednesday, July 1

📍 LinkedIn Live

🎬 Brought to you by 7AI

Production: Audience 1st

Watch Here

What it was like to hang out with Ravi

I spent a day with Ravi Thatavarthy, CISO of Rite Aid and “interview” is the wrong word for what happened.

We hung out all day. And we had JUST met,

We talked about what it actually feels like to carry the weight of protecting a company that millions of people walk into every day.

The trade-offs nobody warns you about.

The moments of doubt, the moments of conviction and the very human reasoning underneath decisions that, on paper, look purely technical.

What struck me most was how quickly he felt comfortable and open to engaging in this immersive experience - touring Patriots Place and Gilette Stadium just outside of Boston.

There is absolute magic in human proximity.

Once you stop performing for the camera and start being with someone, you get the real thing - the texture, the contradictions, their most intimate stories.

Ravi is sharp, generous, and refreshingly honest, and the version of him you’ll meet tomorrow is the one his peers rarely get to see in public.

That’s the WHOLE point.

That’s the secret in Best Kept Secret.

Why this format resonates with cybersecurity buyers

Here’s what I’ve come to believe:

What earns trust with buyers now is human proximity.

The willingness to be a real human, in a real moment, without the corporate scaffolding.

When a buyer watches a CISO speak candidly, something shifts. They lean in. They recognize themselves. They believe what they’re seeing because it wasn’t manufactured to be believed.

This works because it’s the opposite of the echo chamber many of my peers in the marketing and sales space are in.

We’re not putting people on a stage to repeat the consensus.

We’re getting out of the room entirely and immersing in an actual experience.

Why this is the way to go in 2026 and beyond - analog and digital

The future isn’t more content. It’s more closeness.

Whether the medium is analog or digital, a stage or a screen, the differentiator is the same:

How close can you get to the human on the other side?

Everyone has access to the same tools, the same data, the same playbooks.

The one thing that can’t be commoditized is genuine human connection captured honestly and shared generously in the most trusted networks.

That’s the bet I’m making with this series.

Not louder. Not glossier. Closer.

Closeness is the differentiator among all other things and in a sea of beige, it’s the only thing that’s going to stand out.

Join us live

Best Kept Secret, featuring Ravi Thatavarthy, CISO of Rite Aid

🗓 Tomorrow - Wednesday, July 1

📍 LinkedIn Live

🎬 Brought to you by 7AI

See you there,

Dani

I’m really excited to kick off Season 1 of CISO Games with our first Huddle of the season!

Next week, we’re bringing together ~40 cybersecurity leaders, practitioners, founding CISO athletes, and select vendor sponsors for the first official CISO Games Happy Hour.

CISO Games First Huddle

📅 When: May 20th, 5:00-7:00PM CDT
📍Where: Plano, TX
👥 Who will be there? ~40 cybersecurity leaders interested in joining the club, joining a team, or learning more about this unforgettable and original program

We’re holding a few activation slots for vendor sponsors who want to be part of this from the ground floor - especially those who believe in community, creativity, and building real relationships with security leaders beyond the traditional event scene.

This is also a chance to learn what we’re building, meet the people shaping CISO Games, and get plugged into this exclusive competitiors club before The Games tournaments officially begin.

Get in the Game

I created this with Cecil Pineda, co-founder of CISO XC, and our founding CISO athletes so that the community can get a healthy dose of:
🏆 Competition
🤝 Real relationships
🧠 Practitioner-led collaboration
🎥 Original cybersecurity entertainment
🔥 A little chaos, a lot of fun, and actual authentic human connection

At the Huddle, you will be able to:

• Learn what CISO Games is

• Meet our founding CISO athletes

• Join The Club

• Connect with other cybersecurity leaders in a non-transactional setting

• Help shape what this becomes from the beginning

• Explore future CISO Games sponsorship opportunities

Here’s what’s included when you sponsor The Huddle:

• 2 free tickets to join us and network with our founding athletes

• Logo on the Huddle backdrop and on the printed Playbook every guest takes home

• On-camera segment during the Huddle, captured for the Season 1 docuseries, produced by Audience 1st

• Co-branded content from the room - photo, video, social - distributed across our channels and yours

• First right of refusal on the upcoming Draft Party before it opens publicly

Investment: $2,500.

The room is set for next week, so this is a fast yes-or-no either way.

Want in? Reply to this email or book time with me today.

Come play,

Dani

If you’ve read my stuff and followed me long enough, you’d know I’ve spent years in this industry listening to CISOs and cybersecurity leaders. REALLY listening.

And the thing I have heard underneath every research interview, every podcast conversation, every dinner, is this:

“I love this community. I am exhausted by it. And I have nowhere to put any of this.”

The average CISO lasts 26 months in the role.

The weight is unsustainable and the support is almost nonexistent.

The industry that needs them most has built an entire economy around selling to them and almost nothing around taking care of them.

This kept brewing within me.

And it was also stirring within my co-founder, Cecil Pineda (a lot of you know him as Cecil the CISO and co-founder of CISO XC), who has 34 years in the cybersecurity space and has watched peers burn out, get blamed for things outside their control, and disappear after tenures that should have been celebrated.

After years of working alongside this community, watching the people who defend the world give everything and receive so little in return, it was the first (second, actually) idea Cecil and I had come up with that matched the size of what we both felt needed to exist.

Something meaningful.

Something built for the people, not around them.

Something that would still matter in ten years.

A program that would champion the people who have earned the right to feel like they won something and who desperately need a place to channel everything the job puts into them.

That is what CISO Games is.

Eight teams. Five athletes each. One full tournament day.

Real physical and mental challenges designed so the marathon runner and the person who just walks their dog every morning both have a role.

A seeded bracket.

And a medal ceremony at the end where someone wins and a charity check goes out in their name.

It is not a conference.

It is not a panel.

It is not a networking event with a shallow keynote you’ll forget by Tuesday.

It is the first radically human program this industry has seen that says your health matters. Your joy matters. The person behind the title matters.

Season 1 launches in Vegas this summer, literally right before Black Hat USA.

But before the big tournament, we are celebrating the launch of CISO Games May 7th in Plano, TX.

We are hosting the first CISO Games Huddle - a happy hour for the people who are going to help make this real.

The 15 seed athletes who have already been recruited.

The Charter Partners who want to be first in.

And anyone in the security community who has looked at what we’re building and felt something they haven’t felt about an industry event in a long time.

We are keeping it small. And we want you there.

It is part celebration, part preview, and part collaboration.

We will share the full vision for CISO Games - the format, the games, the bracket, the medal ceremony, the charity component, and what it actually feels like to be part of a tournament designed specifically for this community.

We will introduce the athletes who have already committed.

We will recognize the Charter Partners who are stepping up to make it happen.

And then we are going to ask the room a question we genuinely don’t know the answer to yet - because we want the people in this community to help us design part of CISO Games themselves.

Because we are firm believers that The Games should built by the community and driven by competition.

Space is limited and by invitation only.

If you want to sponsor The CISO Games Huddle and become a Charter Partner:

Book a Call

What It Means to Be a Charter Partner

Charter Partners are the founding sponsors who make Season 1 happen.

This is a category-exclusive relationship - one sponsor per team - where your people and your brand are woven into the experience itself.

When you become a Charter Partner, you sponsor a team. Your name is on their jersey. Your team competes. You’re in the huddle, on the floor, and in the medal ceremony footage.

You get direct access to and relationships with the security leaders on your team - not a 10-minute “shark tank” speed-round, but a shared athletic experience that creates the kind of relationship that no booth or dinner ever has.

Charter Partners also lock in the lowest rate we will ever offer.

These spots are category-exclusive and limited.

When they’re gone, they’re gone.

If you are a cybersecurity vendor who is done with the same conference circuit and actually wants to be remembered by the buyers you need - this is your moment.

What You Get When You Compete.

For your body.

• A full day of physical competition designed for every fitness level - not just the athletes in the room

• Movement that breaks the cycle of ten-hour sedentary workdays and chronic desk stress

• A structured physical outlet for the cortisol and tension that accumulates in a high-stakes role

• Optional pre-season training community to prepare alongside other athletes in your city

For your mind.

• Mental challenges embedded inside every physical game - strategy, sequencing, memory, and decision-making

• A complete context switch from the threat landscape you live in every day

• The psychological reset that only comes from playfully competing for something that has nothing to do with incident response

• A day where your brain is fully present because the stakes are real and the outcome is earned

For your emotions.

• The experience of being celebrated - loudly, publicly, and without an agenda - for who you are, not what you protect

• A medal ceremony that honors every person on the floor, winner or not

• A charity donation made in your name, to a cause you chose, in front of a crowd that watched you earn it

• The specific feeling of being part of a team that chose you, competed with you, and stood next to you at the end of the day

For your community.

• A team of peers who become something more than contacts - because you went through something real together

• Access to a network of CISO Games athletes across every season, every city, and every tournament

• A permanent place in the CISO Games alumni community - a record that you showed up and competed

• Hall of Fame eligibility for champions and standout competitors across multiple seasons

For your legacy.

• A competition jersey with your name on the back - yours to keep permanently and wear whenever you want

• Custom engraved Gold, Silver, or Bronze medal with your season and year marked

• Your full tournament footage - every match, every reaction, every medal moment - delivered within 10 business days

• A Hall of Fame induction if you compete across multiple seasons and leave your mark on the community

For the cause.

• A charity donation in your team’s name if you win Gold - doubled live on stage by the Charity Match Sponsor

• A contribution to the season-long charity total announced publicly after the Q4 Championship regardless of result

• The knowledge that your participation put real money into real causes, chosen by the people who competed for them

Come play.

CISO Games launches in Las Vegas, August 1st, 2026 .

Become an official sponsor here.

CISO or Security Leader? Join a team here.

See you on the field,

Dani

Unveiling TITAN AI: A New Era of Threat-Informed Third-Party Risk Management

Learn More

One minute, AY is telling you about Russian botnets built from compromised routers being used to spy on Ukrainian infrastructure and the next he’s complimenting your throw pillows in the podcast studio.

I think that contrast tells you something important about why I keep inviting him back.

It hasn’t been long since our first conversation. But the world moved. Agentic AI continues to explode onto the scene.

OpenClaw went from a cool open-source project to a security crisis in the span of weeks.

The speed at which threats are materializing has shifted from days to microseconds.

And AY, as usual, was not only watching it unfold but his team was publishing the research that quantified exactly how bad it was.

This is the second installment of conversations with AY on Audience 1st Podcast.

The first episode was about origins, philosophy, and the foundational ideas that built Security Scorecard.

This one is about what happens when those ideas collide with a world that is changing faster than anyone predicted.

Subscribe now

OpenClaw Is Not a Security Incident. It’s a Preview of Every Problem We’re About to Have.

OpenClaw is an open-source personal AI agent.

It connects to your email, your calendar, your WhatsApp, your browser.

It can send messages on your behalf, manage your schedule, execute code in your terminal.

People loved it. It went viral.

Thousands of people rushed to install it because the promise was irresistible - wake up to a briefing on your code commits, your weather, your meetings, all handled by an AI that never sleeps. The problem is that almost nobody thought about security before they deployed it.

Security Scorecard’s research team scanned the entire internet and found tens of thousands of OpenClaw instances left completely exposed. No authentication or encryption.

Many of them were named in ways that let you identify the person and the company they worked for.

Hackers could see exactly which instance belonged to a bank, which one belonged to a supermarket, which one belonged to your neighbor.

And because these agents have privileged access to everything - email, messages, calendars, browsing history - breaking into one was like getting handed the keys to someone’s entire digital life.

OpenClaw is not an anomaly.

It’s the first wave.

Every agent framework that prioritizes convenience over security by default is going to produce the same result.

People will deploy it because it’s useful, they’ll skip the security configuration because it’s not the default, and attackers will find the exposed instances before the organization’s security team even knows they exist.

AY’s team built a tool - declaw.io - to help people discover their own exposure.

The fact that a tool like that needs to exist tells you everything about where we are right now.

Subscribe now

You Click and Then You Think. In the Real World, You’d Never Do That.

In the real world, we’ve been trained and conditioned.

You walk into a dark alley at night, you look behind your shoulder.

But in the digital world, those defenses disappear. You click and then you think, instead of thinking and then clicking.

It explains why someone will plug a security camera into their home network and leave the password as admin/admin.

It explains why employees upload confidential documents to ChatGPT without a second thought.

The physical world has friction built into it - distance, darkness, locked doors - that forces you to pause and assess before you act.

The digital world has been engineered for the opposite.

Every interface is optimized to reduce friction, to get you to click faster, to remove the pause that would otherwise protect you.

Visibility Without Context Is Just Noise with a Dashboard

If the information about OpenClaw’s vulnerabilities was already publicly available, if the research was out there, and organizations still didn’t act, then is the problem really visibility? Or is it something else entirely?

His response was nuanced in a way I appreciated.

The problem is that organizations are drowning in data.

If you have visibility into ten thousand issues and no mechanism to tell you which two actually matter right now, then your visibility is functionally useless.

Enter: contextualized visibility.

Not just seeing what’s exposed, but understanding what it means in the context of your specific environment, your specific threats, your specific business.

A hospital needs to know about the threats being used against other hospitals.

A hedge fund needs to focus on data exfiltration patterns in financial services.

A SaaS company has a completely different threat profile than a manufacturing firm.

Yet most security tooling treats them all the same. Here are your vulnerabilities, ranked by severity, good luck figuring out which ones actually matter to you.

Every vendor in the market is selling visibility. Visibility has become table stakes.

The differentiator is context.

Subscribe now

Every AI Agent Is an Intern with Root Access Who Disappears Before You Can Fire Them

Imagine that every single second, you hire ten new interns. They have access to your systems, your data, your customer information.

The next second, those interns are gone, and five new ones show up.

Some of them might make mistakes. Some of them might expose sensitive systems. And you have no idea who they are, what they did, or whether any of them left the door open.

That is what the agent landscape looks like right now. These are not persistent systems you can audit at your leisure.

They are ephemeral, privileged, autonomous processes that spin up, execute tasks, and vanish, often before a security team even knows they existed.

Traditional identity and access management frameworks were not built for this.

They were built for humans who log in, do their job, and log out on a predictable schedule.

Agents do not operate on a predictable schedule. They operate on demand, in parallel, at machine speed.

For anyone building in the identity security space, this is the architectural challenge of the next five years.

How do you tie an agent to an identity? How do you establish accountability when the entity performing the action existed for three seconds and then disappeared?

AY raised this as a problem he’d want to work on if Security Scorecard didn’t exist.

You Can Measure It and Still Not Improve.

In our first conversation, AY said something that became a throughline for the entire episode: what you can’t measure, you can’t improve.

So this time I pushed him on the inverse. What happens when you can measure it, when the data is right there, the dashboard is lit up, the risk is quantified, and the organization still doesn’t act?

He said that many companies say cybersecurity is important the same way they put culture values on a wall.

But if the behaviors don’t match the stated values, then you’re not actually practicing it.

He pointed to large banks running ancient versions of software because upgrading is expensive and might break trading systems. The risk is known. The measurement exists.

The action does not, because the cost of fixing it feels bigger than the cost of ignoring it, until the day it isn’t.

We talk about maturity as a technology problem - do you have continuous monitoring, do you have threat intelligence, do you have automated response?

But the gap between measurement and improvement is a behavioral gap.

It is an organizational willpower gap.

It is a leadership accountability gap.

And no amount of tooling will close it if the people at the top of the organization are not willing to treat security investment as a real priority and not just a compliance checkbox.

Organizations are stretched thin. Budgets are flat. The CISO is being asked to do more with less while the C-suite pours money into AI initiatives.

The behavioral failure is real, but it is often the rational response of overwhelmed people operating inside broken incentive structures.

Fixing it requires changing the incentives - tying executive compensation to security outcomes, making risk posture a board-level KPI with real consequences, and giving security teams the authority and resources to actually act on what they can measure.

Subscribe now

SecurityScorecard’s Maturity Framework Exposes a Lie Too Many Organizations Tell Themselves

AY walked me through SecurityScorecard’s maturity framework for third-party risk management, and what struck me was how clearly it reveals the distance between where most organizations think they are and where they actually are.

The framework has three stages.

1. The first is static, point-in-time assessment. You catalog your suppliers. You run a vulnerability scan or a penetration test. You complete an annual questionnaire. You check the box. This is where the vast majority of organizations live, and many of them believe this constitutes a functioning security program. It does not. It constitutes a snapshot - a single photograph of a landscape that changes every second of every day. AY compared it to putting the results on a top shelf drawer and letting them collect dust until next year. That is not risk management. That is documentation.

