How radical transparency built a team that followed me for three companies

About this episode

Robert Former, CISO at Acquia, has built a security team that trusted him enough to follow him across three companies. His method is radical transparency. When something goes wrong, he leads with the facts of what happened and saves attribution and blame for later. That same honesty runs in both directions, up to the board and down to his team.

He also doesn’t pretend to be the smartest person in the room.

“I like to think of myself as the first among equals, because everybody on this team has got a specialty that they are way better at than I am.”

Robert came up the hands-on way. He started as a cable technician in the 1990s until the day he got his hands on a firewall, then moved into networking, security operations, consulting, and penetration testing before leading compliance and security programs at Pegasystems, Micro Focus, and Hewlett Packard Enterprise. He walks Matt Peters through the two paths into the CISO seat and what surprised him most once he reached the C-suite.

‍

For years, Robert struggled to get leadership to engage with risk. That changed when he found the FAIR methodology, which combines the objective and subjective sides of risk into a single dollar figure any executive can understand. From there, the decision belongs to the business. His job is to give leaders the numbers, not to accept the risk on their behalf. He also explains how he approaches the shared responsibility conversation and how to put a price on reputation and brand risk.

Throughout his career, Robert has held one belief steady: compliance and security are two separate things. He leads with security and treats compliance as the measure of how well he’s doing.

“If all you’re trying to do is meet a compliance requirement, you’re not doing security, you’re just doing compliance.”

What you’ll learn in this episode

• How radical transparency builds a team that follows you from company to company
• Why to lead with facts and save blame for later
• Why a CISO should see themselves as first among equals
• How the FAIR methodology turns security risk into a dollar figure
• Why the business, not the CISO, should decide which risks to accept
• How to put a price on reputation and brand risk
• Why compliance is an outcome of security, not a driver
• What surprised a CISO most about the move to the C-suite

About Robert Former

Robert Former is the Chief Information Security Officer at Acquia, where he leads enterprise risk and cloud compliance for a platform-as-a-service company hosting Drupal-based digital experiences for enterprise clients and more than 80 federal agencies.

He started out as a cable technician in the 1990s before moving into networking, firewalls, and security operations. Over his career, he has led compliance and security programs at Pegasystems, Micro Focus, and Hewlett Packard Enterprise, and worked as a security consultant and penetration tester. He holds the QSA certification.

Resources mentioned

• The FAIR methodology for risk management
• Douglas W. Hubbard, author on measuring and quantifying risk
• Cybersecurity Headlines podcast
• Acquia
• Connect with Robert Former on LinkedIn

About the host

Matt Peters is the CEO and Co-Founder of Fixify, where he’s redefining the IT help desk for the AI era. Before founding Fixify, he was Chief Product Officer at Expel and held senior leadership roles at FireEye and Mandiant, where he helped pioneer some of the earliest managed detection and response services.