Ash Rathod

You already know storytelling is essential for your business and brand. But storytelling is much more than the words on your website, content and other communications. The right narrative can inform your short and long term strategy, help align your team, outmanoeuvre the competition and build a tribe of ambassadors.It can help you attract and retain the right customers who are willing to pay you more for a longer period of time and tell others to do the same.It's about high level performance. ie. increasing profits for the business and providing unique value to the people you serve.I specialise in guiding businesses do exactly this. My philosophy centres on a "Story-First Approach," a method that has proven to be the missing link for many who struggle with brand identity and growth.The challenge most people face when building a brand is twofold: either they're paralysed by indecision, never taking the first step, or they jump in headfirst, producing content without a coherent strategy. Both paths lead to a stagnant or unclear identity. The root cause? A lack of strategic direction.  I can help with that.---I studied media and communications specialising in script-writing, where my love for storytelling started. I worked in TV media alongside the London arm of global ad agencies such as StarCom, OMD, PHD Media and many smaller DRTV agencies. My portfolio stretched across global FMCG, (P&amp;G and Unilever) and automotive (Ford and Toyota) brands before moving to Turner Broadcasting (now Warner Bros. Discovery) to work on kids brands (such as Mattel and Hasbro). As the online world began to grow, I moved into Digital Marketing where I helped scale the Manchester office of a Bournemouth based media agency, going from media owner to client side, which consisted of a team of 20+ designers, marketers, copywriters and BDMs.Then after a short sales role at BT, I decided to start my own creative agency, to help start-ups to SMEs with with their communications online.This was almost 16 years ago. I'm proud to say I still run and I own that brand consultancy and design studio in the UK which has focused on serving start-ups to corporations over those years. Right now my focus covers:L&amp;D Training (1:1 &amp; Corporate teams)Speaking at eventsBrand Strategy workshops for start-ups and SMEs.None of these are an overnight fix.But if you are serious about shaping and growing your brand, I can help you do this faster than most.NB. My profile picture has been touched up with AI to change the colour of my shirt and  background

Brand Story Strategist | Managing Director

A brand strategy + design collective specializing in creating compelling content for digital communications. We work with forward-thinking founders, c-suite stakeholders, and marketing teams who passionately strive to lead the change in making the world of work a better place for all.

Our capabilities include:

Brand Strategy

  - Storytelling for brands 
  - Storytelling for leaders

Activation

  - Content Production
  - Media Planning

I fixed myself. 

AI has given me what I thought I could never have. 

A glimpse into what I’d look like if my skin colour stayed the same.

Or if I removed all the pigmentation on my skin (which can be done in real life. I had the option but declined) 

So which one do I prefer? For me, it’s a no brainer. The real me, in the middle. 

The left and right image was created by Nano Banana Pro. 

Which to be honest, as a tool, it’s amazing. In fact I’ve been playing with it a lot. I have been playing with a lot of AI tools. Image. Music. Vibe coding. And I will be using them a lot in my content, in my work processes and creating new business ideas. 

The next wave of AI tools will open doors for many people. I really am positive but cautious about it all.

Because it has to be used the right way and the right way for me is this:

Don’t be lazy with the tools (Use it to add a layer to the great work you do vs diluting it)
Don’t just blindly copy others. (‘differentiate or die’ mantra is still relevant. Now more than ever)
Don’t hide behind it (ie. pretend you’re something you’re not or try hiding the fact you’ve used AI. Especially if it’s likely to be in doubt for others)

I’m sure there are many other pros and cons. (let me know yours in the comments)

What I will be doing is making sure I inform my audience when I do use AI. For example, I am playing around creating a digital twin. And it's a lot of fun. But I won’t pretend it’s me. I’ll let others know when it’s not. Even when the tech becomes much better than it is now when even more  people won’t be able to tell. 

I think in this new phase, the people that are honest and upfront about how they communicate to their audience are going to be the ones that build trust. And ultimately the ones that win.

For me, I don’t want to fool anyone. Including myself. 

And more importantly. I don’t need to fix myself.

I already did that. 

When I accepted myself for who I really am.