2. The second stage is continuous assessment. This is where you move from once-a-year to always-on. You are being alerted in real time about what is exposed in your environment and your suppliers’ environments. Missing patches. Malware indicators. Configuration drift. The shift from stage one to stage two is significant, but it is not the finish line and this is where I think a lot of organizations get stuck. They achieve continuous visibility and assume the job is done. It is not.

3. The third stage is threat-informed detection and response. This is where you stop treating every vulnerability as equally urgent and start contextualizing threats based on who you actually are. Organizations are spending enormous amounts of money protecting against threats that are not relevant to them while ignoring the ones that are.

SecurityScorecard works with over thirty-two hundred organizations across forty-six countries. Nine of the top ten banks. Major insurance companies. And even among that cohort,

AY was candid that every organization is at a different stage of the journey and most are not as far along as they believe. R

egulated industries tend to be further ahead, not because they are inherently more sophisticated, but because compliance mandates like PCI-DSS and HIPAA force them to invest.

The organizations without that regulatory forcing function are, in many cases, still living at stage one and calling it a program.

Subscribe now

364 Days a Year, Nobody Is Watching. And Everyone Knows It.

I asked AY whether “continuous” has become a buzzword. He didn’t dodge it. He said that almost every term in cybersecurity is a buzzword at this point and that saying it and doing it are two completely different things.

Fair enough. But then he put a number on the gap.

Most third-party risk management programs operate as a once-a-year activity. One assessment and checkbox. One day. Which means there are three hundred and sixty-four days where nobody is verifying anything.

Three hundred and sixty-four days where a supplier could be compromised, a configuration could drift, a new vulnerability could be exploited and nobody would know because the assessment already happened and the results are sitting in a drawer collecting dust.

The adversaries are not operating once a year. They are operating every second of every day. And so when a vendor puts “continuous” on their website, the real question is: does your definition of continuous match the adversary’s definition of continuous?

The only meaningful definition of continuous in the current threat environment is always on. Twenty-four hours a day, three hundred and sixty-five days a year, without gaps.

Start Assuming You’ve Already Been Broken Into.

AY said you have to move from robustness to resilience. Stop trying to make it impossible for an attacker to get in. Start assuming they’re already inside.

A few months before the Russian invasion of Ukraine, the Ukrainians proactively invited hackers to break into their own infrastructure.

They deliberately discovered their own vulnerabilities before the adversary could exploit them. It meant that when the actual attack came, they had already seen many of the paths an attacker would take and had hardened accordingly.

If you are not actively and continuously trying to break yourself, using the same tools and techniques the attackers are using, then your security posture is based on assumptions, not evidence.

You assume your configurations are correct. You assume your patches are deployed. You assume your third parties are secure. Assumptions are what get breached.

Subscribe now

AI Budgets Are Exploding. Security Budgets Are Flat. Nobody Sees the Contradiction.

Boards are pushing AI adoption for Wall Street optics while CISOs are left picking up the pieces. I asked AY whether the disconnect has gotten worse.

More and more company budget is flowing into AI initiatives. At the same time, cybersecurity budgets are staying flat or actually declining.

The board is mandating AI adoption from the top, driven by competitive pressure and investor expectations, while the security team is being asked to govern and protect these new deployments with the same resources they had before the AI push started. In some cases, with fewer resources.

AY drew an important comparison. Application security for traditional software development is a well-established discipline.

People know the OWASP Top 10. There are mature static and dynamic code analysis tools. Decades of collective wisdom have been codified into frameworks and best practices.

AI governance has none of that. The tooling is nascent. The frameworks are early. The startups working on it are still finding product-market fit.

And yet organizations are deploying AI into production environments at a pace that far outstrips the maturity of the security ecosystem around it.

This gap between AI adoption speed and AI security maturity is not closing. It is widening. Every quarter that passes without an organization investing in AI governance creates compounding risk.

The companies building tools that help CISOs quantify and communicate that risk to their boards, not in technical jargon, but in the language of business exposure, are solving a problem that is going to get much more expensive before it gets any cheaper.

Subscribe now

Pirates vs. Navy: The Only Innovation Model That Works Inside a Bureaucracy

AY described an internal culture model at Security Scorecard that I think has broader implications for how any security organization should think about innovation.

He calls it Pirates versus Navy. The Navy is your traditional team, handling scalability, maintaining systems, doing things the established way.

The Pirates are a small, isolated R&D group with explicit permission to experiment, break things, and operate outside the usual constraints.

What I find interesting about this is that it’s not a new idea in the abstract - people have been talking about skunkworks teams for decades - but AY is applying it specifically to how security organizations need to evolve in the age of AI.

He also backs it with structural incentives.

Security Scorecard allocates bonus pools to departments based on AI tool adoption.

They mandate reporting on the percentage of code written by AI.

They test candidates on AI competence during the hiring process.

That last part is what separates this from the generic “we encourage innovation” talking point that every company puts in their values deck.

Innovation culture is about making creativity economically rational - rewarding the people who experiment, protecting them when experiments fail, and structurally separating them from the operational teams whose incentives are optimized for stability, not discovery.

Most organizations say they want both.

Very few actually build the structural conditions for both to coexist.

The Secure Path and the Convenient Path Have to Become the Same Path

If the first conversation with AY was about foundations - about where conviction comes from, why language matters, and how to build something that changes an industry - this second conversation was about velocity.

About what happens when the pace of change outstrips the pace of defense.

About what it means to operate in a world where the attacker moves in microseconds and the defender is still trying to get a budget approved.

The throughline of everything AY said in this episode can be reduced to a single design principle: the secure path and the convenient path have to become the same path.

Humans, without exception, will choose the convenient thing because the digital world has been optimized for speed and convenience at every layer and security is almost always a friction point that sits outside the natural workflow.

This conversation felt different from the first one.

The first time, AY was telling me about the world he wanted to build.

This time, he was telling me about the world that is arriving whether we are ready for it or not.

The optimism is still there. But it comes with a sharper edge now.

The technology is good enough.

Not perfect or remotely equivalent across every vendor in every category.

But good enough that the feature gap between the market leader and the second and third options has compressed to the point where it is rarely the deciding factor in a B2B tech purchase.

Especially in cybersecurity.

Especially among the buyers who have been evaluating tools long enough to know that the demo is always better than the deployment and the product is always more capable than the problem it actually gets used to solve.

When the technology is good enough, something else becomes the deciding factor.

And the answer is completely unexpected.

I’ve extracted it in the most unguarded moments that almost no vendor is designing their marketing around - simpler and more human than any demand gen framework accounts for.

They choose the vendor that is more interesting to be around.

Call it fun, or energy, or the feeling you get when a vendor interaction leaves you in a better spot than it found you rather than depleted and more skeptical than before.

Whatever you call it, it is real, it is measurable in deal outcomes, and almost nobody in B2B tech is treating it as the strategic variable it has become.

Subscribe now

The Middle of B2B Marketing Is Getting Crushed From Both Sides

There is a structural shift happening in how attention moves and how trust forms with buyers (not just in consumer marketing but in every market where human beings are the decision makers).

On one side, digital is accelerating.

AI is producing content at a volume and velocity that no human team can match.

The buyers you are trying to reach are being targeted by more messages, through more channels, with more apparent personalization than at any point in history.

The digital landscape is getting exponentially noisier.

And the tech brands that will thrive let alone survive in that environment are investing in digital presence at genuine scale - AEO, social distribution, retention content that compounds, with the volume and consistency that makes you discoverable when a buyer is forming an opinion before they have agreed to talk to anyone.

On the other side, something equally powerful is happening in the opposite direction.

As the digital world gets noisier, human attention is migrating toward the things that are genuinely, irreducibly real.

Live experiences. Physical presence.

The deepest, most authentic conversations that happen in a room with no ulterior motive and no pitch.

The moment that could not have been manufactured and therefore cannot be ignored.

The analog world is not dying as the digital world grows.

It is becoming more valuable precisely because the digital world is growing.

Now…the middle - the space between digital scale and genuine human experience is where most B2B tech marketing lives…

The conference booth that is neither truly experiential nor truly digital.

The webinar that is neither a real conversation nor a piece of content that will compound over time.

The branded dinner that is neither intimate enough to produce real trust nor distributed enough to produce real reach.

The sponsored panel that produces neither genuine insight nor genuine relationships.

This is the middle. And it is getting crushed from both sides.

The vendors who understand this are making two bets simultaneously.

They are going all-in on digital presence - real volume, real consistency, real investment in being findable and credible in the channels where buyers form opinions.

And they are going all-in on genuine human experience - real moments, real conversations, real specificity about who the buyer is as a person and what it feels like to be in a room with this brand.

The vendors who do not understand this are spending more money on the boring and messy middle and wondering why the returns keep declining.

Why So Many Cybersecurity Vendors are Stuck in the Boring, Messy Middle of B2B Marketing

The question constantly on my mind is:

Why do cybersecurity vendors keep choosing the middle when the evidence that the middle is not working has been accumulating for years?

The answer is that the middle is safe.

The middle has defensible metrics.

The middle does not require an organization to make the bet that genuine human connection, at the right moment, with the right people, will eventually show up in the pipeline.

Badge scans are countable the day of the event.

Trust shows up in revenue six months later.

The first number survives the post-event debrief.

The second number does not exist yet when the budget justification is due.

There is also the problem of what I call institutional gravity.

Every B2B marketing organization has processes, vendors, and internal stakeholders built around the middle.

The events agency.

The booth contractor.

The demand gen agency.

The SDR sequence that starts the Monday after the conference.

These systems have their own momentum.

They produce their own justifications.

They create internal constituencies for their own continuation.

Breaking out of the middle does not just require a strategic decision.

It requires dismantling infrastructure that has been built over years and replacing it with something that looks riskier because its returns are less immediately countable, even when the actual risk profile of the new model is significantly better.

The vendors who are making the move are doing it because someone in the organization - usually a CMO or founder who has spent real time with real buyers - has had enough honest conversations to know that the middle is producing the illusion of marketing while the trust gap keeps widening.

Subscribe now

Fun Is Not a Soft Variable. It Is a Decision Criteria.

When the technology is good enough, buyers are not neutral between the vendors in their evaluation set.

They have preferences that are not fully legible in the formal criteria documented in the RFP.

Those preferences are shaped by the accumulated experience of interacting with each vendor over the course of the evaluation - and in many cases, in the months and years before the formal evaluation started.

When vendors generate genuine energy - who create interactions that feel alive rather than procedural, who show up in ways that are unexpected and specific and even, at times, genuinely enjoyable - they carry something into the evaluation that no feature comparison can measure.

It’s called limbic trust.

It is the trust that forms below the level of conscious analysis, in the part of the brain that processes emotional memory before the rational mind can intervene.

When a buyer has had enough genuinely positive human experiences with a brand, their preference for that brand becomes something closer to feeling than to logic.

They will still be able to articulate rational reasons for their choice. The real driver will be the accumulated residue of the human moments.

Fun is not frivolous in this context.

I have heard this from buyers across hundreds of conversations.

They describe the vendor they eventually chose and the description includes - almost always - some version of “I just genuinely like talking to them.” Or “their events are always something I actually want to attend.” Or “I don’t know exactly why, but when they reach out, I respond.”

None of these are formal decision criteria. All of them are decisive.

Subscribe now

What is Experiential Marketing?

Ask ten B2B marketers to define it and you’ll get ten answers that all describe the same thing: a fancier event.

A rooftop happy hour. A chef’s table dinner. An escape room with your logo on the wall.

A golf outing with a branded tee box. A booth activation where someone spins a wheel and wins a Yeti or kicks a ball at a screen calling it gamification.

That’s not experiential marketing. That’s hospitality.

Experiential marketing is a strategy that invites people to participate in a brand experience instead of passively consuming an ad.

Rather than relying on impressions-based messaging, it creates a memorable moment through live events, interactive activations, product demos, pop-ups, or digital experiences that let audiences see, touch, try, or share something firsthand.

That last part matters more than most B2B marketers want to admit.

Firsthand.

The buyer encounters the brand directly, through something they did, felt, or walked away from changed, and that directness is precisely what makes it stick.

Done right, experiential marketing makes a brand feel real, relevant, and human in a way that deepens emotional connection and improves recall long after the experience ends.

For companies trying to stand out in crowded markets, it turns attention into engagement and engagement into a stronger relationship with the brand.

Which is exactly why the B2B version of it is almost always done wrong.

Most of what gets called experiential in B2B is still passive consumption.

The buyer is still an audience. Still being talked at. Still absorbing a message the vendor decided on in a conference room six months ago.

The format changed. The dynamic didn’t.

Real experiential marketing requires a different posture entirely.

The buyer isn’t the audience. The buyer is a participant.

There’s a meaningful difference between those two things, and buyers, especially the sophisticated, over-marketed security leaders who’ve seen every version of this, feel it immediately.

Why Does Experiential Marketing Accelerate Pipeline and Revenue?

Every marketing interaction a buyer has with your brand activates one of two systems in their brain.

Understanding which one you’re activating and what each system does with the information is the most important thing a B2B marketer can know right now.

Traditional marketing activates the prefrontal cortex.

The rational, analytical, skepticism-generating part of the brain.

The part that reads your ad and immediately starts looking for the catch.

The part that has processed enough vendor messaging to know that every claim is optimistic, every case study is cherry-picked, and every “we’re different” sounds exactly like every other “we’re different.”

The prefrontal cortex is where your messaging goes to get stress-tested, discounted, and forgotten.

Research on advertising recall tells us how well that’s working: most of it is gone within hours.

Experiential marketing activates the limbic system.

The emotional, memory-forming, trust-generating part of the brain.

The part that doesn’t evaluate - it feels.

The part that registers safety or threat before the rational mind can intervene, that encodes memories through emotion rather than logic, that holds onto experiences for years precisely because they produced a feeling rather than a fact.

This is the neurological explanation for why a buyer can forget your campaign the same week it ran and still remember a conversation they had with someone from your team three years ago at a conference.

Different stimulus. Different brain. Different shelf life. Completely different outcome.

Traditional marketing is optimized for the one mode of engagement that cynical, over-marketed buyers have spent years building defenses against.

It talks at them. It engages a single sense.

It transfers information they didn’t ask for through the exact cognitive channel that is most primed to reject it.

And it does all of this in a market where the buyers are smarter, more skeptical, and more defended than almost anywhere else in B2B.

Experiential marketing bypasses the defense entirely.

A genuine human moment that engages multiple senses, invites active participation, and produces an emotional response, doesn’t enter through the skepticism filter because the skepticism filter isn’t what gets activated.

Trust isn’t argued into existence. It’s felt into existence. And what is felt is remembered.

That’s the neurological case.

Here’s what it looks like in practice.

They let it down in small rooms.

Not the thousand-person conference session.

The gathering of twelve where someone has clearly thought about who specifically should be in the room and why.

They let it down in formats that ask something of them.

The conversation where they are being interviewed, not pitched.

The collaborative exercise where their expertise is genuinely needed.

The experience designed around something they care about in their personal life that has nothing to do with the vendor’s product.

They let it down when the content that comes out of the experience sounds like them.

The social show where a CISO is a co-star, not a testimonial.

They let it down when the digital artifact of the human experience finds them in the trusted ecosystems where they actually spend their discretionary attention - not in the channels the vendor controls, but in the communities, the newsletters, the social feeds of the practitioners they already follow and trust.

The format is less important than the conditions it creates.

What matters is that the buyer experienced something real, that the experience was documented with enough craft to carry that realness into digital form, and that the digital form found its way into the places where buyers go to be practitioners rather than targets.

That is the full model.

The physical experience as the production studio.

The trusted ecosystem as the distribution channel.

The peer voice as the most credible signal in the most skeptical market in B2B tech.

And this is where the pipeline math finally becomes legible in the pattern.

The CISO who attended the dinner eight months ago responds to the outreach today.

The security leader who shared the episode tells their peer to take the call.

The buyer who showed up to the event skeptical is now the one forwarding your content to their team.

None of these moments have a clean attribution path.

All of them are in the pipeline.

Some of them are in the closed-won column.

The vendors who have figured this out have stopped trying to draw a straight line from experience to revenue.

They’ve started building the conditions under which those lines draw themselves consistently and compoundingly.

Subscribe now

The Blue Ocean Is Wide Open in Cybersecurity

The cybersecurity market is one of the most crowded, most competitive, and most noise-saturated B2B verticals in existence.

There are more vendors, more categories, more funding, and more marketing spend per buyer than almost any other technology sector.

It is also the sector where the experiential blue ocean is most dramatically wide open.

