Viterra B.V.

- Due to the nature of the assignment, information can not be disclosed. -

Chief Information Security Officer (CISO)

Justitie en v

Designing and implementing the Information Security Risk Strategy for the Department of Justice and Safety in the Netherlands, based on the ISO 31000.

Strategic Advisor Information Security (CISO)

ABN AMRO Clearing Bank

Accountable and Responsible for Cyber Security within all of ABN AMRO Clearing Bank World Wide.
Functional lead of three international teams (APAC – US – EU), total of 15 security officers
Direct report to Global CIO

As part of the Global Management team IT (GMT-IT), I reported directly to the Global CIO about all security matters amongst; HR, Projects, Operations, Tactical and Strategical initiatives & budget. 

Vendor Management
Cognizant (CTS) is the, India based, strategical outsourcing partner for ABN AMRO Clearing Bank and needed to be managed on all (contract / project) aspects of Cyber Security. Including migration plans and projects, strategical initiatives & reporting.

Several projects and plans included;

- Temporary Security Operations Centre (SOC/SIEM) implementation.
- RFP Global (SOC/SIEM) execution.
- Audit Remediation
- Security Architecture
- ISO 27001 Control Implementation

Global IT Security Officer (CISO)

Novamedia

Designing and executing an international Information Security & Cyber Security program. 
Building a strategic Information Security & Cyber Security roadmap for the group, incorporating GDPR compliance, based on the good standard for information security (ISF) and the ISO 27001. Developing and implementing tailored international governance frameworks for Information security, Cybersecurity & Data Protection (privacy)

Strengthening the group IT security posture by expanding one security ecosystem.
Managing & implementing group SIEM & SOC solution. Implementing one security eco-system, Cloud (AWS) Security. Establishing 24x7 penetration testing.

Responsible for audit management, security compliance and IT Security Group contracts.
Building and maintaining a compliance program (ISO27001, Local Permits Specific). Managing the international & local audit programs, primary contact for the external auditor.  Responsible for the International (Cyber) Security budget, managing & negotiating vendor contracts.

Leading an international group of Information Security and IT Security officers. 
Establishing reporting lines & building relationships. Implementing group risk-based security thinking, as part of enterprise risk management. Mentoring information security officers, offering guidance and training. Leading the CSIRT teams on a global or local level in case of breach or severe incident.

Assisting the Enterprise Architect & Infrastructure Architect by filling the Security Architect gap. 
Acting as primary “go-to” when Security Architecture questions arise. Building a security architecture framework Including principles, artifacts, building blocks & functional stacks. 

Reporting to the COO, the Company IT director, the executive board & supervisory board. 
Establishing executive reporting lines for Information Security Strategy, Cyber Security, Security Risk Management, Data protection, Security Projects & Security budgets (finance).

Logius

In the role of Security Manager at Logius, I fulfilled a CISO position for the product MijnOverheid.nl, Overheid.nl and Life Events, with a primary focus on Cybersecurity, where I directly report to the Management Team. 

In addition to writing the information security policies and the implementation of the BIR (ISO 27001/27002), I advised on the vision, strategy, and goals of cyber & information security.

I have written the information security roadmap and set the objectives for operationalization in the years to come.  After the development of the information security policy, I guided & monitored the implementation of the security policies. For compliance & reporting, I developed a methodology that kept the business in the driver seat, without surprises in the area of information security and data privacy. 

Although my daily work has been mostly on a  tactical and strategic level, I also outlined the technical (cyber) security architecture.  I had direct control over the enhancement and implementation of IDS, Anti-Malware, Web Application Firewalls (WAF) and Vulnerability Scanning. 
At a corporate level, I advised the CISO Logius, and I supported him to strengthen information security at Logius. I have been involved in the introduction of the IRAM as a risk management methodology, establish and improve a Logius information security policy framework (policy house) and implementation of a Governance, Risk & Compliance (GRC) tool.

The implementation of the BIR (ISO 27001), the operationalization of the SIEM, various compliance processes (BIR-ICV, TPM), developing of a single audit methodology, the commissioning operational security reports, implementing Dutch privacy laws (WBP, Meldplicht datalekken) and the anchor of security architecture principles are just a few examples of my successes.