---

#PersonalBranding and #Storytelling in an #AI world

Brand Storytelling in an AI World | Creative AI Workflow Consultant

This is not a real ad. 

And here's more context. 

I set myself a challenge to see what these AI tools were capable of and created this. My main learning out of all of this is, this still took a lot of human thinking, time and general input. 

So my challenge was to create a completely speculative ad using just AI tools. 

I chose a brand that I love. Love for their messaging and what they stand for. And then got to work. 

I would say this is still rough around the edges and an important thing to note is that I have no real idea what the brand strategy is so this should be considered. Real creative campaigns take time and a lot human collaboration. I did this completely on my own (and it shows I think :)  

There are also inconsistencies in the creative given the time I gave myself to create this. 

But in the main, I think the tools that are out there are really impressive. And I had a lot of fun with this. 

Tools I used were:

Weavy for workflow
LTX Studio for storyboarding
FreePik as the main base suite and character dev
Higgsfield (It's Popcorn element to experiment with characters)
Nano Banana for stills
Magnific for upscaling still resolutions 
Topaz to upscale video resolution
Kling 2.5 Turbo 2 for video
Seedream 4 Edit - Varied camera angles
Eleven Labs for VO and SFX
Suno for Music 

Then the usual tools I use:

Photoshop to retouch certain stills
After Effects for speed ramping elements
Premiere Pro for Editing

I plan to do a full walkthrough in the next few weeks if time permits ! :)

Would love to know your thoughts.


#Storytelling #AI

Anyone who says “AI content is quick and easy” is wrong. 

Well, sort of.

Producing AI creative content can be more efficient than many traditional methods but we’re not talking about a lot of the AI slop we’re accustomed to seeing on our feeds.

And those well versed in the traditional workflows (storytellers, designers, content strategists, ad creatives and marketing teams) shouldn't fear losing their jobs. If they up skill, they will actually rise to the top because they have the strongest superpower. Talent, experience and a way of thinking that comes from years of putting in the work that will make them stand out. 

But when working with clients or in collaboration with others, it’s important to have systems and workflows in place. This includes traditional workflows, not just AI. And by the way, the two still have a place in this world. It’s not as binary as many make out.

That’s why at DFC Studio we use Weavy. Weavy, (recently acquired by Figma) is a node based workflow system for creative AI work with a lot of the AI image and video tools in one place. It gives you, your team and clients an overview of the process from start to finish. 

Some clients won’t want to see this but some will. But for sharing and collaborating with your team it's great as it's important that you have systems in place that are transparent, repeatable and scalable. 

Or even if you’re working on your own you can go back quicker and reiterate/refine when client feedback comes back. 

If you’re interested in up skilling your team, At DFC Studio we offer consultancy and workshops to help you do this. These can be done in person or remote. If interested, please reach out (below or in my DM)

---

#Storytelling #Creative #AI #Marketing #Workshops

What Visionary Leaders Get Right About Brand

Brand isn’t just built by the things you do externally.

It's about how you show up internally too.

How your team feels every day.

In this weeks Watercooler Brand Talks (4pm Friday UK), we’ll be talking about the link between leadership, culture, and brand.

Why the strongest brands aren’t built by marketing teams alone. 

They’re shaped by the people leading from the front.

We’ll cover:

– What visionary leaders actually do differently
– How culture quietly builds (or breaks) your brand
– Why brand is the outcome, not the starting point

Join us live and definitely bring a question or two as we have two of the most visionary brand legends in this week as our secret guests who's brains you'll really want to pick.

This is going to be soooo much fun! See you there!

What Visionary Leaders Get Right About Brand

AI took me backwards, not forwards.

In a good way. 

The deeper I get into AI led creative work, the more I find myself leaning on traditional film theory.

At university, (many years ago :)) I specialised in script writing. Dialogue was the starting point, but it never stopped there. I fell into camera movement, physics, timing, weight, motion. How things enter a frame. How they leave it. Why something feels real even when we know it is not.

