Founder of FA Consulting | Fractional COO | Developing high performing teams | Startup Advisor | Board Member

At Almeshaan Consulting, we drive organizational effectiveness for high-growth companies by aligning organizational goals, setting up structured performance management systems, and providing leadership development and management training.  

Services:
- 𝐅𝐮𝐥𝐥 𝐓𝐞𝐚𝐦 𝐀𝐥𝐢𝐠𝐧𝐦𝐞𝐧𝐭: Set clear, measurable objectives and key results to guide every team member’s efforts and ensure everyone understands their role in achieving company goals.

- 𝐋𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭 & 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠: Equip your leaders and managers with the skills to lead effectively, from decision-making to people management.

- 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 𝐰𝐢𝐭𝐡 𝐂𝐮𝐭𝐭𝐢𝐧𝐠-𝐄𝐝𝐠𝐞 𝐒𝐲𝐬𝐭𝐞𝐦𝐬 𝐚𝐧𝐝 𝐀𝐈: Develop systems to meticulously monitor and track critical metrics, ensuring your targets are met efficiently.

Curious how you can drive your team's performance? Reach out at faye@almeshaan.co

Faye Almeshaan

We help startups and SMBs strengthen their cybersecurity and compliance. Our 'One Scalable Plan' is designed for companies that are looking for flexibility. It can quickly be adjusted to keep up with requirements as they evolve. The plan includes strategy, assessments, and enhancements so clients can close deals while avoiding fines, penalties, and lawsuits. 

For CMMC, FedRAMP, or SOC 2 prep, we handle most of the work so your team can focus on other priorities. I also co-host The GRC Room, a monthly LinkedIn Live series featuring leading voices in cyber GRC. If you're a startup or SMB leader looking to strengthen your cybersecurity and compliance, feel free to send a connect request or DM anytime.

Mike Andrewes

"Can you do our cybersecurity documentation?"

- Potential client

//break//

This is a fairly common question when a potential client has an IT team.

Companies often want their IT team to handle the technical side of cybersecurity.

They're more likely to admit they need help when it comes to the policy and process documentation.

The challenge is the fact that the technical side needs to be in alignment with the documentation side.

If not, things will be inefficient, at best.

In reality, the issues will probably be a lot deeper.

Let's put this in football terms.

"We just want to play football. You write the playbook though."

Makes no sense, right?

Alright, back to cybersecurity now.

I'm not saying the same team needs to do everything.

It's perfectly normal for teams to collaborate when it comes to cybersecurity.

My point is that this step shouldn't get skipped.

Even if someone is a world-class writer of cybersecurity documentation, they can't do it in isolation.

This stuff takes buy-in across departments.

The business leaders need to be involved in this if anyone is going to pay attention in the business.

Questions for you:

Have you ever seen this sort of thing happen?

What's one way to make collaboration across teams go well?

Cybersecurity Advisor | Scalable cybersecurity for startups and SMBs

I was recently featured in Security Digest by Strike48.

The conversation was engaging and the article is well-written.

Topics we covered:

➡️ Why assessing cyber risk within your actual operations is so important.
 
➡️ The risky "unmanaged middle", where teams point fingers at each other.

➡️ How excess cybersecurity tools add risk and unneeded complexity.

➡️ Whether some companies are introducing "manufactured complexity".

➡️ How to prioritize cybersecurity monitoring efforts in a reasonable way.

✅ If you'd like to read the full article, link is in the comments!

In cybersecurity, offshoring is so hot right now.

During our December LinkedIn Live event, - Karina Klever - and I spoke to "The GRC Recruiter" Pete Strouse about this.

Pete thinks the trend is going to continue. 

He told us, "If the quality of whatever you're doing is good enough, there's no real incentive to not go with the cheaper option."

I completely agree with Pete on this.

If you're thinking about offshoring, here's three things to consider:

➡️ Data residency requirements like we see with GDPR.

➡️ Contractual requirements you may have.

➡️ To avoid scams, vet people carefully before hiring.

▶️ Check out the attached clip for more on this.

PS: What are your thoughts on offshoring in cybersecurity?

- Karina Klever - thinks cybersecurity "tool lard" is leading to technician burnout.

This is what she told "The GRC Recruiter" Pete Strouse and me during our most recent LinkedIn Live event.

When burnout happens, the odds of missing something important goes up dramatically, and this is quite risky.

Karina added: 

"The ability to problem solve is more important than things like understanding the newest tool's user interface" (paraphrased).

Check out the attached clip for more on this and let us know what you think!

PS: 'Inside the mind of a CISO' with guest Jake Bernardes is our next LinkedIn Live, and it's coming up on 1/21 at 1 pm EST. If you'd like to attend, the link is in the comments.

In cybersecurity, trust is everything.

The topic of trust makes me think back to my sports card collecting days.

The Michael Jordan Fleer 1986-87 rookie card is legendary.

In 2006, I wanted to buy one on eBay.

A 9.5 card graded by GEM was selling for something like $3,000.

