Flavius Plesu

OutThink

OutThink is a revolutionary Human Risk Management Platform (SaaS) empowering CISOs by targeting the source of 90% of all data breaches: human behavior.

It's made by CISOs, for CISOs.

Founder & CEO

Bank of Ireland

Responsibilities include developing the UK cybersecurity strategy aligned to business goals and the delivery of a transformation programme aimed at reducing cybersecurity risk and improving key stakeholder relationships, both internally and externally (e.g., FCA, EBA, ECB).

Chief Information Security Officer (UK)

UCL Department of Science, Technology, Engineering and Public Policy (University College London)

The primary objective of the Institute is to develop novel, innovative social-science and socio-cultural techniques for cyber security. Panel member practitioners help shape and improve the future research agenda in the cyber security space at UCL, and engage with testing and validating the research outputs.

Practitioner Panel Member - Research Institute in Science of Cyber Security (RISCS)

IHS Markit

Risk oversight with a strategic focus on fostering key stakeholder relationships and building trust; Cybersecurity transformation programme; Strategy alignment to risk appetite for effective risk mitigation; Conduct group cyber risk assessment and establish the information and cyber security risk management framework; Establish and maintain appropriate information / cyber security governance, assurance and compliance frameworks. Build a risk aware cyber security culture.

Global Head of Cyber Security

University of West London

° Develop and maintain an overarching security strategy
° Develop and monitor compliance with information security policies
° Review security controls and make recommendations for continuous improvement of the ISMS
° Ensure legal and regulatory compliance with the Data Protection Act, Freedom of Information Act, PCI DSS, NHS' Information Governance Toolkit Assessment, etc.
° Facilitate risk assessments and assist business units identify residual risk and pro-actively reduce the potential for security incidents
° Develop, roll-out and maintain a cybersecurity awareness programme pitched at all users across the University (staff, students, guests and visitors)
° Respond to and communicate with sector-wide, national and international bodies in relation to cyber security

Head of Information Security

Plesu & Associates

I launched this business in 2009 as one of the two co-founders, consulting for a wide range of international businesses, across multiple security domains: Information Security Management, Information Security Risk Management, Supply Chain Risk Management, ISO 27001, Web Application Security, Awareness, Education and Training, Implementation of Information Security Classification Schemes.

Responsibilities:
° Provide strategic, pragmatic and business focused security advice to clients
° Help organisations effectively assess, transform, optimise and manage their information security function
° Define and implement Information and Cyber Security Governance Frameworks, Compliance Frameworks, Information Security Policy and Assurance Frameworks, Customer Assurance Frameworks
° Conduct risk assessment of  mission-critical information assets, changes, processes, projects and services
° Refine and expand the due diligence, triage and supply chain security risk assessment methodology
° Assist clients to ensure organisational compliance with ISO 27001, PCI DSS, COBIT and various other Information Security and Data Protection standards.
° Define and implement information security and business continuity risk assessments in line with the ISO 27001, 27005 and 22301 requirements

Founder & Information Security Consultant

Ministerul Afacerilor Interne România

Within the Ministry of Internal Affairs, the Security Component for Information Technology and Communications (CSTIC) coordinates, advises and controls the entire activity in the area of protecting information classified as 'secret', and above, for each County/General Border Police Inspectorate.


Responsibilities:
° Advise Inspectorate’s management team regarding all aspects of securing and protecting classified information
° Ensure safekeeping and archival of national security clearance certificates and authorizations to access classified information for the Inspectorate’s personnel
° Monitor the implementation of government policies, regulations and legal requirements regarding classified information across all Inspectorate departments and divisions
° Audit and monitor all administrative, logical and physical security controls specific to IT and communication systems to ensure classified information is adequately processed, stored, transmitted and/or destroyed

Classified Information Specialist - Law Enforcement

Mart & Partners - Law Firm

Responsibilities:
° Perform information security risk assessments, take appropriate actions to escalate and mitigate risks.
° Translate technical vulnerabilities to business risk terminology and communicate to senior management
° Create, manage and review the company's information security policies and procedures
° Running or preparing, reporting and remediation of penetration tests and vulnerability scans
° Identify and prioritise security-related requirements
° Develop and implement appropriate controls to address security risks identified – security policies, network and host monitoring solutions IDS/IPS, antivirus, VPN, proxy firewall, encryption, logging and auditing, backup and restore capabilities
° System access rights review and role profiles documentation
° Train staff and raise awareness regarding the misuse of information, security risks, threats and the potential business impact
° Promote a risk aware, security-positive culture

Information Security Officer

ETA2U

Responsibilities:
° Configure and troubleshoot network equipment such as modems, hubs, routers & switches.
° Identify, troubleshoot and resolve hardware, software and network related problems encountered by end- users.
° Configure and install Windows/Linux workstations.