What fascinated me most was not learning the rules. It was learning them well enough to bend them. To stretch credibility without breaking belief. That’s the magic of film making. Whatever medium. To create moments that feel grounded, even when logic tells you they are constructed.

That mindset has been shaping my use of AI today.

The tools are new. The thinking is not.

If you treat AI as a shortcut, the output shows it. But if you approach it like film making, with intent, some restraint when needed, and an understanding of how humans read motion and story, the work will land very differently.

The recent sizzle reel is a snapshot of that experimentation. It’s not perfect but continuing to dig into what’s possible. 

Essentially storytelling principles wearing new clothes.

Those on the look for someone with a huge amount of experience with operations, delivery, automations, content production and more importantly leadership, Ryan is your man! 

If you're considering working with Ryan and want to speak to me then please do. 

A fab colleague he was.....and an extremely kind human being who is always ready to help, support, upskill and progress the team he works with.

What a loss to PodFirst and what a potentially huge gain for the next company that bags Ryan on their team!

Straight-Talking Guy | Cutting Through the Crap to Deliver Solutions, Growth, and Results That Actually Matter 💥

I have now left PodFirst and I am officially on the lookout for my next role. The timing isn’t perfect with Christmas approaching, but sometimes life pushes you into a new chapter sooner than expected. I made the decision because it was the right one for me and where I am heading next.

I am proud of what I achieved during my time there. It was challenging, fast paced and full of opportunities to grow, and I am grateful for the experience and everything I learned along the way.

For those who don’t know me well, here is what I bring to the table.

I am someone who cares about the work and the people involved. I take responsibility seriously and I show up fully. I work best in environments where pace, clarity and ownership matter. I enjoy solving problems, building systems, improving processes and keeping things moving even when things get busy. I thrive in roles where I can bring structure, calm and direction without losing the human side of it all.

My experience covers operations, delivery, leadership, automation, content production and working directly with clients to get projects over the line. I am at my best when I am trusted to own outcomes and make things happen.

So now I am looking for the right place to bring all of that into something new. If you hear of anything or know someone looking for someone with my skill set, I would really appreciate you pointing them my way.

Thank you to everyone who has supported me so far.

Onwards.

Lester Chng

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

We landed in Canada 8 years ago. 
Today I still get this question. 
Why did you move from Singapore?

I always answer with this as if one of the reason. 

“We were very comfortable and had stable jobs. In fact, I know almost exactly how many career will pan out”

And we wanted to try something diff. 

This is what it wld have looked like:
- stayed on in the Navy
- promotions to LTC or SLTC
- 300k salary (don’t quote me)
- waiting on a ~500k bonus in 2026
- complete command of 2-3 warships

This is the last 8 years instead:
- ~50% pay cut for first role
- took 3 role changes to gain parity 
- only to be laid off after a few years
- and living through a dead economy

If we take a snapshot view here, it is a disastrous decision. 

But of course it’s never that linear. 

Here are other things that I gained:
- explored 2 career paths. PM + cyber
- grew professional network from 0
- gained experience in enterprises
- sold digital products & services
- found mission driven role + team
- resilience and independence
 
The questions will always be asked. 

And the journey is still being written. 

P.S what questions do u always get when you tell your story?
How do u answer them?

Sales Navigator

li_at

JSESSIONID

Talks about #linkedin, #resilience, #cybersecurity, #crisismanagement, and #personalbranding

The Brand Strategist for Cyber CEOs. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

Rogers Cybersecure Catalyst, Toronto Metropolitan University is hiring.
We continue to grow and if our vision of "Cybersecurity for all" resonates with you. Check out and apply for these roles.

Director of Strategic Partnerships
https://lnkd.in/gaTXKaBz

Director, Public Sector and Small Businessess
https://lnkd.in/gFGDsGvG

Program Lead
https://lnkd.in/gSajF8eK

Cyber Clinic Program Lead
https://lnkd.in/gcFhZFkP

Operations Coordinator

Check out this job at Toronto Metropolitan University:  https://lnkd.in/g2S-fNFa


Applications close soon and start the new year in a role and organization that is shaping the future of Cybersecurity in Canada and beyond.

