Episode Description
Andrew Scott is Field CISO at Todyl, where he bridges executive decision-makers and cybersecurity programs for mid-market and SMB organizations. With over a decade of experience across IBM, CrowdStrike, and Recorded Future, he has built security operations programs, led threat intelligence teams, and advised Fortune 500 companies and Federal agencies.
In this episode, Andrew breaks down the most common security gap he sees across organizations: governance. He explains why buying tools without first establishing process and strategy compounds problems rather than solving them, and why asking "what does good look like?" before building a security program is the most important first step any leader can take.
Andrew and Federico explore how AI is reshaping the threat landscape on both sides. Attackers are automating reconnaissance and phishing faster than defenders can respond, and the fundamentals of identity, patching, and visibility matter more than ever. They also discuss how Moody's now treats cyber events as catastrophically as hurricanes when evaluating business credit risk.
If you lead a team and security feels like an afterthought, this episode will change how you think about risk, accountability, and the cost of getting it wrong.
About Andrew Scott
Field CISO at Todyl | Cybersecurity advisor across IBM, CrowdStrike, and Recorded Future | Helping mid-market companies build stronger security programs
About Federico Ramallo ✨👨💻🌎
🚀 Software Engineering Manager | 🛠 Founder of DensityLabs.io & PreVetted.ai | 🤝 Connecting 🇺🇸 U.S. teams with top nearshore 🌎 LATAM engineers
- 💼 https://www.linkedin.com/in/framallo/
🎙 PreVetted Podcast 🎧📡
- 🎯 https://prevetted.ai/podcast
- 🐦 https://x.com/PrevettedPod
- 🔗 https://www.linkedin.com/company/prevetted-podcast
00:00 Introduction to Cybersecurity Leadership
01:05 Understanding the Role of a Field CISO
05:14 Democratizing Cybersecurity for Mid-Market Organizations
08:05 The Opportunistic Nature of Cyber Attacks
09:26 Balancing Security and Business Needs
12:05 The Importance of Governance in Security Programs
17:06 Common Security Gaps in Organizations
21:34 Incident Response and Governance
23:17 Establishing a Control Framework
23:58 AI's Impact on the Threat Landscape
27:44 The Speed of Cyber Attacks
30:21 Governance and Decision-Making in AI Use
33:18 Human Oversight in AI Development
37:03 Collaboration Between Security and Business
44:08 Cybersecurity as a Business Imperative