A 9.5 card graded by the highly regarded Beckett Grading Service (BGS) was $4,500.

I didn't understand the price discrepancy at the time and decided to buy one graded by GEM to save money.

It showed up and the card was completely off-center and the corners weren't great.

I knew that if it were graded by BGS, it would score around a 7.5, so I returned it.

Trust was broken.

In cybersecurity, a business also needs to know what they're getting.

This is true whether they're hiring an advisory company like us or they have a team internally.

If a cybersecurity practitioner says the ROI of an investment is $450k which equates to 300%, the math should back that up.

When numbers are wrong or inflated, it's easy to lose trust in a hurry.

Same goes with spotting cybersecurity issues in general.

If a practitioner does an assessment and misses most of the big issues, that's very hard to trust.

As practitioners, we need to take the time to do things in a thorough way that businesses can trust.

For businesses, take the time to do research and ask hard questions before hiring someone to do cybersecurity.

Have you ever seen someone lose trust after reporting something that was far from accurate?

If so, what happened?

All businesses addressing cybersecurity get an applause from me. 👏 

We hear about companies that only do it because of compliance.

They draw scrutiny, and terms like "compliance theatre" are used.

Isn't this a better option than doing nothing at all though?

I think so, but here's the more important question:

What would we do differently if "compliance" never existed?

Would we:

- Focus more on actually keeping our user data secure?

- Design systems to be down less frequently?

- Rewrite our policies and procedures so people actually find them helpful day to day?

This doesn't need to be a case of "this or that".

It only takes a bit more effort to do things right.

If our goal is compliance plus these three bullet points, the compliance theatre stops.

It's a win for the company, employees, and customers.

Have you seen compliance actually strengthen security?

If so, what were the main things that allowed this to happen?

"When we're reviewing cybersecurity questionnaire responses, we keep seeing the same dealbreakers."

- Local bank

Doing third-party risk management can be very time consuming.

This is true whether you're the one sending or receiving the questionnaires.

When I heard this statement and the company said they were bogged down with questionnaires, a simple fix came to mind:

"To save time, look at those items first."

Why review 100+ responses from another company, when we can zoom in to the ones that matter?

Let's compare this to house hunting.

If you know you need a three car garage, why look at houses that don't have one?

Not all cybersecurity controls are created equally. 

It's okay to spend more time on the ones that you care about the most.

Multi-factor authentication (MFA) is clearly more important than a lot of other controls, for example.

If you refuse to do business with a company that has no MFA or inconsistent MFA on systems that touch sensitive data, look at that response right away.

If you ask the company about it and they refuse to fix it, then you know you probably shouldn't move forward, and you saved a lot of time.

It's good to have internal processes that lead to consistency, but common sense should be a part of each process.

Have you ever seen a process that was pretty good, but lacked flexibility and common sense in certain areas?

If so, what do you think should have been changed?

In cybersecurity, "lead magnets" and "loss leaders" are a big deal.

Sales cycles are long, options are endless, and we need to stand out.

Lots of companies offer free:

- SaaS trials

- White papers

- Abbreviated reviews

Two years ago, we offered a free one-hour review.

Businesses were thankful, but rarely converted to paying clients.

Prospects that were ready to act knew they needed more.

Now, we do things differently.

We find a specific pain point and address it immediately.

Just this week, we had a call with the owner of a health insurance business.

He helps people find a policy that fits them well.

He wasn't sure how HIPAA applied based on what they actually do.

So, we gave him specific things to check to figure it out.

We even offered to help him sort through it for free.

He liked this idea, and it won't take more than 30 minutes anyway.

That's a win-win.

Do you use a lead magnet or loss leader in your business?

If so, what is it?

When you hear “cybersecurity”, do you think about ... emotions?

Probably not.

Emotions show up often when we work with companies.

This is natural, because people with different personalities are involved.

Sometimes a CEO is frustrated that security was not a priority sooner.

Sometimes an IT manager feels blamed when a firm like ours is brought in.

As an advisory company, we need to navigate this carefully.

We need to listen, be proactive, and sometimes, act as a mediator.

Example:

“We may find issues, and this is normal. This is why we're here. We'll work through them together.”

With AI becoming more common, the human side often gets less attention.

Automation helps, but communicating effectively still matters.

Empathy still matters.

Have you seen emotions or personality conflicts make a project harder than expected?

If so, what happened?

In cybersecurity, we hear a lot about "all-in-one solutions". 

It's really hard for this to be true.

There's no product or service that is a 100% cybersecurity solution.

An advisory service will usually need to be accompanied by tools.

Tools should be accompanied by human expertise.

This expertise can be in or outside the company.

Where does this confusion stem from?

Is it marketing gone too far?

In most cases, I don't think companies are being deceitful about this.

More often than not, they're talking about a specific area of cybersecurity.

An all-in-one vCISO program might be all the strategic guidance a company needs.

An all-in-one GRC platform might be the only GRC platform you need.

These are just examples.