CISOs are the most studied, most targeted, and most marketed-to executive in the enterprise.

They have been the subject of more vendor personalization campaigns, more executive dinner programs, more “exclusive CISO community” invitations than any other title in the organization.

They have developed the most sophisticated filters.

They have the most finely tuned radar for the difference between genuine curiosity about their world and a vendor using the language of genuine curiosity as a lead generation tactic.

What this means in practice is that the experiential bar - the threshold at which a cybersecurity practitioner genuinely feels something rather than categorizing an interaction and moving on - is higher in cybersecurity than almost anywhere else in B2B tech.

And it means that the vendor who clears that bar is operating in territory that their competitors simply cannot access.

The brand that a CISO describes to a peer over dinner is not the brand with the biggest booth.

It is the brand that did something that actually surprised them.

That treated them like a person with a specific, interesting life rather than a title with a budget.

The crowded market created the skepticism.

The skepticism created the gap.

The gap is the blue ocean.

And because the skepticism in cybersecurity is so much higher than in other verticals, the gap in cybersecurity is proportionally wider.

To say I’m excited about this partnership is an understatement.

I’m SO STOKED! Because I have been closely following CISO XC, getting massive value from their events - from a networking and knowledge perspective - and, frankly, really like the people building the community.

And I’m proud to announce the official media partnership between Audience 1st and CISO XC, one of the nation’s leading CISO communities.

The Problem This Partnership Solves

The cybersecurity industry has a trust problem between the people who build and sell security products and the people who buy them.

Vendors sponsor events, scan badges, and send follow-up emails that go straight to trash.

CISOs show up, dodge the sales pitches, talk to each other in the hallway and surrounding venues, and leave.

Both sides walk away frustrated. Both sides blame the other.

Audience 1st will be bridging the gap of communication amd relationships between vendors and security leaders, facilitating deep conversations as videocast episodes through CISO XC’s new Video Studio at their events.

By putting a CISO and a vendor’s SME in the same conversation, in a format that strips away the pitch, it creates space for something the industry desperately needs: honesty.

What actually builds trust is a deep conversation around life, problems, and ways to solve them together, and that’s exactly what this partnership offers.

The partnership launches at the CISO XC Dallas Spring Event on April 23, 2026, where more than 250 attendees - including CISOs and cybersecurity leaders - are expected.

Want to join us at CISO XC’s biggest CISO event on April 23rd?

Book a Call

Introducing the CISO XC Traveling Videocast Studio

The centerpiece of the partnership’s value to cybersecurity vendors is the CISO XC Traveling Videocast Studio - a fully produced, on-site media studio operating inside every CISO XC event.

The studio offers a limited number of sponsorship slots per event.

Each sponsor receives:

• 3 Fully Produced CISO Conversations - On-camera conversations with CISOs, moderated by me, with the sponsor’s SME as a guest as well. Up to 20 minutes each. Fully edited, branded, and distributed for you after the event.

• 15+ Short-Form Social Clips - LinkedIn-ready cuts pulled from each conversation. Insight-rich, platform-native content featuring CISOs discussing the challenges the sponsor’s solution addresses - not scripted talking points, but real buyer perspectives.

• 2 Conference Tickets - Full access to the event, including networking with CISOs and security leaders from the DFW metro and beyond.

The Videocast Studio travels with every CISO XC event, giving sponsors access to CISO communities in multiple cities throughout the year.

Sponsorship slots are limited and expected to fill ahead of the event.

Interested in securing a studio sponsorship for CISO XC’s biggest even in Dallas, April 23rd?

Book a Call

This partnership represents a shift in how cybersecurity community events create relationships and mutual value and distribute knowledge.

Cecil Pineda, Jaimin Shah, and Randy Potts, Co-Founders of CISO XC, have built the organization into one of the most respected CISO community platforms in the country, with events drawing hundreds of security leaders across multiple U.S. cities. The media partnership with Audience 1st extends that reach beyond the room and into a year-round content presence.

About Audience 1st

Audience 1st is a buyer-led experiential marketing firm built for the cybersecurity industry. Founded by Dani Woolf, who brings 15+ years of cybersecurity go-to-market experience and a network of thousands of CISO and security leader relationships, Audience 1st produces media that generates real buyer relationships and pipeline. The company serves cybersecurity vendors through original show production, buyer research, and experiential marketing activations. Learn more at audience1st.fm.

About CISO XC

CISO XC is a national CISO community event platform founded by Cecil Pineda, Jaimin Shah, and Randy Potts. CISO XC events bring together hundreds of CISOs and cybersecurity leaders for networking, peer learning, and community building across multiple U.S. cities. Learn more at cisoxc.com.

Secure Human Risk—all in one platform.

Identify high-risk users and guide them to smarter security choices with a unified platform.

Learn More

When I sat down with Masha Sedova to record this episode of Audience 1st, I was not expecting to walk away with the kind of clarity that made me want to immediately pick up my pen and go deep.

I was expecting a good conversation about security awareness, a category I understand, with a guest I respect.

What I got instead was a genuinely uncomfortable realization that I, someone who has spent years inside the cybersecurity marketing machine, had been operating with the same broken mental model as everyone else.

What follows is not a product review of Mimecast. It is not a puff piece on Masha, though she is unquestionably one of the sharpest people working in this space right now.

This is a structured attempt to surface what this conversation actually revealed about the state of human risk management as a category, the structural failures that allowed the problem to compound for three decades, and the commercial, philosophical, and organizational implications for everyone from CISOs to founders to the VCs writing checks into this space.

The Industry Has Been Measuring the Wrong Thing for Thirty Years

68% to 72% of breaches trace back to the human element, year after year, and the primary intervention has been mandatory training and simulated phishing.

We give people mandatory training and then cross our fingers and hope for a different outcome, Masha says.

But I think the industry gets off too easy when we treat this as simply a technology gap. The real scandal is that the metrics were deliberately insufficient, and the people running these programs understood that at some level and kept reporting them anyway.

Training completion rates are not a proxy for security risk reduction. Neither are phishing simulation click rates.

Security leaders have known this intuitively for a long time and yet these metrics persisted in board decks and QBRs and vendor dashboards for decades.

They persisted because they are measurable. Numbers travel well up the chain of command, they satisfy compliance requirements, and they require no uncomfortable conversation about the gap between what an employee knows in a training environment and what they actually do at 4:47pm on a Tuesday when an urgent vendor invoice lands in their inbox.

The industry optimized for reportability instead of truth, and that is a choice that accumulated into thirty years of largely preventable breach exposure.

This matters enormously for anyone in go-to-market. When a security leader has spent years presenting training completion rates to their board, a vendor asking them to adopt a platform that measures something fundamentally different is also asking them to walk back everything they previously said was working.

That conversation has real political cost inside their organization. Most security vendors have dramatically underestimated that cost, and as a result they are pitching a product problem when the actual obstacle is an organizational one.

Learned Helplessness Is Not a Cultural Problem. It Is the Primary Go-to-Market Obstacle, and Most Sellers Are Ignoring It.

Masha used the phrase ‘learned helplessness’ to describe the posture of CISOs who have tried to invest in the human element and come up empty.

Security teams have run awareness programs, iterated on phishing simulations, hired communications professionals, gamified training modules, and watched the breach statistics barely move.

After enough cycles of that, the rational response is to lower your expectations and redirect budget toward something that shows cleaner ROI.

That is what happened across the industry and that scar tissue is still very much present in the buying population today.

The problem for anyone selling into this space is that learned helplessness is invisible until it surfaces in an objection.

A CISO does not walk into a demo and say they are skeptical of this category because they have been burned before.

They say things like we are not ready for this yet or we need to get our fundamentals right first.

They ask for case studies from organizations that look exactly like theirs.

They slow-walk approvals.

They send you to procurement.

Understanding that these behaviors are expressions of accumulated disappointment changes everything about how a sales team should structure discovery, how marketing should build content, and how a CEO should think about the length of their sales cycle.

The human risk management category has a trust deficit that predates its own existence and that is genuinely unusual.

Most new categories are selling against ignorance.

This one is selling against experience.

The implication for founders and GTM leaders is that demand generation is table stakes.

Credibility generation is the actual job and it takes longer than most growth models account for.

The status quo is bullshit and we need to do something differently.

Subscribe now

The 8/80 Rule Blows Up Every Assumption About How Security Budgets Should Be Allocated

Eight percent of the workforce causes eighty percent of incidents.

When Masha said this, I felt the weight of it immediately and I want to make sure we are not just treating it as a memorable data point, because its implications run much deeper than most people initially clock.

If 8% of your people are responsible for 80% of your risk, then 92% of your people are absorbing security friction - complex password requirements, MFA prompts, endpoint monitoring, content scanning, restricted browsing - for incidents they are not causing.

The security tax on the majority of your workforce is protecting you from a minority, at the cost of speed and productivity for everyone else.

Standard security investment models treat the whole population as roughly equivalent in risk.

Controls are applied uniformly.

Policies are written for the most vulnerable users.

The 8/80 rule suggests this approach is actively counterproductive, because the friction imposed on low-risk users creates organizational drag without a corresponding security benefit.

Meanwhile, the 8% who are actually driving incidents may be receiving the same experience as everyone else, just with a slightly different click rate on their phishing simulations.

For vendors, the 8/80 rule opens a pricing and packaging conversation that nobody has fully solved yet.

If a CISO can identify their highest-risk population, they should be willing to pay a meaningful premium to apply intensive intervention specifically to that group.

The challenge is that identifying that population requires a data infrastructure that most organizations have not yet built, which means the first sale is often the instrumentation layer itself.

That requires a fundamentally different value conversation than replacing an awareness training platform, and most vendors have not restructured their pitches around it.

The Credit Score Analogy Is Genius Positioning, but It Carries Privacy and Power Risks That the Industry Has Not Reckoned With

Masha reached for the credit score and driver’s insurance analogies to explain how we already quantify individual risk in other domains and as a positioning move it is genuinely excellent.

It normalizes scoring people on their security behavior by connecting it to systems audiences already trust and understand.

It makes human risk feel less like surveillance and more like infrastructure. I understand why she made that choice and in a podcast context it lands well.

But I want to push back here, because the analogy has limits that the industry needs to confront before it scales this category.

Credit scores have a deeply troubled history.

They have been shown to encode racial and socioeconomic bias.

They have been weaponized by lenders in ways that harm vulnerable populations.

They are contested, disputed, and subject to regulatory scrutiny across multiple jurisdictions.

The reason they feel neutral and inevitable is a function of decades of normalization, not inherent fairness.

Importing that analogy into the workplace, where the power dynamics between an employer and an employee are fundamentally asymmetrical, should give everyone in this space serious pause.

An employee who scores as high risk because they click more links, use personal devices, or handle data differently than their peers may be exhibiting those behaviors because of workload, stress, cognitive overload, or a job design that forces them to move fast in environments where security is inconvenient.

Scoring them without understanding context identifies the symptom while completely missing the cause.

The vendors who build enduring, trusted platforms in this category will be the ones who bake interpretive guardrails into their frameworks, not just dashboards that surface who is risky, but honest thinking about why, and what the responsible uses of that data actually are inside an organization.

This is a regulatory, reputational, and ethical risk the category needs to get ahead of now, while it is still early.

The Four Personas Framework Is Doing Something Strategically Clever That Has Nothing to Do with Research

When Masha walked through the four personas - negligent, malicious, targeted, and compromised - she framed it as a way to organize security strategy.

And it is useful for that purpose.

But I want to name what is also happening underneath the surface, because it is instructive for anyone thinking about category creation and platform strategy.

Each of the four personas maps precisely onto a distinct security product category.

Negligent users need awareness and training tools.

Malicious insiders require DLP and insider threat solutions.

Targeted users need email security and identity protection.

Compromised users require incident response infrastructure.

Mimecast, through three acquisitions - Elevate Security, Code42, and Aware - now owns meaningful tooling that addresses each of those four personas.

The four-persona framework gives a CISO the conceptual structure to understand why they need all four product categories, and it positions Mimecast as the only vendor that currently connects those categories under a unified human risk signal.

For founders building in adjacent spaces, the lesson is significant.

When a vendor gets their theoretical framework adopted as the standard way the industry thinks about a problem, they have structured the competitive landscape so that their platform becomes the logical conclusion.

The framework becomes the moat.

This is what Salesforce did with the CRM category, what Palo Alto has repeatedly done with platform consolidation narratives, and what Mimecast is now attempting in the human risk space.

Whether they execute on it is a separate question, but the strategy itself is worth studying carefully.

Treating Employees Like Adults Is the Right Philosophy, but Nudges Are Inherently Paternalistic and That Tension Has Not Been Resolved

One of the moments I found most interesting in this conversation was when Masha said that we need to stop treating employees like toddlers and start giving them genuine agency over their own cybersecurity journey.

She is right that this framing shift matters and the contrast with the gamified, infantilizing aesthetic of most security awareness training is valid and overdue.

In the same conversation, Masha also described a nudge mechanism that sends real-time training to an individual employee, calibrated to arrive no more than once per hour, attempting to catch them in the moment following a risky behavior.

She acknowledged the delicate balance between effective and annoying as hell.

My question is whether a system that monitors employee behavior in real time, calculates a risk score, and delivers behavioral correction prompts at algorithmically determined intervals is actually treating that employee like an adult.

I am not arguing that nudges are wrong.

The behavioral science behind them is legitimate, and the intent - helping people make better decisions in moments of real vulnerability - is sound.

But the inconsistency between the philosophy and the product experience is something human risk vendors need to resolve explicitly rather than hand-wave past.

The employees who engage most productively with these platforms will be the ones who understand what is being measured, why it matters, and how they can genuinely improve their standing over time.

Subscribe now

The Board Conversation About Human Risk Works Right Now for One Specific Reason and the Window Is More Timed Than It Appears

Masha made an interesting observation about why human risk resonates in the boardroom:

Board members have been attacked personally and they have family members who have made security mistakes.

There is a depth of lived experience in that room that does not exist for most other security categories.

Board-level anxiety about cybersecurity has been elevated since approximately 2019 and spiked significantly during 2020 through 2022 as remote work dramatically expanded the attack surface.

The personal dimension of that anxiety - executives being targeted individually through spearphishing, whaling attacks, and deepfakes - created a kind of attention that is distinct from the general ‘are we getting breached?’ concern that drove earlier generations of security investment.

Boards have transitioned from seeing cybersecurity as an IT risk to experiencing it as a personal vulnerability.

That transition is what makes the human risk conversation resonate so deeply right now and it is a transition that happened recently enough that most security vendors have not figured out how to fully leverage it.

The Open Ecosystem Bet Is Ethically Sound and Commercially Dangerous and Mimecast Is Gambling That Integrity Wins

One of the more candid moments in this conversation came when Masha addressed the decision to operate as an open ecosystem, pulling data in from CrowdStrike, Okta, Netskope, and others, and sharing enriched human risk scores back out to those platforms.

She was explicit that many competitors have chosen closed ecosystems and that from a pure revenue-maximization standpoint, that makes rational sense.

Closed ecosystems sell more products. Open ecosystems are more useful to the customer but give away data that could otherwise be a retention lever.

I think Masha is right that customers should see a closed ecosystem for exactly what it is.

But the commercial risk is real and worth naming honestly.

When Mimecast shares enriched human risk scores with a platform like CrowdStrike, they are making it easier for that customer to evaluate whether they need Mimecast at all, or whether the risk signal coming through the integration is sufficient for their use case. Some customers will decide it is. That is the tax on openness, and it compounds over time.

The counterargument, and this is the bet Mimecast is making, is that in cybersecurity trust is the ultimate currency, and an open ecosystem builds trust faster than any marketing campaign can.

Security practitioners talk to each other constantly.

A CISO who discovers that a vendor withheld data interoperability to protect its moat will tell colleagues before the week is out.

A CISO who discovers a vendor gave away competitive data because it was the right thing to do for the customer will become an advocate.

In a category still at 10% adoption where the primary barrier is credibility earned over time, that bet might be exactly right.

But it requires conviction and patient capital, and not every CEO or board is built for that kind of long game.

Subscribe now

The Hardest Problem in Human Risk Management is Thirty Years of Cultural Debt Around the Phrase ‘Humans Are the Weakest Link’

I believe this is the most underappreciated dimension of this entire challenge and it is one Masha touched on but that I want to push much further.

The phrase ‘humans are the weakest link’ has been the foundational assumption of security culture for three decades.

It has shaped hiring decisions, product roadmaps, vendor pitches, board presentations, and the unspoken psychology of every security awareness training session ever conducted.

It is also one of the most damaging things the security industry ever said out loud and the field has not fully reckoned with the consequences.