Security Manager Portaaldiensten (CISO)

GlobalCollect

In the role of Senior Information Security Manager I have been assigned several projects. I reported directly to the Chief Credit and Risk Officer which has a seat on the Executive Board.

The success for the (re) certification GlobalCollect for the annual PCI DSS audit. Through creative and pragmatic guidance GlobalCollect passed this audit successfully. The biggest challenge in this has been to, with a fixed deadline, provide the correct pragmatic solutions to senior management to so that they could take a well considered decision. 

It was the wish of GlobalCollect to get a better grip on Information Security Governance & Control. For the introduction of Information Security Governance and Control I prepared a roadmap with associated scope, schedule, deliverables and dependencies. To give effect to this implementation roadmap I helped GlobalCollect to create new structure for the Information Security Department. This new structure held, in addition to determining the work package, also introducing a new division and new roles within the team.

As the first point of contact for recruiting new information security officers for this department I have drawn the job descriptions within the team and I have been involved in the selection for the appointment of the new Director of Information Security which utilizes the roadmap as a "battle plan” in lifting  GlobalCollect to a higher level.

To enhance the grip on projects in progress (projects in stock), I designed an assessment model that can be used for those projects. From a information (data) perspective on risks and measures, discussed from a business perspective, the mitigation measures to be taken with respect to the risks defined can then be translated. These risks can be translated into functional and non-functional requirements (mitigating actions). In the end these requirements can be translated into testing criteria to be tested by the QA team or by an external penetration (compliance) tester.

Senior Information Security Manager (CISO)

ING Insurance Central and Rest of Europe

In the function of Security Architect Web Infrastructure I addressed all external accessible Web Application Infrastructures throughout the CRE Countries. I made new blueprints; took part in task forces and pressure-cookers. In addition, I replaced the project leader at absence, delivered input to project management for budgeting and I drafted, along with the project manager, the PID.
 
The role of Security Architect Web Infrastructure is part of the newly established Centre of Expertise (CoE) Web Application Security. Next to my responsibility of the establishment of the Centre of Expertise, I had an operational task to create logical and technical (security) documentation for infrastructure components, such as Web Application Firewalls (WAF), Secure DNS, Browse in/out, IDS/IPS, Firewalls and so on. As a guide for this device I used information already available from the insurance company and (mainly) the information available through Open Web Application Security Project (OWASP). In addition, I was involved in setting up (automated) vulnerability checks, penetration testing and the remedy (mitigation) of identified risks.
 

At international level, I take care of presentations, workshops, training and guidance in the field of information security, architecture, blueprints, designs, risk management, organizational design & communication. My conversation partners are the CIO, COO, IRM (Risk Management), Heads IT, architects and Designers.

I advised senior management in regards to decision making on middle and long term (information) security perspective, return on investment and strategy to be chosen.

Security Architect for Centre of Web Application Security

Dienst Uitvoering Onderwijs (DUO)

As Security Architect I have been responsible for the design of the new security architecture (picture 2015) that the link between DUO and the educational institutions as well as the educational institutions will facilitate.
 
For this design I made use of the various available research models so I can get my design can auditable was. My biggest challenge, within the time available, was the "business alignment". 
 
The search for the underlying problem, the aggregation of requirements and needs and a sense of what the "market
developments" until 2015 have input supplied for my design (s).
 
In addition to designing this new architecture, I am involved in the technical design of a solution to store digital certificates (signatures, PKIoverheid). A business analysis (risk analysis) about the value of licenses has given input for the specification of the principles. After I did a stakeholder analysis, I used requirements modeling (ISO 9126) to select the desired quality requirements that have to be adhered. In addition, the stated conditions of the enterprise architecture, reusability and management were included in the final design. 
 
I guided/facilitated several and different risk management sessions to ensure that all departments aware of the potential risks and how to design mitigation to the identified risks.

Security Architect

As the lead costumer security officer I am responsible for the security policy (implementation and maintenance) of the KPN branch “Finance and Retail Services”.  Finance and Retail Services has *** Bank Netherlands, *** Bank Belgium, Insurance company (1) and Insurance company (2) as main customers. Supporting over 15000 external users and accommodating over 250 internal KPN / Getronics employees.  