Network Technician

I’m Flavius, a seasoned cybersecurity leader and the CEO of OutThink. With 20 years of experience and a background as a CISO, I understand the complexities of securing large organizations. OutThink was born from my belief that people, when engaged beyond traditional security awareness, can become an organization’s strongest defense.

My passion not only lies in preventing data breaches but also in inspiring change and challenging the status quo. My team and I work enthusiastically to help businesses understand and manage cybersecurity human risk effectively.

As a speaker, I share insights on cybersecurity, human risk management, digital skills, and my journey as a founder. I welcome questions and insightful conversations, so feel free to reach out.

When Horst Schulze joined The Ritz‑Carlton, he gave every employee a budget of $2,000 to spend on their guests. 


His belief was that “luxury isn’t marble floors, it’s how people feel” - he wanted to build a culture where people always felt seen, comfortable and safe. He knew that for the customers to feel that way, the employees had to feel that way too. 

𝐒𝐭𝐨𝐫𝐲 #𝟏: 𝐓𝐡𝐞 𝐋𝐚𝐩𝐭𝐨𝐩 𝐑𝐞𝐬𝐜𝐮𝐞

A guest left his laptop behind after checkout and was travelling to Hawaii. A housekeeper found the device and instead of waiting for standard escalation, she boarded the next flight to Hawaii to hand-deliver the laptop before the guest’s meeting. 

𝐒𝐭𝐨𝐫𝐲 #𝟐: 𝐖𝐞𝐝𝐝𝐢𝐧𝐠 𝐑𝐢𝐧𝐠 𝐑𝐞𝐜𝐨𝐯𝐞𝐫𝐲

A couple on their honeymoon had lost a wedding ring in the sand so after closing hours, the Ritz staff bought 4 metal detectors and spent the night looking for it. The couple then woke up to their ring presented to them at breakfast. 

𝐒𝐭𝐨𝐫𝐲 #𝟑: $𝟔𝟎𝟎 𝐃𝐢𝐧𝐧𝐞𝐫

A server at the Ritz restaurant overheard two executives planning a conference at a competitor’s hotel. He decided to make conversation and slip in some information about holding the conference at the Ritz instead, then quietly paid their $600 dinner tab. That company then moved their event to the Ritz, making them a lot more than $600. 

Interestingly, very few employees (if any) actually spent the full $2,000 budget. Most of the interventions were small gestures, but Schulze noted that the real power was in having the permission and autonomy over the decision-making. 

So this experiment was more to do with trust than money - because when you trust your employees to do the right thing and give them the means to do it, they take ownership of their work and tend to go above and beyond.

Pioneering Human Risk Management as Founder & CEO of OutThink - the original CHRM platform made by CISOs, for CISOs

I don’t think many people understand the physical and mental toll a cyberattack can have on a CISO. 

Tim Brown’s story on how he lost 25 pounds in 20 days and suffered a heart attack following the SolarWinds incident hit a nerve for a lot of people in security. And I think that’s because we know it’s not an isolated story - it really is the quiet reality behind so many big breaches. 

CISOs and security teams are burning out, losing sleep and carrying the pressure of keeping tens of thousands people safe. 

We spend so much time talking about incident response plans, detection systems and technical resilience, but human resilience needs to be talked about too. There’s no playbook for what happens after you’ve spent weeks in crisis mode, or how you come down from that level of intensity when everyone else has moved on.

It’s easy to say “it’s the CISO’s job to manage the risk”, but in moments like a global cyberattack, they also carry the blame, the fear and the emotional fallout - often alone.

If we want sustainable security, we have to start treating psychological safety with the same seriousness as system uptime.