When you institutionalize the idea that humans are inherently the problem, you create downstream cultural consequences that are very hard to undo.

Security teams stop investing serious analytical energy into understanding human behavior because the conclusion feels predetermined - people will fail, the training will not stick, and the best you can do is contain the damage.

Employees absorb the message and disengage, because who wants to bring full engagement to a role where they have been publicly designated the weakest link in the system?

CISOs stop fighting for budget in this area because the track record looks like thirty years of diminishing returns.

The cultural debt accumulates, and by the time a smarter framework arrives, the organization’s immune system is already primed to reject it.

Masha’s reframe - from ‘humans are the weakest link’ to ‘humans are a quantifiable, manageable risk category with distinct personas, data-driven interventions, and the capacity to participate in their own security journey’ - is not just intellectually more sophisticated.

It is psychologically more generous.

And in a field where the implementation of security practices depends almost entirely on human cooperation, psychological generosity toward the people you are trying to protect turns out to be a surprisingly practical strategy.

The founders, vendors, and CISOs who internalize this shift first will build programs and products that earn genuine trust from employees, and that earned trust is what eventually moves the needle on actual security posture, which is what this whole conversation has been about.

The Seismic Shift Is Coming - The Only Question Is Who Will Be Standing in the Right Place When It Arrives

I do not use the word seismic lightly.

Human risk management represents a genuine paradigm shift in how the security industry thinks about its most persistent and underserved problem.

The structural conditions for mainstream adoption are either already in place or rapidly accelerating:

The breach statistics demand a different approach, the analyst community is formalizing the category, the acquisition activity is consolidating the necessary tooling, the board-level attention is at a historic high, and the early practitioners are starting to generate proof points that will pull the next wave of buyers in.

Paradigm shifts are not self-executing, though.

They require people who are willing to publicly retire the old model, even when doing so is politically uncomfortable inside their own organizations.

They require vendors who can build trust before scale rather than the other way around.

They require CISOs willing to adopt a strategy that is still being defined, knowing they will need to help define it.

And they require investors who understand that category creation at this level of complexity has a longer feedback loop than most enterprise software bets.

What Masha described in this episode is a reorientation of how an entire industry thinks about people.

That is harder to build, harder to sell, and harder to sustain than any technology platform, and it is precisely why, when it works, it becomes nearly impossible to displace.

The early movers in this category are positioning themselves at the center of the next major shift in enterprise security strategy.

That is worth paying very close attention to, right now, before the window closes.

Leave a comment

I am sitting in a tattoo chair.

The needle hasn’t touched my skin yet, but I can already hear it - that flat, relentless buzz that lives in the precise gap between excitement and dread, the one that reminds you that no matter how many times you’ve done this, you never actually know what the next few hours are going to take out of you.

Across from me is someone I’ve known for about forty minutes.

They’re settling into their own chair.

Their tattoo artist is prepping the stencil.

There’s a camera pointed at both of us, catching the nervous energy, the slight forward lean, the moment just before everything becomes permanent.

We are about to have a conversation that neither of us would have had on a podcast, a webinar, a LinkedIn Live, or any other format that B2B marketing has approved for public consumption.

And that is precisely the point.

This is Ink Your Brand - my new social show, produced by Audience 1st.

And if you’re reading this wondering whether I’ve finally lost it, I want to offer you a different hypothesis:

Maybe I’m the only one in the room who’s actually paying attention.

Subscribe for free to watch the show and follow the full production diary - from guest recruitment through filming day through distribution and everything that surprises me along the way.

Ink Your Brand

2 creators. 1 tattoo chair. Your story should leave a mark. Produced by Audience 1st.

By Dani Woolf

The Problem Tech Marketers are Aware of and Don’t Want to Change

Here is a thing that is true and that almost everyone in B2B marketing privately agrees with but almost no one will say at full volume:

Traditional content is showing diminishing return.

Why?

Because buyers have seen every move.

They’ve been marketed to so many times, in so many of the same ways, that the part of their brain that used to engage with a well-produced webinar or a cleverly written email now just...routes around it automatically.

The filters aren’t conscious anymore, they’re reflexive.

And every new piece of traditional content that lands in their feed, however polished, however well-targeted, is training those reflexes to fire faster.

The more the industry produces, the less any individual piece of it means.

Volume became the strategy at exactly the moment volume became the problem.

And now everyone is sitting on content calendars full of AI-generated assets that get published, get ignored, and get replaced by next week’s assets, which will also get ignored, in a cycle that generates a lot of activity and very little trust.

I’ve spent the last several years sitting across from the most skeptical IT buyers - CISOs, VPs, cybersecurity directors and practitioners - asking them what they actually think, why and how they engage with vendors.

What comes out when nobody’s pitching them anything.

And what comes out is this:

They can’t tell your company apart from the other twelve vendors in their inbox.

They stopped watching the webinars.

They’ve stopped going to the massive tradeshows.

They’ve stopped going to the steak dinners (minus the steak mafia).

What the buyers I talk to want - and what almost nobody in this industry is giving them - is the feeling that someone on the other side of the table actually sees them.

That the content made for them was made with them in mind, not for a quarterly board slide that says “we have leads coming in!”

Fifteen years in this industry has given me a clear enough view to say that somewhere along the way, B2B marketing decided that looking credible was the same thing as being trustworthy.

That producing content was the same thing as creating connection.

That talking at buyers, with enough frequency and enough polish, would eventually feel like a relationship.

It doesn’t.

The buyers will tell you so themselves if you find a way to ask them somewhere they actually feel safe enough to answer honestly.

The Format That Changes the Equation

So what does work?

I’ve watched (and launched) enough marketing experiments succeed and fail over fifteen years to have a strong opinion about this and it comes down to one structural truth:

Buyers don’t trust brands, they trust people.

This is not revolutionary by any means.

Today, however, AI, what with it taking over the way marketers operate and create content, has forced the industry to become more disjointed and disconnected than every.

My friends, your differentiator is human proximity.

The formats that win are the ones that put real people, real stakes, and real stories on camera at scale, in a way that feels like something worth watching rather than something worth skipping.

That format is the social show.

What is a social show?

A social show is an episodic, character-driven media program built specifically for the feeds where your buyers already live - short enough to binge, human enough to feel, and structured enough to build a narrative that compounds over time instead of disappearing into the void like every other piece of content you’ve ever published.

It’s branded entertainment that happens to be about the things your buyers care about most, featuring the people they already trust or want to hear from, in formats designed to stop a scroll rather than fill a content calendar.

The reason social shows are the right vehicle right now is not complicated, it is just underacted on.

Attention has collapsed in B2B.

The average buyer is drowning in vendor noise and their filters have become extraordinarily precise.

What cuts through is not more content.

It is better stakes. It is something that feels like it was made for a human being to watch, not for an algorithm to index.

It is, above all, the sense that something real is happening - that the people on screen are not performing but actually participating in something together.

A social show, done right, is not awareness.

It is not demand gen in the traditional sense.

It is the deliberate, repeatable act of building the kind of trust that makes a buyer think of you first, believe you when you speak, and tell their peers about you before you ever send them a proposal.

The byproduct? Partnership. Pipeline. Revenue. Brand affinity. Customer retention.

That is the benchmark. That is what I am chasing.

And the question I kept asking myself - the one that eventually led me to a tattoo chair with a camera pointed at my face (and body) - was:

What format creates that kind of feeling so reliably that you could build a whole show around it?

Ink Your Brand

What I Know About Building a B2B Social Show (and What I Don't Yet)

I committed to this show before I had a studio booked…

Read more

6 months ago · 1 like · Dani Woolf

The Insight That Started Everything

I didn’t arrive at Ink Your Brand by thinking about content strategy.

I arrived at it by thinking about something I personally like doing - getting tattoos.

I have them. Several.

And anyone who knows me knows that the story behind each one matters more than the ink itself.

There’s something about the ritual - the choosing, the committing, the sitting still in vulnerability while something permanent happens to your body - that strips away performance almost completely.

You can’t be “on” when you’re wincing.

You can’t give a polished answer when the needle is doing its thing.

The discomfort is a truth serum, the permanence is a commitment ceremony, and together they create a kind of conversation that simply does not happen in any other context.

I started thinking:

What if that’s exactly what B2B marketing needs?

Not the tattoo as gimmick.

Not “edgy branding” for its own sake.

But the experience - the real, unscripted, embodied, impossible-to-fake experience - as a media format.

What if the format itself was the argument?

What if, instead of making content about the importance of doing things differently, I just did something radically different and filmed it?

That thought became Ink Your Brand.

What Exactly is Ink Your Brand?

Ink Your Brand, produced by Audience 1st, is a social show where I sit down with the top B2B GTM professionals, content creators, CMOs, founders, product marketers, and - crucially - the tch buyers themselves: CISOs, VPs, directors, practitioners who live on the other side of the table from the vendors trying to reach them.

We get meaningful tattoos together, on camera.

And while the needle does its work, we have the conversations that nobody is having on camera in this industry.

We talk about the pain of standing out in saturated markets.

About the content that buyers ignore and why.

About what it actually takes to build a brand that doesn’t just get noticed but gets believed.

About the moments of failure and the pivots that followed.

About conviction - what it means to actually stand for something when your whole industry is telling you to hedge.

Two chairs. Two needles. No script. No safe talking points. No pre-approved narratives.

Every episode follows a natural emotional architecture - seven stages that mirror the tattoo itself, from the nervous energy of The Sit to the mirror moment of The Reveal - and the result is something that doesn’t look or feel like anything else in the B2B media landscape.

Because nothing in B2B media is built quite like this.

The needle is the truth serum. The tattoo is the commitment. The conversation is the story.

Each full session runs 90 to 120 minutes of real tattoo time and yields one 10-to-15-minute supercut, eight mid-form thematic segments, and seven short-form clips: single moments of truth that can live on LinkedIn, Instagram, TikTok, and YouTube, built to stop a scroll and start a conversation.

Season 1 films eight guests across two days.

That’s 56 episodes, 120 total assets, and a content library built to run for months = not from a studio full of talking heads, but from a tattoo chair, where the stakes are visible on skin.

Why I Built It as a Show About Building Shows

Here is the meta-layer that I want to be transparent about, because I think it’s the most important part of this entire project.

Ink Your Brand is a living demonstration of the exact thesis I am bringing to B2B marketers.

My company, Audience 1st, produces social shows for B2B tech and cybersecurity vendors.

We build the kind of buyer-led, experiential media programs that I’m describing above - original show concepts where your buyers become co-stars, where the experience is the production studio, and where the trust you build on camera compounds forever.

That is the service. That is the product.

So when I sat down to think about how to market that service, the answer that kept presenting itself was:

Don’t explain it. Do it.

Don’t write a whitepaper about why social shows create trust. Make a social show that creates trust.

Don’t give a keynote about how vulnerability unlocks buyer relationships. Get in a tattoo chair on camera and be vulnerable.

Don’t produce a case study about why non-traditional formats break through noise. Be the case study.

This show is my proof of concept, my portfolio, my pitch, and my practice all at once.

Every episode of Ink Your Brand is simultaneously a piece of content for the show and a demonstration of what Audience 1st builds for clients.

Every conversation about brand and story and conviction is a conversation about what we do and why it works.

I launched a social show to show how to create a social show.

The irony is the strategy. The meta is the message.

If that reads as too clever by half, I understand.

But I’d argue that the B2B world is full of companies that tell you they can make you stand out and then hand you a PDF.

I’d rather show you, permanently, on my arm.

(Literally. I tattooed my company’s logo there. People ask about it at every conference. That’s a different kind of brand impression than a sponsored LinkedIn post.)

Why This Matters for B2B Tech Marketing Right Now

The buyers I talk to (and I have spent years building relationships with over a thousand of them) are not withholding trust because vendors are saying the wrong things.

They’re withholding trust because vendors are saying things at all, in formats designed for vendor comfort rather than buyer resonance.

The formula for breaking through is not complicated, but it is uncomfortable.

It requires doing something that not everyone will do, because that is the filter for who stands out.

It requires telling a real story, not a polished one, told in partnership with the people you’re trying to reach.

It requires making a commitment that’s visible, costs something, and can’t be faked.

That is what every tattoo is. And that is what every great social show is.

The stencil before the needle.

The pilot before the full series.

You validate before you commit, but then you commit fully, with both hands, and you don’t flinch when people tell you it’s too risky or too weird or too much.

Vulnerability is the point. The pain is what makes it real. And what’s real is what people remember, share, and believe.

Where to Watch

Ink Your Brand lives on Substack, LinkedIn, Instagram, TikTok, and YouTube - published as short-form episodes 7 to 10 times per week (dropping this week).

Subscribe to Watch When an Episode Drops

What’s Coming Next

Episode 0 is dropping this week.

Plus, I am building this show in public on the Ink Your Brand Substake - if you want to follow the full production diary - from guest recruitment through filming day through distribution and everything that surprises me along the way:

Subscribe now

Every decision, every mistake, every lesson from pre-production through launch and distribution - I’m going to write about it.

I’m not a content creator posting about content creation.

I believe there is a serious, teachable, replicable framework for how B2B companies can use social shows to build brand, create demand, and earn the trust of the buyers they’ve been trying to reach for years.

And I learn best by doing it myself first, then sharing exactly what I learned.

Future issues will go deep on the questions I get asked most:

How do you design a show format with a real narrative arc?

How do you recruit guests who will actually open up on camera?

How do you build a content machine from a single production day?

How do you get the CISOs and CMOs who decline every media request to get in a tattoo chair on camera and mean it?

I know the answers to these questions because I’ve built this - for myself and for clients.

And now I’m building it again, on camera, in a tattoo chair, with the people I trust most in this industry (and if you’ve agreed to sit in a chair with me and get tattooed - deeply trust me too).

Join us on Ink Your Brand.

Ink Your Brand

2 creators. 1 tattoo chair. Your story should leave a mark. Produced by Audience 1st.

By Dani Woolf

And if you want to sit in the chair - as a guest, a sponsor, or a brand that’s ready to do something that can’t be ignored - let’s talk. There are limited placements available, and the chair doesn’t stay empty for long.

I have spent years sitting across from the hardest-to-reach, most skeptical buyers in the world.

CISOs who have been lied to by vendors so many times that their default posture in any sales interaction is practiced suspicion.

Security engineers who have been on call at 3am cleaning up after decisions made by someone who believed a demo from a product company that has over-promised and under-delivered.

IT practitioners who have absorbed enough vendor “thought leadership” to recognize and dismiss it before they finish the first paragraph of that whitepaper.

I do not blame them for any of it.

I blame the playbook.

The “modern” B2B marketing playbook.

You know…the one almost every tech company is still running in 2026, which created the exact conditions that make buyers almost impossible to reach.

And the companies doubling down on it are not going to be able to outspend their way out of the hole it dug.

Let me explain what I mean.

“AI-Powered” Everything Trained Buyers to Ignore You

There is more vendor content in the world right now than at any point in the history of B2B marketing.

More emails. More LinkedIn posts. More “thought leadership,” workflows, sequences, aliases.

More AI-generated everything - technically correct, strategically assembled, efficiently produced, and yet, pigeoneholding our industry into a dangerous, disconnected, and emotionally empty world.

Interestingly, marketers notice this problem. But what concerns me most is that we, as an industry and as people, have made peace with it.

We acknowledged that buyers were tuning out and then we decided the answer was volume of more AI-generated “slop” as they call it.

If the message and format isn’t resonating and converting, send it to more people more often.

“Optimize” the subject line.

Add another touchpoint to the sequence.

Create more talking heads with fancy captions and AI effects.

The machine got more efficient. The results got worse.

And somewhere along the way, the industry accepted that declining engagement was a targeting and algorithm problem rather than a trust problem.

It was never a targeting or algorithm problem, my friends.

What actually happened is that buyers became immune to the shitstorm of mediocracy.

I’ve talked about this relentlessly for years - in the podcast episodes, in the live streams with WTF DId I Just Read? Tech Sales and Marketing Edition, in the LinkedIn posts, the conference talks, the conversations behind closed doors with buyers.

Buyers have developed filters that trigger before conscious thought.

Why? Because we have treated them as targets before humans.

And when someone is treated as a target, their natural response is to protect themselves and block that shit out.

The response most companies had to this was to produce more touchpoints, sequences, cheesy or flashy ads, at higher volume.

The logic was: if the message isn’t getting through, send it more times to more people.

You’ve heard of the spray and pray phenomenon. Not phenomenal at all, actually. It’s just on steroids now.

That logic made the problem worse.