Each customer has its own support group with separate management, contracts and agreements. Each has its own set of services that KPN / Getronics is providing for them. All these services include separate security services. 

Each support group is using the ISO 27001 certificates from higher or lower organizational units with an addition of the customer specific implementation of some ISO 27001 controls. Most management controls are selected by the costumer through the use of the COBIT. Trough the use of the ISACA mapping table the link between COBIT and the ISO 27001 is made.

Lead Customer Security Officer

COLT Telecom

Solution Architect

European CISO of the year 2024. 

I am a visionary coach, trainer, and executive passionate about revolutionizing the world through profound cybersecurity management. 

As a dynamic leader, I thrive on challenging traditional thinking in these domains, always embracing the power of "Yes!" to drive innovation and transformation.

My unwavering commitment to continuous training and education has propelled me to the forefront of the information and cybersecurity field. Renowned as one of the top specialists, I possess an extensive network of influential peers and constantly seek new connections to expand my knowledge. 

However, my ambitions extend beyond these realms. I am particularly intrigued by the intersection of leadership, organizational behavior, and cybersecurity culture, recognizing their vital role in fostering sustainable success.

Throughout my illustrious career, I have successfully constructed and guided information and cybersecurity programs and teams on a global scale. As a strategic change agent, I have spearheaded initiatives that redefine the landscape of information and cybersecurity. 

Drawing upon over two decades of experience, I excel in delivering visionary strategic planning, inspiring leadership, incisive analysis, and tailored solutions. My expertise ensures that businesses remain secure amidst the ever-evolving security landscape.

If you seek a visionary executive who can orchestrate cutting-edge information and cybersecurity strategies while instilling a culture of innovation and resilience, I am the ideal candidate. I possess the acumen, experience, and unwavering dedication needed to lead organizations to unparalleled heights of security and success. 

Let's connect and explore how my transformative leadership can drive your company's growth in today's complex digital landscape.

Certified as: CISSP, CISM, CISA, CRISC, CGEIT, CSX-P, CDPSE, CCT, C|EH, E|CSA, L|PT, C|CISO, C|HFI, C|NDA, CIPP/e, CIPM, CIPT, FIP, CCSP, CCSK, S-ISME, S-DPP, C31000, PCS, SABSA, I am a Cybersecurity Rockstar!

Patric J.M. Versteeg, MSc.

✨ Information Security Forum World Congress 2025 — what an experience!

I had the privilege to present on Cybersecurity Leadership, powered by Lectorship Cyber Security - Utrecht University of Applied Sciences 

Bringing together research, field experience, and cultural leadership insights sparked truly meaningful conversations — and I couldn’t be more grateful for the response.

Here’s what participants shared:

“Excellent.”
“Inspiring.”
“Solidly founded by research and personal experience.”
“Nice, authentic way to present this.”
“Invaluable insight to bridge the gap between different styles of working and cultures.”
“Fun and engaging talk – a great start to the day!”

Hearing words like authentic, inspiring, practical, and engaging reinforces the importance of blending academic rigor with real-world leadership — and the human side of cybersecurity.

A heartfelt thank-you to the Information Security Forum community and everyone who joined, shared stories, and made this such a rewarding session. 🙏

Onward — to building trust, connection, and leadership that transcends culture and complexity. 🌍🔐

#CyberSecurityLeadership #ISF2025 #TrueNorth #NextGenCISO #CrossCulturalLeadership #AuthenticLeadership #UtrechtUniversity #CyberSecurity #LeadershipInAction

Patric J.M. Versteeg, MSc. MBA

Flavius Plesu

OutThink

OutThink is a revolutionary Human Risk Management Platform (SaaS) empowering CISOs by targeting the source of 90% of all data breaches: human behavior.

It's made by CISOs, for CISOs.

Founder & CEO

Bank of Ireland

Responsibilities include developing the UK cybersecurity strategy aligned to business goals and the delivery of a transformation programme aimed at reducing cybersecurity risk and improving key stakeholder relationships, both internally and externally (e.g., FCA, EBA, ECB).

