Matthew O'Neill

Last week Gartner published a proposal to enable organisations to demonstrate the hidden cost of not investing in moving away from legacy systems, going for short-term non-integrated platforms, risk-averse roadmaps and not executing change dynamically enough. The cost of technical debt should be included in every business case related to IT platform change. #TechnicalDebt

24

The real impact of a cyber breach goes beyond costs. The UK saw a 50% rise in major attacks and 204 nationally significant incidents, with JLR’s outage revealing how fragile supply chains can be—resulting in a £1.5bn guarantee. Boards need to treat cyber risks as continuity threats. Start tracking “Revenue-at-Risk” daily, demand proof of recovery (like immutable backups and executive-witnessed restores), and expect regulators and insurers to factor in resilience. In the next 90 days, focus on: ➡️ Phishing-resistant MFA + Conditional Access ➡️ Micro-segmentation/ZTNA ➡️ Quarterly restore drills ➡️ Supplier attestations (top 25) Stay proactive, not reactive. Read the full article here: https://lnkd.in/eeNwa4dg Ready to safeguard your business from the next cyber threat? Visit Loopli and let's make sure you're protected today! #CyberSecurity #RiskManagement #SupplyChain #BusinessContinuity #DigitalTransformation

13

1 Comment

Sales Tip #191 Is Hard Copy Cold Outreach the New Black? ✉️ "You may have seen the recent letter from the UK Government to FTSE 350 boards that highlights the rise in hostile cyber activity and stresses the need for... strong supply chain controls and proactive resilience." "[Company] provides real detection and fast response" This company decided to send this message via a physical letter as part of their cold outreach. Am I to expect their SOC alerts to come through the same channel? Or perhaps they'll escalate via carrier pigeon? 🐦‍⬛ At the bottom of the letter, they've stuck on a QR code with "Book A Meeting" written next to it I am almost lost for words (I said almost, I'm never actually lost for words.) This security company expects a CISO to book a meeting by scanning a QR code. A QR code which isn't event printed on the letter - it's a sticker. Do they know what a MitM attack is? Or quishing? Or is this rage-bait marketing? A new form of phishing LARP? The letter signs off with: ✉️ "Even if we never work together, you will get something useful from the conversation" That is very bold statement, and one I doubt very much. --- In response to my initial question: no, hard copy cold outreach is not the new black. A physical letter does not add credibility. It does not make your message more "serious" It's a waste of paper, postage... and everyone's time. And please - for the love of god - will security suppliers STOP SENDING MATERIAL THAT RESEMBLES PHISHING. You are undermining your position and infuriating prospects. #SalesTip #SpamScamOrSales #LifeAsACISO #Phishing #SnailMail 📎

12

6 Comments

If you were too busy to note, the UK’s National Cyber Security Centre published its latest "Annual Review": https://lnkd.in/etWxVb2Y Notably, NCSC calls for “radical transparency” in technology, quipping that we know more about what’s in our sausages than our software. It’s a brilliant and frankly damning indictment. For too long, we’ve allowed critical business decisions to be made in a fog of technical jargon and ambiguity. We’ve hidden behind vague, qualitative statements that do more to obscure reality than illuminate it. The chief culprit seems to be the “risk appetite.” It has become a boardroom euphemism, a convenient way to justify underinvestment without a rigorous analysis of the consequences. A board states it has a “moderate risk appetite” and the conversation ends. But what does that actually mean? It’s a statement devoid of the specificity needed for effective governance. To achieve the radical transparency our industry needs, we must shift our entire mindset: from managing an ill-defined attack surface to managing a quantifiable risk surface. This requires a new engine room for security: the Risk Operations Centre (ROC) and a ruthless intolerance for ambiguity.

82

6 Comments

We've been talking to a few customers about extending our licence optimisation tool, SAMi, into AI costs, something we've been working through for a while. EY has a useful perspective on this, looking beyond agentic token costs to the wider TCO of running agents, effectively "Agent FinOps". That makes sense to me. Where I’m a little more cautious is the temptation to create a new executive role for every emerging discipline, in this case, something like a Head of Agent Economics. That may work in very large organisations, but when you scale the thinking down to a typical New Zealand business, we tend to see something different: an existing executive (or sometimes a board member) gets politely volun-told to pick it up alongside everything else. The other challenge is the business case. Across most of the AI ideation and business-case work we've done, the cost side is usually identifiable. albeit maybe missing a TCO view covering all of licences, tokens, infrastructure, integration, governance and ongoing management. The benefit side, however, can still be a little... loosey-goosey. “Time saved” is easy to claim. “Value realised” is much harder to prove. As AI moves from individual tools into autonomous agents and business processes, I think the question becomes less: “What does the AI cost?” and more: “What does this AI-enabled process cost to operate — and what measurable value does it produce?” https://lnkd.in/eXnU4EJU

16