A security leader running security across fifty countries told me cybersecurity does not come above everything, and he was right.

In episode four of The Cybersecurity CEO Podcast, Robert O'Brien talks with Steve Lorimer, Group Privacy and Information Security Officer at Hexagon, who runs privacy and security across around fifty countries. The two first met when Steve was a customer of MetaCompliance, and this conversation picks up fifteen years later. Steve has a name for the habit that quietly sets the standard in most organisations: the blind acceptance of risk, carrying on with something because nobody has been able to point at the damage yet.

They discuss what security first means when it meets profit, why Steve says security does not come above everything, and where Robbie parts company with him over who cybersecurity should report to.

If you lead a business or sit on a board, this one's for you.

About the guest:
Steve Lorimer is Group Privacy and Information Security Officer at Hexagon, the measurement technology group, and has spent his career building security and privacy programmes that hold up across languages, cultures and jurisdictions.

About the host:
Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join him here:

Subscribe on Substack - https://substack.com/@cybersecurityceo

Follow on LinkedIn - /thecyberceo

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

Most security training dies quietly, months after somebody ticked the box that said it worked.

In episode three of The Cybersecurity CEO Podcast, I speak with Martin Smith, MBE, founder of SASIG and the man who wrote the British military's first computer security training back in 1981. He was handed the chapter to fill and found a single line waiting for him on the page: this page left intentionally blank. He has spent four decades filling it.

Martin is best known for building one of the largest security communities in the UK and for arguing that the human layer is where the risk actually sits.

We discuss why the bulk of the budget guards technology while the bulk of breaches walk in through people, why boards hear the cyber message and still fail to act, and why Martin puts that squarely on the profession rather than the boardroom.

If you lead a business or sit on a board, this one's for you.

About the guest:
Martin Smith MBE is the founder of The SASIG, the Security Awareness Special Interest Group, and has spent more than forty years working on the human side of security. Find him here on LinkedIn and at https://www.thesasig.com/.

About the host:
I am the Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. I have spent over 20 years helping private and public sector organisations build cyber resilience, and I write under the banner The Cybersecurity CEO. My forthcoming book, Cyber First: Security Above All, is due for release in January 2027.

Join me here:

• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/

• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.

Most businesses are still catching up with the cybersecurity threats of five years ago. AI just moved the goalposts again.

In episode two of The Cybersecurity CEO Podcast, Robbie O'Brien sits down with Professor Kevin Curran, Professor of Cybersecurity at the University of Ulster and one of the most widely cited researchers in his field. Kevin is Executive Co-Director of the Legal Innovation Centre, a tech entrepreneur, and a passionate advocate for practical, real-world cybersecurity solutions.

Anthropic's Mythos model has changed the cybersecurity threat landscape permanently, and most businesses have no idea what that means for them yet. Robbie and Kevin cut through the noise on what AI-powered vulnerability discovery actually looks like in practice, why the controls that have always protected you still matter, and why the single biggest risk right now is leadership teams that are watching from the sidelines while the game changes around them.

If AI feels like a threat you haven't fully got to grips with yet, this episode is the right place to start.

About the guest:
Professor Kevin Curran is Professor of Cybersecurity at the University of Ulster, with over 13,500 citations and more than 1,100 peer-reviewed publications. He is Executive Co-Director of the Legal Innovation Centre and co-founder of Ultri. Find him here on X and on YouTube here.

About the host:
Robbie O'Brien is Co-Founder and Chairman of Safe Harbour Security and the founder of MetaCompliance. He has spent over 20 years helping private and public sector organisations build cyber resilience, and writes and speaks under the banner The Cybersecurity CEO. His forthcoming book, Cyber First: Security Above All, is due for release in September 2026.

Join him here:

• Subscribe on Substack - https://substack.com/@cybersecurityceo
• Follow on LinkedIn - https://www.linkedin.com/in/thecyberceo/
• Subscribe on Youtube here - https://www.youtube.com/@TheCyberCEO

New episodes of The Cybersecurity CEO Podcast are released monthly. Subscribe to make sure you don't miss the next conversation.