CISO/vCISO | IT/IS Leadership | Mentor | MSc., CCSP, CISM, CRISC, CMMC RP

I help organizations make confident, risk‑informed decisions by turning complex cybersecurity and regulatory challenges into clear, actionable strategy. For 20+ years, I’ve advised mid‑market and Fortune 50 companies across automotive, healthcare, financial services, energy, and higher education - leading security programs, maturing governance, and guiding executives through high‑stakes decisions.

As a Field CISO and vCISO, I build and lead security programs, drive regulatory alignment (ISO 27001, NIST CSF, CMMC, TISAX, HIPAA, PCI), and strengthen resilience through practical, business‑aligned risk management. I’ve scaled consulting practices, supported sales and client growth as a senior SME, and led organizations through major incidents, including enterprise‑wide ransomware events.

I’m also an educator and industry voice; adjunct professor, APMG-accredited ISACA instructor, and frequent podcast and webinar guest on cybersecurity, privacy, AI, and connected‑vehicle risk.

Whether advising as a vCISO or stepping into a full‑time executive role, I focus on clarity, credibility, and measurable outcomes. If your organization needs strategic leadership, program maturity, or a trusted partner who can bridge technical depth with executive decision‑making, I’m always open to a conversation.

EDIT: Context added at the bottom...

The ISACA CISM isn't easy, Fam.

The CISSP has a reputation for being nigh on impossible to master the first time through - but it's just trivia.  It relies on the same parts of the brain that remember the names of all of the cast members of Friends or that Jeff Ament and Stone Gossard were founding members of Mother Love Bone before Pearl Jam was formed.   If you've got an encyclopedic recollection of one-liners from '90s comedies, you can prepare for the CISSP. 

It's a particularly nerdy version of Jeopardy! - or Whose Line, maybe.

Everything's made up and the points don't matter.

Anyway, ISACA's exams are not this way; they require a mindset shift.  You have to adopt ISACA's *perspective* on InfoSec/GRC leadership.

So when I hear from folks I've met with or taught for in the past that they've conquered the CISM credential, I know it isn't because they memorized the three key sizes for the AES encryption algorithm or the first year that the Orange Book was published or the minimum distance between primary and alternate processing facilities - it's because they now SEE what it means to be a leader in this space, providing real value to business.

Congratulations, Nicolle Rosecrans ITIL, CISO, CISM, on EARNING the CISM credential.  You are awesome.

😶 

...Folks, a LOT of you have taken this post directly at face value when I meant for it to be tongue-in-cheek and the POINT was to recognize the efforts of someone who put a ton of time into the process of studying for the CISM credential.

CISSP is anything BUT a trivial exam.  It IS scenario-based and requires the candidate to understand the subject matter clearly - while ALSO covering "an inch deep and a mile wide of topics" that, frankly, you just have to commit to memory to find success.

I teach both.  I hold both.  I wrote a piece for TechTarget a bit back about the two certs - CISSP is still the gold standard for our industry and CISM is highly sought-after based on its strong focus on business priorities and where the security/GRC/risk management leader fits into the larger puzzle.

I'll return to this...  The POINT of this post wasn't to call forth from the depths those who think I'm anti-CISSP.  There are people who fit that description, but I am not one of them.

The point was to recognize the efforts of a person who FOUGHT to make a challenging credential her own.

Mike Pedrick, CISSP

I believe that all businesses are at risk - hackers, crackers, nation states and bad actors - but small- and medium-sized businesses have to defend themselves against the same threats as the major corporations with fewer resources at their disposal.  Who helps small business leaders navigate the murky waters of risk management, governance, compliance, privacy, and guerilla marketing campaigns?

Well...  I do.

CISO/vCISO & GRC Leader | Strategic Risk Management | Driving Cross-Industry Program Excellence

I believe...

➡️ If a thing CAN exist, it DOES exist somewhere.  You might never find it, but that doesn't mean it doesn't exist.

➡️ When you step in 💩, own it.

We do so love our tribalisms, don't we?  Coke vs. Pepsi.  Raiders vs., well, Everyone.  Red vs. Blue.

...CISSP vs. CISM.

Yesterday, I made a tongue-in-cheek post recognizing the accomplishment of someone who worked very hard to earn the ISACA CISM credential.  I made a comical reference to the ISC2 CISSP's structure of leaning into its famous 'inch deep and a mile wide' need for memorization of facts, figures, and trivia one needs only long enough to pass the exam.

Let's be clear here, folks...  CISSP ain't no joke, either.  I spent a full 18 months prepping for the thing myself and was over the moon that I'd passed it on the first attempt.  I know more about fire extinguisher systems, steganography, and the Stored Communications Act of 1986 than I'd ever wanted to before and I'm probably better off for it.

A friend of mine read that post and asked me if maybe I'd taken too sharp a jab at the folks who, like the woman whose CISM win I decided warranted recognition, had a similar experience taking on the CISSP.