Every additional piece of AI-powered-whatever-you-want-to-call-it that ends up in a buyer’s ecosystem is one more data point training them to ignore the next one.

The more you push in front of them, the better they get at filtering it.

The better they get at filtering it, the less anything resonates.

The less anything resonates, the more you send.

This is the vicious loop we are dealing with.

And too many B2B tech companies are doubling down on it while doing more of the same, every year.

Subscribe now

Dashboard-Driven Decisions Are Disconnected from Human Context by Design

The metrics that B2B marketing teams are measured on have never been good proxies for trust.

Badge scans. MQLs. Open rates. Click-through rates. Impression counts. Video views.

These metrics tell you who took an action. They tell you nothing about whether that person trusts you, remembers you, or will ever buy from you.

For a long time, that was fine. The market was less crowded. A click meant something. A badge scan turned into a conversation.

The metrics were imperfect but they pointed toward revenue often enough that nobody questioned them too hard.

That is no longer true.

Today, the dashboard can look fine and the pipeline can look bleak. Both things are often true at the same time for too many of my peers.

A buyer clicks your email (if you’re lucky) and forgets you by the end of the day. They attend your webinar with it open in a background tab.

You forcibely scan their badge at your conference booth and they automatically mentally file you under vendors they will never engage with post-conference.

Every one of those interactions registers as a positive metric. None of them produced trust with that human.

The problem is seemingly invisible inside the organization because the tools companies use to measure marketing were never designed to measure trust.

And I say seemingly because deep down inside, most stakeholders in the organization know this is an issue.

Anyway, those tools you use for measuring performance were designed to measure activity…or…noise. Some call it signal.

Activity is not the same thing as progress.

The buyers I interview describe feeling like data points. Like the destination of a sequence rather than the subject of genuine curiosity.

They say vendors know their tech stack, their budget cycle, their title and nothing about who they actually are.

I have sat in enough buyer interviews to know this is not a fringe perspective.

It is the majority view. The gap between what dashboards measure and what buyers actually experience is where the trust deficit lives.

Subscribe now

Borrowed Reach Has an Expiration Date

B2B tech companies solve their distribution problem by borrowing someone else’s audience.

They sponsor a conference and reach the attendees.

They buy a media placement and reach the subscribers.

They run ads against a platform’s targeting and reach whoever the algorithm decides to serve.

The numbers look real. The reach is real.

The relationship between the brand, or more importantly, the people that represent the brand, and that audience, however, is not.

This is called renting an audience and it has one defining characteristic:

It resets to zero the moment you stop paying.

The audience never belonged to the vendor.

The trust that might have started forming in that borrowed space evaporates when the context that created it disappears.

They are building audiences that follow because they want to, communities that share because the content earns it, relationships that exist independently of any platform or paid placement.

These assets do not reset. They compound. Each piece of content, each genuine interaction, each episode builds on the last.

The vendors I watch who are actually winning are not renting attention, they are building something that accumulates and using organic distribution as R&D before they spend any other dollar on distribution.

They thoughtfully uild audiences that follow them because they want to.

Communities that share because the content deserves to be shared in trust ecosystems.

Relationships that exist independent of any platform, paid placement, or transaction.

Those assets do not reset when the campaign ends. They compound.

Each piece of content, each genuine interaction, each episode builds on the last.

Subscribe now

Storytelling Void of Vulnerability Activates Skepticism

This pattern of borrowed reach producing borrowed attention creates a third consequence that most companies are not connecting back to its source.

The storytelling in most B2B tech marketing is technically competent.

It follows the frameworks we, as marketers, are taught - problem, solution, proof.

Create the customer story with the challenge and the outcome.

Share thought leadership with the pragmatic, key takeaways.

It is assembled correctly but does it really persuade anyone to deeply engage?

I’ve found that IT buyers are not moved by competence.

They are moved by the truth and vulnerability.

And the truth in most vendor storytelling is that it was produced at a distance from the people it is supposed to be about.

The case study with the customer name redacted.

The persona-based messaging that describes a version of the buyer’s reality that is accurate at the category level and wrong at every specific level that matters.

The “human-centric” content written by someone who has never had an unstructured conversation with a CISO about what their actual day feels like.

Nuance matters.

Buyers sense this distance and see the lack of nuance immediately and not always consciously.

It is not that they analyze the content and conclude it is inauthentic; rather, that emotionally thin storytelling produces the feeling of being spoken at rather than spoken to.

That feeling activates skepticism rather than trust.

What happens then is the buyer’s guard goes up.

And because of that, the vendor spends more money to make their next conversation happen, if it will happen at all.

Sadly, this is simply the predictable outcome of a model that optimizes for production volume over human connection and vulnerability.

Subscribe now

The Economic Cost of Buyer Distrust

All of this - the skepticism, the filtering, the emotional distance, the borrowed reach that resets to zero - has a direct economic consequence that is rarely framed as a trust problem even though that is exactly what it is.

Cold outbound stays ice cold. No trust means no reply. SDRs burn hours on outreach to people who have already tuned out the entire category, not just the company.

Late-stage deals stall. Buyers add stakeholders, create diligence steps that were not in the original evaluation criteria, and slow the timeline down. The pipeline inflates. Revenue flatlines.

Brand resets to zero. Campaigns end. Events wrap. Without trust built into the relationship independent of any single activation, everything starts from scratch.

CAC keeps rising. Paid channels get noisier and more expensive. Without earned trust generating organic demand, the treadmill only speeds up. There is no leverage in a model with no compounding component.

Pipeline becomes paid-dependent. No organic demand means no resilience. The forecast lives and dies on ad spend rather than buyer affinity and the moment the spend stops, so does growth.

Trust is not a brand metric. It is a revenue multiplier.

The companies that understand this are not asking how to get more impressions or more MQLs.

They are asking how to build something that makes the conversations they do get matter more.

That is a fundamentally different question and it leads somewhere fundamentally different.

Subscribe now

Everyone Sounds, Looks, and FEELS the Same and That Is the Problem

Underneath all of the above is a market dynamic that ties every other problem together.

When every vendor in a category is using the same messaging framework, running the same conference playbook, producing the same demand gen motion, the buyer cannot tell them apart.

The logos are different. Everything else is functionally identical.

Differentiation has collapsed, which has forced buyers even further to more predictable ways to make decisions - with their friends and colleagues in trusted ecosystems.

They make decisions based on who they already know. Based on a peer who told them about a vendor.

Based on the conversation that happened two years ago in a setting that had nothing to do with a marketing campaign or sales cycle.

The peer referral wins every time.

The trusted voice in a Slack community wins every time.

The vendor who had a genuine, unhurried, human conversation with a CISO at a conference two years ago - not at a booth, not in a scheduled thirty-minute meeting, but in the kind of moment that actually forms a memory - wins every time.

This is the market signal most B2B tech companies are misreading as a distribution problem.

They think they need more reach.

What they actually need is more trust.

And reach, purchased at scale, in a market where every competitor is competing for attention, produces nothing that compounds.

This is the problem.

All of it - the skepticism, the disengagement, the fractured attention, the rising cost of acquisition - traces back to the same root.

A model optimized for metrics that are easy to count and poor predictors of whether a human being will ever genuinely trust you and collaborate with you.

I know this model.

I built parts of it.

And I have spent years learning from the buyers we are all trying to reach - what they actually need from us.

The next post is about what that looks like in practice and why the window to get there before your competitors is still open.

Stay tuned.

Ready to amplify buyer trust at scale?

Deals close faster with trust. Buyers trust their peers above everything else. So we put them on camera with you, in experiences so human, the relationship that’s built can’t be manufactured any other way.

Book a call with me

I’m sitting at my desk right now doing some light meditation to prepare my soul for RSA Conference.

(Don’t judge me.)

Two weeks, people. Two weeks.

To every person showing up to RSAC (and the team behind the keyboard who aren’t going but juggling logistics remotely) and pulling off the impossible feat of managing a tradeshow of that scale, I genuinely don’t think you get enough credit.

The booth, the briefings, the coordinating seventeen different people across three time zones - it’s a lot.

I see you. I’m rooting for you.

And to everyone attending - Godspeed.

Between the badge hunts, the sad hamburger sliders, and the full-contact sport of finding somewhere to sit down for five minutes - RSAC is a lot.

It’s beautiful chaos. And somehow, every year, we do it anyway.

So here’s my contribution to making it slightly less chaotic for you.

I’m holding Open Office Hours at the W Hotel Lobby Bar. This is an open door to real conversation.

If you’ve been in my world for a while - if you’ve listened to the podcast, read the newsletter, been part of the research - this is your invitation to come say hi in person and actually talk.

Meet Me at RSAC

What Open Office Hours at RSAC Actually Means

Come with your real questions. Leave with clarity. Or just chill with me.

Here’s what I’m happy to dig into with you:

• Why experiential marketing is the only thing cutting through the noise right now and why most vendors are doing it wrong

• What it actually takes to create an experience that makes a CISO stop, stay, and remember you

• How to turn a single in-person moment into months of content that builds pipeline

• Why your buyers don't trust you and how experiential flips that dynamic completely

• How to build a case internally for experiential when your CMO is still asking for MQLs

• How to use your voice to build influence without becoming a vendor mouthpiece
  

• How to turn RSAC into momentum that lives for months after the conference floor clears

I've spent 15+ years in tech.

I have relationships with thousands of CISOs and security leaders.

I've done the research.

I've sat in the rooms.

I know what buyers think about you and I'll tell you the goddamn truth.

Come with your real questions.

Meet Me at RSAC

But Here’s the Bigger Thing I’m Doing at RSAC and Why I Want You In It

I’m bringing a camera to RSA.

I’m conducting an on-camera research study capturing the deepest, most unfiltered perspectives on the state of cybersecurity go-to-market straight from the people living it:

Marketers, vendors, founders, practitioners, and buyers.

This isn’t a podcast interview. It isn’t a testimonial. It isn’t a sponsored segment.

It’s primary research - raw, on-record, unscripted - that will become part of a published study on the state of experiential marketing in cybersecurity.

Your voice, your perspective, your name attached to something that actually matters in this industry.

The questions we’ll explore together:

• Why the trust gap between vendors and buyers keeps widening and who’s actually responsible for closing it

• What it really takes to break through to a CISO who’s seen every pitch, heard every claim, and stopped trusting marketing years ago

• The gap between what vendors think buyers care about and what buyers actually lose sleep over

• What good GTM looks like in a market where everyone sounds the same, budgets are tighter, and scrutiny is higher than ever

• Why experiential marketing is becoming the only credible path to building buyer trust and what it takes to get it right

If you have something real to say - if you’ve felt the frustration, seen what works, or have a perspective the industry needs to hear - I want you in front of my camera.

Camera slots are limited. First come, first served.

Meet Me at RSAC

Have a Badass Booth at RSAC? I Want to Come Cover It.

Here’s something I don’t see enough of at RSA:

Vendors actually capturing what’s happening at their booth - the real conversations, the buyer reactions, the moments that make people stop and engage.

If you’re creating a unique experience for buyers at your booth - an activation, a live demo, something that actually puts the human element front and center - ping me.

I’ll come to you.

I’ll capture it on camera.

We’ll get the raw, unscripted reactions.

We’ll document what it actually feels like to be on the receiving end of what you built.

This is what experiential marketing is supposed to look like and it’s exactly what I do.

Slots are extremely limited.

If this is interesting to you, reply to this email now so we can figure out timing before the week gets away from us.

Here’s What to Do Next

📍 March 24th. W Hotel Lobby Bar. San Francisco.

Lock in a specific time for office hours or grab a camera slot

Or just show up. I’ll be there, and my door is open

This is what I believe in - human proximity, real conversations, no BS.

Come bring yours.

See you there,

🔥Dani

I’ve spent 15 years in B2B tech marketing.

I’ve had thousands of structure and sem-structured conversations with CISOs and security leaders leading primary research for security companies.

I’ve watched tech vendors pour hundreds of millions of dollars into conference floors that buyers navigate around on their way to the hallway conversations they actually came for.

And I have a hypothesis I’m about to go test in public.

Experiential marketing does not exist in cybersecurity. Not really. Not yet.

I’m going to RSA Conference 2026 to find out if I’m right and I’m inviting you to prove me wrong.

If you want to meet me at RSA Conference, book some time with me here.

What I Mean When I Say Experiential Marketing Doesn’t Exist Here

Before you send me a photo of your themed booth activation, let me be specific about what I mean.

A branded dinner is not experiential marketing.

An open bar at a side venue is not experiential marketing.

Prancing ninjas in the streets of San Francisco - definitely not experiential marketing.

Those things are hospitality.

And in the ninja case (IYKYK) - very poorly executed “branded entertainment.”

There is nothing wrong with hospitality.

Hospitality is just not the thing I’m talking about.

Experiential marketing is the deliberate engineering of conditions where a buyer experiences something unexpected and permanently attaches that feeling to your brand.

It requires five things, based on every conversation I’ve had with buyers about the vendor interactions that actually moved them:

The experience was unexpected - they couldn’t have predicted it from your marketing.

It was personal - it required knowing something specific about them as a human being, not a buying signal.

It was participatory - they were a co-creator, not an audience.

The vendor’s presence was felt but not performed - the brand enabled something real and then got out of the way.

And it was slightly uncomfortable - just enough to push them briefly outside their professional identity so their human identity could show up.

That combination is almost entirely absent from RSA Conference.

From Black Hat.

From every major cybersecurity conference.

From tech brands DNA altogether.

I think.

Which is exactly why I’m going to evaluate this in public.

My Hypothesis and Why I’m Testing It In Public

Here is the thing I believe to be true, built from 15 years of watching this industry spend money on things that don’t work:

The percentage of buyers who can name a single genuinely extraordinary vendor experience from a cybersecurity conference is vanishingly small.

I do believe vendors care about experiences. And I do believe we are able to impress even the most skeptical IT buyers.

However, the very system that funds conference marketing rewards badge scans and booth traffic - outcomes that are easy to count and terrible predictors of whether a deal ever closes.

The experiential alternative doesn’t fit that measurement system.

So it doesn’t get funded.

So it doesn’t happen.

So the blue ocean sits empty while cybersecurity vendors collectively spend hundreds of millions of dollars fighting over the same shrinking puddle.

That absence, if the data confirms it, is an unclaimed category.

And whoever enters it first, before the model becomes obvious enough that every competitor follows, owns territory that doesn’t yet have a name in this industry.

I’m going to RSA Conference to find out how empty that territory actually is.

And I’m going with a methodology, a camera, and the deepest curiosity and conviction I’ve had in a hot minute.

This research will become a report:

State of B2B Experiential Marketing: RSA Conference Edition.

Or a better name once I hit the ground analyzing.

But first, I need the data. And the data needs to be challenged.

Here’s Where You Come In

I am not going to RSA as a vendor. I’m not running a booth. I’m not hosting a dinner.

I’m going as a field researcher with a hypothesis, a mic, and an open mind.

I’ll be in the places where people tell the brutal truth - bars, hallways, outside restaurants, the Expo - including Early Stage Expo, and, importantly, anywhere that isn’t a booth.

Three-minute conversations. No leading questions. No rehearsed answers.

And I’m extending three invitations right now, before I get on a plane.

Invitation One: Challenge the hypothesis.

Tell me I’m wrong.

Tell me in the comments, in my DMs, in a reply to this article.

If experiential marketing exists at scale in cybersecurity and I’m missing it, I want to know.

I have been wrong before.

I will be wrong again.

I would genuinely rather find a thriving blue ocean than an empty one.

What is the most extraordinary thing a vendor has done for you at a conference - not the most expensive, not the most elaborate, but the most genuinely human and unexpected?

Tell me. I’m building the research framework right now and your answer will sharpen it.

Invitation Two: Contribute to the research.

If you’re going to be at RSA Conference 2026, I want three minutes of your time.

On camera. In whatever unstructured setting we end up in.

For buyers and practitioners: When was the last time a vendor made you feel something at a conference and what happened next?

For CMOs and field marketers: If your CEO told you tomorrow that you have the same budget but can’t spend it on a booth, what would you actually do with it?

For early stage founders: You’re watching the main floor from the outside. What do you see that the people inside can’t?

Find me. I’m not hard to spot. I’m the one without the A1ST hat on.

Or you can ping me here and I’ll find you.

Every conversation is on the record.

Every honest answer makes the research better.

And if you tell me something that challenges my hypothesis, I’ll say so publicly.

Invitation Three: Show me what you’re doing.

This one is directed specifically at cybersecurity vendors.

If you are doing something genuinely experiential at RSAC -something that meets the five criteria I described above, something that treats buyers as full human beings instead of badge-scan targets, I want to see it.

