Lester Chng

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

I lost my voice on many occasions.  
 
But LinkedIn helped me find it again. 
 
I lost my voice when I left the Navy. 
12 years in service.  
It remains a part of me. 
Naval terms. Military speak.  
Barking orders and receiving them. 
 
And then I left the Navy.  
 
I lost my voice when I left the country. 
34 years in the land. 
I will always belong there. 
Singlish, slang, and all I knew. 
Culture, habits, being a local. 
 
And then I left the country. 
 
I lost my voice when I began abroad. 
8 years since I landed. 
I wonder if I'll ever belong. 
New nuances, new circumstances. 
 
And then I began again. 
 
I lost my voice when I lost my job. 
I will never forget the letter. 
"Changing business requirements" 
I told myself this will never be a chore. 
 
And then I found my voice. 
 
You may find this platform a bore. 
"I need a job" 
"I am excited to...." 
"🚀🚀🚀🚀🤖🤖🤖🤖" 
"Are you interested in buying.." 
 
But it has allowed me to find my voice. 
 
Cause one day, I may lose it again. 
 
Have you lost your voice before?
What steps are u taking to mitigate?

No alternative text description for this image

Running naval wargames and designing cyber exercises at a bank are more similar than people expect.

It did help that the big boss at the bank was a former naval aviator. 

He knew with a fusion centre structure of managing security incidents across cyber, fraud, physical security, and crisis management, the teams needed a robust training program to drive operational excellence and achieve full operating capabilities. 

That was the first task. 

Get back to basics. 
Sort out the procedures. 
Drill the response teams. 

Do you run drills for your teams?

Or assume they will respond to your expectations?

You know Canada is on the up when Dad sends you a TikTok (no i dont have an account) about the upcoming increase in defence spending.

What about Canada do you appreciate?

I like the cold...... what about you?

undefined undefined

bootcamp

Sign up here:
https://catalystcorporatetraining.classe365.com/form/view/AutoBootCamp?_gl=1*9rfqtg*_ga*MTQ4NTczNDM0MC4xNjk4MjQxODM1*_ga_YYXBQS6S5Q*MTcwNzgzMzEyNi4xODEuMS4xNzA3ODMzMTYwLjI2LjAuMA

Building a cyber company is not for everyone.

Do you even have the commitment to do so?

I interviewed Eldon Sprickerhoff to get his insights for the next generation of founders. He is an Entrepreneur-in-Residence and a mentor at Rogers Cybersecure Catalyst, Toronto Metropolitan University. 


𝗧𝗵𝗲 𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝗰𝗵𝗮𝗽𝘁𝗲𝗿. 𝗦𝘁𝗶𝗹𝗹 “𝗖𝗼𝗺𝗺𝗶𝘁𝘁𝗲𝗱”

𝘘: 𝘞𝘩𝘢𝘵 𝘵𝘩𝘦𝘮𝘦𝘴 𝘰𝘳 𝘤𝘩𝘢𝘭𝘭𝘦𝘯𝘨𝘦𝘴 𝘬𝘦𝘱𝘵 𝘴𝘩𝘰𝘸𝘪𝘯𝘨 𝘶𝘱 𝘪𝘯 𝘤𝘰𝘯𝘷𝘦𝘳𝘴𝘢𝘵𝘪𝘰𝘯𝘴 𝘸𝘪𝘵𝘩 𝘧𝘰𝘶𝘯𝘥𝘦𝘳𝘴 𝘵𝘩𝘢𝘵 𝘶𝘭𝘵𝘪𝘮𝘢𝘵𝘦𝘭𝘺 𝘭𝘦𝘥 𝘺𝘰𝘶 𝘵𝘰 𝘸𝘳𝘪𝘵𝘦 𝘊𝘰𝘮𝘮𝘪𝘵𝘵𝘦𝘥 𝘢𝘯𝘥 𝘤𝘳𝘦𝘢𝘵𝘦 𝘵𝘩𝘦 𝘮𝘢𝘴𝘵𝘦𝘳𝘤𝘭𝘢𝘴𝘴?


I kept seeing the same patterns: some passionate and brilliant technical founders hitting predictable walls - raising capital without understanding dilution consequences, scaling teams without proper foundations, pursuing growth without sustainable unit economics, or worse: flailing in the market with a product/offering that didn’t have an obvious value or importance.

What frustrated me was that these weren't unsolvable problems. They were challenges we had faced and eventually figured out, often painfully. I realized this knowledge could help others avoid the same expensive mistakes.