Rogers Cybersecure Catalyst, Toronto Metropolitan University

You are all busy. I don't expect you to read my history, so here is a little about me.

𝗕𝗼𝗿𝗻 𝗮𝗻𝗱 𝗿𝗮𝗶𝘀𝗲𝗱 𝗶𝗻 𝗦𝗶𝗻𝗴𝗮𝗽𝗼𝗿𝗲.

Never the model student.
Made a career choice at 19.
To serve in the Navy and see the world.

𝗖𝗮𝗿𝗲𝗲𝗿 𝗶𝗻 𝘁𝗵𝗲 𝗡𝗮𝘃𝘆

Daily lessons of leadership, critical thinking.
Ran the wargaming and simulation centre.
Left in 2017 after rejecting a promotion and the opportunity to command a ship.

𝗢'𝗖𝗮𝗻𝗮𝗱𝗮

Moved to Canada w no corporate exp
Struggled for years to climb a ladder
Fortunate to move into cybersecurity

𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆

Currently in my 3rd role in cyber.
1. Project Management
2. Senior advisor - security exercises
3. Senior advisor - security exercises

𝗖𝘂𝗿𝗿𝗲𝗻𝘁 𝗲𝗻𝗱𝗲𝗮𝘃𝗼𝗿𝘀

Full-time at Rogers Cybersecure Catalyst, Toronto Metropolitan University. 
Best place I have worked in Canada.

Need cybersecurity tabletop exercises, cyber range training, cyber advisory services?

Give me a shout.

𝗖𝗼𝗻𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀

Book author
The Essential Cybersecurity Ex Playbook.
I still refer to it when I design exercises. 
Get it if you are tasked to run exercises.

Ghostwriter for Cyber CEOs and Founders
Your LinkedIn Account is a goldmine.
Build your thought leadership and authority.
I write your LinkedIn posts for you.

P.S What did you not know abt me?

Cybersecurity professionals struggle in OT organizations.

Especially if they don’t take the time to understand operations.

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

What Makes OT/IoT Security Complex

Q3: What makes protecting operational environments fundamentally different from traditional IT cybersecurity?

OT environments have physical processes, so organizations prioritize safety, reliability, and availability of OT systems. Confidentiality of data takes a back seat. Additionally, OT systems have a much longer life cycle. As a result, these systems operate 24/7 on legacy equipment and networks making patching and rebooting a challenge. Security changes can directly impact physical processes, which means risk management must balance cyber controls with operational continuity.

Q4: Can you share an example of how operational and security priorities sometimes conflict — and how organizations can bridge that gap?

Security teams may recommend immediate patching or network changes, while operations teams push back due to downtime risks or safety concerns. Capital upgrades of legacy equipment are also cited as reasons for avoiding immediate patches. Bridging that gap comes from joint risk assessments, staged mitigation plans, or designing controls that reduce risk without disrupting critical operations
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What’s the biggest challenge in OT security?

OT & IoT Cybersecurity | Smart Building Technology | Smart Cities

“I’ll take a break from writing/posting”. 

That’s what I told myself as I returned from my vacation. 

“It will be easy to get back into it”. 

Just like my exercise routine, my writing and networking rhythm were severly derailed. 

Even though my systems and tools were in place, I need to reconvince myself of the intend of being active on this platform. 

And it really does fall back to the why. 

Once that is reaffirmed, then the other pieces of the how kicks back in. 

Here’s back to sharing:
- how organizations should use cyber exercises to improve their readiness and resilience 
- how cyber CEOs should use LinkedIn to drive brand awareness 

P.S who thinks the LinkedIn feed is darn boring these days. Let’s start sharpening our storytelling skills.

Cyber CEOs are missing one of the biggest opportunities on LinkedIn.

Your founder story.

Not the pitch.
Not the product.
The reason you started.

Here is why it matters.

1. It builds trust faster than yr website.

People want to know the conviction behind your company. Your story answers the core question every buyer has: why should I trust you.

2. It humanizes your brand.

Cybersecurity is technical and crowded. Your story cuts through the noise and shows the person behind the mission.