Show me. Prove it. Document it and tag me or reach out directly.

If it’s real, I will analyze it, write about it, and share it to everyone following this research and my community of cybersecurity practitioners.

You will be the exception that proves the rule.

The blue ocean spotter.

The case study that every CMO who reads this report points to and says that’s what we should be doing.

If it’s hospitality disguised up as experiential, I’ll say that too.

Not to embarrass you, but to sharpen the distinction that this entire industry needs.

The research is only as good as the evidence it encounters.

If you’re doing this right, I need to know about you.

What This Is Not

This is not a hit piece on the conference booth model.

The booth exists for reasons.

Defensive brand presence matters.

Some buyers do walk the floor.

This is not an argument that hospitality is worthless.

Dinners do build relationships, just buyers are sick and tired of them.

Happy hours create moments of genuine connection.

I’m not against any of it.

This is a question about whether cybersecurity vendors are leaving the most valuable category of conference marketing completely unclaimed and whether the buyers on that floor are experiencing anything that will make them remember a vendor’s name six months from now when the decision actually gets made.

I think the answer is:

Almost never. Almost no one. Almost nothing.

I want to be wrong.

The Research Lives Here

I’ll be publishing live from the RSA floor - from wherever the honest conversations are happening.

The full report drops post-conference.

If you want early access when it lands, get on the list my replying to this email and sayin - I want all the juicy details.

If you have something to say before I get on the plane, say it below.

The hypothesis is on the table. Come at it.

Related questions this research addresses:

What is experiential marketing in B2B cybersecurity?

The deliberate engineering of conditions where a security buyer experiences something unexpected at a conference or industry event and permanently attaches that feeling to a vendor brand - distinguished from hospitality by requiring genuine unexpectedness, buyer participation, and trust formation.

Is experiential marketing common at RSA Conference?

This is the hypothesis being tested. The working assumption, based on buyer conversations across 15 years in cybersecurity marketing, is that genuinely extraordinary vendor experiences are rare enough to constitute an unclaimed category - a blue ocean in a market that believes it is fully saturated.

How can vendors participate in the RSA experiential marketing research?

By finding Dani Woolf at RSA 2026 for a three-minute on-camera conversation, by documenting and sharing any genuinely experiential activations they’re running, or by engaging with the hypothesis in the comments of this article before the conference.

What is field marketing enablement™?

Field marketing enablement is the operational infrastructure of high-impact events - event intelligence, audience targeting, venue selection, account intelligence - that allows marketers to execute human experiences with precision rather than guesswork. The co-commissioner of this research, Delve Risk, has built the platform specifically for cybersecurity vendors who want to execute experiences that produce measurable relationship outcomes rather than badge counts.

It started with a hypothesis in 2020.

I was deep in running demand gen for a fast-growing cybersecurity company and kept watching the same thing happen over and over:

My peers in marketing teams producing more content, spending more budget, getting less response from the buyers they were trying to reach.

CISOs ignoring emails. Security leaders tuning out webinars. Vendors stuck in a loop of vanity metrics that felt performative and produced nothing to show for the programs.

Hell, this was MY reality too. And it was a painful one.

The problem wasn’t effort. It was proximity.

All this to say, I didn’t think the problem was effort.

I and my peers were really damn good at executing some cool (and sometimes uncool) marketing tactics.

But in that time, I had the opportunity to really think about what the real issue was.

The problem was proximity.

Not proximity in the physical sense, though that turned out to be a big part of it.

Proximity in the trust sense.

Buyers weren’t engaging with vendor content because they didn’t trust the voice behind it.

And the voice behind it had no empathy for the buyers they were trying to reach.

Buyers trusted their peers. They trusted shared experience. They trusted the kind of conversation that doesn’t happen on a Zoom call or a sponsored panel, but the one that happens when guards drop, when the transactional agenda disappears, and when two humans are just in a room together being themselves.

Fast forward one year later to the end of 2021 and I found myself getting “tased” by Chris Roberts - if you know, you know.

I had proven my exact hypothesis - no proximity to the buyer yields really stupid go-to-market decisions.

So I ran an experiment.

In March 2022, I launched Audience 1st Podcast.

And I did something most podcasters weren’t doing:

I recorded qualitative interviews with my buyers in videocast format to learn so deeply about their world and who they are - the result?

More empathy. More understanding. More opportunity to design shared experiences that would impact my demand gen goals.

But it didn’t stop there.

Still, my peers, despite their best efforts to resonate and connect with cybersecurity buyers, continued to piss them off with shady marketing tactics.

So, because I care for buyer experiences and the sustainability of my peers’ careers, I set out to bring vendors and buyers in the room to better understand each other - and distribute those experiences on Audience 1st Podcast.

I already knew the power of connection when you actively listen and engage with a human in authentic media - Audience 1st Podcast took off because of that.

But more importantly, I felt it and saw how it changed my life personally and professionally.

What the data kept telling me.

The podcast continued to take off. But what the data kept telling me about what happened after the recording was compelling.

My guests became clients.

The CISOs who joined me in the room with other vendors went on to evaluate their products and services after they’d met in the studio.

But what’s more magical, honestly, is seeing how human connection and relationships form.

It’s a privileged position to be in, especially when you’re the one who’s facilitated that magical moment.

I distinctly remember a specific experience from 2024 - the President of a large MSSP and a CISO I brought together in my Los Angeles studio went to lunch with me, we filmed an engaging session around a specific ransomware attack, and they left the studio unusually thrilled to have met.

I sat there thinking: this is it.

These in-person, shared media experiences are the thing.

In tandem, I kept testing throughout the years.

Buyer focus groups. Customer advisory programs.

Producing and distributing video to social networks years before video reels and short-form content became a B2B marketing conversation.

Putting vendors in rooms with CISOs and watching what happened when the formal part ended and the real conversation began.

Every single time, the same pattern emerged:

The empathy, trust, and credibility didn’t come from the content.

It came from the experience that produced the content.

The content was just how we scaled what had already happened in the room.

That was the proof of concept.

And it was all happening at Audience 1st, quietly, before anyone was calling it anything.

Then I spent a year following every signal but the most important one until now.

Between 2024 and 2025, I tried a lot of things outside of what I’d already proven.

I created academies.

Digital courses.

I co-founded a buyer research platform to productize everything I’ve learned in facilitating qualitative interviews and focus groups for Audience 1st clients.

I conceptualized, designed, hosted, and co-produced a cooking show.

I followed the signals in front of me.

I followed my curiosity and gut.

And I followed what I thought the market needed at different moments.

Some of it worked. Most of it didn’t. All of it was wildly instructive.

And every single time, no matter how far I traveled from the original idea, I kept coming back to the same thing.

The room. The real experience.

The trust that forms when you stop performing and just show up as humans.

It was like a compass. Every detour eventually pointed back north.

I now have five years of evidence for something I only had a hypothesis about in 2020.

And that changes everything about how I move forward.

Here’s what five years of evidence forces me to say.

People talk a big ass game about building trust in this space.

It’s in everyone’s mission statement, everyone’s pitch deck, everyone’s bio. Slapped on websites “trusted by…” and plastered around LinkedIn posts.

But there are little to no receipts from many of those people to prove their credibility among cybersecurity buyers and GTM pros.

Trust isn’t a content strategy.

It’s not a campaign.

It’s not something you manufacture with the right messaging framework or the right distribution play.

Trust is what happens when you become so obsessively curious and empathetic toward people you genuinely care about.

It’s what happens when someone has a real, authentic, and sometimes, vulnerable experience with you.

Or with someone who vouches for you from their own real experience. It compounds slowly and it’s almost impossible to fake at scale.

The only shortcut to trust and credibility I’ve ever found is real human proximity.

Put the right people in a room who have the right intentions.

Design an engaging experience worth having.

Let the camera catch what’s real.

Then distribute that reality to everyone who wasn’t there so they feel it too.

That’s it. That’s the whole model. It took me four years of creating at Audience 1st to say it that simply.

So here’s where I am now.

I’ve done the hard work.

I’ve watched this move some mountains in cybersecurity, with the most skeptical, hardest-to-reach buyers in any industry, across four years, 60+ IRL experiences, and over 200 video shows produced.

And I am going all-in on it. Nothing else.

Human proximity. Buyer-led experiences. Social shows built with the people you’re trying to reach, not about them.

On camera, in experiences so human that the trust built cannot be manufactured any other way.

That’s Audience 1st.

That’s what it has always been.

And I have never had more conviction that this is the way for our space to thrive.

I am open for business. And this year, I’m going hard.

If you’ve been watching, wondering whether to reach out, and have been craving to work closely with me, this is your sign.

I work with cybersecurity companies who are done throwing budgets at bland content that doesn’t convert.

Who want to build real trust with buyers before a sales call ever happens.

Who understand that the most powerful voice in any deal isn’t theirs - it’s their buyer’s.

I invite and give your buyers unique, engaging experiences designed to make them forget the camera’s rolling.

And then I help you scale what happened in that room to everyone who wasn’t there.

If you’ve read this far, you already know I don’t believe in cold pitches.

Neither do you, probably.

So let’s just talk - the way this whole thing started.

Human to human.

Let’s go.

🔥Dani

We wreck hackers. A purpose-built platform for organizations like yours, all backed and operated by our industry-proven, 24/7 AI-assisted SOC for continuous threat protection.

Enterprise-grade cybersecurity for ALL businesses.

Learn More

When John Hammond sat down with me to record his episode of Audience 1st Podcast, he squirmed in his chair the moment the word “influencer” came up.

That single, involuntary reaction told me more about the state of cybersecurity marketing than most panel discussions I’ve attended this year.

Here’s a guy with a massive YouTube following (2.12 million followers), a principal security researcher title at one of the fastest-growing security companies in the space (Huntress), and genuine credibility with practitioners - and the label that best describes his public reach makes him physically uncomfortable.

That discomfort is a data point. And it’s the first of many from this conversation that I think the industry needs to sit with rather than scroll past.

I’m pulling the threads here - the insights that surfaced between the lines, the places where what John said carries weight far beyond the immediate topic, and a few spots where I think the reality is sharper than he took it.

The People Who Move the Needle on Security Education Never Planned To

John didn’t set out to become a cybersecurity content creator.

He said it himself - he “accidentally fell into” the influencer thing.

And yet he has built one of the most genuinely useful educational presences in the space on YouTube, producing hours-long deep dives into how adversaries actually operate, walking through exploits in real time, and doing so with an energy that doesn’t feel manufactured.

This matters because the cybersecurity industry has a chronic education problem that it keeps trying to solve with the wrong playbook.

We throw money at stuffy awareness training modules.

We build slick e-learning platforms.

We hire content marketers to produce thought leadership content that reads like it was written by committee that hasn’t lived the pain.

And then someone like John Hammond sits in front of a camera, cracks open some malware, and gets more genuine engagement and retention than any of those initiatives ever will.

If 2.1 million subscribers is any indication…

The pattern I keep seeing is that the people who move the needle on security education are almost never the ones who planned to.

They’re security researchers who started sharing because they were deeply curious and excited, practitioners who couldn’t stop teaching because it’s how they process what they learn.

This should make every cybersecurity vendor rethink how they approach “thought leadership.”

Authenticity in this space isn’t a nice-to-have differentiator. It’s the only currency that compounds.

The Cybersecurity Industry’s Business Model Depends on Never Catching Up, Sadly

John shared a metaphor from one of his keynotes: the cybersecurity industry is on a treadmill and he’s not sure we’re going to get off.

I could tell he said it with what felt like genuine concern, almost an apology for souring the conversation.

But I want to lean into the discomfort of what he’s describing because I think he’s underselling the severity of it.

The innovation cycle in technology broadly and cybersecurity specifically, has created a compounding debt problem.

We have built and deployed so much infrastructure, so many applications, so many interconnected systems, that the attack surface isn’t just expanding.

It’s expanding faster than our collective ability to secure it.

A meaningful chunk of the cybersecurity industry’s business model depends on this treadmill never stopping.

If organizations actually got ahead of the problem, if the attack surface stabilized, if we reached some equilibrium, the demand for new tools, new platforms, new solutions would contract.

I’m not saying that to be cynical.

I’m saying it because the incentive structure matters when we’re trying to understand why we can’t seem to catch up.

Are we building to solve or are we building to sustain?

That’s a question the industry owes itself an honest answer to and I don’t think it’s getting one at most tradeshow booths, private dinner conversations, or virtual interactions with cybersecurity buyers.

Subscribe now

The Cybersecurity Companies Honest About Not Knowing Where AI Fits Are the Ones Worth Trusting

When John talked about Huntress’s security operations center, the thing that struck me was the philosophical conviction underneath their solutions.

Huntress runs a human-led SOC. Not human-assisted, not AI-augmented-with-humans-in-the-loop. Human-led.

Analysts following the sun across Australia, the UK, and the US, making the actual decisions about what constitutes a real threat and what doesn’t.

The tension he was honest about:

They’re still trying to figure out where AI fits.

They haven’t just bolted on an LLM and called it innovation.

They’re asking whether it helps or hurts and they’re doing slowly and deliberately because they don’t want to sacrifice what they believe is their actual competitive advantage - human judgment.

I want to push back on the industry’s AI-in-the-SOC narrative a bit here, because I think the conversation has gotten dangerously binary.

You’re either an “AI-first SOC” or you’re a dinosaur.

That framing is convenient for the companies selling AI-first SOC solutions, but it’s not honest about what’s actually happening on the ground.

The adversaries John chases every day are creative.

They are contextual. They exploit the gaps between what’s on the checklist and what’s actually happening.

Those are exactly the gaps that a pattern-matching model, no matter how sophisticated, is architecturally ill-suited to catch.

John said he’d bet on the human-powered SOC every time.

And when I asked why, his answer was about creativity, critical thinking, and the ability to look under rocks that nobody thought to include in the training data.

The Security Awareness Gap Isn’t Informational. It’s Motivational.

John said, about the disconnect between security awareness and actual behavior: “I’ll be the first to admit, this [cybersecurity] stuff’s hard.”

He wasn’t talking about the technology. He was talking about getting human beings to care enough, understand enough, and retain enough to actually change their behavior when it matters.

And he acknowledged that his own educational content - hour-long, two-hour-long deep dives into exploit chains - asks a lot of people’s attention spans.

We keep building content, tools, and platforms that assume the end user wants to learn about security.

Most of them don’t. They want to do their job, go home, and not think about whether that email was a phishing attempt.

The gap is not informational. The information exists. John has literally made it free and accessible on YouTube.

The gap is motivational and cognitive. People don’t retain what they don’t find relevant to their immediate lives.

And most security training is built around what the security team thinks is important rather than what the user actually cares about.

The bridge is relatability.

His Log4Shell-through-Minecraft example - showing kids that the video game they love could be compromised - is a masterclass in meeting people where they are instead of where you wish they were.

But the industry at large hasn’t internalized this.

We’re still building security awareness programs that talk at people instead of talking about what they already care about.

Your Checklist is a Ceiling on Curiosity Disguised as a Safety Net

When I asked John where defenders and red teamers are missing the mark, he went straight to the checklist mentality.

Checklists and procedures have their place, but the real discoveries happen when someone is creative enough, curious enough, to say “hang on, there’s something under this rock that isn’t on the list.”

This is not a new critique. But I think the implications are deeper than how it’s usually framed.

The checklist exists because organizations need scalability, repeatability, and legal cover.

You can point to the checklist in an audit. You can demonstrate that you followed the procedure. In a compliance-driven industry, that matters enormously.

But the checklist also functions as a ceiling on curiosity.

Once everything on the list is checked, there’s enormous organizational pressure to declare the work done.

The analyst who says “I know the checklist is clear, but something feels off and I want to spend another four hours digging” is fighting against the incentive structure, the burnout, and the ticket queue.

This is a cultural problem disguised as a process problem. And the companies that solve it won’t do so by writing better checklists.

They’ll do it by creating environments where following a hunch is rewarded even when it doesn’t produce a finding, and where curiosity is treated as a core job competency rather than a nice personality trait.

John was tactful about this, but I don’t mind being more direct:

If your security team only does what’s on the checklist, you are paying for the illusion of security while leaving the creative attack paths wide open.

Subscribe now

The Cybersecurity Industry Celebrates Collaboration at the Bar and Kills It in the Quarterly Strategy Meeting

When John talked about what excites him most about cybersecurity events, he didn’t mention a product launch or a technical breakthrough. He talked about the “family reunion” of it - seeing people, celebrating their successes, feeling part of a community.

And then he said something that I want the community to really hear:

“There’s this stigma, you gotta compete against each other, but at the end of the day, there’s a core mission. We’re all in this together.”

