John Stillwagen

Most boards approve cybersecurity budgets to prevent hypothetical breaches, then wonder why they cannot measure returns on preventing things that did not happen. I have spent over two decades watching this pattern waste board time and capital. Security investments justified through abstract risk reduction get minimum budgets and maximum skepticism. Boards approve because they have to, not because they see value. At Waste Management, I led an initiative that strengthened security posture while creating long-term cost efficiencies. I am continuing that work at Brinks Home. Modernizing systems eliminated downtime, costing revenue. Reduced maintenance expenses consuming IT budgets. Enabled capabilities improving operations. Real dollars, real results. True integration with the core business. Boards could finally evaluate investment using financial metrics instead of risk arguments that they could not verify. This changed how they thought about security. Not a cost center requiring approval, but a strategic capability creating enterprise value. Security leaders translate technical complexity into business strategy that boards can act on. We align investments with measurable outcomes boards already track. We reframe security from "insurance expense" to strategic capability. Forward-thinking boards stack the deck with people who have walked the walk. Learn more: https://lnkd.in/gcC65peH

100

12 Comments

Just wrapped another Black Hat, always great to connect with innovators and reconnect with past colleagues and friends. 𝐀 𝐟𝐞𝐰 𝐭𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬 𝐟𝐫𝐨𝐦 𝐭𝐡𝐢𝐬 𝐲𝐞𝐚𝐫: * AI’s impact is everywhere: Attackers are rewriting the playbook. Defenders must evolve just as fast. * Fundamentals matter more than ever: Significant number of breaches still leverage social engineering and unpatched vulnerabilities.  * Data exfiltration is accelerating: The window from breach to data loss is continually decreasing, making detection speed and response critical. * Incident Response must be agile: Test your IR plan against a range of scenarios. Data theft isn’t the only threat, business disruption is just as critical. * Browsers are the new front line: Protecting user endpoints means looking beyond the workstation. Big thanks to everyone for an insightful week!

73

2 Comments

Wow, it’s 2025, and this article still resonates deeply with so many CISOs navigating the complexities of their roles today. It’s a wake-up call for companies to reflect on their leadership and consider whether they truly understand their business and the crucial role cybersecurity plays in protecting it. Without this understanding, businesses risk serious vulnerabilities. Organizations must take proactive steps to close this gap by fostering a culture where cybersecurity is seen not as just an IT function, but as a core business priority. Leadership teams should collaborate closely with CISOs to ensure cybersecurity strategies align with business objectives. Investing in continuous education on emerging threats, robust incident response planning, and empowering cybersecurity teams with the necessary resources are critical steps. Moreover, cultivating a culture where the board actively listens to and supports cybersecurity initiatives is essential for building resilience and ensuring long-term success. https://lnkd.in/ebQcsCfM

27

4 Comments

HITRUST certification isn’t a checkbox. It’s a business differentiator. When I helped a healthcare organization achieve HITRUST on the first attempt, I saw firsthand how compliance goes beyond security—it builds trust. 🚑 Why should healthcare orgs prioritize HITRUST? ✅ Protects sensitive patient data (HIPAA isn’t enough). ✅ Strengthens vendor relationships & industry credibility. ✅ Reduces the risk of breaches, which cost healthcare billions. HITRUST is challenging, but it’s worth it. What’s your biggest compliance challenge in healthcare cybersecurity? Let’s talk! 👇

14

AI security, guidance and standards are evolving slower than the technology and the adoption, defenders need to focus on security fundamentals like data classification and governance, least privleage and other controls to remain secure. This is promising but it needs to evolve quicker.

12