Marcus Chan

Helping AEs earn $500K+ and max their potential to achieve freedom, fulfillment, & security without grinding or slimy sales tactics | Team + Individual Programs | 4X Salesforce Top Influencer | WSJ Best-Selling Author

Three quarters in a row, the number slipped.
The CRO was out of answers.
Reps were burning out, the board was circling, and pressure was suffocating.

After one framework from our Revenue Engine OS™, that same org hit 114% the next quarter — with no new hires and no extra leads.

A $40M HR tech firm was losing 6 out of 10 deals to “no decision.”
Their pipeline looked full. It was fiction.
After installing our discovery system, deal velocity jumped 65% and win rates climbed 47%.

A fintech startup took 14 months to ramp reps.
After Venli, they did it in 6 and doubled first-year retention.

That is where we step in — when chaos meets quota pressure.

At Venli Consulting, we help CROs, VPs of Sales, and Revenue Leaders fix the invisible breakdowns that quietly drain $2–$10M+ in revenue every year.

Every strategist and trainer on our team has led sales organizations from the trenches.
We have carried quota, built teams, and scaled revenue firsthand.

Because most sales orgs do not have lazy reps.
They have leaky systems:

→ Discovery that fails to create urgency
→ Demos that die in silence
→ Managers stuck chasing deals instead of building people

I’m Marcus Chan, Founder & CEO of Venli and creator of the Revenue Engine OS™, a proven system used by 100+ organizations to turn chaos into predictable growth.

Before Venli, I led a $195M/year Fortune 500 sales organization, earned 12 promotions in 8 years, and authored a Wall Street Journal bestselling book.

Recognized by Salesforce, LinkedIn, and Forbes, I’ve spent my career helping sales leaders stop gambling on effort and start scaling with systems.

If you lead a sales organization generating at least $10M+ annually, I can show you exactly where your revenue is leaking — and how to fix it systematically so you can scale to $100M and beyond.

👉 Benchmark your revenue engine: https://venli.co/47c-sta-vsl

📕 232-page tactical playbook (50,000+ leaders): https://venli.co/xxt-sfss-book

💻 100+ hours of elite B2B sales training: https://urlgeni.us/youtube/channel/marcuschan

Predictability is not luck.
It is engineered.

President / Founder

We help AE’s earn $250K-$500K+ and develop record-breaking sales skills.

We provide proven sales coaching + training for reps and teams teaching the exact President’s Club winning system that helped me close $140M ARR and hit 100-250% to quota 13 years in a row.

With over a decade of winning awards, crushing sales quotas, and sales leadership experience, we can help you transform your results! Yes, we are sales coaches that have actually achieved real proven results consistently before we started the business!

In under 5 years we've grown from 0 to 600+ clients and have achieved a few of the following things:

✅ 4X Salesforce Top Sales Influencer to Follow
✅ Wrote a Wall Street Journal and Amazon Best Selling Sales Book
✅ LinkedIn Top Voice - Sales: #5 out of 300M+ active users
✅ Featured in Forbes, Yahoo! Finance, Yahoo! News, MarketWatch, CNBC, and more!

Make sure to access our free most popular free training resources including our on-demand no cost training in the Featured section of my profile.

Lester Chng

Rogers Cybersecure Catalyst, Toronto Metropolitan University

Corporate Training & Cyber Range
- Tabletop Exercises (Cyber, IT, Emergency and Crisis Mgmt)
- Cyber Risk Advisory services (Workshops, Bootcamps)
- Cyber Range Scenarios (Individual, Team Training)

https://cybersecurecatalyst.ca/

Senior Cybersecurity Advisor

The Essential Cybersecurity Exercise Playbook

https://lesterchng.gumroad.com/l/The_Essential_Cybersecurity_Exercise_Playbook

Part I - Executing a single exercise
Chapter 1 - How to develop objectives for your exercise
Chapter 2 - How to run joint exercises with 3rd party
Chapter 3 - How to decide the modality of the exercise
Chapter 4 - How to create injects for your exercise
Chapter 5 - How to facilitate a cybersecurity exercise
Chapter 6 - How to encourage discussion during an ex
Part II - Establishing an exercise program
Chapter 7 - How to establish a cyber exercise program
Chapter 8 - How to write a business case for your prog
Chapter 9 - How to create a 5 part ransomware exercise
Part III - Bonus information
Chapter 10 - 120 facilitation questions for your exercises
Chapter 11 - 30 objectives for your exercises
Chapter 12 - 3-part Ransomware exercise deck

Book Author - The Essential Cybersecurity Exercise Playbook

BMO Financial Group

I built a cybersecurity and crisis management exercise program from scratch for one of the largest financial institutions in North America.

