Throwing the Elephant

Bryson Bort frames corporate leadership as an elephant: large, slow to move, and indifferent to security unless it sees a business reason to act. He argues that technical skill alone will not shift priorities, so the talk starts with how budgets flow through a company. He cites survey figures showing that few boards have a dedicated cybersecurity committee. He then suggests learning what leaders value from public filings, investor briefings and management books.

Bort then turns to practical steps. He suggests mapping existing controls with the Cyber Defense Matrix to spot strengths and gaps, and pulling threat groups for your industry from MITRE ATT&CK as a realistic starting point. His purple team process sets milestones, predicts outcomes together, then tunes detections as each technique runs. For ransomware he recommends simulating encryption on dummy data. He also outlines a starter scenario using living-off-the-land binaries and PowerShell, with Sysmon for visibility.

The closing section turns to metrics and engagement. Bort recommends measuring visibility, alert fidelity and response speed, reporting results as business impact rather than lists of hosts, and starting with crown jewel assets. For wider buy-in he proposes tabletop exercises, security champions in other departments, and inviting IT and business staff to observe purple team work.