And you know what?  That's fair enough.  I'd celebrate those wins just as vociferously.

...I knew that there COULD be what I'll refer to as CISSP Stans.  Yesterday, I found some of them.  You'd think I'd slept with their spouse the way they took offense to my comments.

I'm not saying I didn't, but it felt like a leap to get there from the post I made yesterday.

At any rate, I teach multiple credentials and will *always* stan for those folks who don't give up until they make the thing their own - CISSP, CISM, or any other InfoSec/GRC/Privacy credential.

Always.

To say Meta's new spywear is problematic really undersells the thing.

Co-founder of the AI, Tech & Privacy Academy (1,400+ participants), Author of Luiza’s Newsletter (91,000+ subscribers), Mother of 3

"Meta's smart glasses have been unknowingly recording people getting undressed, sitting on the toilet and even having sex - with the resulting footage then reviewed by data workers thousands of miles away."

Nearly every attack chain we have conceived of includes a process by which the attackers establish a foothold in the environment.  This gives them persistent access so that they can accomplish their mission.

And yet...

There are still MSPs and MSSPs out here *not* establishing the same in the networks of clients who are paying good money for reliable services.

Huh.

#BuildaBetterClient

I'm not the kind of cat that enjoys spending time standing in a line.  I find that the longer I am in line, the higher my expectations become.

While at Disney Springs, I saw a line around the building for a place advertising "Cookies, Cakes, and Curiosities."  Through tiny, dark windows, I could see dusty, hardcover books - and nothing else.

Alright, folks - you have my attention.

I heard from a few of my queue mates that Gideon's Bakehouse is one of the stops they commit to making when they come to Disney, 90-minute wait and all.

Coming away from the experience, I was filled with thoughts.  And sugar - so much sugar.  😶 

1️⃣ Bottom line up front: the cookies aren't bad, but they're not spectacular, either.  I'd love for them to be more hot and fresh, less pulled out of a drawer at the register - but I get it.  These folks move *thousands* of these little gut bombs in a day.

2️⃣ I immediately recognized Michael Reyes' artwork throughout the shop and it is *perfect* for the aesthetic; I couldn't be more pleased to see Mr. Eyes getting his signature style out into the (Disney) World in such a wonderful way.

3️⃣ The word on the street - literally - builds SO much hype for the product.  No MBA-fueled marketing wizardry, even in the presence of a bottomless budget, can generate the type of goodwill and demand that gets created by hopelessly romantic diabetics waxing ecstatic about the product.  Leaning into the aesthetic, too, which stands out like a sore thumb yards from a Michelin-starred Asian fusion restaurant in the heart of one of the world's most beloved parks but gives up no secrets from the outside looking in, is an enviable strategy that'd be almost impossible to replicate.

It's fun, it's intriguing, and it's flat-out intelligent.  It's the intersection of intentionally mean margins, public interest, and the cult of personality that all the best small businesses cultivate until they're inevitably bought up by a corporate conglomerate and the lightning is let back out of the bottle.

If you find yourself at Disney World, make the trip.  Stand in line.  Try the cookies - but digest the experience.

Good stuff.

I submit to you all that the DeLorean is one of the weirdest, most wonderful American automobiles of our - or any - time.  The story surrounding it, from conception to creation to its impact on pop culture, would fill libraries.

It doesn't matter what YOU drive.  If you arrive somewhere with someone driving a DeLorean, you're now invisible.  Kids of all ages (especially those in their 40s and 50s) vibrate with pure joy at the thought of sitting in one of these rare creatures.

I will also submit that, true to the legends, they sometimes need a little love on long journeys through unpleasant climates.

This particular one has seen several Rally North America charity events.  I'm hoping to see it, as well as our good friend who owns it, in 2026 when we visit the Ohio Valley.

Please help us out by Liking, Sharing, and interacting with these posts and, if you can, help us reach our fundraising goal by donating here:

https://lnkd.in/gcejZiTs

Everything counts and it all goes directly to Hope For The Warriors®. You'll receive a receipt you can use for tax purposes. HUGE thank you to those who have donated this and any other year.

If you're a small business and you like the cause, let's talk about getting your sticker on our car for the duration of the event.

Click here for past Slightly Lost posts: #slightlylost661

taplio

Mike Pedrick's Linkedin Analytics

Mike Pedrick, CISSP

Performance ScoreMike Pedrick, CISSP's LinkedIn Performance

Mike Pedrick, CISSP's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Mike Pedrick's Linkedin Analytics

Mike Pedrick, CISSP

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Mike Pedrick, CISSP's LinkedIn Performance

Mike Pedrick, CISSP's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Mike Pedrick's Linkedin Analytics

Performance ScoreMike Pedrick, CISSP's LinkedIn Performance

Mike Pedrick, CISSP's Best Posts (last 30 days)