What happens when a cyber incident stops being a security problem and becomes a leadership problem?

Robbie O'Brien is joined by Joe Sullivan, CEO of Joe Sullivan Security and former Chief Security Officer at Facebook, Uber and Cloudflare.

Joe's federal conviction following Uber's handling of its 2016 data breach made him one of the most consequential figures in the debate around cybersecurity accountability. In this episode, he reflects on what happened, what organisations still misunderstand about incident response, and why the decisions that matter most are often made long before a breach occurs.

They discuss why no security leader can promise an organisation is "safe", how CEOs and boards should approach disclosure, the value of rehearsing for the incident that gets through, Cloudflare's approach to transparency, and why leadership cannot simply delegate cyber accountability to the CISO.

They also explore the limits of security awareness training, the need to design organisations that can survive human error, and how AI is beginning to change vulnerability management and security operations.

As Joe says: "We all know we're going to have incidents. And I think what my case shows is that those are the days that we get judged on."

A conversation about cybersecurity, accountability and what leadership looks like when things go wrong.

A security leader running security across fifty countries told me cybersecurity does not come above everything, and he was right.

In episode four of The Cybersecurity CEO Podcast, Robert O'Brien talks with Steve Lorimer, Group Privacy and Information Security Officer at Hexagon, who runs privacy and security across around fifty countries. The two first met when Steve was a customer of MetaCompliance, and this conversation picks up fifteen years later. Steve has a name for the habit that quietly sets the standard in most organisations: the blind acceptance of risk, carrying on with something because nobody has been able to point at the damage yet.

They discuss what security first means when it meets profit, why Steve says security does not come above everything, and where Robbie parts company with him over who cybersecurity should report to.

If you lead a business or sit on a board, this one's for you.

About the guest:
Steve Lorimer is Group Privacy and Information Security Officer at Hexagon, the measurement technology group, and has spent his career building security and privacy programmes that hold up across languages, cultures and jurisdictions.

About the host:
Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join him here:

Subscribe on Substack - https://substack.com/@cybersecurityceo

Follow on LinkedIn - /thecyberceo

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

Most security training dies quietly, months after somebody ticked the box that said it worked.

In episode three of The Cybersecurity CEO Podcast, I speak with Martin Smith, MBE, founder of SASIG and the man who wrote the British military's first computer security training back in 1981. He was handed the chapter to fill and found a single line waiting for him on the page: this page left intentionally blank. He has spent four decades filling it.

Martin is best known for building one of the largest security communities in the UK and for arguing that the human layer is where the risk actually sits.

We discuss why the bulk of the budget guards technology while the bulk of breaches walk in through people, why boards hear the cyber message and still fail to act, and why Martin puts that squarely on the profession rather than the boardroom.

If you lead a business or sit on a board, this one's for you.

About the guest:
Martin Smith MBE is the founder of The SASIG, the Security Awareness Special Interest Group, and has spent more than forty years working on the human side of security. Find him here on LinkedIn and at https://www.thesasig.com/.

About the host:
I am the Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. I have spent over 20 years helping private and public sector organisations build cyber resilience, and I write under the banner The Cybersecurity CEO. My forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join me here:

• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/

• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.