James Davison

The worst time to figure out how your board will respond to a cyber breach is during the breach. Yesterday, we hosted a #Cybersecurity Incident Response Workshop led by members of the Good Harbor Security Risk Management. Within minutes of the live simulation, a powerful truth was clear to all - in a crisis, you don’t rise to the occasion, you fall to the level of your preparation. The event, attended by over 100 directors and c-suite executives demonstrated how simulating a live cyber breach with directors and executives in the room quickly exposes the difference between having a plan and being ready to execute under pressure. Three observations stood out: 1) Cyber crises unfold faster than governance structures are designed to respond. * The clock moves in minutes, not board cycles. 2) The hardest decisions are not technical but they’re leadership decisions. * Disclosure timing, regulatory engagement, operational shutdowns, customer communication, and reputational risk all converge at once. 3) Most organizations overestimate preparedness. * Until you run a real simulation, gaps in escalation paths, decision authority, and communication become painfully obvious. For boards and C-suite leaders, three implications stand out: 1) Boards must understand their role before a crisis occurs: Incident response is a governance responsibility, not just an IT responsibility. 2) Muscle memory matters: Tabletop exercises and simulations are essential because plans on paper rarely survive the first hour of a real attack. 3) Speed and clarity of decision-making determine outcomes: In a breach scenario, in-decision can be more damaging than the attack itself. A big thank you to Richard Clarke, Emilian Papadopoulos, Cristin Flynn Goodwin, Mario DiNatale, rest of the Good Harbor team, and our very own Anita D'Amico, PhD from the PDA NY Metro Chapter for such a candid and practical exercise! Cyber risk, as we all know, is now firmly a boardroom issue, and preparation cannot begin during the crisis. #CyberRisk #BoardLeadership #ExecutiveLeadership #Governance #IncidentResponse #Cybersecurity #AI #PrivateDirectorsAssociation

16

4 Comments

Today, CertifID released its third annual State of Wire Fraud report and one theme rose above the rest: consumers know they're at risk, and they expect their agent and title company to protect them. A few anchoring stats: → 85% say they'll pay extra for fraud protection → 68% would choose a firm that guarantees it → 56% said they'd never work with a firm again if their funds were stolen — even after a full recovery Consumers are making decisions based on who takes this seriously. They're not being subtle about it. The firms that lean in aren't just doing the right thing - they're earning a reputation as the trusted choice in their markets. That's a competitive advantage in today's world of continued cyber threats. I'm hosting a To Catch a Fraudster session with Tyler Adams on April 8 to break down the full findings. It's been a while since we've presented together and I promise it will be worth the time! 📋 Register for TCAF webinar: https://lnkd.in/gftuVmsi 📄 Download the State of Wire Fraud report: https://lnkd.in/giWGfUbh

50

1 Comment

Check out Janet Costello Worthington's blog on this often overlooked, but extremely important requirement to understand what exactly you have just placed within your Enterprise.

6

1 Comment

CISA’s proposed Software Bill of Materials (SBOM) update marks a shift from checkbox compliance to strategic supply chain security. New requirements like hashes, license data, and provenance tracking raise expectations for accuracy and integrity. Alex Kreilein of Qualys notes that vendors must now generate richer metadata and integrate SBOMs with security frameworks – that add exploitability context and standardize security info – to deliver actionable insight. Read more in this article by ReversingLabs. #SoftwareSupplyChain #SBOM

4

📈 Thrilled to share news of VulnCheck's Series B funding round led by Sorenson Capital, with participation from Ten Eleven Ventures, IQT, and National Grid Partners 🎉 The most pressing security gaps today aren't tooling gaps — they're timing gaps. The vulnerability data ecosystem typically moves at vendor speed, but risk moves at attacker speed. VulnCheck delivers real-time visibility, context, and validation that's normalized and integration-ready out of the box. See what the fuss is about 👇 https://lnkd.in/etGT3vbg

102

3 Comments