Execution of >50 cybersecurity, fraud, physical security, and crisis management exercises

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Managed technological delivery of TD's anti-money laundering project
• Proactive management and engagement of multi-faceted team of architects, vendors, developers
• Established work plan, identified project deliverables and motivated team to deliver projects
• Prepares daily reports and presentations to executive groups
• Highly complex project involving IT infrastructure build, code deployment, and data and app migration
• Detailed risk identification and assessment and performed active risk mitigation
• Directed and coordinated project activities across various teams to ensure adherence to schedule

Project Manager - Enterprise Enabling Technology Solutions (AML)

Driving project delivery excellence through portfolio governance and quality assurance practices
• Championed and responsible for standards and procedures across PMO
• Represented the PMO for all enterprise level project methodologies issues
• Delivery of training program for project management practices
• Conduct analysis of project trends and risks to enhance PMO delivery excellence
• Provide direct support to projects on methodology, adherence to standards, and policies
• Led the development of Portfolio Key Performance Indicators, Benchmarking, and Dashboard development

PMO Governance Lead - Technology Risk Management and Information Security PMO

Ministry of Defence of Singapore

Project Manager
- Represented the Navy and delivered the award winning state of the art training facility.

- Developed all security and safety procedures as the Unit Security and Unit Safety Officer.

- Established new training scenarios for Navigation, Maritime Security and Naval Warfare.

Project Manager [Major] Naval Simulation Centre

- Designed and delivered turnkey training solution to generate 240 crew and 8 leadership teams for 8 new ships.

- Streamlined work processes of the new vessel and promulgated best practices.

- Executive coaching on leadership, communication, team dynamics, and effectiveness.

Head of Training [Major], Littoral Mission Vessel Squadron

- Directed exercises as “Enemy Force” to test Operational Plans of the Navy.
- Led a team of 19 senior military experts to operate key training facility of the Navy.
- Project advisor of instructional video which saved 90% manpower resource.
- Coached participants on leadership, communication, team work and professional knowledge.

Directing Staff, Wargaming and Simulation Centre [Major]

- Second in Command of a Patrol Vessel (30 Officers and Military Experts).
- Unit Security Officer responsible for all aspects of security including IT, physical security and info security. 
- Responsible for the safety, discipline, training, morale, operational readiness and security.
- Coached junior officers in leadership, watch-keeping duties and naval warfare.
- Prepared the ship for operational duties and responses to maritime incidents.

Executive Officer and Unit Security officer [Captain], Patrol Vessel

Unit Security Officer responsible for all aspects of security including IT, physical security and info security.

Assistant Operations Officer and Unit Security Officer [Captain]

Navigating Officer [Captain]

Combined Maritime Force, Bahrain

-Held the appointment as Liaison Officer (Intelligence) in the Combined Maritime Force (CMF) 
- Headquarters in Bahrain under the US-led Task Force
- Main intelligence link between the Singapore Led Command Team and the CMF HQ.
- Involved in in-depth analysis of Somali pirate operating models.

Intelligence Analyst

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

Write books, speak at TEDx, full time cyber pro, mum.

Sometimes I wonder how she expands time.

I interviewed my friend Zinet Kemal, M.S.c, who is an immigrant, mother of four, author, TEDx speaker & Cybersecurity professional. She is passionate about educating and empowering children on online safety and cybersecurity careers.

Empowering the Next Generation

Q5: What inspired you to write children’s books about online safety?

As a mom of 4 and cybersecurity practitioner, I saw a gap in how we teach kids to navigate the digital world safely. I wanted to start that conversation early in a fun, relatable way.

