Cyber Insights · Episode 10

Why CISOs Can't Fix Cybersecurity (And What Actually Works)

Dr Paul Guckian, Author, Systematic Cyber Risk
· 37 min
  • Why CISOs are snipers fighting a general's war
  • The difference between cyber knowledge and cyber understanding
  • How organisations reach tipping points where recovery becomes impossible

Prefer your own app? Spotify · Apple Podcasts

About this episode

“Just defend better and you won't need resilience.” It is a logic trap that is burning out CISOs, and the premise may be wrong.

Dr Paul Guckian, author of Systematic Cyber Risk: Why CISOs Can't Fix Cybersecurity, joins Ronan Murray and Ian Finlayson to explain why cybersecurity needs systemic answers. Drawing on research across financial services, fire safety and military cyber command, he challenges the perfectionist mindset common in security teams.

PG
Guest
Dr Paul Guckian
Author, Systematic Cyber Risk

Paul is the author of Systematic Cyber Risk: Why CISOs Can't Fix Cybersecurity.

In this episode

  • Why CISOs are snipers fighting a general's war
  • The difference between cyber knowledge and cyber understanding
  • How organisations reach tipping points where recovery becomes impossible
  • Why containment deserves its own pillar in security frameworks
  • What the contrast between Delta and United Airlines reveals about cyber resilience
  • Why compliance gets you to level 3 maturity, but rarely beyond
  • Why you have to assume your security will fail
Want to see where your gaps are?
Security Posture Review · Assessment
See the Security Posture Review

Keep going

Browse all episodes
Assessment
Security Posture Review

A structured review of your security controls, policies and technical posture, with a written report and prioritised roadmap.

See what's included
Episode 16
Do You Need a CISO, or Do You Need Security Leadership?

Ronan Murray and Ian Finlayson on the vCISO model: how it differs from a full-time CISO and how it helps organisations meet NIS2 and DORA accountability.

Listen
Episode 11
Inside Ireland's Fight Against Cybercrime

Det. Chief Supt Barry Walsh of the Garda National Cybercrime Bureau on ransomware response, backup mistakes, AI phishing and why SMEs are targeted.

Listen
Service
vCISO

Senior security leadership embedded in your organisation, without a full-time hire.

Find out more
Ian Finlayson

Got a question about cyber resilience?

Talk to Ian. Ian Finlayson, Chief Security Services Officer at Edge7 Networks, is happy to talk through what this looks like for your environment.

Talk to Ian See the Security Posture Review

ISO 27001:2022 · ISO 9001:2015 · Cyber Essentials · Networking and security specialists since 2018