3. It creates instant differentiation.

Competitors can copy language, pricing, and positioning. They cannot copy your journey.

4. It strengthens every future conversation.

When people understand your why, your product demonstrations, sales calls, and partnerships become warmer and easier.

Your founder story is not optional.
It is a strategic asset.

If you do not tell it, your audience will never hear it. And don’t wait for permission to share too. 

No one is gonna give you that.

Culture change is crucial for security transformations.

How does one influence change in critical infrastructure?

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

Leadership, Culture & Collaboration

Q7: You’ve worked across consulting, engineering, and executive leadership — what have you learned about leading teams through complex technical change?

Real progress happens when leaders listen to their teams, and more importantly, remove obstacles instead of issuing directives. Operational teams adopt change when they feel respected, supported, and protected from unnecessary risk — not when security is pushed onto them as “another policy to follow.”

Q8: In your view, what’s the biggest cultural or mindset shift organizations need to make to strengthen their cyber and operational resilience?

Organizations must stop treating security as something they “enforce” on operations and start treating it as something they build with them. When frontline technicians and engineers are empowered as partners rather than problems to manage, security becomes practical, sustainable, and actually effective.
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. Which sector needs the most security attention?

Have you tried asking ChatGPT abt yourself?

Try it. I hope you don’t find sensitive information.

AI models feed on data. And yet so many organizations have headed straight for the AI gravy train without due consideration for the impact on data management and privacy. 

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

The Intersection of Privacy and AI

Q5: As AI becomes more embedded in diagnostics and digital health tools, where do you see the biggest privacy blind spots emerging?

Many organizations that adopt AI often overlook the importance of a solid AI Governance Framework. This oversight can lead to unsupervised AI being used within the organization, allowing users to leverage AI solutions without proper guidance. Such a lack of direction often leads to unintended disclosures of sensitive information. Additionally, a significant blind spot exists where many organizations are unaware of what personal or health data their AI models are accessing, retaining, or inferring. 


Q6: How is Privacy Horizon adapting its services — for instance, with AI-PIAs or automated privacy assessments — to address these new challenges?

We’ve expanded our service model to include AI Privacy Impact Assessments, AI Governance Frameworks, AI Training, and readiness tools aligned with the EU AI Act and ISO 42001. These help healthcare organizations assess AI systems’ risks, ensure transparency, and demonstrate trustworthy AI adoption.
_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S What worries you about AI and privacy?

It seems like privacy is a premium these days.

And it can be sidelined if we don’t preserve it.

AI models feed on data. And yet so many organizations have headed straight for the AI gravy train without due consideration for the impact on data management and privacy. 

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

The Future of Privacy Leadership

Q7: What qualities will define the next generation of privacy leaders in healthcare?

Future privacy leaders will combine a strong understanding of technology, turning intricate risks related to AI, data, and cybersecurity into transparent, human-focused governance approaches that build trust among stakeholders.

Q8: If you could change one thing about how organizations approach privacy today, what would it be and why?

I would change the perspective from viewing “privacy as compliance” to seeing “privacy as strategy.” Privacy doesn’t have to be a boat anchor. Privacy is about common sense. Privacy is nothing more than good information management and good customer service. When organizations integrate privacy with trust, innovation, and brand value, compliance occurs naturally and a culture of accountability becomes self-sustaining.

_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S Is privacy a top concern when implementing AI?

Take a second to count your personal connected devices.

Now, estimate that number for an enterprise set-up.

Enterprises struggle to keep up with the inventory, tracking, management, and governance of their IT systems. Industries and companies that rely heavily on physical systems, such as monitoring devices, automated systems, and highly integrated systems, add layers of complexity and associated risks to maintaining operational efficiency and security.

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

The OT/IoT Security Landscape 

Q1: How has the growing interconnection between physical systems and digital networks changed the way organizations think about cybersecurity?

Organizations that run physical systems and OT are more aware now of the risks that come with connecting them to digital networks. Asset owners are increasingly focused on securing these environments—marketing hype can amplify the fear, but the concern is justified. More connectivity expands the attack surface and links cyber incidents to real-world impacts on safety, reliability, and finances. As a result, there is a shift to treat cybersecurity as an operational responsibility, not just an IT issue.

