What happens when a cyber incident stops being a security problem and becomes a leadership problem?

Robbie O'Brien is joined by Joe Sullivan, CEO of Joe Sullivan Security and former Chief Security Officer at Facebook, Uber and Cloudflare.

Joe's federal conviction following Uber's handling of its 2016 data breach made him one of the most consequential figures in the debate around cybersecurity accountability. In this episode, he reflects on what happened, what organisations still misunderstand about incident response, and why the decisions that matter most are often made long before a breach occurs.

They discuss why no security leader can promise an organisation is "safe", how CEOs and boards should approach disclosure, the value of rehearsing for the incident that gets through, Cloudflare's approach to transparency, and why leadership cannot simply delegate cyber accountability to the CISO.

They also explore the limits of security awareness training, the need to design organisations that can survive human error, and how AI is beginning to change vulnerability management and security operations.

As Joe says: "We all know we're going to have incidents. And I think what my case shows is that those are the days that we get judged on."

A conversation about cybersecurity, accountability and what leadership looks like when things go wrong.