Take your security program maturity, cyber risk quantification, and board reporting to the next level with practical insights on advancing beyond baseline frameworks, governing rapid AI adoption, and building continuous operational resilience. It’s time to move past chasing every “shiny new toy” and refocus your strategy on core hygiene, financial risk translation, and actionable metrics. Who better to guide you through this transition than Qualcomm Cybersecurity Program Strategy Lead, former digital health DPO, and Qualified Technology Executive (QTE), Jim Covington?
You will learn why aiming for a level 5 maturity across every NIST CSF domain isn’t always the right business move, how to translate technical security gaps into financial loss metrics that boards care about, and why continuous system rollover is replacing legacy 30-day patch cycles. Get motivated to cut through reporting noise, implement AI governance with real teeth, and build security programs designed for ultimate business resilience!
Takeaways:
Targeted NIST CSF Maturity: Organizations don’t need a 5.0 maturity rating across every domain; target high maturity for critical functions like Incident Response and balance other domains around business risk appetite.
Speaking the Board’s Financial Language: Technical scores and 1-to-5 heatmaps no longer cut it; converting cyber risk into potential financial loss or gain is essential for securing executive buy-in.
The Perils of Chasing “Shiny Toys”: Leaders often chase cloud, machine learning, or generative AI while neglecting basic cyber hygiene; mastering 80% to 90% of the CIS Top 10 remains the most effective defense.
Continuous Rollovers vs. Patch Tickets: With zero-day exploit velocity shrinking, traditional ticketing to IT teams is failing; continuous 24- to 48-hour automated system updates represent the future of vulnerability management.
AI Governance Requires Real Teeth: While organizations rush to deploy AI agents and tools, steering committees often lack the purview and enforcement mechanisms needed to manage internal and external data risks.
Quote of the Show:
“The risk needs to be converted into financial loss or gain in order for the executives and boards to really take notice and understand, to be able to speak their language.” - Jim Covington
Links:
LinkedIn: https://www.linkedin.com/in/covingtonsd/
Website: https://www.qualcomm.com/
Ways to Tune In:
Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297