Q6: For newcomers in cyber, what’s your top tip for building skills and visibility?

Learn by doing. Share what you learn. Even small wins and lessons can inspire others and help you grow your voice and network in the community.

Women in Cyber & Representation

Q7: What barriers still hold women back in cybersecurity today?

Representation and confidence. When you don’t see people like you in the room, it’s easy to doubt you belong but you absolutely do. Lack of respect and enough true support from allies.

Q8: What would a more inclusive cyber industry look like to you?

A more inclusive cyber industry is one where everyone feels seen, heard, and valued. It is where representation drives innovation and thriving, not just participation and surviving.
_____________________________

If you enjoyed this interview series, please follow Zinet. She frequently shares about her cybersecurity journey and is a gem to the industry.


P.S What is a barrier that still exists in the job market?

Another reason to be active on LinkedIn and you won’t like this. 

People are too busy to notice you. 

- social media doom scroll
- Netflix and chilling 
- project deadlines
- kids schedule 
- home stuff  
- life events 

And there you are, typing away on your keyboard, working your bum off. Spending all your hours and energy delivering the best work that you can. 

But you forgot to spend time on yrself. 

Time to learn more. 
Time to recuperate. 
Time to invest in you. 

Use LinkedIn to share just abit more of
- what you do
- what you think
- what you are like 

You work hard enough to be noticed. 

Don’t let all that go to waste because you are afraid of what yr colleagues and friends think. 

Let them live with their insecurities. 

You have a career + reputation to build.

No alternative text description for this image

You are all busy. I don't expect you to read my history, so here is a little about me.

𝗕𝗼𝗿𝗻 𝗮𝗻𝗱 𝗿𝗮𝗶𝘀𝗲𝗱 𝗶𝗻 𝗦𝗶𝗻𝗴𝗮𝗽𝗼𝗿𝗲.

Never the model student.
Made a career choice at 19.
To serve in the Navy and see the world.

𝗖𝗮𝗿𝗲𝗲𝗿 𝗶𝗻 𝘁𝗵𝗲 𝗡𝗮𝘃𝘆

Daily lessons of leadership, critical thinking.
Ran the wargaming and simulation centre.
Left in 2017 after rejecting a promotion and the opportunity to command a ship.

𝗢'𝗖𝗮𝗻𝗮𝗱𝗮

Moved to Canada w no corporate exp
Struggled for years to climb a ladder
Fortunate to move into cybersecurity

𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆

Currently in my 3rd role in cyber.
1. Project Management
2. Senior advisor - security exercises
3. Senior advisor - security exercises

𝗖𝘂𝗿𝗿𝗲𝗻𝘁 𝗲𝗻𝗱𝗲𝗮𝘃𝗼𝗿𝘀

Full-time at Rogers Cybersecure Catalyst, Toronto Metropolitan University. 
Best place I have worked in Canada.

Need cybersecurity tabletop exercises, cyber range training, cyber advisory services?

Give me a shout.

𝗖𝗼𝗻𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀

Book author
The Essential Cybersecurity Ex Playbook.
I still refer to it when I design exercises. 
Get it if you are tasked to run exercises.

Ghostwriter for Cyber CEOs and Founders
Your LinkedIn Account is a goldmine.
Build your thought leadership and authority.
I write your LinkedIn posts for you.

P.S What did you not know abt me?

How to create a content calendar in 10 mins and never worry abt what to post. 
 
Follow this process and save time. 
 
I never worry about what to post about. 
Not because I have a constant stream of inspiration and the words flow naturally. 
 
Writing and posting on LinkedIn has become part of my professional portfolio and I constructed a simple system. 
 
1. Decide what your objectives are 
- to establish thought leadership 
- to build stronger professional relations 
- to bring awareness to brand and product 
 
=> The clearer this is, the easier it gets. 
 
2. Decide how frequent you post 
- minimum twice a week 
- thrice is good 
- seven if able 
 
=> Schedule your time to write. 
 
3. Decide what are your content pillars 
- keep it no more than 2-3 
- for me it is ghostwriting 
- and cyber exercises 
 
=> What you want to be known for? 
 
4. Decide the various themes 
- posts that builds awareness 
- posts that builds authority 
- posts that builds trust 
 
=> How do u get ppl to like, trust, know u? 
 
5. Decide the theme for the day 
- Mon = Awareness 
- Wed = Authority 
- Fri = Trust 
 
=> Saves your time thinking of the theme 
 
6. Mind-map and research abt topics 
- Content should be planned 
- Mind-map your experience 
- Answer yr client qns 
 
=> If it is not planned, u will struggle  
 
7. Keep it simple and you will follow 
- create a simple system 
- don't complicate it 
 
=> It takes some prep but well worth it 
 
I planned out my content calendar and stick to it for at least 6 months. 
 
Struggling with posting consistently? 
Chances are you are winging it. 
 
Do you also leave yr business to chance? 
Didn't think so. 
 
It's time to take action. 
Get in touch. Start being intentional.

Getting into Cyber feels like winning the lottery.

Here’s how to increase your odds.

I interviewed my friend Zinet Kemal, who is an immigrant, mother of four, author, TEDx speaker & Cybersecurity professional. She is passionate about educating and empowering children on online safety and cybersecurity careers.

Journey & Motivation

Q1: You started in law before moving into cybersecurity. What inspired that switch?

I wanted a career where I could make a tangible impact and continuously learn. Cybersecurity offered that blend of purpose, challenge, and growth that instantly drew me in.

Q2: Hands-on experiences like competitions helped launch your career — what advice would you give to others trying to break into cyber?

Don’t wait to feel “ready.” Jump in, join competitions, try extra curricular stuff and learn by doing. Real-world practice builds confidence faster than any certification alone.

Cloud Security Expertise

Q3: What’s one common mistake organizations make when moving to the cloud?

Rushing migration without embedding security from the start. Security shouldn’t be an afterthought. It should guide every design and decision.

Q4: How do you balance speed and security in fast-paced cloud environments?

By automating what you can and baking security into the pipeline. That way, teams can move fast and stay secure without friction.
_____________________________

If you enjoyed this interview series, please follow Zinet. She frequently shares about her cybersecurity journey and is a gem to the industry.


P.S Have you seen her award list!

“I’ll take a break from writing/posting”. 

That’s what I told myself as I returned from my vacation. 

“It will be easy to get back into it”. 

Just like my exercise routine, my writing and networking rhythm were severly derailed. 

Even though my systems and tools were in place, I need to reconvince myself of the intend of being active on this platform. 

And it really does fall back to the why. 

Once that is reaffirmed, then the other pieces of the how kicks back in. 

Here’s back to sharing:
- how organizations should use cyber exercises to improve their readiness and resilience 
- how cyber CEOs should use LinkedIn to drive brand awareness 

P.S who thinks the LinkedIn feed is darn boring these days. Let’s start sharpening our storytelling skills.

Cyber CEOs are missing one of the biggest opportunities on LinkedIn.

Your founder story.

Not the pitch.
Not the product.
The reason you started.

Here is why it matters.

1. It builds trust faster than yr website.

People want to know the conviction behind your company. Your story answers the core question every buyer has: why should I trust you.

2. It humanizes your brand.

Cybersecurity is technical and crowded. Your story cuts through the noise and shows the person behind the mission.

3. It creates instant differentiation.

Competitors can copy language, pricing, and positioning. They cannot copy your journey.

4. It strengthens every future conversation.

When people understand your why, your product demonstrations, sales calls, and partnerships become warmer and easier.

Your founder story is not optional.
It is a strategic asset.

If you do not tell it, your audience will never hear it. And don’t wait for permission to share too. 

No one is gonna give you that.

Data is absolutely vital for effective healthcare.

But how do we manage the risk and liability?

Managing data and addressing privacy issues are major risk areas for many healthcare organizations. Add AI to that picture and it can be messy very quickly.

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

The Evolution of Privacy in the Health Sector

Q1: You’ve worked across both government and private healthcare environments. How has the concept of “privacy by design” evolved in the health sector over the past decade?