Chief Information Security Officer (UK)

UCL Department of Science, Technology, Engineering and Public Policy (University College London)

The primary objective of the Institute is to develop novel, innovative social-science and socio-cultural techniques for cyber security. Panel member practitioners help shape and improve the future research agenda in the cyber security space at UCL, and engage with testing and validating the research outputs.

Practitioner Panel Member - Research Institute in Science of Cyber Security (RISCS)

IHS Markit

Risk oversight with a strategic focus on fostering key stakeholder relationships and building trust; Cybersecurity transformation programme; Strategy alignment to risk appetite for effective risk mitigation; Conduct group cyber risk assessment and establish the information and cyber security risk management framework; Establish and maintain appropriate information / cyber security governance, assurance and compliance frameworks. Build a risk aware cyber security culture.

Global Head of Cyber Security

University of West London

° Develop and maintain an overarching security strategy
° Develop and monitor compliance with information security policies
° Review security controls and make recommendations for continuous improvement of the ISMS
° Ensure legal and regulatory compliance with the Data Protection Act, Freedom of Information Act, PCI DSS, NHS' Information Governance Toolkit Assessment, etc.
° Facilitate risk assessments and assist business units identify residual risk and pro-actively reduce the potential for security incidents
° Develop, roll-out and maintain a cybersecurity awareness programme pitched at all users across the University (staff, students, guests and visitors)
° Respond to and communicate with sector-wide, national and international bodies in relation to cyber security

Head of Information Security

Plesu & Associates

I launched this business in 2009 as one of the two co-founders, consulting for a wide range of international businesses, across multiple security domains: Information Security Management, Information Security Risk Management, Supply Chain Risk Management, ISO 27001, Web Application Security, Awareness, Education and Training, Implementation of Information Security Classification Schemes.

Responsibilities:
° Provide strategic, pragmatic and business focused security advice to clients
° Help organisations effectively assess, transform, optimise and manage their information security function
° Define and implement Information and Cyber Security Governance Frameworks, Compliance Frameworks, Information Security Policy and Assurance Frameworks, Customer Assurance Frameworks
° Conduct risk assessment of  mission-critical information assets, changes, processes, projects and services
° Refine and expand the due diligence, triage and supply chain security risk assessment methodology
° Assist clients to ensure organisational compliance with ISO 27001, PCI DSS, COBIT and various other Information Security and Data Protection standards.
° Define and implement information security and business continuity risk assessments in line with the ISO 27001, 27005 and 22301 requirements

Founder & Information Security Consultant

Ministerul Afacerilor Interne România

Within the Ministry of Internal Affairs, the Security Component for Information Technology and Communications (CSTIC) coordinates, advises and controls the entire activity in the area of protecting information classified as 'secret', and above, for each County/General Border Police Inspectorate.


Responsibilities:
° Advise Inspectorate’s management team regarding all aspects of securing and protecting classified information
° Ensure safekeeping and archival of national security clearance certificates and authorizations to access classified information for the Inspectorate’s personnel
° Monitor the implementation of government policies, regulations and legal requirements regarding classified information across all Inspectorate departments and divisions
° Audit and monitor all administrative, logical and physical security controls specific to IT and communication systems to ensure classified information is adequately processed, stored, transmitted and/or destroyed

Classified Information Specialist - Law Enforcement

Mart & Partners - Law Firm

Responsibilities:
° Perform information security risk assessments, take appropriate actions to escalate and mitigate risks.
° Translate technical vulnerabilities to business risk terminology and communicate to senior management
° Create, manage and review the company's information security policies and procedures
° Running or preparing, reporting and remediation of penetration tests and vulnerability scans
° Identify and prioritise security-related requirements
° Develop and implement appropriate controls to address security risks identified – security policies, network and host monitoring solutions IDS/IPS, antivirus, VPN, proxy firewall, encryption, logging and auditing, backup and restore capabilities
° System access rights review and role profiles documentation
° Train staff and raise awareness regarding the misuse of information, security risks, threats and the potential business impact
° Promote a risk aware, security-positive culture

Information Security Officer

ETA2U

Responsibilities:
° Configure and troubleshoot network equipment such as modems, hubs, routers & switches.
° Identify, troubleshoot and resolve hardware, software and network related problems encountered by end- users.
° Configure and install Windows/Linux workstations.

