Dive into the complete episode list for The Rook. Each episode is cataloged with detailed descriptions, making it easy to find and explore specific topics. Keep track of all episodes from your favorite podcast and never miss a moment of insightful content.
That cybersecurity budget request about to land on the CFO's desk is full of acronyms and tool names, and the number probably went up again. This episode gives you five questions that turn it into a business decision you can defend from either side of the table.
Who it's for: CFOs and finance leaders who approve the budget, and the IT lead, security lead, MSP or vCISO who submits it.
The five questions:
What would hurt most if it stopped working or leaked?
What do we own, and is it working for us?
What is required from outside, and what is a business call?
Chapters 0:00 The budget request about to land 2:03 Five questions and a one-page worksheet 3:01 1. What would hurt most 6:08 2. What do we own, and is it working 7:50 3. Required from outside vs a business call 10:10 4. What becomes more likely if we cut this 12:07 5. Who is accountable 13:47 The decision that fits on one page 15:13 Your move
Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure
David Shaw explains that ransomware leverage is shifting from encrypting systems to stealing data and threatening public exposure, using Galaxy Warden’s report that Canadian immersive media company PHI Studio appeared on Nova Ransomware’s leak site on July 17 after data was exfiltrated. He argues this model particularly endangers creative and IP-heavy businesses because unreleased work, client contracts, and other confidential assets can be exposed without operational downtime. Shaw connects the threat to CISA’s Known Exploited Vulnerabilities Catalog, highlighting actively exploited flaws in edge-facing systems like remote access platforms, identity infrastructure (e.g., ADFS), collaboration tools (e.g., SharePoint), and critical apps. He stresses detection and monitoring (EDR and network visibility), tested response readiness, and insurance realities as carriers remove silent cyber coverage and scrutinize MFA and controls. He recommends executives ask about KEV patch status, phishing-resistant MFA compliance, and whether a 48-hour intruder would be detected.
00:00 Silent Ransomware Shift 01:22 Meet The Rook 02:30 PHI Studio Case Breakdown 03:11 Why Exposure Hurts Most 04:28 CISA KEV And The Door 06:07 From Downtime To Liability 06:59 Detecting Exfiltration With EDR 08:44 Vulnerabilities To Full Breach Chain 09:52 Insurance And Control Requirements 11:24 Three Questions To Ask Now 14:25 Wrap Up And Next Steps
The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG
The $200,000 Security Leadership Gap: CISO, Internal Promotion, or Fractional vCISO
There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem. It's what the 2026 CISO Report from Cybersecurity Ventures and Sophos calls a market failure.
Most companies under $50 million in revenue never close that gap with a full-time hire; the math doesn't work at that scale. Instead, security decisions get made informally: an IT director carrying a second job, a compliance program built to pass audits rather than manage risk, or no one at all. Host David Shaw (CISSP, GLEG) walks through what actually fills the gap: a full-time CISO, an internal promotion, or a fractional vCISO, what each one costs, where each one works, and where each one fails.
In this episode:
The 10,000-to-1 CISO-to-business ratio, and why the 2026 CISO Report calls it a market failure
The three informal models that fill the gap when there's no security leader, and why each one breaks down under pressure
Full-time CISO vs. internal promotion vs. fractional vCISO: honest costs and tradeoffs for each
The revenue thresholds where each option actually makes sense
An illustrative example of what an unaddressed gap costs when a known, escalated risk goes unfixed
The Security Leadership Readiness Check, five questions:
Who is accountable to the CEO or board for security risk, by name, as a primary responsibility?
When was security last on the board agenda as a standalone item, not folded into an IT update?
Do you have a documented security roadmap with budget attached, reviewed at least annually?
In the last 12 months, has an executive overridden an IT security recommendation, and do you know why?
If you had a material security incident tomorrow, who makes the notification and response decisions, and have you rehearsed it?
Note: the healthcare-acquisition scenario referenced in this episode is an anonymized composite illustration, not a specific named case.
The Rook is board-ready security intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk but don't have a dedicated security function. New episodes every other Tuesday.
CISA adding a vulnerability to its Known Exploited Vulnerabilities catalog isn't a patch reminder anymore. It's the moment your insurer and your counterparty's diligence team start treating you as someone who was on notice, and if you didn't patch, that's on you.
In this episode, David Shaw walks through how the KEV catalog moved from a federal compliance tool to a market-facing liability standard, the exploited vulnerabilities in Oracle, SonicWall, VMware, Microsoft, and Citrix systems that drove that shift across July, August, and early September, what insurers and diligence teams now read into a KEV listing, and the three conversations every executive needs to have this week.
In this episode:
What the KEV catalog is, and why it moved from government plumbing to a market liability standard The exploited flaws behind that shift: Oracle E-Business Suite Payments, SonicWall SMA1000, VMware vCenter, Microsoft AD FS and SharePoint, and Citrix NetScaler How insurers and incident response firms cite KEV entries to build a documented record of notice What KEV exposure means in M&A diligence, rep and warranty coverage, and escrow The vendor-risk lesson from the Suno breach The three conversations to have this week: with your IT lead or MSP, your insurer or broker, and your diligence team
Resources mentioned:
CISA Known Exploited Vulnerabilities (KEV) Catalog CISA Binding Operational Directives 22-01 and 26-04 Beazley Security and eSentire advisories
A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what executives read into it is where most companies are quietly carrying real risk.
In this episode, David Shaw walks through what compliance audits actually evaluate, the three places where compliance and real security pull apart inside companies (access management, detection, out-of-scope creep), what someone running a real security practice will tell the board, and the two questions every board should be putting on the agenda at the meeting after the next audit closes.
In this episode:
What an audit actually answers, and what it doesn't
Why the gap between the report and reality isn't a failure of the audit
The three places compliance and real security pull apart: access, detection, scope
What a real security practice looks like, versus a compliance program
What someone running a real program will tell the board
The two questions to put on the agenda after the next audit closes
In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs.
In this episode:
How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligence
How Marriott bought a four-year-old, undetected breach when it acquired Starwood
Why the standard M&A cybersecurity questionnaire fails to catch material risk
How R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teams
The four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisions
What sellers should be doing now to protect deal value
Three artifacts every buyer should require, not just three questions to ask
The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG