Dave Chronister has been doing penetration testing and incident response since 2007 — back when Fortune 500 CIOs called it a novel concept.
In the years since, he's walked into breached environments where the EDR was running, the MDR was installed, the SOC 2 audit had passed, and none of it mattered.
This conversation covers the gap between what companies think they bought and what they actually have why tools become the program by default, why compliance audits and security programs are two different things, what AI is actually doing to enterprise risk profiles right now, and what the organizations that survived a ransomware encryption event had that the ones who didn't were missing.
If you're responsible for a security decision, this is the conversation to have before the next one.
Chapters
- (00:00) - Cold open: a hospital ransomware event, and a CIO who wanted an assessment instead of action
- (00:41) - Intro: Dave Chronister, founder of Parameter Security
- (01:35) - What tells you in the first conversation whether a client wants real work or theater
- (03:17) - Why you can't educate someone into buying security
- (04:31) - Reframing cybersecurity as risk management, and the limits of scare tactics
- (07:22) - Why IT holds the data but doesn't own the responsibility for it
- (08:32) - Allocated costing: making the business own its own technology budget
- (09:30) - A merged company, one sysadmin, and the ransomware attack that followed the warning
- (12:52) - What percentage of clients actually implement a pen test's findings
- (14:01) - Why larger, regulated companies are often the worst at fixing the same issues year after year
- (16:18) - Why "I think I need a pen test" became the default ask
- (17:37) - Turning on MFA doesn't require a pen test to tell you to do it
- (18:16) - The hospital ransomware story, and the CIO who wanted an assessment before action
- (20:48) - Preserving evidence versus the real cost of staying down longer
- (21:03) - The earthquake DR plan nobody actually tested against real life
- (22:35) - The bank whose disaster plan was "go to the VFW," with no plan for during the storm
- (24:48) - Scar tissue: why DDoS mitigation became standard but security hasn't followed the same path
- (28:09) - Is bad security a vendor problem or a buyer problem
- (28:43) - The "we have a firewall, so we should be good" mentality
- (29:50) - Why a patch management tool is not a patch management policy
- (31:21) - Firewalls between app and database servers that don't actually stop anything
- (32:21) - Why "it's in the cloud" doesn't mean it's safe, and the default-permissions problem
- (34:21) - Reframing cloud as "someone else's computer"
- (35:40) - Why non-technical CIOs are more common than people assume
- (36:11) - The iCloud hack that wasn't a hack, and the awareness gap nobody wants to name
- (38:56) - Assumptions about which OS is more secure by default
- (39:23) - The real reason tech layoffs let people keep their laptops
- (40:31) - What percentage of companies who go through compliance actually end up secure
- (43:06) - How SOC 2 became a checkbox nobody actually understands
- (45:00) - Is there a saner framework than SOC 2, and where NIST CSF fits
- (46:27) - Why readiness assessments sometimes fail because clients change course mid audit
- (46:46) - BAAs that say nothing, and why "we have one" means nothing
- (47:51) - Blinky light security, and the atomic bomb drill parallel
- (49:26) - How to make SOC 2 actually useful instead of annual busywork
- (51:44) - Cyber insurance checklists and the tools-versus-outcomes tension
- (52:10) - Compensating controls, and why insurers demand specific tools regardless of fit
- (54:08) - The stat: 60%+ of ransomware encryption events happened with a leading EDR in place
- (55:43) - A WAF isn't a fix for a hemorrhaging wound
- (56:29) - The client whose MDR sat in monitored mode for years before the breach
- (58:39) - Why "we don't have anything a hacker wants" is always wrong
- (59:50) - What percentage of "AI" tools are actually AI, versus AI washing
- (01:00:48) - Why AI is dangerous for attackers' victims but a gift for attackers themselves
- (01:01:53) - The risk of two employees asking AI the same question and getting different answers
- (01:02:49) - The Carnegie Mellon stat: 95% of AI initiatives never reach production
- (01:04:06) - Layoffs blamed on AI efficiency that have nothing to do with AI
- (01:06:11) - Outsourcing your brain to AI, and what that costs a team
- (01:07:29) - Why AI gets more confident the more wrong it is
- (01:08:52) - Parameter's own policy: no AI in billable client work
- (01:10:38) - The Oracle-OpenAI deal, and why it could collapse the industry
- (01:12:24) - Best case outcome for AI risk management inside companies
- (01:14:14) - Why the oldest tech people are the most pessimistic about new tech
- (01:16:56) - The landlord running an AI tool on the shared network despite the warning
- (01:17:11) - Tool category churn: EDR to MDR to XDR, and the bundling versus best-in-breed debate
- (01:21:11) - The risk cycle: identify, control, implement, validate, and manage evolving risk
- (01:23:29) - Policies people copy but never actually adopt
- (01:24:59) - The federal auditor who taught the real lesson: say what you do, do what you say
- (01:29:21) - A YubiKey eliminates a huge threat vector, so why is enforcement still the hard part
- (01:32:46) - The question nobody asks: "what is my responsibility in this?"
- (01:34:16) - Documentation gaps behind most "sophisticated" attacks
- (01:35:16) - When does personal liability for boards and executives actually start to bite
- (01:39:02) - Closing: let the board decide, don't decide for them
What We Mentioned
- NIST Cybersecurity Framework (CSF) — nist.gov/cyberframework
- NIST 800 series — csrc.nist.gov
- NIST AI Risk Management Framework — nist.gov/system/files/documents/2023/01/26/AIREF1.0.pdf
- SOC 2 / AICPA — aicpa-cima.com
- CMMC — dodcmmc.us
- PCI DSS — pcisecuritystandards.org
- HIPAA / HITECH
- Qualys — qualys.com
- Tenable — tenable.com
- Microsoft E5 / E7 security stack — microsoft.com
- YubiKey — yubico.com
- Parameter Security — parametersecurity.com
About Dave Chronister
Dave Chronister is the founder of Parameter Security. He started doing penetration testing in 2007 when most companies hadn't heard the term and has spent nearly 20 years walking into environments after the breach to find the things the audit missed. He's unusually direct about what tools actually do and what they don't, and he's seen every version of the gap between what companies think they bought and what they actually have.
LinkedIn: https://www.linkedin.com/in/davechronister
Company: https://www.parametersecurity.com
About Signed
The IT market is built for sellers, not buyers.
Signed is the podcast for the buyers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals — the ones who can tell you what actually determined whether the deal worked, not what the deck promised.
New episodes weekly. An ITBroker.com podcast.