Network Technician

I’m Flavius, a seasoned cybersecurity leader and the CEO of OutThink. With 20 years of experience and a background as a CISO, I understand the complexities of securing large organizations. OutThink was born from my belief that people, when engaged beyond traditional security awareness, can become an organization’s strongest defense.

My passion not only lies in preventing data breaches but also in inspiring change and challenging the status quo. My team and I work enthusiastically to help businesses understand and manage cybersecurity human risk effectively.

As a speaker, I share insights on cybersecurity, human risk management, digital skills, and my journey as a founder. I welcome questions and insightful conversations, so feel free to reach out.

When Horst Schulze joined The Ritz‑Carlton, he gave every employee a budget of $2,000 to spend on their guests. 


His belief was that “luxury isn’t marble floors, it’s how people feel” - he wanted to build a culture where people always felt seen, comfortable and safe. He knew that for the customers to feel that way, the employees had to feel that way too. 

𝐒𝐭𝐨𝐫𝐲 #𝟏: 𝐓𝐡𝐞 𝐋𝐚𝐩𝐭𝐨𝐩 𝐑𝐞𝐬𝐜𝐮𝐞

A guest left his laptop behind after checkout and was travelling to Hawaii. A housekeeper found the device and instead of waiting for standard escalation, she boarded the next flight to Hawaii to hand-deliver the laptop before the guest’s meeting. 

𝐒𝐭𝐨𝐫𝐲 #𝟐: 𝐖𝐞𝐝𝐝𝐢𝐧𝐠 𝐑𝐢𝐧𝐠 𝐑𝐞𝐜𝐨𝐯𝐞𝐫𝐲

A couple on their honeymoon had lost a wedding ring in the sand so after closing hours, the Ritz staff bought 4 metal detectors and spent the night looking for it. The couple then woke up to their ring presented to them at breakfast. 

𝐒𝐭𝐨𝐫𝐲 #𝟑: $𝟔𝟎𝟎 𝐃𝐢𝐧𝐧𝐞𝐫

A server at the Ritz restaurant overheard two executives planning a conference at a competitor’s hotel. He decided to make conversation and slip in some information about holding the conference at the Ritz instead, then quietly paid their $600 dinner tab. That company then moved their event to the Ritz, making them a lot more than $600. 

Interestingly, very few employees (if any) actually spent the full $2,000 budget. Most of the interventions were small gestures, but Schulze noted that the real power was in having the permission and autonomy over the decision-making. 

So this experiment was more to do with trust than money - because when you trust your employees to do the right thing and give them the means to do it, they take ownership of their work and tend to go above and beyond.

Pioneering Human Risk Management as Founder & CEO of OutThink - the original CHRM platform made by CISOs, for CISOs

I don’t think many people understand the physical and mental toll a cyberattack can have on a CISO. 

Tim Brown’s story on how he lost 25 pounds in 20 days and suffered a heart attack following the SolarWinds incident hit a nerve for a lot of people in security. And I think that’s because we know it’s not an isolated story - it really is the quiet reality behind so many big breaches. 

CISOs and security teams are burning out, losing sleep and carrying the pressure of keeping tens of thousands people safe. 

We spend so much time talking about incident response plans, detection systems and technical resilience, but human resilience needs to be talked about too. There’s no playbook for what happens after you’ve spent weeks in crisis mode, or how you come down from that level of intensity when everyone else has moved on.

It’s easy to say “it’s the CISO’s job to manage the risk”, but in moments like a global cyberattack, they also carry the blame, the fear and the emotional fallout - often alone.

If we want sustainable security, we have to start treating psychological safety with the same seriousness as system uptime.

Thank you Tim Brown, for sharing your experience and the impact it had on you 👏

Please welcome OutThink’s newest office and team in Bangalore! 🥳

Around six months ago, we set out to build something special in India: an expansion of the OutThink family. 