In the last ten years, privacy by design has evolved from a compliance trend to a core design principle integrated into digital health innovations and an operational imperative. It’s now focused on instilling trust and resilience in systems rather than merely fulfilling regulatory requirements.


Q2: What are some persistent privacy misconceptions you still encounter among healthcare organizations today?

A common misconception is that privacy is the same as security or that having a lawyer create an agreement and terms of use ensures protection and compliance. Effective privacy management requires ongoing governance that aligns people, processes, and technologies to foster accountability and manage data throughout its lifecycle.
_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S. What other privacy mistakes do you see healthcare organizations make?

Privacy mgmt shouldn't be an afterthought.

Yet many choose to only address it later.

That is a risk startups should address early in their journey, especially if they handle sensitive information. Add AI to that picture and it can be messy very quickly.

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

Operationalizing Privacy — From Compliance to Trust


Q3: Many healthcare startups treat privacy as a barrier to speed. How do you help founders operationalize privacy without slowing innovation?

I encourage them to view privacy as an enabler rather than an impediment. We help clients establish strong privacy foundations and clear growth plans. We offer Virtual Privacy Officer service to help them navigate privacy-related challenges and implement best practices, allowing them to concentrate on their core business. Embracing privacy can not only benefit their bottom line but also set them apart from the competition. Effective privacy management builds customer trust and differentiates them from competitors.


Q4: What frameworks or approaches have proven most effective in embedding privacy into day-to-day clinical or product operations?

The NIST Privacy Framework, ISO 27701, and the CSA Model Code for the Protection of Personal Information provide a solid foundation, but achieving success often requires creating and executing a well-organized privacy management program. This program should encompass an accountability framework, functional tools such as privacy impact assessments (PIAs) and risk registers, and training that ensures everyone is responsible for privacy, not just the compliance team.
_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S What other privacy frameworks would you recommend?

It seems like privacy is a premium these days.

And it can be sidelined if we don’t preserve it.

AI models feed on data. And yet so many organizations have headed straight for the AI gravy train without due consideration for the impact on data management and privacy. 

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

The Future of Privacy Leadership

Q7: What qualities will define the next generation of privacy leaders in healthcare?

Future privacy leaders will combine a strong understanding of technology, turning intricate risks related to AI, data, and cybersecurity into transparent, human-focused governance approaches that build trust among stakeholders.

Q8: If you could change one thing about how organizations approach privacy today, what would it be and why?

I would change the perspective from viewing “privacy as compliance” to seeing “privacy as strategy.” Privacy doesn’t have to be a boat anchor. Privacy is about common sense. Privacy is nothing more than good information management and good customer service. When organizations integrate privacy with trust, innovation, and brand value, compliance occurs naturally and a culture of accountability becomes self-sustaining.

_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S Is privacy a top concern when implementing AI?

Have you tried asking ChatGPT abt yourself?

Try it. I hope you don’t find sensitive information.

AI models feed on data. And yet so many organizations have headed straight for the AI gravy train without due consideration for the impact on data management and privacy. 

I interviewed my friend Patrick Lo, the CEO of Privacy Horizon, who helps his clients make sense of the ever-changing landscape of privacy and the impact of AI.

The Intersection of Privacy and AI

Q5: As AI becomes more embedded in diagnostics and digital health tools, where do you see the biggest privacy blind spots emerging?

Many organizations that adopt AI often overlook the importance of a solid AI Governance Framework. This oversight can lead to unsupervised AI being used within the organization, allowing users to leverage AI solutions without proper guidance. Such a lack of direction often leads to unintended disclosures of sensitive information. Additionally, a significant blind spot exists where many organizations are unaware of what personal or health data their AI models are accessing, retaining, or inferring. 


Q6: How is Privacy Horizon adapting its services — for instance, with AI-PIAs or automated privacy assessments — to address these new challenges?

We’ve expanded our service model to include AI Privacy Impact Assessments, AI Governance Frameworks, AI Training, and readiness tools aligned with the EU AI Act and ISO 42001. These help healthcare organizations assess AI systems’ risks, ensure transparency, and demonstrate trustworthy AI adoption.
_____________________________

If you enjoyed this interview series, please follow Patrick. He is a healthcare privacy expert and has helped organizations build privacy and security programs.