Thank you Tim Brown, for sharing your experience and the impact it had on you 👏

Please welcome OutThink’s newest office and team in Bangalore! 🥳

Around six months ago, we set out to build something special in India: an expansion of the OutThink family. 

We already had a strong foundation of hungry, humble and smart people, and the goal was to grow that energy in a city filled with world-class talent. Many companies outsource talent to India for cost saving and fail to make their teams feel truly integrated - we wanted to do the opposite!

A huge thank you to Kanav Bhama, CA, whose leadership and dedication has been instrumental in shaping this team. The impact they’ve already made has been incredible, and their ideas, creativity and drive are helping push OutThink forward in ways that make us all proud :)

Sometimes it’s hard to believe how far we’ve come in the past 7 years. What started as an idea has turned into a global team with hubs in London, New York, Barcelona and now Bangalore. I couldn’t be more grateful for the brilliant people making it possible ❤️

PS: We’re still hiring! So if you’re passionate about making a real impact in AI/cybersecurity, drop me a DM or check out our open roles on OutThink’s website.

LinkedIn Login, Sign in | LinkedIn

JSESSIONID

li_at

(41) Feed | LinkedIn

Building @ OutThink | UK Regional Councillor for CA ANZ

I once sat in a meeting where the security team proudly announced that 97% of employees had completed their annual security awareness training.

But a week later, someone clicked a phishing link…

We’ve built entire programmes around the idea that if people are trained and know enough, they’ll automatically do the right thing, but human behaviour doesn’t work like that.

Someone can complete their training but organisations need to do more than just train people. We have to: 

↳ Engage them 
↳ Systemically identify human risk factors in the organisations and address them 
↳ Build workable, sustainable security

And focusing on training completion metrics is not an accurate representation of actual human cyber resilience.

This is the reality of how clever your employees can be if you: 


1️⃣ Push generic training/phishing down their throats 
2️⃣ Ignore genuine engagement 
3️⃣ Overlook rewarding positive security behaviour 

Many legacy SAT solutions only focus on showing employees how security helps the company, not themselves. It’s clear that these old-school methods don’t work and tech has moved far beyond these outdated approaches. 

Employees learn how to work around them, and they do 🤷🏻‍♂️

STOP CALLING YOUR EMPLOYEES HUMAN FIREWALLS. 

It’s dehumanising, unproductive and doesn’t address the complexities that make us human. Every single person has their own concerns, motivations and emotions which means they would handle every situation differently. 

A problem within our industry sometimes is that because we’re so used to solving technical problems, we approach the People side of cyber the same way - trying to patch, configure or “fix” behaviour instead of understanding what drives it.

This is where legacy security awareness training often fails. Modern human risk management solutions need to go beyond tick-box or compliance-based exercises to understand human behaviour and adapt to it. 

Because when we stop designing training for ‘users’ and start designing security that works for people, we stop the blame game and start ACTUALLY reducing risk.

I’ve always felt that a big issue in cybersecurity is that we have a branding problem.

If we’re honest, the security team tends to be something people tolerate rather than value in most organisations. And yes, it’s frustrating to be on the receiving end of being undervalued but instead of pushing blame, we should be working out how we can solve this problem. 

We talk about compliance, technical security controls and cyber risk, and somehow expect everyone else to feel invested in it - but language like that doesn’t inspire much interest. 

If employees associate security with friction, paperwork or compliance, they’ll always dread it or find ways around it. But if they associate it with trust, confidence and safety, they’ll naturally engage with it. 

The organisations that get this right treat security as part of their DNA and build it into their culture and business processes.

🚀 We’re hiring! 🚀

OutThink is looking for a Senior Cybersecurity Product Manager to help shape the future of Human Risk Management.  If you have experience in cybersecurity and product management, we’d love to hear from you.

We’re hiring across our hubs in 🇪🇸 Barcelona, 🇮🇳 Bangalore, 🇬🇧 London, and 🇬🇧 Brighton. Apply now and join us in building something extraordinary!

Greater Barcelona Metropolitan Area (Hybrid)

Just under 2 months ago, Google sneakily made changes to their users’ privacy - and not enough people are talking about it. 