We already had a strong foundation of hungry, humble and smart people, and the goal was to grow that energy in a city filled with world-class talent. Many companies outsource talent to India for cost saving and fail to make their teams feel truly integrated - we wanted to do the opposite!

A huge thank you to Kanav Bhama, CA, whose leadership and dedication has been instrumental in shaping this team. The impact they’ve already made has been incredible, and their ideas, creativity and drive are helping push OutThink forward in ways that make us all proud :)

Sometimes it’s hard to believe how far we’ve come in the past 7 years. What started as an idea has turned into a global team with hubs in London, New York, Barcelona and now Bangalore. I couldn’t be more grateful for the brilliant people making it possible ❤️

PS: We’re still hiring! So if you’re passionate about making a real impact in AI/cybersecurity, drop me a DM or check out our open roles on OutThink’s website.

LinkedIn Login, Sign in | LinkedIn

JSESSIONID

li_at

(41) Feed | LinkedIn

Building @ OutThink | UK Regional Councillor for CA ANZ

I once sat in a meeting where the security team proudly announced that 97% of employees had completed their annual security awareness training.

But a week later, someone clicked a phishing link…

We’ve built entire programmes around the idea that if people are trained and know enough, they’ll automatically do the right thing, but human behaviour doesn’t work like that.

Someone can complete their training but organisations need to do more than just train people. We have to: 

↳ Engage them 
↳ Systemically identify human risk factors in the organisations and address them 
↳ Build workable, sustainable security

And focusing on training completion metrics is not an accurate representation of actual human cyber resilience.

This is the reality of how clever your employees can be if you: 


1️⃣ Push generic training/phishing down their throats 
2️⃣ Ignore genuine engagement 
3️⃣ Overlook rewarding positive security behaviour 

Many legacy SAT solutions only focus on showing employees how security helps the company, not themselves. It’s clear that these old-school methods don’t work and tech has moved far beyond these outdated approaches. 

Employees learn how to work around them, and they do 🤷🏻‍♂️

STOP CALLING YOUR EMPLOYEES HUMAN FIREWALLS. 

It’s dehumanising, unproductive and doesn’t address the complexities that make us human. Every single person has their own concerns, motivations and emotions which means they would handle every situation differently. 

A problem within our industry sometimes is that because we’re so used to solving technical problems, we approach the People side of cyber the same way - trying to patch, configure or “fix” behaviour instead of understanding what drives it.

This is where legacy security awareness training often fails. Modern human risk management solutions need to go beyond tick-box or compliance-based exercises to understand human behaviour and adapt to it. 

Because when we stop designing training for ‘users’ and start designing security that works for people, we stop the blame game and start ACTUALLY reducing risk.

I’ve always felt that a big issue in cybersecurity is that we have a branding problem.

If we’re honest, the security team tends to be something people tolerate rather than value in most organisations. And yes, it’s frustrating to be on the receiving end of being undervalued but instead of pushing blame, we should be working out how we can solve this problem. 

We talk about compliance, technical security controls and cyber risk, and somehow expect everyone else to feel invested in it - but language like that doesn’t inspire much interest. 

If employees associate security with friction, paperwork or compliance, they’ll always dread it or find ways around it. But if they associate it with trust, confidence and safety, they’ll naturally engage with it. 

The organisations that get this right treat security as part of their DNA and build it into their culture and business processes.

🚀 We’re hiring! 🚀

OutThink is looking for a Senior Cybersecurity Product Manager to help shape the future of Human Risk Management.  If you have experience in cybersecurity and product management, we’d love to hear from you.

We’re hiring across our hubs in 🇪🇸 Barcelona, 🇮🇳 Bangalore, 🇬🇧 London, and 🇬🇧 Brighton. Apply now and join us in building something extraordinary!

Greater Barcelona Metropolitan Area (Hybrid)

Just under 2 months ago, Google sneakily made changes to their users’ privacy - and not enough people are talking about it. 

As of the 10th of October, Google quietly switched on Gemini AI inside every Gmail account.

That means Gemini can now scan your emails and attachments for financial records, personal details, confidential information – essentially anything in your inbox.

For some people, that might add a layer of convenience… but it comes with a very real cost to privacy and security.

