A misconception I hear often, from otherwise sensible clients: "we're too small to be a target." Attackers…
Christian T. — Fractional CISO | Strategic Cyber, Technology & AI Advisor | Founder, Alvearium Associates
A misconception I hear often, from otherwise sensible clients: "we're too small to be a target." Attackers do not check headcount before choosing a mark, they check for exposed RDP, reused passwords, and a finance team that will move money if the email looks urgent enough. Size buys you nothing except a smaller budget to fix it with.
The second favourite is the pen test as a substitute for a security programme, one PDF a year, filed and forgotten, treated like an annual MOT that somehow certifies the car for the other 364 days. A test tells you what was true on the day. Risk does not wait politely for the next booking.
Most risk exposure clients underestimate is not exotic. It is ordinary and unpatched.
What's the most persistent myth you've had to talk a board out of this year?
3 reactions · 0 comments