European CISO of the Year 2024 | Visionary Cybersecurity Leader & Executive Coach

I help organisations transform the way they think about cybersecurity — shifting from compliance & controls to culture & resilience.

With over 20 years of experience in information and cybersecurity, I’ve built and led global programs that fuse strategic vision with pragmatic delivery, pairing academic insight with real-world leadership. As a coach and trainer, I’m passionate about turning cybersecurity professionals into trusted business leaders.

📌 What I bring to the table:
•	Recognised as European CISO of the Year 2024, reinforcing my credibility as a top-tier practitioner.
•	A track record of designing and delivering global infosec programmes and teams, driving measurable business impact and fostering organisational transformation.
•	A unique intersection of leadership, organisational behaviour and cybersecurity culture — enabling companies to embed security into their DNA rather than treating it as an add-on.
•	A dynamic speaker and trainer praised for authenticity, inspiration and pragmatism — my sessions blend storytelling, research and leadership lessons to engage diverse audiences and bridge cultural/organisational divides.
•	A mindset of “yes!” to innovation and change — challenging the status quo and driving transformation beyond traditional boundaries.

🔍 How I can help you:
Whether you are looking for a strategic executive to lead cybersecurity through complex change, a coach who can elevate your leadership in a cyber context, or a speaker/trainer who can engage senior teams and multiply their impact — I bring the experience, the network, and the dedication to make it happen.

Let’s connect if you’re seeking a visionary executive or coach who can orchestrate cutting-edge cybersecurity strategy, embed innovation and resilience in your organisation, and help elevate your people and culture for sustained success in today’s digital landscape.

Certified as: CISSP, CISM, CISA, CRISC, CGEIT, CSX-P, CDPSE, CCT, C|EH, E|CSA, L|PT, C|CISO, C|HFI, C|NDA, CIPP/e, CIPM, CIPT, FIP, CCSP, CCSK, S-ISME, S-DPP, C31000, PCS, SABSA

I am a Cybersecurity Rockstar!

Patric Versteeg

Flavius Plesu

I’m Flavius, a seasoned cybersecurity leader and the CEO of OutThink. With 20 years of experience and a background as a CISO, I understand the complexities of securing large organizations. OutThink was born from my belief that people, when engaged beyond traditional security awareness, can become an organization’s strongest defense.

My passion not only lies in preventing data breaches but also in inspiring change and challenging the status quo. My team and I work enthusiastically to help businesses understand and manage cybersecurity human risk effectively.

As a speaker, I share insights on cybersecurity, human risk management, digital skills, and my journey as a founder. I welcome questions and insightful conversations, so feel free to reach out.

Founder & CEO

Not all password managers protect you in the same way.


At a glance, most modern password managers appear very similar. In practice, they contribute in materially different ways to security, privacy and responsibility placed on the user.

🔐 Built-in password managers (device or browser-based)

These tools are deeply integrated into the device or browser ecosystem, allowing passwords to be saved and filled automatically with very little user effort. This reduces day-to-day friction and lowers the chance of simple mistakes, but it also means credentials, identity, and access are often concentrated within a single ecosystem.

That centralisation can work well, but it also increases the impact of a single failure and tends to encourage reuse and over-reliance on defaults, especially when users are unaware of how recovery or account compromise is handled.

🔑 Dedicated password managers

Standalone tools usually require a more deliberate setup, including a master password and explicit decisions around organisation and sharing. While this adds friction upfront, it often results in better long-term credentials hygiene, clearer boundaries between accounts, and more thoughtful handling of access and recovery.

The tradeoff is that these tools rely more heavily on consistent user engagement, which can become a weakness when people are busy, distracted, or fatigued.

The more useful question is not which password manager has more features, but which one best supports how people actually work, minimising productivity impact.

Pic from Devolutions

Pioneering Human Risk Management as Founder & CEO of OutThink - the original CHRM platform made by CISOs, for CISOs

About a year ago, a French woman lost over €800,000 after being scammed by someone pretending to be Brad Pitt. 


And this kind of scam will only become increasingly frequent as AI and deepfakes become more convincing. 

When this story came out, a lot of people laughed and shook their heads while missing the lesson we could learn from this. 