As of the 10th of October, Google quietly switched on Gemini AI inside every Gmail account.

That means Gemini can now scan your emails and attachments for financial records, personal details, confidential information – essentially anything in your inbox.

For some people, that might add a layer of convenience… but it comes with a very real cost to privacy and security.

If you’d prefer to turn this setting off, here’s how:

1️⃣ Open Gmail → click the gear icon (top right) → “See all settings.”
2️⃣ Go to the General tab → scroll to Smart features and personalisation.
3️⃣ Untick “Smart features in Gmail, Chat and Meet.”
4️⃣ Scroll a bit further to “Smart features in Google Workspace and other products” → turn that off too.
5️⃣ Hit Save and refresh Gmail.

Curious to know your thoughts — does anyone think this was a good idea from Google?

— 

Image credit: CyberPress

In 1977, Richard Montañez dropped out of school and took a job as a janitor at Frito-Lay.

One day, when a Cheetos machine broke down and left a batch of snacks unflavoured, he saw an opportunity others might have overlooked. 

He brought some home, dusted them with chilli powder and spices inspired by his Mexican heritage, and realised he might be onto something special.

With no business background and no formal invitation, he reached out directly to PepsiCo’s CEO, Roger Enrico, to share his idea.

That bold move led to the creation of Flamin’ Hot Cheetos, a billion-dollar product line that redefined the brand and transformed Montañez’s career.

From the factory floor to the executive boardroom, his story is a reminder that innovation doesn’t depend on titles, but on courage, creativity and the confidence to speak up 👏

Below is a list of the 20 most common passwords of 2025 😅 

It should come as no surprise after it was found that the Louvre’s video surveillance system password was ‘Louvre’.

This list is an aggregation of over 2 billion real account passwords leaked on data breach forums in 2025, by Comparitech. While this report focused on personal accounts, having a strong password is even more important at work, where bad password behaviors combined with your company’s potential lack of MFA could be putting people, critical business systems and data at risk.

Meanwhile, Microsoft has decided to push account holders to delete passwords completely, in order to reduce the threat from infostealers and other data leaks. Both Google and Microsoft are at the forefront of pushing passkeys instead of passwords, with Google taking the market lead with a staggering 350% increase in passwordless account take-up.

What do you think? How long before we get rid of passwords altogether?

I recently shared a story about the time I clicked on a phishing link, and a lot of people seemed to resonate and appreciate the vulnerability of sharing it. And I urge more security professionals to do the same because it genuinely can make such a difference. 

When I first started my career in cybersecurity, Alex S., a senior executive at my company, clicked on a phishing link. Thankfully, it was a simulation so there was no breach or real harm done. 

But instead of being embarrassed and brushing it under the rug, Alex used this as a teaching opportunity. It was brought up at a company meeting and a conversation around how easy it is to make that mistake was opened up. 

I truly believe that this discussion made a huge difference to how people within the organisation thought about security and it definitely made a difference to me - not only as someone on the security team but as a leader too. 

I shared similar sentiments to the comments left on my recent post - that taking accountability and being transparent is far more effective for building psychological safety and improving  your security culture than placing blame.

More than 50% of American employees reportedly use AI tools at work without telling their managers. 

Surveys from Fishbowl, Salesforce and Pew Research indicate similar patterns across Europe and Asia, where between 40-60% of professionals report using generative AI for everyday tasks such as writing, summarising information or creating visuals.

Shadow technology has always existed, but the scale and accessibility of AI has made it easier than ever for it to spread. This points to a widening gap between how people actually use technology and how organisations think they do. 

When AI tools are used quietly, without governance or security oversight, they create blind spots that no policy can easily fix. This means sensitive data can be shared with unvetted platforms and business processes may begin to rely on systems that were never reviewed for compliance or security. 

People are trying to do their jobs efficiently, so you can’t really blame them for rushing to AI  to do so and bypassing security measures in the process, especially when security likely isn’t crossing their mind. If security teams continue to only focus on blocking tools instead of understanding why employees turn to them and educating / increasing risk understanding,  they will continue to play catch up.

I’ve seen security processes so rigid and over-engineered that people quietly stop using them. Not because they don’t care about safety, but because they’re just trying to get their jobs done.