He’s right. And yet…the gap between the collaboration rhetoric and the collaboration reality in cybersecurity is enormous.

Yes, there are ISACs and threat intelligence sharing agreements and joint advisories.

Those are real and valuable.

But at the company level, the incentive structures work overwhelmingly against meaningful collaboration.

Sales teams are measured on competitive displacements.

Marketing teams build battle cards designed to undermine specific competitors.

Product roadmaps are closely guarded secrets.

And the default posture at most industry events is strategic friendliness that stops well short of genuine openness.

I hear John’s sincerity and I share his ideal.

But I also think the industry needs to be more honest about why collaboration is hard.

It’s hard because the business model of most cybersecurity companies depends on winning market share from other cybersecurity companies.

The mission is shared. The economics are zero-sum. And until the incentive structures change, the collaboration will remain mostly atmospheric - warm and genuine at the conference bar and largely absent in the quarterly strategy meeting.

The companies that figure out how to make collaboration a genuine competitive advantage - not just a talking point - will be the ones worth watching.

We Mythologize the All-Nighter and Then Wonder Why People Leave the Cybersecurity Field

The most human moment in the entire conversation came when John pivoted from talking about passion and curiosity to talking about burnout, work-life balance, and the reality of pouring yourself into security work.

He described the arc almost everyone in this industry goes through:

You start obsessed, staying up late, cracking code, chasing problems because you genuinely can’t stop.

And then, gradually, the weight of it catches up. You want to be with family. You want to be with friends.

The passion doesn’t disappear, but the capacity to sustain that intensity does.

I appreciated that he brought this up because the cybersecurity industry has a burnout problem that it loves to acknowledge in keynote speeches and promptly ignore in its operational expectations.

We celebrate the all-nighters. We mythologize the security analysts who “never sleep.”

We build cultures that reward unsustainable output and then express surprise when people leave the field entirely.

John’s advice to junior folks - “be a sponge, learn as much as you can, be present” - is solid.

But I want to add something to it that the industry doesn’t say often enough:

Being a sponge is a season, not a lifestyle.

And the organizations that treat it as a permanent expectation are the ones hemorrhaging talent.

If there’s anything I learned in the thousands of conversations I’ve had with security leaders, it’s that the retention crisis in cybersecurity is a sustainability problem.

Subscribe now

You Can Copy a Product Roadmap but You Can’t Copy a Self-Selecting Talent Pool

When I asked John to describe Huntress in three words, he gave me an internal mantra:

“Ethical badasses.”

He also added “team players” and talked about the collective mission.

Now, I’ve heard plenty of company mantras.

But I want to take this one at face value for a moment, because I think it reveals something about how Huntress thinks about culture as a competitive weapon.

“Ethical badasses” is an identity statement, not a values statement.

It doesn’t tell you what the company believes.

It tells you who the company hires. And that’s a much more powerful filter.

Side note: did you know that cybersecurity buyers actually evaluate who the cybersecurity vendor hires and how many employees they have? This is an actual decision criterion.

When your internal identity is that specific, it creates a self-selection mechanism.

People who resonate with it apply. People who don’t, don’t. And over time, that creates a cultural density that’s very hard for competitors to replicate, because you can copy a product roadmap but you can’t copy a self-selecting talent pool.

The question for Huntress, as it scales from 28 employees to 600 and beyond, is whether that identity can survive the growth.

Culture is easy to maintain when everyone fits in the same room.

It’s enormously hard to maintain when you’re hiring at scale, expanding internationally, and managing the inevitable dilution that comes with rapid growth.

The Signal Is in the Squirm

The through-line of this entire conversation with John Hammond is acceptable discomfort.

That discomfort is signal.

It tells me that the people closest to the actual work of cybersecurity - the researchers, the analysts, the threat hunters - are navigating tensions that the marketing layers above them are eager to flatten into clean narratives.

AI good or bad? Clean answer, please. Human vs. machine SOC? Pick a side. Collaboration or competition? Both, somehow, simultaneously.

The truth, as John kept circling back to, is messier than any of that. The humans matter more than the tools, but the humans are burning out.

The research advances the field, but also arms the adversaries. The passion is real, but it has a shelf life.

John Hammond squares his meals. He chases hackers and wrecks them.

And when I asked him the hard questions, he didn’t have all the answers.

He sat in the discomfort. That’s the person I want making decisions when the checklist runs out.

Take Control of Vendor Risk Across Your Supply Chain

SecurityScorecard helps TPRM and SOC teams detect, prioritize, and remediate vendor risk across their entire supplier ecosystem at scale.

Learn More

Aleksandr Yampolskiy was doing everything right. He had the tools, the budget, the processes - the full security stack humming along at the e-commerce company where he served as CISO.

Then one routine vendor integration blew the whole thing open. Unencrypted credit card data from other customers, just sitting there, inside a platform that had been rubber-stamped by a Big Four firm.

In that moment, he realized something most security leaders spend their careers trying not to think about: you can do everything right and still lose your job because someone else didn’t.

That scar became SecurityScorecard.

But here’s where the story gets interesting. When Aleksandr, or AY - as he introduced himself when joining me in my studio, started telling people in 2013 that he wanted to quantify cyber risk the same way credit scores quantify financial risk, nobody was excited.

The reactions ranged from “that’s impossible” to a polite shrug. Most founders would have taken that as a signal to pivot. Alex took it as proof he was early enough to matter.

In this episode, we go deep into what this man’s journey reveals - the stuff that founders miss, that GTM teams overlook, that VCs undervalue, and that practitioners forget when the daily grind takes over.

I’m pulling on the threads - the moments in the conversation where something real surfaced, the places where what AY said carries implications far beyond the immediate topic, and a couple of spots where I think the truth runs even deeper than he took it.

Lukewarm Reactions Are the Best Market Signal You’ll Ever Get

In 2013, when Aleksandr started telling people he wanted to create a way to quantify cyber risk the way credit scores quantify financial risk, the responses he got fell into three buckets.

1. People said it was impossible.

2. Or they said they already handled it with pen-and-paper questionnaires.

3. Or they pointed to point-in-time vulnerability scans and shrugged.

Bottom line: Nobody was excited. And nobody said, “Yes, finally!”

And that’s exactly what told him he was onto something.

His logic was simple and, I think, brilliant:

If the idea were obvious to everyone, it would mean someone else had already built it.

The lukewarm response was evidence of a gap, not a dead end.

He said it plainly - when people tell him something can’t be done, that’s what motivates him to prove them wrong.

I want to linger on this because it runs completely counter to how most founders and GTM leaders think about validation.

We’re conditioned to chase the enthusiastic “take my money” response.

We treat excitement as signal and skepticism as noise.

But AY is saying something more honest and grounded:

Genuinely new ideas don’t get standing ovations at the concept stage.

They get raised eyebrows. They get polite confusion. The market cannot demand what it doesn’t know is possible.

The implication for founders and creators is uncomfortable but important.

The next insanely successful and innovative company might be sitting in your deal flow right now, getting a “pass” because the category doesn’t cleanly map to an existing market and the “buyer persona” is hard to define.

The founders worth betting on are often the ones hearing “interesting, but I’m not sure” - as long as they also carry the wound from hard-learned lessons and the stubborn refusal to let the idea die.

Your Most Dangerous Competitor Doesn’t Have a Website

The status quo is the most dangerous competition in the world.

For SecurityScorecard, it’s not BitSight, Panorays, or whoever else shows up on the competitive slide in the pitch deck.

The real thing they’re fighting is the spreadsheet.

The pen-and-paper questionnaire. The rubber stamp that lets a compliance team check a box and move on, even though nothing meaningful actually happened.

I hear it in almost every conversation I have with CISOs.

When I ask why they haven’t adopted a particular tool or approach, the answer is almost never that they went with a competitor.

It’s that they’re “fine with what they have.” Or it’s just not a priority.

The free, familiar, good-enough option is what you’re actually trying to unseat.

And here’s the thing that drives me crazy:

Most competitive battle cards don’t even acknowledge it. They’re built entirely around named competitors, as if the biggest threat to your deal has a logo and a sales team.

So here is where I want to be direct with the GTM community.

Stop building competitive positioning that only maps to other vendors.

Start building positioning that accounts for inertia.

Craft messaging that makes the status quo feel dangerous, because it is.

AY lived this. He discovered a vendor breach because nobody was actually verifying anything.

The questionnaire was a performance of diligence with no substance behind it.

Your buyers are living inside that same theater right now, and most of them know it, even if they won’t say it out loud.

Someone has to name it for them. That someone should be you.

Subscribe now

“I Love It, I’ll Buy It” Is the Most Expensive Lie in B2B Tech

Late 2013, AY talked to about twenty potential customers and described what he was building.

Every single one of them said some version of “I love this, if you build it I’ll buy it.”

So he went and spent six months building the technology. Poured everything into it. Then went back to those same twenty people, ready to close.

Every single one of them ghosted him. Zero revenue. Zero customers. Just six months of his life spent building something for an audience that had already moved on.

This is, in my view, the single most important lesson in this entire conversation. People are polite. Enterprise buyers especially.

They will tell you your idea is great because saying “I’m not sure” feels awkward and “that doesn’t solve my problem” feels rude.

A verbal “I’d buy that” costs them nothing to give and costs you everything to believe.

It is a social reflex masquerading as market validation and it has killed more startups than bad technology ever will.

I’ve watched this exact thing hurt founders building amazing products and services - hell, I’ve suffered from this as well.

What Alex learned, and this is the part I want people to really internalize, is that you have to change the questions.

Don’t ask someone if they’d buy your product.

Ask them how they do the job today.

Ask them what they hate about their current process.

Ask about their actual behavior, not their hypothetical intentions.

Intentions cost nothing. Behavior is where the truth lives.

This is the foundation of what we do at Audience 1st.

We don’t ask buyers whether they’d like your product.

We ask them how they operate, what frustrates them, how they actually make decisions, and what it would take for them to change.

The Best Ideas in Cybersecurity Will Come from Outside Cybersecurity

The intellectual origin of SecurityScorecard’s scoring model is not what you’d expect. It didn’t come from NIST. It didn’t come from ISO 27001. It came from a pediatrician named Dr. Virginia Apgar, who saved tens of thousands of newborn lives by inventing a ten-point scoring system that could be administered in under a minute.

Before Apgar, hospitals ran elaborate, time-consuming tests on newborns. Thorough tests that produce pages of data.

The problem was speed. By the time the results came back, some babies had already, unfortunately, died.

Apgar’s insight was almost offensively simple:

What if we traded precision for speed? What if we asked a handful of easy-to-observe questions - is the baby crying, is the complexion pink, is there muscle tone - and used those to make fast triage decisions?

It worked. It saved an enormous number of lives. And it went completely against the grain of what the medical establishment thought rigorous assessment looked like.

AY saw the parallel immediately.

Cybersecurity had its own version of the same problem: lengthy assessments, expensive audits, point-in-time vulnerability scans. All thorough. All slow. None of them giving you a useful answer fast enough to act on it.

So he asked the Apgar question:

What are the simple, observable signals that tell you whether a company is being diligent about security?

The copyright date on a website that hasn’t been updated in twenty years isn’t a vulnerability you can exploit, but it tells you something real about how seriously that organization takes its digital presence.

I am deeply convinced that the next wave of breakthrough cybersecurity companies will come from founders who are looking sideways - at healthcare, insurance, behavioral economics, supply chain logistics, even urban planning - rather than staring at the same MITRE ATT&CK framework everyone else already knows by heart.

AY calls it the beginner’s mindset.

I’d call it intellectual cross-pollination.

And the cybersecurity industry, for all its technical sophistication, is shockingly insular about where it sources its ideas.

If every reference on your bookshelf is a cybersecurity reference, you’re probably already a step behind someone who’s borrowing from a field you’ve never explored.

Subscribe now

You Don’t Out-Strategize Your Competitors. You Out-Fail Them.

I asked Aleksandr about the turning point - the moment SecurityScorecard started to scale.

He didn’t give me a single breakthrough story. No big contract, no viral moment, no lucky break.

What he gave me instead was a philosophy:

You have to out-fail your competitors.

Try ten things. Accept that most of them won’t work. Find the one that does. Double down. Repeat forever.

It sounds straightforward when you say it out loud.

It is brutally difficult to practice, because the organizational immune system in most companies is designed specifically to prevent failure.

Failure means wasted budget.

Failure means someone gets a hard conversation in their next review.

Failure means the board asks uncomfortable questions at the next meeting.

So what happens is that companies stop optimizing for winning and start optimizing for not-failing.

Those are entirely different games and the second one is how you become irrelevant.

Now, I do want to push back on this slightly, because I think it’s more nuanced than the way it sounds as a soundbite.

This philosophy is easy to champion as a founder.

AY is the CEO. He can decide to be okay with failure.

The harder question is whether the culture of experimentation survives contact with middle management.

Can the product manager safely kill a feature that isn’t working without someone second-guessing their judgment?

Can the SDR team try a completely different outbound approach without their manager panicking about weekly pipeline metrics?

In my experience, most companies preach experimentation at the all-hands and punish it in the spreadsheet or silde deck.

The failure tolerance has to go all the way down or it doesn’t go anywhere at all.

The Language Gap Is the Real Vulnerability Nobody’s Patching

After talking to thousands of security leaders, founders, and GTM pros in the cybersecurity space, this theme emerges time and again.

The industry keeps treating solving the language gap as a “nice to have” skill when it is, in fact, a strategic vulnerability.

If a CISO cannot translate technical risk into language that a CFO or a board member understands, they will be chronically under-resourced.

They will struggle to maintain executive sponsorship.

They will watch other priorities get funded while theirs gets pushed to next quarter.

And it won’t be because the board doesn’t care about security.

It’ll be because they genuinely don’t understand what the CISO is telling them.

The communication failure is the resource failure. They’re the same thing.

For vendors, this should reshape how you think about GTM entirely.

If your marketing materials, your sales decks, and your product messaging all speak the same technical jargon that the CISO is already struggling to translate for their stakeholders, you’re not helping them. You’re adding to their workload.

The vendor who helps a CISO tell their story to the board, who gives them the charts, the KPIs, the plain-language narratives they can walk into an executive meeting with, that vendor earns a kind of loyalty that feature comparisons never will.

The field has moved from technical superiority to communication enablement.

AI Is Not Making Security Practitioners Better. It’s Making Laziness Cheaper.

Having a car with a gas pedal means you don’t ride the bicycle and riding the bicycle is what keeps you fit.

Convenience has a cost and the cost is competence.

Let me be specific about what this looks like in cybersecurity right now, because the general statement deserves concrete grounding.

Junior analysts are using AI to triage alerts without ever developing the intuition to understand what they’re looking at.

People are prompting their way to incident reports who couldn’t walk you through the kill chain if you put them on the spot.

Meanwhile, the shadow AI problem Aleksandr raised is very real and very scary:

Employees across organizations are uploading sensitive financial data, strategy documents, even customer information into ChatGPT because it saves them twenty minutes.

Nobody authorized it. Nobody assessed the risk. It just happened and it’s happening everywhere.

On the attacker side, the picture is worse.

The sophistication floor has collapsed. AY talked about AI-powered offensive tools where you can type a plain-language prompt and generate exploit code that would have taken years of expertise to write manually a few years ago.

Deepfakes are reaching the point where you genuinely cannot tell the difference between a real human and a deepfake.

A sophisticated denial-of-service attack against a competitor can be launched for about a hundred dollars a day.

The asymmetry between attackers and defenders was already painful. AI is accelerating it.

Here is my honest take and I don’t think enough people are saying this clearly:

The industry is so drunk on the productivity narrative around AI that it is not having a sober conversation about what we are losing in the process.

Critical thinking. Foundational technical skills. The ability to reason through a problem without a model doing the heavy lifting.

AY made this tangible when he talked about his own teenagers - can they write in cursive? Can they compose a thought without a keyboard?

Look no further than OpenClaw. An open-source AI agent that went viral in a matter of weeks, racking up over 180,000 GitHub stars, while security researchers were discovering tens of thousands of exposed instances running without basic authentication, credentials stored in plaintext, and a skill marketplace that became a distribution channel for malware.

People gave this thing access to their email, their files, their messaging apps, their terminal because it was convenient. Because it saved them time. Sound familiar?

SecurityScorecard published research identifying over 40,000 exposed instances, with sixty-three percent of them vulnerable.

The very phenomenon he warned about in our conversation was playing out in real time while the episode was being produced.

AY and I are going to unpack the OpenClaw situation in detail in an upcoming episode, because it deserves its own conversation.