The exchange didn’t start with money. It started with attention and messages that felt personal. Over time, the story became emotionally coherent, consistent and reassuring until the idea of questioning it felt more uncomfortable than believing it.

By the time money entered the picture, the decision had already been made at a psychological level.

And this has been the reality for decades before AI entered the picture - it’s just become quicker and easier for cybercriminals to be convincing now.

It’s important for us to understand that while on the surface a scam like this can make someone seem gullible, it’s still going to happen. 

The outdated security approach is to  assume that if we provide users with awareness and knowledge, they will always stay rational, sceptical and emotionally detached. But is that enough? Was that ever enough?

Some of the most meaningful ideas don’t come from getting there first, but from having enough life behind you to know why you’re there at all.

There’s something deeply compelling about people who start again with perspective - those who create not to impress, but to express, and whose work carries the weight of everything they’ve survived.

I still remember the first time I presented to the board as a CISO.


I spent days preparing the slides that provided every metric, every control and all the events that proved how much work my team was doing.

Five minutes into the presentation, I realised no one in the room understood what I was saying and the language I was using meant nothing to them.

That meeting taught me one of the most important lessons of my career: people won’t engage with anything if they can't relate to it. 

From then on, I approached my role as CISO very differently. I focused less on proving technical depth and more on building understanding, trust and value. Communication and people skills are often treated as secondary in cybersecurity, but these are really, really important. 

Unintentionally, that lesson eventually became the foundation of OutThink. Our vision is to put the 'human' at the heart of security operations, and engaging users is a key part of that. 

If people relate to security, they engage with it. And when they engage with it, organisations become genuinely safer.

One thing that continues to baffle me is how cybercriminals seem to understand the importance of human behaviour but many cybersecurity professionals still don’t. 

Cybercriminals know that individuals have different motivations, pressures, emotional states, levels of confidence and ways of making decisions. A phishing email aimed at a finance leader looks very different from one aimed at a graduate, a contractor or someone in HR. The tone, timing, language and emotional triggers are carefully chosen because attackers know that behaviour is situational and context matters.

Many security programmes, however, still assume the opposite.

Security awareness training and acceptable use policies are designed as if knowledge alone will override stress, distraction, authority bias, fear or the desire to be helpful. 

We expect people to behave “securely” in exactly the same way, regardless of what is happening around them, what pressure or incentives they are under or what past experiences they bring into the moment.

Attackers invest time in understanding people as humans first and users second. Too often, security teams are satisfied with generic, one-size-fits-all training, policies and security controls. 

If we want to reduce risk in a meaningful way, this is something we can learn from  cybercriminals - they already work by understanding human behaviour and the environment people operate in. Security needs to be designed to work for people and not against them. 

Until we shift our approach to human-centric security, it should not surprise us that those who understand (and exploit!) human behaviour are ahead of those that don’t.

When I first started OutThink, the term “human risk management” didn’t exist. 

(And no, I’m not that old)

7 years ago, I would walk into meetings with boards and CISOs, trying to explain a problem that many of us were aware of but very few could articulate. 

The reality was that over 90% of breaches involved the human element, but not enough was being done to fix that. The norm was annual training, phishing simulations and compliance reports and the assumption that knowledge alone would change behaviour. 

So suggesting that security teams must do something entirely different, to identify, understand and manage human risk - and that this should be largely automated, sounded unrealistic and too complicated to implement, and I understood why. It’s difficult to move away from something that has been accepted for so long. 

One of the most difficult parts about building OutThink at that time was learning to meet security leaders where they were, instead of trying to pull them into a future that felt too far away.

Today, the landscape looks very different. 

Human risk management is no longer a concept that needs defending, it’s a space with a lot of momentum and interest, shaped by leaders who know that the human element demands more thoughtful and more innovative solutions.

I’m excited to see more and more competitors pop up because this means there's demand for solutions that go beyond legacy phishing and training. 

We still have a long way to go, but the progress is crazy to look back on. What used to feel like a long while away is slowly becoming the standard. I’m proud that OutThink helped set that direction and even more excited to see the sector continue to evolve.

♞Mornay Walters Juan Gomez-Sanchez Andy Wood Benoît Herment
Romain Aviolat Hussein Shafik Bahgat Urmas Aamisepp Neil Cassidy Jonathan Webber Damon DePaolo Genady V. Bryan Kissinger, PhD Darren Kerr and many, many more - too many to tag!

