Invited

Chris Roberts and Charles Valentine open by explaining why Roberts moved from an outside consultancy into an aerospace and manufacturing organization, where he works as the security lead reporting into the CFO. They describe how they began at the company by listening to engineers who had bad experiences with strict security rules elsewhere. Their first changes made daily work easier, such as identity tools with passwordless login and tuned multi-factor prompts.

The middle of the talk focuses on people. The speakers favour short, humorous awareness videos over simulated phishing, and they describe an internal test of two training vendors in which one group's scores fell after training, so they recommend measuring training before buying it. They also urge buyers to question vendors on accountability and to choose smaller partners who stand behind their work. For boards, they advise reporting risk in business terms, such as how many days systems can stay unpatched, and starting with a basic inventory of assets before buying tools. Compliance, finance and IT were brought toward shared goals, and a 90-day plan with clear priorities helped a new security leader get started quickly.

The closing message is that practitioners can change how security is seen by speaking plainly, demonstrating results, and working with engineering, IT and finance rather than apart from them. The speakers plan to return periodically to report on what is working.