But for now, let it sit as proof that this is not a theoretical concern. The laziness tax is already being collected.

Subscribe now

Boards Are Adopting AI to Look Cool. CISOs Are Left Cleaning Up the Mess.

A lot of boards and CEOs are pushing AI adoption because they want to signal innovation to Wall Street. The stock gets a nice bump. The earnings call sounds forward-looking.

And then the CISO gets handed a mandate to somehow secure a technology that was adopted for optics, not because anyone thought through the operational implications.

I see this playing out in real time.

The C-suite announces an AI initiative. Some press happens. Investors feel good. And then behind the scenes, the CISO discovers a dozen shadow AI deployments already running in the organization, no governance framework in place, no additional budget allocated for security, and no clear documentation of what data is going where.

They are being asked to retroactively secure decisions they had no input on. It is an impossible position and it is remarkably common.

For founders building in the AI security space, this dynamic is your opening.

But the play is not what most people think. Do not just sell the CISO a better detection tool. Give them the framework and the language to push back on reckless AI adoption from the top.

The CISO who can walk into a board meeting and say “here is a quantified view of the risk our current AI posture creates, and here is what remediation looks like” is the CISO who keeps their seat at the table.

Give them that ammunition. Equip them to have the conversation that nobody else in the room wants to have. They will never forget you for it.

“Who Do You Want Your Customers to Become?” Is the Only GTM Question Worth Asking

For me, this was the most important moment in the entire conversation. AY referenced his company advisor at SecurityScorecard, Mike Schrage, who poses a question that I think should be written on the wall of every GTM room in the industry:

Who do you want your customers to become?

Not what does your product do. Not what problem does it solve.

Who does your customer become after they work with you?

Aleksandr illustrated this with two examples that reframed everything for me.

1. Facebook’s real innovation, he argued, was not building a social media platform. It was transforming introverts into people who compulsively overshare personal information for social validation.

2. Google’s real innovation was not building a better search algorithm. It was turning all of us into people who type half-formed questions into a box and trust whatever comes back. The product was the mechanism. The transformation was the business.

For SecurityScorecard, the aspiration is specific and ambitious:

Yhey want to turn their customers from passive report generators - people who send out vendor questionnaires, rubber-stamp compliance approvals, and pretend that process equals security - into proactive incident responders who use quantified risk as a shared language across the entire organization.

I want every GTM leader reading this to actually wrestle with this question instead of nodding along and moving on.

Who does your customer become?

The companies that win are the ones that change how their customers see themselves.

Features Don’t Close Deals. Feelings Do. And the Industry Still Doesn’t Get It.

Apple did not sell iPods by listing storage capacity and headphone jack specifications.

They sold the feeling of having your entire music library in your pocket.

They sold belonging to a movement.

That distinction, between what a product does and how it makes someone feel, is so fundamental to how humans make buying decisions that it’s almost embarrassing how badly the cybersecurity industry misses it.

Go look at the homepage of the average cybersecurity vendor right now.

Count how many times they mention a feeling, confidence, control, peace of mind, versus a feature.

Count how many times they talk about the person the customer becomes versus the technical capability of the product.

The ratio will be depressing. It is almost always specs, compliance badges, detection rates, and AI buzzwords.

The human being on the other side of that webpage, the one who has budget pressure and a board meeting next week and a team that’s burning out - that person is nowhere in the messaging.

CISOs are human beings who make purchasing decisions the same way every other human being makes purchasing decisions:

Through a messy, intuitive blend of logic, emotion, trust, and relationship.

The vendor who makes a CISO feel understood, supported, and more capable will beat the vendor with the marginally better detection engine every single time.

I’ve heard it time and again - sitting with security leaders in person. It literally is a decision criteria.

Word of mouth matters more than any analyst quadrant.

A case study from a peer they trust matters more than a product demo.

This is not sentimental thinking. This is how B2B actually works when you strip away the pretense.

AY sees it clearly. Most of the market still does not.

Subscribe now

Your Gut Is Giving You Intelligence. Stop Dismissing the Faint Signal.

When I asked Aleksandr about his hardest lessons, he went straight to hiring.

Specifically, to the times he overrode his own gut feeling because someone else, an executive coach, a reference, a well-reasoned case, told him to move forward.

Every time he was on the fence and let an external voice tip him over, the hire failed. Every time.

He’s since learned to pay attention to what he calls the “faint signal” - that barely audible feeling that something is off - and to amplify it rather than dismissing it as noise.

He said intuition starts as a very faint signal, almost too quiet to hear. And most people just sweep it under the rug.

Oh, it’s nothing. I’m overthinking it.

The data says otherwise.

He’s learned to do the opposite. When that whisper shows up, he leans into it. He tries to hear what it’s actually telling him before the noise of everyone else’s opinions drowns it out.

This resonates with me on a personal level.

I’ve doubled down on gut decisions that turned out to be the most profitable moves I’ve made. But more importantly, most useful and valuable resources for my community - the people I deeply care about in the security space.

But I also want to push back on the idea in a way I think is important.

Gut instinct is not magic. It is not some mystical sixth sense. It is compressed experience - years of pattern recognition, accumulated across thousands of interactions, that you need to look at and assess in yourself and in your performance.

The reason Aleksandr’s gut is reliable is because he has spent over a decade gathering input data through lived experience.

A first-time founder’s gut might be less calibrated, because they’ve had less input.

So the real lesson is not simply “trust your gut.”

The lesson is: build a life that gives your gut something worth trusting and then have the discipline to actually listen when it tries to tell you something.

The Quantum Clock Is Ticking. The Room Would Rather Not Talk About It.

AY believes quantum security migration will be a much bigger problem, much sooner than most people want to acknowledge.

The technical core of it is straightforward:

Once quantum computers reach sufficient capability, they will be able to factor large numbers efficiently, which means RSA encryption - the backbone of most secure digital communication on earth - stops being secure.

Quantum-safe algorithms already exist. The migration path is known. But the work of actually implementing it across global infrastructure is enormous, and almost nobody has started.

What I appreciate about Aleksandr raising this is that quantum risk is one of those topics most cybersecurity conversations either skip entirely or treat as something that will matter “someday.”

But “someday” is precisely what people said about third-party risk back in 2013, when AY was getting lukewarm reactions to the idea of quantifying it.

A decade later, supply chain security is one of the most critical issues in the industry.

The pattern is always the same:

I believe this is a space worth watching closely. Companies building quantum-readiness assessment tools, cryptographic migration playbooks, and crypto-agility platforms are working on a problem that every enterprise will eventually have to solve.

The Human Layer Is the Moat

If I had to distill everything AY shared in this conversation down to a single idea, it would be this:

The companies that win in cybersecurity - whether they are early-stage, growth-stage, or scaleups - are the ones that understand the human layer better than everyone else in the room.

Technology is going to keep evolving.

Artificial intelligence will get more powerful and more dangerous simultaneously.

Quantum computing will eventually break the encryption we all depend on.

Supply chains will get more interconnected and more brittle.

None of that is optional.

What is optional is the human failure to prepare.

The failure to listen deeply enough.

The failure to communicate clearly enough.

The failure to build trust before you need it, instead of scrambling for it after the crisis has already started.

Aleksandr built SecurityScorecard because he experienced a third-party risk failure personally and decided that no one else should have to feel that kind of helplessness.

That is not a business thesis born from market analysis. That is a conviction born from a wound.

And conviction - more than technology, more than funding, more than any clever go-to-market play - is what separates the companies that thrive and scale from the ones that get quietly absorbed into someone else’s platform.

If you are in the business of cybersecurity - selling it, funding it, buying it, or building it - your competitive advantage is not hiding in your tech stack.

It is in your ability to understand the human being on the other side of every transaction, every deployment, and every decision.

"You don't even know what you're talking about."

This episode with Nick Lantuh (CyberProof) and Amy Chaney (Citibank) breaks down how a methodology became a meaningless marketing term and how buyers can fight back.

The reality check:

• CTEM requires connecting vuln scanning, endpoint, SIEM, cloud, email, network—not just one of them

• Adding CAASM or external attack surface management doesn't make you a CTEM vendor

• Most organizations doing "CTEM" are actually using spreadsheets and manual threat intel fusion

• Why services-led beats platform-first (60x revenue growth proved it)

• The disingenuity problem: vendors spray the term, buyers have to unpack it

Amy's evaluated these claims at the world's largest banks. Nick built the solution that actually connects the pieces. Together, they arm you with the filter.

Skeptics vs. pragmatists vs. the "it depends" crowd.

Same arguments. Same camps. Same circular conversation.

Everyone's missing the point.

After having hundreds of direct conversations between vendors and CISOs, I've come to a controversial conclusion:

The analyst relations industry exists because marketers don't want to do the hard work of actually understanding their buyers.

In this episode, I'm going deep on what no one's willing to say:

• How buyer insight gets distorted through seven (at least) layers of interpretation before it reaches your strategy. By the time Gartner's "insight" hits your roadmap, it's a game of telephone.

• Vendors expect Gartner to generate pipeline. It generates awareness. That awareness doesn't convert. And the "justification" use case? I don't buy it anymore. I'll tell you what CISOs actually say.

• Gartner has become a shortcut to avoid the uncomfortable work of direct buyer relationships. More surprisingly, the analysts aren't doing the deep work either. You are the product, not the customer.

• AI is commoditizing surface-level insight. But the deep nuance, the psychology, the politics, the unspoken objections, that still requires human connection. The differentiator is becoming more human, not less.

• What to do instead. How to build buyer intimacy as a core competency. Why the vendors who win will be the ones who stop outsourcing the most important work in marketing.

This episode isn't about whether Gartner is good or bad.

It's about a harder question:

How well do you actually know your buyer?

If the honest answer is "not deeply enough", Gartner isn't your problem.

If you're a cybersecurity founder, marketer, or GTM leader wondering who has even the smallest inkling or intuitive feeling deep down inside that your Gartner investment isn’t worthwhile, this one's for you.

Connect with me on LinkedIn

Learn more about CyberSynapse

For too long, security has been treated as an unavoidable expense - just another cost on the balance sheet, a necessary evil to keep auditors and regulators at bay.

CFOs approve budgets for security tools, teams, and compliance initiatives, but the conversation rarely goes beyond risk mitigation.

It’s time for a shift.

Cloud security isn’t just about reducing threats.

Done right, it removes operational bottlenecks, increases efficiency, and accelerates revenue.

The challenge is that most CFOs aren’t hearing that message.

Security teams focus on technical risk, while finance teams focus on business growth.

And somewhere in the middle, the real value of cloud security gets lost.

I sat down with Chris Thomas, Chief Revenue Officer at AlgoSec, to break down the financial impact of cloud security investments.

We talked about the cost of doing nothing, how automation changes the math, and what CFOs should really be looking at when evaluating security spend.

If security is still seen as a cost center in your organization, you’re leaving money on the table.

This playbook will show you why.

Let’s go.

The CFO’s Dilemma: Why Security Investments Are Often Undervalued

Most CFOs don’t think of security as a business accelerator.

Instead, it’s a budget line item that only gets attention when something goes wrong - a compliance failure, a breach, or an operational bottleneck that slows down a key initiative.

That approach is shortsighted.

Every day security delays cause real financial losses.

It’s not just about risk - it’s about revenue. Chris put it bluntly:

“Security teams were the enemy to the application teams…Security traditionally has not been thought of as a true partner to the business side.”

Chris Thomas

The reality is that security should be enabling business growth, not slowing it down.

The problem isn’t just that companies spend money on security - it’s that they spend it inefficiently by failing to align security with business priorities.

Instead of asking, How much does security cost?

CFOs should be asking, How much money are we losing due to inefficient security processes?

The Three Pillars of Cloud Security ROI for CFOs

For security to justify its cost, it has to deliver clear business value. That value comes from three key areas:

1. Revenue Enablement: Security as a Business Accelerator

Every application, service, and digital product relies on security approvals before it can launch.

If those approvals take too long, they delay revenue.

If they are rushed, they increase risk.

Cloud security investments should focus on removing friction while maintaining compliance and security integrity.

Chris shared a story about a European banking service provider managing IT for 1,000 banks.

Their biggest issue?

Security reviews for cloud applications were taking four weeks, delaying revenue-driving services.

“When their banking customers were going to push new applications into the market…it would take them up to 3 or 4 weeks to pull that off. That is a huge amount of time when you’re talking about applications that drive revenue.”

Chris Thomas

By automating cloud security processes with AlgoSec Cloud Enterprise (ACE), they cut that timeframe to three days, with a goal of 24 hours.

That’s a direct impact on revenue.

If security teams and CFOs aren’t talking about how security enables faster product rollouts and customer acquisition, they’re missing the point.

2. Cost Optimization: Reducing Operational Waste

Companies waste millions each year on manual security processes that should be automated.

Security approvals, policy reviews, and compliance checks take up valuable time - often performed by highly paid specialists doing administrative work.

Chris highlighted a financial services firm in Orange County (that’s where I’m from!) that had ten full-time IT employees manually reviewing 500 security change requests per month.

“They have about ten IT people whose sole job is running off spreadsheets to review change requests… Those people should be working on strategic projects.”

Chris Thomas

By implementing security automation with AlgoSec Cloud Enterprise (ACE), they eliminated that manual workload, freeing up their IT staff for higher-value work.

Instead of spending resources on inefficient workflows, they redirected talent to innovation.

CFOs need to look at security investments the same way they look at any other operational efficiency project.

If automation can replace slow, manual processes, it’s a cost-saving initiative, not an expense.

3. Risk Avoidance: Preventing Financial Losses from Breaches and Compliance Failures

Security failures are expensive.

Fines, lawsuits, lost customers, and stock price drops can cost a company more than an entire security program.

Yet, many CFOs still see security investments as optional, despite the financial risk of non-compliance or a breach.

Chris made one point clear:

“Getting audited and failing an audit is reputational risk. There’s fines. A lot of costly things can go on with being out of compliance.”

Chris Thomas

Companies that treat compliance as a last-minute fire drill end up spending more on reactive fixes than proactive investments.

Security automation ensures compliance is continuous, reducing the cost of last-minute fixes and preventing regulatory penalties.

CFOs should be asking:

What’s the financial impact of a security failure?

What would a breach or compliance fine cost compared to proactive investment?

How AlgoSec Cloud Enterprise (ACE) Reduces Costs: A CFO’s Perspective

Beyond reducing risk and improving efficiency, ACE delivers measurable cost savings.

Companies that fail to optimize security are paying too much for inefficiencies, breaches, and downtime.

1. Avoiding Multi-Million Dollar Security Breaches

• The global average cost of a data breach in 2024 was $4.88 million.

• In the U.S., that number jumps to $9.36 million per breach.

Most breaches aren’t caused by elite hackers - they happen due to preventable misconfigurations.

ACE automates risk detection and remediation, eliminating human error-driven breaches.

2. Reducing Downtime and Accelerating Application Deployment

• The average cost of downtime is $225,000 per day.

• Cyberattacks cause an average of 18 days of downtime per incident.

ACE prevents costly security-related downtime by automating approvals and eliminating misconfigurations.

3. Cutting IT Labor Costs Through Automation

• Many organizations pay security professionals six-figure salaries to perform manual security policy checks.

• ACE eliminates repetitive security tasks, freeing up talent for strategic work.

4. Reducing Compliance Costs and Audit Readiness Expenses

• Companies with high levels of non-compliance face an average financial impact of $5.05 million.

• ACE automates compliance management, ensuring that audits don’t become last-minute, high-cost fire drills.

Final Thoughts: ACE is a Cost-Saving Business Investment, Not an Expense

CFOs evaluating cloud security need to stop asking, How much does security cost? and start asking, How much money are we losing by NOT automating security?

ACE isn’t just reducing risk - it’s cutting costs, eliminating waste, and increasing efficiency in a way that positively impacts the bottom line.

As Chris said:

“Security should be a strategic enabler, not a blocker. It’s time to rethink how we measure its value.”

Chris THomas

CFOs who get this right will see security not as a cost center - but as a competitive advantage.

If you want to hear more from Chris Thomas, check out the full episode of Audience 1st or talk to AlgoSec’s team here.

Until next time,

Dani

In this episode, Dani Woolf sat down with Chris Thomas, Chief Revenue Officer at AlgoSec, to break down how CFOs should really evaluate cloud security investments, not just as a defensive measure, but as a business accelerator.

They dove into the cost of inaction, the inefficiencies draining budgets, and the financial case for security automation - all from a CFO’s perspective. If you’re still treating security as an overhead cost, this conversation will change the way you think about it.

To get a demo of AlgoSec, visit: https://www.algosec.com/lp/request-a-demo