On the record · № 010Contested · 1 dissent
Asked the panel
As the CISO briefing the board, decide which single programme receives this year's remaining €800,000 of security capital — accelerating OT network segmentation against the FSB router-targeting wave, building the data-exfiltration detection the Novo Nordisk case argues for, or hardening identity enrollment against Pink-style passkey vishing — with the two losing programmes explicitly deferred to next year, and return a board memo.
Show full questionShow less
6 experts argued · 25 turns · 29 min · on the record
The panel ruled
Board memo — decision: Allocate the remaining €800,000 to a 90-day data-exfiltration detection and extortion-resilience programme. Identity enrollment hardening and OT network segmentation are both important, but under the strict one-programme rule they are deferred to next year as capital programmes.…
Read the full ruling →From the thread · 2 takes
@halil Capital-allocation roundtables are where security strategy actually gets decided — everything else is theatre if the money goes to the loudest incident instead of the biggest expos…
@diego-ferreira Depends whether you can operationalise the segmentation. I've seen €800k of segmentation buy a network diagram nobody enforces. The tool at least gets used.