The Rook – Details, episodes & analysis

Podcast details

Technical and general information from the podcast's RSS feed.

The Rook

David Shaw

Business

Frequency: 1 episode/34d. Total Eps: 6

Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts.

Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job.

Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it.

New episodes every other Tuesday.

Read moreCollapse

Site

RSS

Apple

Data updated on 23/10/2026

Recent rankings

Latest chart positions across Apple Podcasts and Spotify rankings.

Apple Podcasts

🇨🇦 Canada - Management
23/10/2026
#99

Spotify

No recent rankings available

Shared links between episodes and podcasts

Links found in episode descriptions and other podcasts that share them.

See all

https://www.verizon.com/business/resources/reports/dbir/
2 shares
https://corvus-cyber.com/the-2027-security-budget-worksheet/
2 shares
https://sophos.com/ransomware2026
2 shares

RSS feed quality and score

Technical evaluation of the podcast's RSS feed quality and structure.

See all

RSS feed quality

To improve

Score global : 48%

Publication history

Monthly episode publishing history over the past years.

Year

Latest published episodes

Recent episodes with titles, durations, and descriptions.

See all

Before You Approve the 2027 Security Budget

Season 1 · Episode 6

Thursday, October 15, 2026 • Duration 15:52

Send us Fan Mail

That cybersecurity budget request about to land on the CFO's desk is full of acronyms and tool names, and the number probably went up again. This episode gives you five questions that turn it into a business decision you can defend from either side of the table.

Who it's for: CFOs and finance leaders who approve the budget, and the IT lead, security lead, MSP or vCISO who submits it.

The five questions:

What would hurt most if it stopped working or leaked?
What do we own, and is it working for us?
What is required from outside, and what is a business call?
What becomes more likely if we cut this?
Who is accountable for the outcome?

Free one-page worksheet that follows the five questions: https://corvus-cyber.com/the-2027-security-budget-worksheet/

Chapters
0:00 The budget request about to land
2:03 Five questions and a one-page worksheet
3:01 1. What would hurt most
6:08 2. What do we own, and is it working
7:50 3. Required from outside vs a business call
10:10 4. What becomes more likely if we cut this
12:07 5. Who is accountable
13:47 The decision that fits on one page
15:13 Your move

Sources
Verizon 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/
Sophos, The State of Ransomware 2026: https://sophos.com/ransomware2026
IANS and Artico Search, 2026 Security Budget Benchmark: https://www.ians.com/blog/security-budgets-stall-as-ai-reshapes-2027-spending

The Rook is a show about the business decisions underneath cybersecurity headlines, by David Shaw of Corvus Cybersecurity. corvus-cyber.com

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Read moreCollapse

The Rook EP005 - The Leverage is the Data

Season 1 · Episode 5

Wednesday, September 30, 2026 • Duration 15:33

Send us Fan Mail

Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure

David Shaw explains that ransomware leverage is shifting from encrypting systems to stealing data and threatening public exposure, using Galaxy Warden’s report that Canadian immersive media company PHI Studio appeared on Nova Ransomware’s leak site on July 17 after data was exfiltrated. He argues this model particularly endangers creative and IP-heavy businesses because unreleased work, client contracts, and other confidential assets can be exposed without operational downtime. Shaw connects the threat to CISA’s Known Exploited Vulnerabilities Catalog, highlighting actively exploited flaws in edge-facing systems like remote access platforms, identity infrastructure (e.g., ADFS), collaboration tools (e.g., SharePoint), and critical apps. He stresses detection and monitoring (EDR and network visibility), tested response readiness, and insurance realities as carriers remove silent cyber coverage and scrutinize MFA and controls. He recommends executives ask about KEV patch status, phishing-resistant MFA compliance, and whether a 48-hour intruder would be detected.

00:00 Silent Ransomware Shift
01:22 Meet The Rook
02:30 PHI Studio Case Breakdown
03:11 Why Exposure Hurts Most
04:28 CISA KEV And The Door
06:07 From Downtime To Liability
06:59 Detecting Exfiltration With EDR
08:44 Vulnerabilities To Full Breach Chain
09:52 Insurance And Control Requirements
11:24 Three Questions To Ask Now
14:25 Wrap Up And Next Steps

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Read moreCollapse

The Rook EP004 - The $200,000 Gap

Season 1 · Episode 4

Wednesday, September 23, 2026 • Duration 11:55

Send us Fan Mail

The $200,000 Security Leadership Gap: CISO, Internal Promotion, or Fractional vCISO

There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem. It's what the 2026 CISO Report from Cybersecurity Ventures and Sophos calls a market failure.

Most companies under $50 million in revenue never close that gap with a full-time hire; the math doesn't work at that scale. Instead, security decisions get made informally: an IT director carrying a second job, a compliance program built to pass audits rather than manage risk, or no one at all. Host David Shaw (CISSP, GLEG) walks through what actually fills the gap: a full-time CISO, an internal promotion, or a fractional vCISO, what each one costs, where each one works, and where each one fails.