The recurring theme was the gap between technical excellence and business fundamentals. Founders could build incredible technology but struggled with identifying their true “ideal client profile”, minimally viable offering, go-to-market strategy, fundraising dynamics, or organizational design. "Committed" became my way of sharing survival strategies that weren't readily available elsewhere.


𝘘: 𝘞𝘩𝘢𝘵 𝘢𝘳𝘦 𝘺𝘰𝘶 𝘮𝘰𝘴𝘵 𝘪𝘯𝘵𝘦𝘳𝘦𝘴𝘵𝘦𝘥 𝘪𝘯 𝘸𝘰𝘳𝘬𝘪𝘯𝘨 𝘰𝘯 𝘰𝘳 𝘤𝘰𝘯𝘵𝘳𝘪𝘣𝘶𝘵𝘪𝘯𝘨 𝘵𝘰 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸, 𝘢𝘯𝘥 𝘩𝘰𝘸 𝘥𝘰𝘦𝘴 𝘵𝘩𝘦 𝘮𝘢𝘴𝘵𝘦𝘳𝘤𝘭𝘢𝘴𝘴 𝘧𝘪𝘵 𝘪𝘯𝘵𝘰 𝘵𝘩𝘢𝘵 𝘧𝘰𝘤𝘶𝘴?

Right now, I'm focused on helping the next generation of cybersecurity founders build enduring companies. Through my consulting and advisory roles, I'm seeing exceptional technical talent that needs guidance on the business side.

The masterclass is a way to scale that impact. I can only mentor a handful of founders directly, but the principles I learned building eSentire are broadly applicable. I want to help founders avoid the mistakes that nearly killed our company early on and accelerate their path to product-market fit and sustainable growth.

What excites me most is seeing founders take these lessons and apply them in ways I never imagined - solving problems that didn't exist when we started eSentire. The cybersecurity landscape keeps evolving, and I want to help the best founders navigate it successfully.


If you enjoyed this interview series, please follow Eldon and get his book at https://lnkd.in/gS2HNAnY


P.S. Have you read Committed? 
Get it already.

Dear LinkedIn,
Here is what it is like using the app. 

Suggested

Suggested

Suggested

Sponsored

Suggested

Sponsored 

Suggested

Sponsored


What’s up with this feed?

Did you even consider the experience?

Pls bring my connections’ posts. 

Sincerely,
Everyone.

LinkedIn

It is RSAC in a couple of weeks. 
Yet your meeting calendar is scarily empty.

Your VP Marketing has been urging you to post more on LinkedIn during the lead-up to RSAC.

But is has been crazy busy with client demos, contract negotiations, partner agreements, manpower turnover, investor updates, fund-raising, and just LIFE.

The start of the year flew by and you didn't realize RSAC is just around the corner. The conference that costs a pretty penny but you don't feel like you have good momentum going into the event.

Your last LinkedIn post was a report of a company announcement 3 weeks ago. Your DMs are all full of spam. And you ignored your VP Marketing's email to post more.

But where do you start? What do you post about?

I have 2 resources for you.
1. The Cybersecurity CEO’s Personal Brand Blueprint
2. 5 LinkedIn Posts Templates for Cyber CEOs

You have 1 week to catch up.

Don't waste another year at RSAC.

DM or comment "RSAC" and I'll send you both.

When I first moved to Canada, I remember reading about their Navy and Air Force capabilities (don’t ask me why I didn’t bother abt the Army). 

12 Halifax frigates. Ageing, 1990s
4 Victoria subs. Second hand. 
6 OPVs. Still coming online. 
12 Patrol crafts. 

F18s - started from 1982….


And to defend coast to coast….
to the True North

Was an impossible task. 

This Defence budget and Strategy is long overdue and may be the silver lining in this rocky new world. 

We are all pulling in the same direction. 

Rogers Cybersecure Catalyst, Toronto Metropolitan University will offer every company in every Catalyst program strategic insights to help them explore and pursue opportunities in Canada’s growing defence sector.

Stay connected and pull together.

Rogers Cybersecure Catalyst, Toronto Metropolitan University

The reason your posts fall flat? 
They read like press releases.

Most posts I see on LinkedIn read like they were written by a corporate communications team.

They’re clean. Safe. 
Approved by six people.
And boring as hell. 

