CISOs, Stop Worrying About Your Budget and Focus on Your Brand

11/12/24 • 33 min

CISO Edge, The Gartner Cybersecurity Podcast

See this episode’s highlights:

How building an intentional brand connects you to the C-suite. (01:00)
To build an intentional brand, create three lists. (09:45)
Shout-out to Houston’s late, great Atchafalaya River Cafe. (20:56)
Use the tactics of framing and priming to reinforce your brand. (23:13)

CISOs tend to see their budget as the key thing capping the cybersecurity function’s potential enterprise impact, when in fact the function’s (and the CISO’s) reputation has just as much to do with the role cybersecurity can play. And, unlike the budget, which has many drivers beyond our control, CISOs can exert almost complete control over their brand! In this episode of CISO Edge podcast, Gartner experts Leigh McMullen and Chris Mixter share the steps needed to create an intentional — and impact-amplifying — CISO (and cybersecurity function) brand.

Leigh C. McMullen is a Distinguished Vice President, Analyst in Gartner's CISO, Security and Risk Management team. Leigh leverages his experience as both a line-of-business manager and IT leader to provide CISOs with insight on navigating and making a difference within the C-suite. Additionally, he provides clients with a holistic view of cybersecurity leadership research, specializing on the topics of future operating models, vision and strategy, politics, influence, business engagement, internal marketing and communications.

See this episode’s highlights:

How building an intentional brand connects you to the C-suite. (01:00)
To build an intentional brand, create three lists. (09:45)
Shout-out to Houston’s late, great Atchafalaya River Cafe. (20:56)
Use the tactics of framing and priming to reinforce your brand. (23:13)

Previous Episode

Want People to Behave Securely? Listen to Them

Join Gartner experts Chris Mixter and Richard Addiscott in this episode of CISO Edge to debunk the myths around why employees behave nonsecurely, why most tactics and executive communications around employee behavior don’t work, and to explore ways to rapidly increase the value delivered by your secure behavior and culture program (SBCP).

What if I told you that “lack of cyberawareness” isn’t the reason people behave nonsecurely? (03:50)
Where do your employee-related security incidents come from? (09:56)
How can we move from compliance-centric to behavior-centric cybersecurity? (13:48)
Help executives understand what is a defensible level of performance around human risk exposure. (26:15)

Richard Addiscott is a Vice President Analyst in Gartner's global security and risk management practice, helping CISOs and senior cybersecurity executives deliver highly effective information security programs and build high performing cybersecurity teams. With more than 20 years of experience in industry, Richard has held enterprise information security and IT leadership, information security consulting and advisory, IT governance, and business development roles across the public, private, and not-for-profit sectors.