Q2: From your experience, what are the biggest misconceptions business leaders still have about securing operational or connected environments?

Many business leaders place more emphasis on tooling and technology. Their main focus should be prioritized towards embedding cybersecurity practices and controls in their business workflows, organizational processes and ensuring their governance is not just documented, but functional. 
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What are some IoT/OT security assumptions that many have?

If growing your LinkedIn presence as a cyber CEO is not part of your 2026 plan, it is a huge marketing miss. 

The others parts are shaping up:
- website copy
- marketing swag
- cold email blasts
- conference booth
- CISO wine and dine 😃

All that is important and probably takes up the bulk of your budget. 

And then when your prospects land on your LinkedIn page, it blands (yes bland) in with the rest of the corporate copy. 

“We are on brand.”
“Our product speaks for itself.”

What could have been a differentiator from your competitors and a vibrant platform to build a community and awareness for your company. 

Instead, it just fades to the background. Like many of the other passive accounts. 

Is your LinkedIn account working your you, your company, and your vision?

Or will 2026 be another missed opportunity? 

Your platform. 
Your choice.

LinkedIn

Addressing security issues in an OT heavy organization is an uphill battle.

Especially if we blindly apply IT security principles.

Where should one start? Or is it an impossible task?

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

Building Secure and Resilient Systems

Q5: When you work with clients on OT/IoT cybersecurity, what guiding principles or frameworks do you find most effective?

Common sense, to start with. We also rely heavily on frameworks like NIST SP 800-82 and ISA/IEC 62443, focusing on asset visibility, segmentation, and defense-in-depth. These frameworks take a risk-based approach. There are industry-specific regulations that may also apply. Effective cybersecurity programs align cybersecurity controls directly to safety, reliability, and regulatory objectives rather than treating security as a standalone effort.

Q6: How can organizations take practical first steps toward improving their OT or IoT resilience without massive overhauls?

Work on foundational knowledge first. Document your environment and how OT intersects with and affects other organizational departments. Start with visibility - and I don’t mean deploying a tool. Understand what assets are connected, where data flows, and who owns them. Understand your existing staff's skill set. Establish your risk tolerance thresholds. Document everything. Then implement basic segmentation, access control, and incident response planning — small changes that dramatically reduce risk without major system interruptions.
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What are some key differences between IT and OT security?

Here’s one signal to know yr cyber exercise is highly effective. 
And most TTXs never trigger this. 

We recently executed a cyber range simulation exercise that put an IT team through a stressful scenario. 

The team was actively analyzing the IOCs and raise many relevant points for decision making. The leadership team weighed the risks and make a decision for containment. 

This decision was communicated to the technical teams and it spark a behavior which I didn’t expect but was glad it happened. 

The IT team responded to seek clarification on the decision. The instructions from the leadership team was clear on intent but the IT teams wanted to ensure that the leadership team understood the risks and nuances of the decision. 

And the discussion got pretty heated. 

This is termed as “Challenge and Response” and is something that we used while we manage the navigation team to ensure the safety of the ship. 

Team members would challenge the instructions (not the authority) if they were unclear or they had information that may impact the decision. The officer of the watch will have to respond to confirm or clarify the order. 

The purpose of this mechanism was to ensure that there was an avenue for clarification of an order without the risk of insubordination. 


So to my surprise, I saw this playing out as we ran our exercise. 

This is a healthy sign that the team had the right culture and understood the intent of the team’s actions. 

How did the heated discussion end?

I had to intervene, acknowledge the perspectives of both parties, and park the issue aside to continue w the exercise. 

This learning point would not occur in a benign tabletop exercise. It took a realistic high pressure scenario to tease out the practical considerations of incident response. 

P.S can u guess what the discussion was about? 
I’ll give a prize if anyone guessed it!

I consult with many Cyber CEOs. 

These 4 questions come up in every strategy call I run with founders.

⸻

1/ What should I post without oversharing or sounding salesy

They worry about balancing:
- Oversharing insights 
- Being authoritative vs promotional

But the real issue?

This isn’t a writing problem.
It’s a positioning + content strategy problem.

Once you define your POV and boundaries, posting becomes easy.

⸻

2/ Will this really generate business, or is it just vanity?

They’re skeptical because:
- Impressions ≠ pipeline
- “Likes” don’t close deals
- Decision-makers feel invisible on LI

Behind this question is a deeper fear:

“Will my effort pay off?”

LinkedIn is a trust engine, not a slot machine. It compounds if you show up consistently.

⸻

3/ How do I stand out when every cyber CEO sounds the same?

Their feed is full of:
- News reposts
- Corporate announcements 
- Zero Trust / AI buzzwords

Their real question is:

“What is MY unique point of view?”

The answer is always the same. 
Stand out by being specific, not louder.

Your niche, your observations, your client stories, your lessons.

Those are the differentiators.

⸻

4/ How much time does this take each week?

They assume LinkedIn is:
- Daily posting
- Daily commenting
- Constant DMing
- Full time social media diva

But what they actually want is simple:
A strategy that is intentional. 
A plan that drives results. 

You don’t need to post daily.
You need clarity, consistency, and relevance.

⸻

If you’ve have all these questions too, the good news is they’re all solvable.

Cyber CEOs don’t need more content.
They need a clearer strategy, stronger positioning, and a repeatable system.

P.S what other qns do u have?

Cyber CEOs have endless stories. 

Here are some ideas if u r stuck.

1. The moment you realized the cybersecurity problem you’re solving was real (A client incident, a failure you witnessed, or a blind spot in the market.)

2. Why you decided to start the company instead of joining another one (Your conviction, frustration, or spark.)

3. The first obstacle you faced as a founder and what it taught you
 (Funding, product clarity, hiring, credibility.)

4. The early version of your solution and how different it was from today
 (Show evolution and persistence.)

5. A hard lesson you learned that shaped how you lead now
 (Trust, communication, resilience, decision speed.)

6. The turning point when you knew the company would work
 (First client, first renewal, first big validation.)

7. A belief you hold about cybersecurity that most people overlook
 (Your “why” behind your mission.)

8. How your background shaped the way you approach security problems
 (Past industries, roles, failures, or personal experiences.)

9. The sacrifice most people don’t see
 (Time, stability, opportunity cost, personal growth.)

10. Your vision for the industry and why you’re committed to it
(Where things are going and why you care.)

P.S Expand on each point in a few different angles and your content is set for months. 

Any other story ideas?

LinkedIn has never worked for me. 

Many Cyber CEOs tell me that. 

“What have you tried?”

- had 1 video call w a new contact
- create 2 posts every quarter 
- msg 3 CISOs every week
- like 4 posts every day 
- read 5 cringey posts

Bruh, what were you expecting. 

If you execute prod dev like a hawk,
raise funds like the fed, why do you neglect your professional presence?

You may be causing more damage missing more opportunities than u thk. 

Is 2026 going to the same for u?

Here are 4 silly TTX lessons that you never plan for but do happen. 

You have gone through the rigor. 

Study the IRPs and escalation flows. 
Deep dive into sector intel and risks. 
Create the most compelling scenario. 

You executed the exercise w precision. 

Then realize this is what they gained. 

1. Some participants have never met. 

Whether it is high turnover or there never as reason to meet, don’t be surprised if some members have never met before and the exercise served its purpose of building relations. 

Silly but happens more often than u thk

2. Some plans have never been read. 

Or in some cases, no one knew it existed or didn’t event realize annex C-7 had a whole section dedicated to the responsibilities of said department. 

Better late than never to realize you have a role to play in an incident. 

3. Some words have diff meaning. 

You used industry defined nomenclature as you peppered the response plans with actionable and detailed terminology. Only to realize no one cares about your glossary on page 54. 

Fav terms. Isolate. Asset. Segregate. Sanitize. Take offline. Clean up. 

Record the lesson learned. 
Create an action item to synch. 