Here are a few lessons that I gained after writing >1000+ posts. 
⸻

Lesson 1: Write as you would speak. 
You don’t need big words or long sentences.
Short. Direct. Clear.
If you wouldn’t say it in a conversation, don’t write it in a post.

⸻

Lesson 2: Share what it means, not just what happened.
Describe what you learned from it.
What changed for you? 
For your clients?
That’s the part people care about.

⸻

Lesson 3: Write to one person.
Think of someone specific — a client, a peer, a younger version of yourself.
Write as if you’re speaking to them.
That’s what makes people stop scrolling.

⸻

LinkedIn isn’t a press room.
It’s a coffee chat. 

Incorporate these lessons and the posts will start landing.

Whose posts do you enjoy reading?

Sick of tabletop exercises?

Here are other training tools to use. 

Picture this. 
You designed and planned for your tabletop exercise for months. 

The date is decided and you sent out the calendar hold. 

“Urghh”. The synchronized groans echo across the office space. 


Johnny Smarty Pants: “I bet it’s an AI or ransomware scenario again”. 

Jimmy Old Timer: “Time to dust off the old playbook”. 


How do you think the exercise will go?
Probably the same as the last 5..

Even MSPs know that this is a problem. 
“Our clients are bored of TTXs”.


Here’s how to shake things up. 

1. Use short drills instead
2. Execute unalerted exercises
3. Ask delegates to be the primary 
4. Allocate budget for a simulation ex

You can and should incorporate some variety and creativity in your training. 

Otherwise it’s a bloody snooze fest. 

Everyone know it and just goes through the motion at your tabletop. 

Depressing stuff. 

P.S any other bright training ideas?

4 types of people in tabletop exercises.

And how to deal with them.

It is every facilitator's nightmare. You spend hours designing and scheduling a tabletop exercise and you practice and envision every conversation, pushback, scenario.

Yet you still feel unprepared because you don't fully know who the audience is, what they are like, and whether they will chew you up and spit you out.

Here are the 4 archetypes and how to manage these characters.

1. The Know-it-all

If we all conduct a blind survey in the room and ask everyone to close their eyes and point to the person who "Knows-it-all", they will all point to the same person.

How to tell who this person is?

Don't worry. When the exercise reaches the first discussion point, this person will start talking about Step A to Z on what he or his team will do. He knows his plans, critical processes, who to call, what to ask, what to investigate, how long it takes, priorities etc

How do you handle the "Know-it-all"?

This is a good thing.
Don't discourage the sharing. Instead leverage what the person is sharing and post some of the things he raised to other teams.

Example:
Know-it-all: For this particular incident, we will triage and send out the initial report within 30 mins

You: That is excellent. Operations team (or any other team that should receive the report), is the information within the initial report sufficient or what other types of info will help your team's processes?

Know-it-alls are good for keeping the flow of the exercise. Leverage them well.

2. The Forever-Skeptic (FS for short)

Signs of the FS.
- This will never happen
- We have implemented tools for this
- This inject is not applicable for our env

I know. 
You may find yourself sweating at this point. But don't worry, leverage your exercise design partner to help expand on the inject to make it relevant.

OR if all else fails. 
This is one trick that works.

Ask the FS straight up. 
"Is there a similar inject or scenario where in your experience and expertise, you know will triggers an event/incident that needs your team's response?"

1. This strokes FS's ego.
2. You have trapped FS. He can't say there is no such scenario.
3. Smile and pivot from FS's suggestion.
4. Rem to tie it back to the overall scenario.

3. The Conversation Hogger

Signs of the Hogger
- This is a no brainer. If you record the whole, the hogger probably took up 70% of the air time.

It is likely that the hogger has gone too far down a rabbit hole. 

Acknowledge the hogger's contribution and bring others in the convo.

4. The silent ones

No sound. No inputs. No involvement.
Ask them directly what they think or they would do. 
Do it with every inject.

What other characters are there and how do you deal w them?

LinkedIn  isn’t rocket science. 
10 things you can do today that will take less than 1 min. 

Forget the polished profile. 
Funnel content tactics. 
Funky AI graphics. 

Keep it simple. 

Do one of these (or all) and make LinkedIn work for you. 

1. Send a DM to refer someone
2. Send a DM to encourage someone
3. Comment on a stranger’s post
4. Reconnect w an ex colleague
5. Congratulate an achievement
6. Say hi to a stranger in your field
7. Say hi to a stranger not in your field
8. Ask for insights from an expert
9. Ask someone for that referral
10. Ask someone if they need help

Try it out. 
Let me know how many you hit today.

