A programmatic approach to enterprise security

Luke McOmie opens by polling the audience on why they run security programs, assessments and penetration tests. Common answers such as compliance requirements, insurance demands and once-a-year testing become the starting point for his critique. He argues that yearly provider changes, reliance on vulnerability scan dashboards and opaque risk scorecards give leaders a false sense of coverage while losing the depth that comes from knowing an environment over time.

The middle of the talk covers firefighting, one-off projects and cyber insurance used as a substitute for protection. McOmie describes how executives are more likely to fund security work when it is framed in financial and operational terms, such as the cost of remediation and the return on the effort, rather than in severity ratings or fear of reputational damage. He recommends learning how the business makes money before discussing technology, bringing people from across departments into a security council, and cross-mapping overlapping compliance requirements into a single readiness assessment. He is also skeptical of zero trust sales pitches for organizations without large budgets or specialized staff.

The closing section steps back to a practical takeaway: treat security as a living, continuous process, prioritize work by its impact on the business, and avoid adopting industry defaults without checking them against your own environment. He gives the example of a low-rated SMB signing finding that testers often use early in an engagement. The talk ends with an invitation to continue the conversation informally and a short personal note.