P.S What worries you about AI and privacy?

Value stream mapping is a reshaping Biz Cont.

Don’t get left behind and stuck in BIA-land.

I interviewed my friend Shane Mathew, MPH, CBCP, who is the founder and CEO of Riffle Resiliency Systems, where he’s reimagining how organizations build operational resilience through automation and flow intelligence. 

Practical Adoption

7. For leaders who want to start using value stream mapping, what is the most practical first step to take?

Start with one essential service and a whiteboard. Bring the people who actually make it happen and ask, “What breaks first when this stops working?” The conversation might get messy—but that’s where the learning happens. That’s when continuity starts to feel real.
The Future of Resilience

8. How do you see methods like value stream mapping shaping the next generation of business continuity and operational resilience programs?
We’re moving from documents to dynamic systems thinking. BIAs will stay part of the picture, but VSM provides the context they’ve always lacked. The next generation of programs will be visual, collaborative, and built into everyday operations—where resilience isn’t something you update annually, it’s just how the business runs.
_____________________________

If you enjoyed this interview series, please follow Shane. He is focused on turning static continuity plans into dynamic, data-driven systems that evolve with the business.


P.S Have you heard of Value Stream Mapping?

10 planning considerations for a live red team exercise.

A live Red Team exercise can transform your organization’s cyber readiness.

Or it can blow up in your face.

Most companies underestimate the planning required. 
Live exercises introduce operational risk, reputational exposure, and real technical consequences if poorly scoped.

Here are 10 planning considerations. 

⸻

1. Define crystal-clear objectives before touching the scenario.

A Red Team exercise easily derails without a defined purpose.
•	Are you testing detection?
•	Decision-making?
•	Business response?

Knowing the objective helps guide the red team and enables alignment.  

⸻

2. Assess organizational maturity honestly before selecting tactics.

Live exercises should match capability.
Teams still struggling with escalation protocols shouldn’t jump straight to advanced APT emulation.
Ensure your IRP, SOC workflows, and communication playbooks are mature enough to withstand live pressure.

⸻

3. Secure executive sponsorship and socialization early.

Leadership must know what they’re approving. This includes scope, risks, expected disruptions, and reporting cadence.

⸻

4. Establish strict scope, boundaries, and rules of engagement.

A Red Team must know exactly what is allowed.
Examples:
•	No production data exfiltration.
•	No destructive actions.
•	Limited hours for intrusion.
•	Clear ‘stop game’ conditions.

Defined ROE protects your systems, your people, and your reputation.

⸻

5. Map out all critical systems, dependencies, and crown jewels.

You can’t test everything.
Choose what matters most:
•	Mission-critical applications
•	Identity systems
•	Cloud environments
•	OT/ICS (very rare)

Have a clear reason why this is the target. 

⸻

6. Involve key third-party vendors before game day.

Many Red Team exercises collapse due to vendor bottlenecks.

Notify them early. 

Their tools, logging, and escalation capabilities determine how realistic and valuable the exercise becomes.

⸻

7. Prepare the SOC and security teams without revealing the scenario.

Let them know the exercise window and who to clarify with if there are doubts. 

A Red Team exercise shouldn’t overly hamper operations. Yes there will be increased load for short periods of time. 

⸻

8. Decide the battle rhythm for decision-making and communication.

Synchronisation avoids chaos and ensures realism in response flow.

Also include exercise control meetings to keep teams updated. 

⸻

9. Create a safety plan.

Live operations = live risk.

A safety plan ensures the Red Team can push boundaries without endangering the business.

⸻

10. Design a mature debrief, learning review, and AAR process.

The biggest ROI comes after the exercise.

A rigorous debrief is where transformation happens.

⸻

Conclusion

A live Red Team exercise is a meticulously planned, high-stakes enterprise learning event.

Plan it properly, and you elevate your team’s resilience.
Rush it, and you erode trust in security

taplio

The Battle

Marcus Chan

Lester Chng

Followers

Posts

Engagements

Likes

Performance ScoreLester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Marcus Chan

Lester Chng

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Lester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreLester Chng's LinkedIn Performance