P.S when was the last time you did any of the above?

Running the Naval Wargaming & Simulation Centre provided a strong foundation for running cyber exercises.

Here was what a typical week looked like.

• detailing injects
• designing exercise scenarios
• preparing exercise with instructors
• running exercises for warfare teams
• keeping up to date with naval tactics
• tracking and assessing performances
• planning out future exercise schedules
• conducting pre and post-exercise briefs
• discussing the ship's exercise objectives
• ensuring teams are up to date on Red Team tactics

Now you can understand the transferable skills in Cybersecurity exercises.

It’s 2026 and it’s still a VUCA world. 

Volatilite
Uncertain
Complex
Ambiguous 

No wonder there is a continued demand for crisis mgmt professionals. 

VUCA was introduced in 90s to describe the post Cold War period. 
Still as relevant today. 


In fact, things may escalate. 

BANI is added to the frame with pandemics, AI, and whatever’s next. 

Brittle
Anxious
Nonlinear 
Incomprehensible


Stay safe out there. 

P.S Just saw the missile attack on the base in Bahrain where I was stationed back in the day.

Building a product isn’t the hardest part for cyber founders. 

It’s building trust. 

- Enterprise buyers make a decision about a founder before they ever get on a call. 

- Investors decide whether to respond to your email based on what they find when they search your name. 

-Partners size you up against competitors who’ve been showing up publicly for years.

You can have the best product in the market and still lose the deal to someone with an inferior solution and a stronger presence.

Trust is built before the conversation starts and your presence on LinkedIn shouldn’t be overlooked.  

What does your LinkedIn say about you to someone who’s never heard of your company?

Imagine exercising the exact scenario a couple of weeks before an incident. 

This is how some teams would have managed the lead up to this weekend. 

The sharpest teams would have tracked the escalation and highlighted the threat scenarios weeks ago. This can only happen if your threat intel teams covers beyond just cyber. 

The risk teams would be pulled in and have a quick reassessment. This can only happen if your intel and risk teams know how to work together. 

The exercise and security teams collaborate to rapidly design and develop exercise scenarios. This can only happen if leaders carve out time. 

The leadership team prepare briefs to the executive leadership and board. This can only happen if there is trust. 

Can you predict when something kicks off? Nope but you can certainly prep for it in advance. 

And when you run the exact scenario weeks before it actually happens. 

Imagine the credibility your team gains. This doesn’t happen by chance but by an intricate and established machinery. 

P.S 
how are you actively managing risks?

If the message is still unclear, do this. 
- review last few major incidents 
- identify the most relevant scenarios
- refresh or recirculate response plans
- stand up a quick incident drill 
- plan for a near term exercise 
- run the exercise and note lessons
- update leadership on readiness


Write a quick doc on this process. 
That is your response playbook. 
Don’t fumble the next crisis.

Cybersecurity marketing truth:

Conference booth: $40,000 for 72 hours of exposure
LinkedIn: $0 for year-round client acquisition

Let me explain why this matters:

The math simply doesn't add up anymore.

That $40K RSAC booth gets you:
- A week of fighting for attention
- Hundreds of scanned badges (most whom will never respond)
- A team of exhausted sales reps
- Maybe 2-3 qualified opportunities if you're lucky

Meanwhile, the most successful cybersecurity leaders I work with are building personal brands on LinkedIn that generate:
- Continuous inbound leads
- Speaking invitations
- Media opportunities
- Partnerships
- Investor interest
- And yes, actual customers

The key difference? 
Trade shows are transactional. 
LinkedIn is relational.

Here's what a strategic LinkedIn approach for cybersecurity leaders looks like:

𝟭. 𝗙𝗼𝗰𝘂𝘀 𝗼𝗻 𝗮 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗱𝗼𝗺𝗮𝗶𝗻
Don't try to be everything to everyone. Are you an identity expert? Cloud security specialist? OT security veteran? Pick your lane and own it.

𝟮. 𝗦𝗵𝗮𝗿𝗲 𝘆𝗼𝘂𝗿 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲
CISOs don't need another vendor telling them breaches are bad. They need practical insights from someone who's been in the trenches.

𝟯. 𝗛𝘂𝗺𝗮𝗻𝗶𝘇𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀
Most security content feels like it was written by robots for robots. Talk about the human elements - the stress, the politics, the wins.

