A security leader running security across fifty countries told me cybersecurity does not come above everything, and he was right.

In episode four of The Cybersecurity CEO Podcast, Robert O'Brien talks with Steve Lorimer, Group Privacy and Information Security Officer at Hexagon, who runs privacy and security across around fifty countries. The two first met when Steve was a customer of MetaCompliance, and this conversation picks up fifteen years later. Steve has a name for the habit that quietly sets the standard in most organisations: the blind acceptance of risk, carrying on with something because nobody has been able to point at the damage yet.

They discuss what security first means when it meets profit, why Steve says security does not come above everything, and where Robbie parts company with him over who cybersecurity should report to.

If you lead a business or sit on a board, this one's for you.

About the guest:
Steve Lorimer is Group Privacy and Information Security Officer at Hexagon, the measurement technology group, and has spent his career building security and privacy programmes that hold up across languages, cultures and jurisdictions.

About the host:
Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join him here:

Subscribe on Substack - https://substack.com/@cybersecurityceo

Follow on LinkedIn - /thecyberceo

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.