4.  Some roles and ppl r gone. 

This always happens but don’t let u derail the exercise. Plans are never perfect. They are there to serve as a kick off point and reference, not a step by step instruction booklet. 

Don’t be so rigid. 

P.S what other interesting TTX encounters have you experienced?

10 planning considerations for a live red team exercise.

A live Red Team exercise can transform your organization’s cyber readiness.

Or it can blow up in your face.

Most companies underestimate the planning required. 
Live exercises introduce operational risk, reputational exposure, and real technical consequences if poorly scoped.

Here are 10 planning considerations. 

⸻

1. Define crystal-clear objectives before touching the scenario.

A Red Team exercise easily derails without a defined purpose.
•	Are you testing detection?
•	Decision-making?
•	Business response?

Knowing the objective helps guide the red team and enables alignment.  

⸻

2. Assess organizational maturity honestly before selecting tactics.

Live exercises should match capability.
Teams still struggling with escalation protocols shouldn’t jump straight to advanced APT emulation.
Ensure your IRP, SOC workflows, and communication playbooks are mature enough to withstand live pressure.

⸻

3. Secure executive sponsorship and socialization early.

Leadership must know what they’re approving. This includes scope, risks, expected disruptions, and reporting cadence.

⸻

4. Establish strict scope, boundaries, and rules of engagement.

A Red Team must know exactly what is allowed.
Examples:
•	No production data exfiltration.
•	No destructive actions.
•	Limited hours for intrusion.
•	Clear ‘stop game’ conditions.

Defined ROE protects your systems, your people, and your reputation.

⸻

5. Map out all critical systems, dependencies, and crown jewels.

You can’t test everything.
Choose what matters most:
•	Mission-critical applications
•	Identity systems
•	Cloud environments
•	OT/ICS (very rare)

Have a clear reason why this is the target. 

⸻

6. Involve key third-party vendors before game day.

Many Red Team exercises collapse due to vendor bottlenecks.

Notify them early. 

Their tools, logging, and escalation capabilities determine how realistic and valuable the exercise becomes.

⸻

7. Prepare the SOC and security teams without revealing the scenario.

Let them know the exercise window and who to clarify with if there are doubts. 

A Red Team exercise shouldn’t overly hamper operations. Yes there will be increased load for short periods of time. 

⸻

8. Decide the battle rhythm for decision-making and communication.

Synchronisation avoids chaos and ensures realism in response flow.

Also include exercise control meetings to keep teams updated. 

⸻

9. Create a safety plan.

Live operations = live risk.

A safety plan ensures the Red Team can push boundaries without endangering the business.

⸻

10. Design a mature debrief, learning review, and AAR process.

The biggest ROI comes after the exercise.

A rigorous debrief is where transformation happens.

⸻

Conclusion

A live Red Team exercise is a meticulously planned, high-stakes enterprise learning event.

Plan it properly, and you elevate your team’s resilience.
Rush it, and you erode trust in security

How to instantly instill confidence during an incident response call?

One of the key features in every incident response plan is the incident response call or CSIRT (cybersecurity incident response team) call. 

Yet, it is hardly ever practised and you can confuse everyone if it is a mess. 

There is no clear lead, the agenda is sketchy, and the conversation goes all over the place. Even worse, it drags on with no end in sight. 

A simple way to fix this. 

Meetig structure + Practice

Here is a sample meeting structure:

1. State the objective and summary
2. Facts so far (what we know, what we think, what we don’t know)
3. Impact and scope 
4. Top 3 priorities and risks
5. Decisions needed now
6. Action item review
7. Comms and notifications
8. Recap key next steps
9. Open for questions 
10. Timing of next call 


You need to practise these calls. 
And run it with military disciple. 

P.S what agenda item wld u add?

taplio

The Battle

Ash Rathod

Lester Chng

Followers

Posts

Engagements

Likes

Performance ScoreAsh Rathod's LinkedIn Performance

Performance ScoreLester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Ash Rathod

Lester Chng

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Ash Rathod's LinkedIn Performance

Performance ScoreLester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreAsh Rathod's LinkedIn Performance