𝟰. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝘆𝗼𝘂𝗿 𝗷𝗼𝘂𝗿𝗻𝗲𝘆
Building or selling security solutions is hard. Share your progress, setbacks, and lessons. Vulnerability builds trust.

𝟱. 𝗘𝗻𝗴𝗮𝗴𝗲 𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝘁𝗹𝘆
This isn't about posting once a month. It's about showing up regularly to add value to industry conversations.

The cybersecurity industry has a trust problem. Your LinkedIn presence helps solve that by building relationships before the sales pitch.

Is a LinkedIn-first approach right for every security company? No.

But if you're spending $200K+ annually on trade shows without a personal brand strategy, you're leaving opportunities on the table.

What's your experience with cybersecurity marketing? Is LinkedIn working for you or is the trade show circuit still your primary channel?


P.S who has the best pre-RSAC game?

It’s RSAC week and if you are the Head of Marketing and your CEO only makes 1 "I’m going to RSAC" post. 

U know u have missed an opportunity. 

An opportunity to raise awareness. 
An opportunity to warm up leads. 
An opportunity to stand out. 

Now all you can do is pray that the thousands that walk by your booth will be pulled in by the free tshirt. 

And spend 45 seconds giving yr marketing reps a slight nod every once in a while, with a sheepish smile. 
And a thank you. Before scurrying away with their prize in hand. 

You’ll never hear from them again. 

Hated reading that?

While it may be slightly late to "build authority", at least try to raise awareness for your organization with a last minute 5-post sequence.

Drop me a DM, I'll send you:
1. The Cybersecurity CEO’s Personal Brand Blueprint
2. 5 LinkedIn Posts Templates for Cyber CEOs


Stay safe.

Here is what Cyber CEOs should post on LinkedIn. Save this for ideas.  

Most Cyber CEOs only repost their company's content.
Or share updates about the latest hacks. Or they post random AI blogs.

But here's the thing:

- Those posts are generic.
- They don't stand out.
- They don't show leadership.

You are the leader. Lead by example.

Share customer success stories.
Talk about business lessons. 
Have a contrarian viewpoint. 

This is how you can stand out:

→ Highlight customer success stories.
Share real examples of how your company helped clients.
It builds trust and showcases your value.

→ Discuss lessons learned.
Talk about your experiences and what you’ve learned.
It shows you are growing and learning.

→ Voice strong opinions.
Take a stand on industry issues.
It positions you as a thought leader.

By doing this, you'll not just be another CEO. You'll position as aa leader who leads by example.

Make those posts count. 

Here are 26 types to choose from.

Type 1: Authority Posts
Examples:
Deep dive into project implementation
Demonstration of expertise
Client transformation
Knowledge sharing
Client testimonial
Opinions
Insights
Trends

Type 2: Personal Posts
Vision for company
Vision for products
Lessons learned
Founder stories
Team culture
Challenges
Leadership
Resilience
Wins

Type 3: Trust Posts
Highlight value proposition
Talk about problems solved
Demonstrate solutions
Customer pain points
Decision making 
Social proof
Principles
Results
Values

5 things Cyber CEOs do on LinkedIn that harms their brand and rep. 

Before you dismiss it as trivial, your prospects, clients, partners have and will take a glance at your profile. 

How will you show up in their snapshot assessment? Can you risk of they form an early impression?

1. Empty Profile

This may be acceptable in 2010. 
It will raise more questions than answers and you don’t want that. 

2. Unprofessional Pic and Banner

If you don’t accept a shoddy website, why would you accept an unpolished profile?

3. Boring copy across page 

From your headline to your about section and even your outdated experience page. 

If it screams a lack of attention and effort, doesn’t really move the needle forward does it?

4. Effortless content

Repost, repost, repost, repost

And you wonder why this platform sucks. 


5. Full on AI Bonanza

We have all seen it. 
Posts with more fluff than insights. 
Comments that don’t make sense. 
Spam DMs that lead to being reported. 

This is a straight road to being banned.  



When was the last time you audited your profile and campaign?

P.S what else are folks doing wrong here?

I spent years simulating attacks and training naval warfare teams. 

Wargaming and simulation to hone tactical nuance, command and control, and making decisions under pressure.  

These played out in a simulation centre so that when the teams are out at sea, they have the confidence and clarity in execution. 

It is not so much different to readiness in cyber incident response. 

I started building and running tabletop exercises and cyber range simulations for banks, regulators, manufacturers, ministries. 

