Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

In this episode of the Secure and Simple Podcast, host Dejan Kosutic (CEO at Advisera) speaks with Ben Wilcox, who serves as both CISO and CTO at ProArk, about how AI is collapsing the traditional separation between technology transformation and security risk management. Ben explains that AI touches data, identity, permissions, apps, workflows, and decision-making, making every technology decision a risk decision and requiring CISOs to understand architecture and DevOps while CTOs embed security from the start. They discuss when merging CTO/CISO roles may work versus when separation is required by regulation, how Ben balances speed and risk using context such as data sensitivity and blast radius, and lessons from building an agentic product, including the need for better telemetry and technical governance controls. They conclude with recommendations for experimenting, ensuring compliance feasibility, and collaborating earlier in projects.
Links from the episode:
- Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software
- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits
- Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses
- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account 
- Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t
- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining 

(00:00) - Interview with Ben Wilcox

(00:57) - How AI Changes Roles

(04:55) - Should Roles Merge

(10:42) - Balancing Speed and Risk

(13:36) - Benefits and Innovation

(17:55) - Making the Merge Work

(20:48) - AI Agents Governance Lessons

(26:53) - Governance Reviews and Ownership

(32:27) - Resources for Security Professionals

In this Secure and Simple Podcast episode, host Dejan Kosutic interviews Taylor Hersam, founder and former CEO of Eden Data, a compliance consultancy providing SOC 2, ISO 27001, CMMC and other framework services that grew rapidly after starting on Upwork during COVID, later scaling to nearly 100 people and being acquired by Riveron in 2025. Taylor explains how he gamified Upwork to build reviews, tested and refined a subscription-based consulting model, and positioned Eden as an external security and compliance team with clear scoping to avoid overreach. He discusses why subscription pricing appeals to clients needing ongoing compliance, key scaling challenges, KPIs like customer satisfaction and revenue per headcount, and how AI is shifting consulting away from time-and-materials toward value, requiring firms to use customer feedback, employee input, and market signals to focus services.
Links from the episode:
- Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software
- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits
- Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses
- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account 
- Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t
- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining 

(00:00) - Interview with Taylor Hersom

(01:20) - COVID Pivot to Freelancing

(02:38) - Subscription Model Breakthrough

(06:18) - Packaging Compliance Services

(09:50) - Why Customers Stay

(16:06) - Subscription vs Project Fit

(21:41) - Scaling to 100 People

(27:16) - AI Disrupts Consulting

(33:51) - Skills Consultants Need Now

(36:25) - Final Advice and Wrap Up

(38:36) - Resources for Security Professionals

In this Secure and Simple Podcast episode, host Dejan Kosutic (Advisera) interviews Robert Siciliano, co-founder of ProtectNow and author of Strategic Human Firewall, about why organizations must address the “human blind spot” - people’s psychological need to trust that attackers exploit through impersonation, social engineering, and manufactured urgency. Siciliano explains why phishing simulations alone are not true security awareness training and introduces the AAA protocol (Analyze, Authenticate, Act) with out-of-band verification to stop scams like fake PayPal charges or CEO payment requests. He argues companies should build a “strategic human firewall” by shifting employees from passive targets to active detection layers through scalable, interactive dialogue (e.g., all-hands Q&A) that teaches personal security first, improving engagement and security behaviors measurable through better phishing results and increased adoption of practices like unique passcodes and password managers.
Links from the episode:
- Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software
- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits
- Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses
- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account 
- Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t
- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining 

(00:00) - Interview with Robert Siciliano

(01:20) - Beyond Phishing Training

(04:10) - Understanding Human Blind Spot

(08:27) - Manufactured Urgency Scams

(11:28) - AAA - Analyze, Authenticate, Act

(18:27) - CEO Fraud and Verification

(22:56) - Building Strategic Human Firewall

(30:28) - Getting Companies Onboard

(38:00) - Security vs Paranoia

(40:03) - Humanize the CISO

(42:09) - Measuring Behavior Change

(48:06) - Resources for Security Professionals

In this episode of Secure and Simple Podcast, host Dejan Kosutic (Advisera) speaks with Aaron Lange (GRC Lab, TÜV SÜD auditor) about combining security controls across multiple standards and frameworks, including ISO 27001/27002, NIST Cybersecurity Framework, NIST SP 800-53 and 800-171, TISAX, C5, SOC 2, and sector-specific regimes like PCI DSS and CMMC. They clarify the difference between requirements and controls, and how to handle cross-mapping, gap analysis, scoping, and phased implementation when adding frameworks. They discuss how standards typically complement rather than contradict each other (e.g., NIS2 incident reporting timelines) and why starting with a generic ISMS like ISO 27001 before adding specific frameworks often works best, illustrated by a startup achieving ISO 27001 and then C5 attestation. They also examine the purpose and common shortcomings of the ISO 27001 Statement of Applicability and close with advice to avoid perfectionism, start, and iterate.
Links from the episode:
- Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software
- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits
- Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses
- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account 
- Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t
- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining 

(00:00) - Interview Aron Lange

(01:29) - Requirements vs Controls

(03:14) - NIST 800-53 vs 800-171

(06:46) - C5 And TISAX Deep Dive

(10:38) - Control Mapping Across Standards

(14:34) - One Integrated ISMS

(19:59) - Pick A Core Standard

(23:32) - Scoping And Real Examples

(29:48) - Statement Of Applicability

(43:37) - Free Resources for Security Professionals

Dejan Kosutic hosts Matthew Webster, founder and CEO of Cyvergence, to explain what “security as a business enabler” means in practice: aligning cybersecurity with business operations, priorities, and decision-making rather than siloed technical metrics. Webster emphasizes using business impact analysis, scenario analysis, and cost-benefit thinking to translate vulnerabilities into operational risk executives understand, including concepts like materiality and value at risk. He discusses how security can enable revenue through third-party/supply-chain risk expectations, certifications, and better governance, and how CISOs can overcome gaps in business understanding by learning business language, building trust, and collaborating with legal, HR, finance, and risk leaders. The episode also covers balancing speed, innovation, and acceptable risk, including AI guardrails, storytelling, and a “work towards yes” approach.
Links from the episode:
- Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software
- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits
- Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses
- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account 
- Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t
- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining 

(00:00) - Interview with 1043 Matthew Webster

(00:56) - Security as Business Enabler

(04:50) - From Cyber to Operational Risk

(08:18) - Revenue and Third Party Risk

(11:32) - Scenario Storytelling

(13:48) - CISOs Learn Business

(21:33) - Mission Critical Objectives

(26:00) - Balancing Speed and Controls

(29:31) - Innovation and AI Guardrails

(34:41) - Human Trust and Stories

(38:24) - Resources for Security Professionals