What separates great CISOs from everyone else? It isn't knowing more about CVEs, ransomware, or the latest security tools. It's understanding the business. In this episode of CISO Tradecraft, Ross Young and G Mark Hardy reveal why many cybersecurity leaders spend too much time protecting systems and not enough time protecting the capabilities that generate revenue, keep operations running, and create shareholder value.

You'll discover:

1) Why most vulnerability management programs prioritize the wrong assets.

2) The six business capabilities every CISO should understand before making security decisions.

3) How executive leaders evaluate cyber risk differently than security teams.

4) A practical framework for aligning cybersecurity investments with business priorities.

5) Why traditional third-party risk questionnaires often fail—and the questions that actually predict ransomware risk.

6) Lessons learned from real-world breaches, mergers & acquisitions, business resilience, and executive decision making. Free Resources Mentioned

• Ransomware Risk Assessment Questionnaire - https://drive.google.com/file/d/1L4spXwrB7nFgdSP5at2uJfFKvG_7ppmz/

• Mission-Critical Business Capability Framework - https://docs.google.com/presentation/d/1zHjxcJXvAkJNQKXCVbVoR7yzexD3KKEu

How has the role of the CISO changed over the last 15 years? In this episode of CISO Tradecraft, G. Mark Hardy interviews Rafeeq Rehman, creator of the CISO Mind Map, to discuss its latest update and the biggest challenges facing cybersecurity leaders today.

You'll learn:

• Why the CISO Mind Map was updated after 15 years
• How AI security is reshaping cybersecurity leadership
• Why the remote work category was removed
• How a RACI matrix helps CISOs delegate while staying accountable
• Why consolidating security tools reduces complexity and risk How to support your team's mental health in a high-stress industry
• What tomorrow's cybersecurity leaders need to succeed

Whether you're an aspiring CISO or an experienced security executive, this episode provides practical insights to help you lead more effectively in the AI era.

Link to the Mind Map - https://rafeeqrehman.com/2026/04/11/ciso-mindmap-2026-what-do-infosec-professionals-really-do/

Nation-state adversaries are vacuuming up encrypted traffic today, waiting for quantum computers to decrypt it tomorrow. This attack strategy, "Harvest Now, Decrypt Later," isn't theoretical. It's happening right now.

G Mark Hardy sits down with Marcus Sachs (former White House cyber advisor, CSO of NERC, now SVP and Chief Engineer at CIS) to break down two executive orders just signed by the White House on post-quantum cryptography and what every security leader needs to do before the clock runs out.

What you'll learn:

• Why TLS, VPNs, and PKI are your most urgent exposure
• The Harvest Now, Decrypt Later threat model and what it means for your data retention policies
• How to build a Cryptographic Bill of Materials (CBOM)
• What cryptographic agility means and why hard-coded crypto is a ticking time bomb
• Lessons from Y2K that apply directly to the quantum migration

You can't name a date certain. But your adversaries are already running the clock.

Links, NIST resources, and both executive orders in the show notes.

https://www.nist.gov/cybersecurity-and-privacy/what-post-quantum-cryptography

https://www.nist.gov/pqc