If you’d prefer to turn this setting off, here’s how:

1️⃣ Open Gmail → click the gear icon (top right) → “See all settings.”
2️⃣ Go to the General tab → scroll to Smart features and personalisation.
3️⃣ Untick “Smart features in Gmail, Chat and Meet.”
4️⃣ Scroll a bit further to “Smart features in Google Workspace and other products” → turn that off too.
5️⃣ Hit Save and refresh Gmail.

Curious to know your thoughts — does anyone think this was a good idea from Google?

— 

Image credit: CyberPress

In 1977, Richard Montañez dropped out of school and took a job as a janitor at Frito-Lay.

One day, when a Cheetos machine broke down and left a batch of snacks unflavoured, he saw an opportunity others might have overlooked. 

He brought some home, dusted them with chilli powder and spices inspired by his Mexican heritage, and realised he might be onto something special.

With no business background and no formal invitation, he reached out directly to PepsiCo’s CEO, Roger Enrico, to share his idea.

That bold move led to the creation of Flamin’ Hot Cheetos, a billion-dollar product line that redefined the brand and transformed Montañez’s career.

From the factory floor to the executive boardroom, his story is a reminder that innovation doesn’t depend on titles, but on courage, creativity and the confidence to speak up 👏

Below is a list of the 20 most common passwords of 2025 😅 

It should come as no surprise after it was found that the Louvre’s video surveillance system password was ‘Louvre’.

This list is an aggregation of over 2 billion real account passwords leaked on data breach forums in 2025, by Comparitech. While this report focused on personal accounts, having a strong password is even more important at work, where bad password behaviors combined with your company’s potential lack of MFA could be putting people, critical business systems and data at risk.

Meanwhile, Microsoft has decided to push account holders to delete passwords completely, in order to reduce the threat from infostealers and other data leaks. Both Google and Microsoft are at the forefront of pushing passkeys instead of passwords, with Google taking the market lead with a staggering 350% increase in passwordless account take-up.

What do you think? How long before we get rid of passwords altogether?

I recently shared a story about the time I clicked on a phishing link, and a lot of people seemed to resonate and appreciate the vulnerability of sharing it. And I urge more security professionals to do the same because it genuinely can make such a difference. 

When I first started my career in cybersecurity, Alex S., a senior executive at my company, clicked on a phishing link. Thankfully, it was a simulation so there was no breach or real harm done. 

But instead of being embarrassed and brushing it under the rug, Alex used this as a teaching opportunity. It was brought up at a company meeting and a conversation around how easy it is to make that mistake was opened up. 

I truly believe that this discussion made a huge difference to how people within the organisation thought about security and it definitely made a difference to me - not only as someone on the security team but as a leader too. 

I shared similar sentiments to the comments left on my recent post - that taking accountability and being transparent is far more effective for building psychological safety and improving  your security culture than placing blame.

More than 50% of American employees reportedly use AI tools at work without telling their managers. 

Surveys from Fishbowl, Salesforce and Pew Research indicate similar patterns across Europe and Asia, where between 40-60% of professionals report using generative AI for everyday tasks such as writing, summarising information or creating visuals.

Shadow technology has always existed, but the scale and accessibility of AI has made it easier than ever for it to spread. This points to a widening gap between how people actually use technology and how organisations think they do. 

When AI tools are used quietly, without governance or security oversight, they create blind spots that no policy can easily fix. This means sensitive data can be shared with unvetted platforms and business processes may begin to rely on systems that were never reviewed for compliance or security. 

People are trying to do their jobs efficiently, so you can’t really blame them for rushing to AI  to do so and bypassing security measures in the process, especially when security likely isn’t crossing their mind. If security teams continue to only focus on blocking tools instead of understanding why employees turn to them and educating / increasing risk understanding,  they will continue to play catch up.

I’ve seen security processes so rigid and over-engineered that people quietly stop using them. Not because they don’t care about safety, but because they’re just trying to get their jobs done.

When security becomes unworkable, people find their own ways around it, and those workarounds eventually become the real process. At that point, the technical security controls exist only on paper.