In this episode:

The 10,000-to-1 CISO-to-business ratio, and why the 2026 CISO Report calls it a market failure
The three informal models that fill the gap when there's no security leader, and why each one breaks down under pressure
Full-time CISO vs. internal promotion vs. fractional vCISO: honest costs and tradeoffs for each
The revenue thresholds where each option actually makes sense
An illustrative example of what an unaddressed gap costs when a known, escalated risk goes unfixed

The Security Leadership Readiness Check, five questions:

Who is accountable to the CEO or board for security risk, by name, as a primary responsibility?
When was security last on the board agenda as a standalone item, not folded into an IT update?
Do you have a documented security roadmap with budget attached, reviewed at least annually?
In the last 12 months, has an executive overridden an IT security recommendation, and do you know why?
If you had a material security incident tomorrow, who makes the notification and response decisions, and have you rehearsed it?

The Rook EP003 - Notice Is the New Negligence

Season 1 · Episode 3

Monday, September 7, 2026 • Duration 20:58

Send us Fan Mail

CISA adding a vulnerability to its Known Exploited Vulnerabilities catalog isn't a patch reminder anymore. It's the moment your insurer and your counterparty's diligence team start treating you as someone who was on notice, and if you didn't patch, that's on you.

In this episode, David Shaw walks through how the KEV catalog moved from a federal compliance tool to a market-facing liability standard, the exploited vulnerabilities in Oracle, SonicWall, VMware, Microsoft, and Citrix systems that drove that shift across July, August, and early September, what insurers and diligence teams now read into a KEV listing, and the three conversations every executive needs to have this week.

In this episode:

What the KEV catalog is, and why it moved from government plumbing to a market liability standard
The exploited flaws behind that shift: Oracle E-Business Suite Payments, SonicWall SMA1000, VMware vCenter, Microsoft AD FS and SharePoint, and Citrix NetScaler
How insurers and incident response firms cite KEV entries to build a documented record of notice
What KEV exposure means in M&A diligence, rep and warranty coverage, and escrow
The vendor-risk lesson from the Suno breach
The three conversations to have this week: with your IT lead or MSP, your insurer or broker, and your diligence team

Resources mentioned:

CISA Known Exploited Vulnerabilities (KEV) Catalog
CISA Binding Operational Directives 22-01 and 26-04
Beazley Security and eSentire advisories

Connect with David Shaw:

Website: corvus-cyber.com
LinkedIn: linkedin.com/in/djshaw
Email: david@corvus-cyber.com

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

The Rook EP002 - Your Compliance Program Is Not a Security Program

Season 1 · Episode 2

Tuesday, May 19, 2026 • Duration 18:53

Send us Fan Mail

A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what executives read into it is where most companies are quietly carrying real risk.

In this episode, David Shaw walks through what compliance audits actually evaluate, the three places where compliance and real security pull apart inside companies (access management, detection, out-of-scope creep), what someone running a real security practice will tell the board, and the two questions every board should be putting on the agenda at the meeting after the next audit closes.

In this episode:

What an audit actually answers, and what it doesn't
Why the gap between the report and reality isn't a failure of the audit
The three places compliance and real security pull apart: access, detection, scope
What a real security practice looks like, versus a compliance program
What someone running a real program will tell the board
The two questions to put on the agenda after the next audit closes

Resources mentioned:

SOC 2, ISO 27001, PCI, NIST, HIPAA frameworks

Connect with David Shaw:

Website: corvus-cyber.com
LinkedIn: linkedin.com/in/djshaw
Email: david@corvus-cyber.com

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Read moreCollapse

The Rook EP001 - The Deal You Didn’t Know You Made: Cyber Risk in M&A

Monday, April 27, 2026 • Duration 20:19

Send us Fan Mail

In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs.

In this episode:

How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligence
How Marriott bought a four-year-old, undetected breach when it acquired Starwood
Why the standard M&A cybersecurity questionnaire fails to catch material risk
How R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teams
The four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisions
What sellers should be doing now to protect deal value
Three artifacts every buyer should require, not just three questions to ask

The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

Read moreCollapse

The Rook – Details, episodes & analysis

Podcast details

Recent rankings

Apple Podcasts

Spotify

Shared links between episodes and podcasts

RSS feed quality and score

Publication history

Latest published episodes

Related Shows Based on Content Similarities

Apple Podcasts

Spotify

Related Shows Based on Content Similarities

The Rook – Details, episodes & analysis

Podcast details

Recent rankings

Apple Podcasts

Spotify

Shared links between episodes and podcasts

Other8

Buzzsprout1

RSS feed quality and score

Publication history

Latest published episodes

Similar podcasts and content

Related Shows Based on Content Similarities

Apple Podcasts

Spotify

Related Shows Based on Content Similarities

Other8

Buzzsprout1