Scammers are taking advantage of a job market that is already difficult to navigate, and it’s getting increasingly common. 

Cybercriminals know people are feeling stuck, uncertain or under pressure, and that urgency clouds judgement - so they use that against them because emotional momentum can be more powerful than technical awareness. 

What’s happening here isn’t about a lack of knowledge or awareness - it’s about emotional leverage. When someone is anxious, hopeful or under financial strain, urgency and reassurance can override even strong technical judgement.

If you’re job hunting:
Take a pause before responding to anything that feels unusually urgent or “too good to be true.” A short delay can be enough to regain clarity.

If you’re leading security teams or security programmes:
Education alone isn’t enough. We need to be providing clarity and support while cultivating trust instead of just telling people to “be careful” or “click wisely.”

If you’re working on this problem and have ideas on how we can do better together, I’d love to hear them.


Image credit to Josh Rangel

Some of the strongest leaders I’ve worked with throughout my career didn’t have fancy titles but they still showed up prepared, followed through with their commitments and took extreme ownership. 

They created clarity where there was confusion and calm where there was pressure. Over time, people trusted them and influence followed naturally.

If you want to lead from wherever you sit:
↳ Take ownership of outcomes, not just tasks
↳ Be the person who raises standards instead of lowering expectations
↳ Act in a way you’d be comfortable seeing copied across the organisation

Leadership isn’t about where you are on the org chart. It’s about the example you set when no one is asking you to lead, and you’re not even sure who’s watching. But you do it anyway. 

I came across this quote and immediately thought of Bogdan Perian. Thank you for being an authentic leader, Bogdan!

85% of organisations increased their security spend in 2025, and nearly 90% expect to invest even more in 2026, which reflects a growing recognition that cyber risk is no longer a technical issue sitting on the sidelines, but a core business concern.

Yet despite this upward trend, more than half of security leaders still believe their organisations are not investing enough to manage risk effectively, and that gap between intent and confidence is where many CISOs now find themselves.

As the report by Wiz says,  “CISOs are being asked to do more with more and are under new pressure to prove that rising spend translates into measurable outcomes”. 

Increased visibility and support in security provides us with the chance to rethink how we measure success - to move beyond ineffective metrics and compliance checklists, and focus instead on outcomes that actually matter: informed decision-making, changed behaviours and a risk-aware security culture.

If we use this increased investment wisely, we can break the cycle of: 

➟ getting more funding > being unable to prove or justify that budget resulting in budget cuts > having a material breach > getting more funding 

I’m hopeful that the next evolution of cybersecurity won’t just be better funded, it will be far more effective.

I’d be interested to hear how security leaders are approaching this shift as they plan for 2026!

When it comes to security, does there really always have to be a tradeoff, or do we treat it as fundamental because that’s what we’re used to?


A lot of the way we talk about security still relies on linear models where progress is framed as a choice between stronger controls on one end and the practical needs of running the business on the other.

That framing is useful to a point, but it also quietly reinforces the idea that friction is not only unavoidable, but necessary, and that the best we can hope for is to find a tolerable balance instead of questioning whether the balance itself is being defined in the right way.

Gartner found that 69% of employees admit to intentionally bypassing security controls, and the top reason for doing so is productivity. Users have deadlines and are under pressure to deliver so currently, a lot of security measures feel misaligned with how work actually happens, resulting in the need for tradeoffs.

I am not arguing that tradeoffs should/will never exist, because 100% frictionless security seems unrealistic, but many of the trade-offs we accept today feel less like unavoidable truths and more like the result of designing security around models and controls first, while treating the human element as something be corrected or contained, rather than understood and catered for.

If security starts from how people actually work, including their context, pressures, and intent, the conversation shifts away from asking how much friction the business should tolerate and towards questioning why that friction was introduced in the first place.

We may never reach perfect security, but we can do better than assuming that visible friction is proof that security is working.

taplio

The Battle

Patric Versteeg

Flavius Plesu

Followers

Posts

Engagements

Likes

Performance ScoreFlavius Plesu's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Patric Versteeg

Flavius Plesu

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Flavius Plesu's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreFlavius Plesu's LinkedIn Performance