According to a report by Gartner, 69% of employees admit to intentionally bypassing security controls, and the top reason isn’t convenience,  it’s productivity. They’re under pressure to deliver and if a control gets in the way, it’s often the first thing to go.

Systems that don’t fit how people ACTUALLY work will always be replaced by the systems they invent for themselves. Human-centric security means understanding users’ experience with security controls, their workflows, building guardrails that enable employees instead of obstructing them and not silo-ing security from the rest of the organisation. And OutThink helps security teams automate the first part. 

When people feel that security is there to help them succeed and not slow them down, it stops being a checkbox and starts becoming a part of the culture. While 100% frictionless security is utopian, as an industry we can certainly do better.

Back in 2022, only about 10% of online content was AI-generated.
Today, it’s risen to about 57%, and experts think it could reach 90% by 2026.

Every month, billions of new pages are added to the web, most of them produced at speed, without authorship, accountability, or verification. From a cybersecurity perspective, this means we are entering an era of data poisoning at a scale where the information we use to detect, analyse and prevent threats may itself be polluted by synthetic sources.

When LLMs are trained on their own output, they degrade in quality, accuracy, and diversity - a process known as model collapse which is described as ‘AI eating itself’. Over time, the systems learn from their own recycled content rather than real human knowledge, and the signal weakens. 

The danger this causes extends beyond creating misinformation ⤵

↳ What happens when fake threat actors, tactics and fabricated narratives pollute threat intelligence feeds. 
↳ Or security awareness content repeats erroneous AI-generated advice? 
↳ Or attackers flood OSINT with fake, AI-generated indicators, burying genuine threats in high volume of noise? 

And the economics behind it make things worse. 

Human expertise takes time and money to produce, while synthetic data is almost free. So as organisations prioritise scale and profit, they end up optimising for volume instead of truth and quality, which feeds algorithms with content that’s already machine-made.

The internet was originally built as a place for humans to connect with each other and share what we know. Now it’s at risk of turning into an endless feedback cycle of AI slop…

Most people still trust what pops up on their screen when the phone rings - and that’s exactly why caller ID spoofing works.

Cybercriminals can make it look like they’re calling from your bank, your office or even your family and that’s what makes vishing attacks so effective. 

Law enforcement and governments globally are now doing their best to raise awareness for the rise of Caller ID Spoofing and are trying to get ahead of it. This year, the UK government and mobile networks announced that they are introducing new measures to prevent overseas call centres from pretending to use UK numbers. It’s a good step, but it doesn’t fix everything.

The USA’s FCC have shared useful information on cautionary measures you can take: 

➤ If you answer the phone and the caller - or a recording - asks you to hit a button to stop getting the calls, you should just hang up. Scammers often use this trick to identify potential targets.

➤ Do not respond to any questions, especially those that can be answered with "Yes" or "No."

➤ If you are at all unsure about a call from a friend or family member, hang up and call them back. 

➤ Never give out personal information such as account numbers, Social Security numbers, mother's maiden names, passwords or other identifying information in response to unexpected calls or if you are at all suspicious.

➤ If you get an inquiry from someone who says they represent a company or a government agency, hang up and call the phone number on your account statement, in the phone book, or on the company's or government agency's website to verify the authenticity of the request. 

➤ Use caution if you are being pressured for information immediately.

➤ If you have a voice mail account with your phone service, be sure to set a password for it. Some voicemail services are preset to allow access if you call in from your own phone number. A hacker could spoof your home phone number and gain access to your voice mail if you do not set a password.

➤ Talk to your phone company about call blocking tools and check into apps that you can download to your mobile device. 

Share this post to raise awareness.

taplio

The Battle

Patric J.M. Versteeg, MSc.

Flavius Plesu

Followers

Posts

Engagements

Likes

Performance ScorePatric J.M. Versteeg, MSc.'s LinkedIn Performance

Performance ScoreFlavius Plesu's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Patric J.M. Versteeg, MSc.

Flavius Plesu

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Patric J.M. Versteeg, MSc.'s LinkedIn Performance

Performance ScoreFlavius Plesu's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScorePatric J.M. Versteeg, MSc.'s LinkedIn Performance