Darwin said it's not the strongest or the smartest that survive and thrive, but the quickest to adapt to change. Speed is everything if you want to run a company successfully. To do that, you need to build a culture of operating with urgency. That doesn’t mean you run frazzled or do a million things simultaneously. Nor does it mean being too flexible and nice when dependent teams tell you, “Go wait.”

At Amazon, Jeff Bezos was famous for having an empty chair in the meeting room that represented the customer. I admire him for that because as the organization grows, it's easy to have meetings that are so focused on metrics, KPIs, internal execution, etc. that you lose sight of the customer. Here’s how we practice being customer-obsessed at SecurityScorecard: We make sure that we start every meeting by sharing customer insights, such as.

Over $800,000 - that’s the cost of the average ransomware payout last year. 66% of mid-sized organizations and about 37% of global organizations got hit. (Sources cited below) Attackers have developed new techniques that a lot of companies aren’t aware of or prepared for. For example, the demand for ransomware as a service has hugely increased, resulting in many more organizations being hacked every day.

"I understand the pitfalls of cyber security, but my boss just won't support me with the budget I need.” Does this sound familiar to you as a CISO? I have 3 pieces of advice for you: Speak their language I like to say that CISOs are from Mars, while CEOs and board members are from Venus. It’s because they don't speak the same language. You might go to your board and say, “I installed Akamai Prolexic.1.4.4.3.1./24 subnet to mitigate an SYN flood attack.”

Here are 3 tips for founders and CEOs to have a work-life balance: As a founder/CEO, there are always 500 more things you could do at the end of the day, the next day, and the day thereafter. So you’ve to ask questions like:“What can I do that will deliver 10x results?”“What can I do to move the needle the most?”“What areas will the results be the same unless I get involved?” Before each day starts, I ask myself, “What are the top few things I need to accomplish?”

Here’s why you should check a company’s overall cyber security health before acquiring it: You could be doing a great job protecting your company. But then, if you merge with a business with holes and attackers are already inside it, their problem becomes your problem. So you need to build a rigorous methodology and a playbook to assess the security of your target during the M&A diligence. Here’s how you can do it.

Vulnerability scans test for different misconfigurations and report the vulnerabilities. But they have 2 big drawbacks: You need to get consent from a company before you do a vulnerability scan on them. You may get a very rigorous readout from a vulnerability scan. But then a sleep-deprived IT administrator misconfigured the system, making your report irrelevant. On the other hand, security ratings don’t need anybody’s consent and provide continuous, real-time monitoring.

“My company has cyber insurance. Isn’t that enough to protect us?” NO. Cyber insurance will help you cover the damages but won’t protect you from being hacked in the 1st place or recover as soon as possible if you’re attacked. In fact, a lot of progressive cyber insurance companies today also provide preventative care tools (like SecurityScorecard). They know the importance of having an entire cybersecurity toolset rather than just having insurance.

We charge 0$ for additional login at SecurityScorecard. Here's why: One of our company values is customer-centricity. So we asked ourselves: "What's best for the customer?" What's best for customers is to give logins to as many people in the organization as possible. We want every team in the organization to benefit from the insights provided by the SecurityScorecards, including: This way, everybody knows the risk of entering into a proof of concept engagement or signing a contract with a vendor or service provider.

Stop using questionnaires to assess the risk of your business partners. Here's why: Suppose you want to hire a marketing firm to help grow your company. To assess the risk, you send them a 20-page questionnaire asking about 2-factor authentication, data encryption, etc. Even if they have a 2-factor authentication in place, e.g., you still have to ask for their company policy to verify. Not only does that result in mountains of paperwork.