The conversation

The same sentence can be useful or empty

The episode begins with a feeling many security people will recognise: open your feed and you see the same arguments again. Compliance is not security. The board needs to care. Everyone should do the basics. The hosts do not dismiss all of that as noise. Belknap points out that a familiar lesson may be new to someone earlier in their career, and a simple reminder can be exactly what they need.

But repeating a line is not the same as helping a team make a decision. If I say “do the basics” after an incident, I should be able to name which basic failed, who could change it, and how we would know the change held. Otherwise the phrase gives us agreement without progress.

What I took from it

Make room for the story behind the advice

Holton argues for sharing what went wrong, including our own mistakes, so others can learn from something more useful than a polished slogan. Belknap adds a caution: sharing alone is not enough if we dress opinion up as engineering. Together, their points make a good test for any “best practice” passed around a team: what happened, what did we observe, what did we change, and did it work?

The episode also resists the idea that every repeated problem has one universal answer. A control that makes sense for an industrial site may not fit a software company. The point is not to stop teaching old lessons; it is to carry the context along with them.

My take

A slogan is a good opening line for a conversation and a poor closing line for a decision. The human work is asking where it applies, what evidence we have, and what will change on Monday.

For teams

Turn one recurring complaint into a small experiment

  1. 1

    Choose a real recurring issue. Pick one that people keep raising—for example, stale access, patch exceptions, or noisy detections. Write down the specific failure rather than the slogan attached to it.

  2. 2

    Show the evidence and the constraint. Use a recent example, a baseline, and the people or systems involved. Ask what stopped the earlier fix from sticking.

  3. 3

    Try a bounded change. Assign an owner, a timeframe, and a measure that would show improvement. Share the result, including what did not work, so the next team can start further ahead.

Editorial note

About this review

This review draws on the CISO Series’ published episode and transcript from 1 October 2026. It is an original interpretation for defenders, not a transcript or a claim that the guests endorsed the three-step exercise above. The sponsored segment is not treated as evidence for our recommendations.