If you're a company selling cybersecurity products or services, please be clear what all-in-one is referring to.

If you're a company researching cybersecurity products and services, please remember the saying:

If it's seems too good to be true, it probably is.

PS: The GRC Room LinkedIn Live today at 1 pm EST currently has 1,630 RSVPs. While it's far from an all-in-one cybersecurity solution, you're welcome to join us. Link is in the comments!

This session of 'The GRC Room: 5 Questions' features Frederick Livingston, who is a Co-Managing Partner at McDonald Baas & Livingston, PLLC.

Frederick is an attorney that understands Cyber GRC at a deep level.

He highlighted the Change Healthcare breach as one that stood out because of the scale and the fact that it was reportedly caused by a lack of multi-factor authentication (MFA) that the company was aware of.

Frederick told us that the best GRC-related advice he's received is "your vendor's security is your security".

This is such a big one, since third-parties are a common cause of data breaches, and it's hard to assess risk when you don't have full system access.

The questions:

1️⃣ Which part of cyber GRC do businesses struggle with the most?

2️⃣ What's one data breach that stood out to you and why?

3️⃣ What's the most impactful GRC-related advice you ever received?

4️⃣ What do you do differently that allows you to excel in this field?

5️⃣ What's the top thing a business can do today to strengthen its cyber GRC?

▶️ There were more notable parts than I can mention here, so check out the attached video and let us know what you think!

Cyber risk and compliance often becomes a priority in a hurry.

Perhaps it's because of a cyberattack, a close call, or a deal that didn't close.

For startups and SMBs without unlimited resources, it's important to get this right.

Common questions:

➡️ Do we add it to the IT person's to-do list?

➡️ Should we use a GRC platform?

➡️ Does it make sense to bring in a cybersecurity company?

Selecting the right option can be tough.

Fortunately, Dr. Victor Monga knows this topic well, and he’s joining - Karina Klever - and me in The GRC Room on Feb 18th.

Dr. Monga has been a cybersecurity company founder, is a Past-President of ISACA Orange County, and is a SOC Domain Consultant for Palo Alto Networks.

👉 Next steps: RSVP today or share with your network!

-----
Note: The views expressed by Dr. Monga are strictly his own and do not necessarily reflect the views or positions of his employer(s).

Sahar Dahan, William Weathersby and 478 other attendees

Working with our cybersecurity advisory company has a 400% ROI.

This is a claim I'd never make.

Big ROI claims are common in marketing, but they can hurt trust if they seem unrealistic.

ROI isn't universal, especially in cybersecurity.

A company doing 4M in revenue will see a different ROI than one doing 40M, simply because there is less revenue to protect.

Our pricing doesn't drop a lot just because revenue is lower.

Cybersecurity maturity also plays a role, since ROI will be lower if a company has already addressed cybersecurity to a large degree.

The scope of work is a big factor in this too.

If we deliver an assessment and most recommendations aren't implemented, the ROI will be limited.

Here is what I can say with confidence:

- We know how to identify and deal with cyber risk and compliance issues.

- We know how to calculate ROI using real inputs.

- We keep estimates conservative.

Ultimately, advisors need be trustworthy, and this should extend to marketing.

Have you noticed extreme ROI claims lately?

If so, what's the most outlandish one you've seen?

This session of 'The GRC Room: 5 Questions' features Zlatko Unger 🧙‍♂️.

Z is a CISO Expert at Wiz.

He told - Karina Klever - and me about the 2023 Caesars and MGM breach, where their help desk staffs were targeted.

Caesars decided to pay the ransom and MGM didn't.

It ended up being more expensive for MGM, but this will vary from case to case.

Then, Z highlighted the importance of attributing risk to the business owners, since the business owns the risk, not the CISO.

The questions:

1️⃣ Which part of cyber GRC do businesses struggle with the most?

2️⃣ What's one data breach that stood out to you and why?

3️⃣ What's the most impactful GRC-related advice you ever received?

4️⃣ What do you do differently that allows you to excel in this field?

5️⃣ What's the top thing a business can do today to strengthen its cyber GRC?

▶️ To hear more, check out the attached video and let us know what you think!

According to McKinsey & Company, 78% of organizations now use AI in at least one business function.

Vendors are regularly adding AI features to their offerings.

Many times, SaaS vendors are enabling these features by default. 

I recently spoke to our SDR Sandra Avila about AI-related cyber risks.

Some things to consider:

➡️ Threat actors are using AI to scale and improve their targeting.

➡️ Be careful which AI systems get access to your data.

➡️ Is your data being used for training? You might be able to disable this.

➡️ Try to anonymize data before putting it in an AI system, when possible.

➡️ Make sure your AI usage aligns with your contractual obligations.

To hear more about this, check out the attached clip and let us know what you think!

PS: What other AI-related cybersecurity issues should companies be thinking about?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance ScoreMike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Faye Almeshaan

Mike Andrewes

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Mike Andrewes's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreMike Andrewes's LinkedIn Performance