When security becomes unworkable, people find their own ways around it, and those workarounds eventually become the real process. At that point, the technical security controls exist only on paper.

According to a report by Gartner, 69% of employees admit to intentionally bypassing security controls, and the top reason isn’t convenience,  it’s productivity. They’re under pressure to deliver and if a control gets in the way, it’s often the first thing to go.

Systems that don’t fit how people ACTUALLY work will always be replaced by the systems they invent for themselves. Human-centric security means understanding users’ experience with security controls, their workflows, building guardrails that enable employees instead of obstructing them and not silo-ing security from the rest of the organisation. And OutThink helps security teams automate the first part. 

When people feel that security is there to help them succeed and not slow them down, it stops being a checkbox and starts becoming a part of the culture. While 100% frictionless security is utopian, as an industry we can certainly do better.

Back in 2022, only about 10% of online content was AI-generated.
Today, it’s risen to about 57%, and experts think it could reach 90% by 2026.

Every month, billions of new pages are added to the web, most of them produced at speed, without authorship, accountability, or verification. From a cybersecurity perspective, this means we are entering an era of data poisoning at a scale where the information we use to detect, analyse and prevent threats may itself be polluted by synthetic sources.

When LLMs are trained on their own output, they degrade in quality, accuracy, and diversity - a process known as model collapse which is described as ‘AI eating itself’. Over time, the systems learn from their own recycled content rather than real human knowledge, and the signal weakens. 

The danger this causes extends beyond creating misinformation ⤵

↳ What happens when fake threat actors, tactics and fabricated narratives pollute threat intelligence feeds. 
↳ Or security awareness content repeats erroneous AI-generated advice? 
↳ Or attackers flood OSINT with fake, AI-generated indicators, burying genuine threats in high volume of noise? 

And the economics behind it make things worse. 

Human expertise takes time and money to produce, while synthetic data is almost free. So as organisations prioritise scale and profit, they end up optimising for volume instead of truth and quality, which feeds algorithms with content that’s already machine-made.

The internet was originally built as a place for humans to connect with each other and share what we know. Now it’s at risk of turning into an endless feedback cycle of AI slop…

Most people still trust what pops up on their screen when the phone rings - and that’s exactly why caller ID spoofing works.

Cybercriminals can make it look like they’re calling from your bank, your office or even your family and that’s what makes vishing attacks so effective. 

Law enforcement and governments globally are now doing their best to raise awareness for the rise of Caller ID Spoofing and are trying to get ahead of it. This year, the UK government and mobile networks announced that they are introducing new measures to prevent overseas call centres from pretending to use UK numbers. It’s a good step, but it doesn’t fix everything.

The USA’s FCC have shared useful information on cautionary measures you can take: 

➤ If you answer the phone and the caller - or a recording - asks you to hit a button to stop getting the calls, you should just hang up. Scammers often use this trick to identify potential targets.

➤ Do not respond to any questions, especially those that can be answered with "Yes" or "No."

➤ If you are at all unsure about a call from a friend or family member, hang up and call them back. 

➤ Never give out personal information such as account numbers, Social Security numbers, mother's maiden names, passwords or other identifying information in response to unexpected calls or if you are at all suspicious.

➤ If you get an inquiry from someone who says they represent a company or a government agency, hang up and call the phone number on your account statement, in the phone book, or on the company's or government agency's website to verify the authenticity of the request. 

➤ Use caution if you are being pressured for information immediately.

➤ If you have a voice mail account with your phone service, be sure to set a password for it. Some voicemail services are preset to allow access if you call in from your own phone number. A hacker could spoof your home phone number and gain access to your voice mail if you do not set a password.

➤ Talk to your phone company about call blocking tools and check into apps that you can download to your mobile device. 

Share this post to raise awareness.

taplio

Flavius Plesu's Linkedin Analytics

Flavius Plesu

Performance ScoreFlavius Plesu's LinkedIn Performance

Flavius Plesu's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Flavius Plesu's Linkedin Analytics

Flavius Plesu

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Flavius Plesu's LinkedIn Performance

Flavius Plesu's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Flavius Plesu's Linkedin Analytics

Performance ScoreFlavius Plesu's LinkedIn Performance

Flavius Plesu's Best Posts (last 30 days)