Same discipline, different domain. 

Subject teams to pressure and guide how they handle it. 

What I kept noticing had nothing to do with firewalls or detection tools. It was about who could communicate clearly when the pressure builds. 

Who could look at a chaotic situation and build a clear picture of what was happening, what it meant, and what needed to happen next.

The technical teams usually understood the problem. The ones who succeeded were the ones who could explain it to everyone else in the room.

What are some horror stories you have seen during incident response and exercises?

Amazon and Samsung didn't assess their AI-related risk properly, and got burned.

The weakest link?

Lack of processes and guardrails.

- "There's no governance in place, not even an AI policy."
- "We're moving at Mach 7" when it comes to AI products.
- "We're rolling out dozens, if not hundreds, of AI-powered tools."

Sound familiar? These are all things security leaders have said to me.

What they - and you - desperately need is a comprehensive and structured approach to managing the resulting risk.

While revolutionary - and critical to any business that wants to survive - artificial intelligence can create cybersecurity, compliance, and privacy headaches.

You need the right tools to navigate these competing demands.

Dealing with internal and external stakeholders can be even more demanding, requiring not just an understanding of the issues but the ability to communicate them effectively and quickly.

Here's what your plan should look like:

1. Identify the business needs. Successfully automating your operations with AI will probably be the difference between your company's success and failure, so you'll need to look throughout your organization to understand where to deploy these tools, and in what priority.

2. Analyze the security, privacy, and compliance risks. How is your SaaS vendor managing your data? Are you subject to the GDPR, CCPA, or any other data privacy obligations (hint: you probably are)? What frameworks (e.g. ISO 42001, HITRUST, EU AI Act) do you need to comply with? You'll need to know these things before heading to the next step.

3. Apply controls. This includes making sure you have a company-wide policy, creating a structured framework for risk decisions, and deploying the right technical safeguards to your AI systems. You'll need to train up your team on all of these things as well.

So, if you're a security, compliance, or tech leader who wants to launch AI-enabled products without fear,

it’s time to look at your AI-related risk NOW.

Need an assessment?

DM me.

Walter Haydock

3 common AI governance myths, and how I advise clients otherwise to avoid costly mistakes:

1. "Generative AI SaaS is insecure"
   
ChatGPT and some other Software-as-a-Service (SaaS) AI tools do train on inputs by default.

They can retain data indefinitely even if not training on it.

These are real risks.

But there are ways to avoid them, whether through:

-> Opting-out
-> Zero data retention (ZDR)
-> Enterprise/business versions

And self-hosting models has its own problem.

Cloud misconfigurations are more likely, which can lead to breaches.

The key here?

Developing a balanced, risk-based approach that incorporates

-> Compliance
-> Security
-> Privacy

concerns along with business needs.

And make sure you don’t accidentally ​become​ a data center company because you are afraid of SaaS risks.

2. "I should start my program with AI security tools"

Tools can help, but only with a firm foundation.

Security teams fixate on the shiny and new. But often it's boring stuff that needs to be done first, like:

-> Asset inventory
-> Data classification
-> Vendor management

Building a strategy around tools is backwards.

Unused tools are financially wasteful and can themselves become a net security risk if not managed.

3. "Once I have an AI governance committee, I’m done"
4. 
A committee can help if structured the right way.

But if turns into a debate club and can't make decisions, innovation will suffer.

Here is what I recommend for my clients:

-> Clear decision authority
-> An established risk appetite
-> Hard limits on time to respond to requests

And before you stand up a committee, consider assigning AI risk management (but not ownership) to a single business unit.

TL;DR - the top 3 AI governance myths I encounter are:

1. "Generative AI SaaS is insecure"
2. "I should start my program with AI security tools"
3. "Once I have an AI governance committee, I’m done"

Are your beliefs about AI governance serving you?

I help AI-powered companies innovate responsibly by managing cyber, compliance, and privacy risk | ISO 42001, NIST AI RMF, and EU AI Act expert | Host, Deploy Securely Podcast | Harvard MBA | Marine veteran

taplio

The Battle

Lester Chng

Walter Haydock

Followers

Posts

Engagements

Likes

Performance ScoreLester Chng's LinkedIn Performance

Performance ScoreWalter Haydock's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Lester Chng

Walter Haydock

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Lester Chng's LinkedIn Performance

Performance ScoreWalter Haydock's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreLester Chng's LinkedIn Performance