When I spoke with Mark Lluic, CEO in Residence at Zscaler, on the Business of Cybersecurity podcast, we didn't spend time rehashing the basics. We looked at how leadership thinking must evolve. If your security posture is still built for light rain, what happens when a hurricane hits?

Mark has spent years helping organizations rethink security from the ground up. Instead of chasing alerts or layering new tools onto outdated systems, he advocates for a proactive, systems-first approach. One that prioritizes architecture and continuity over quick fixes.

Zero Trust Isn't Just for Remote Work

Zero Trust started as a security fix for remote access, but that's just one piece of the puzzle. Mark made a sharp observation: many companies still trust users more when they're sitting in the office. That's a dangerous assumption.

Modern Zero Trust means treating all traffic with the same level of scrutiny, regardless of its origin. Every access request should be evaluated based on its context: who is making the request, what device they're using, what they're trying to do, and whether that behavior fits a known pattern.

The Problem with the Patch-and-Pray Model

Security teams often react to new threats by throwing more tools into the mix. Over time, this patchwork creates more problems than it solves. Complexity grows, visibility shrinks, and attackers exploit the gaps.

Mark pointed to research showing that many teams are overwhelmed by the tools they already have in place. Others are held back by outdated systems or a lack of staff with the right skills. That creates a situation where attackers need to succeed once, while defenders must stop everything every time.

A Better Way Forward: Resilient by Design

So, what does a stronger strategy look like? Mark recommends starting with architecture. Build systems that expect disruption. Apply continuous risk assessment. Incorporate business continuity from the start rather than as an afterthought. And don't limit Zero Trust to a single use case. Make it your foundation.

For leaders looking to take action, Mark laid out some clear first steps:

Start by reviewing where Trust is currently assumed. Challenge those defaults. Apply the same standards inside your network as you do for external traffic. Think about context every time you evaluate access.

Ensure that your legacy systems are also included in this effort. But remember, you don't need to replace everything overnight.

Resilience is about ensuring your organization remains standing, regardless of what challenges it faces. That means planning, testing your response, and building security into your infrastructure not bolting it on later.

Listen to the full episode to hear why this shift is a leadership decision that defines how your organization faces tomorrow's threats.

Are junior cybersecurity professionals outpacing their senior colleagues in readiness for modern threats?

In this episode of The Business of Cybersecurity, Neil C. Hughes sits down with Max Vetter, Vice President of Cyber at Immersive Labs, to examine a surprising trend: less experienced team members are consistently completing more difficult training content than veterans with eight or more years in the field. It’s a data point that challenges assumptions and raises urgent questions about how organizations approach skills development in cybersecurity.

Max shares findings from recent research that expose worrying gaps in readiness, especially at the senior level, and outlines a practical checklist for building resilient, threat-ready teams. He makes a compelling case for continuous, challenge-based learning across all levels of expertise, not just for new hires, but for seasoned professionals who may risk falling behind.

Together, Neil and Max explore:

• Why traditional training approaches might be failing senior professionals
• How complacency and lack of tailored development can erode cyber resilience
• The cultural shifts needed to make continuous learning a team-wide priority
• What boards and business leaders should know about workforce readiness gaps

Whether you're leading a SOC, managing risk at the executive level, or shaping your organization's cyber strategy, this episode offers real-world insight into the human dynamics behind technical defenses.

Are we doing enough to upskill cybersecurity veterans before the next threat hits? Tune in and join the conversation.

Legacy systems are everywhere, quietly powering core operations in some of the world’s largest enterprises. But behind that familiarity is risk. In this episode of The Business of Cybersecurity, Paul Savill, Global Practice Leader of Networking and Edge Compute at Kyndryl, joins me to break down why aging infrastructure is becoming a major liability in today’s security posture.

We talk candidly about the security implications of 44 percent of enterprise technology being “out of life” and unsupported. Paul shares how that vulnerability becomes even more exposed as IoT devices proliferate and AI-powered attacks grow more sophisticated. It’s no longer a question of whether legacy tech is a problem, but how long organizations can afford to ignore it.

This conversation moves beyond the buzzwords and straight into the operational reality. Paul explains how Kyndryl’s post-IBM spin-off transformation included shifting to a cloud-first, zero trust model—and why that decision was just as much about improving agility and cost control as it was about reducing risk.

We also explore the human side of cybersecurity. Paul outlines how Kyndryl’s internal phishing simulations and scenario-based training have led to a measurable increase in employee-reported incidents. It’s a compelling argument for why building a cybersecurity culture beats any off-the-shelf solution.

From AI-enhanced social engineering threats to the disconnect between IT and OT teams, this episode highlights the practical steps business leaders can take to modernize without compromising day-to-day operations. If your cybersecurity strategy still depends on outdated tools and last year’s training modules, it might be time to rethink the foundation.

For more insight, check out the Kyndryl Readiness Report at kyndryl.com,