# The CISO’s Financial Reality Check: Building Security That Pays for Itself

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 7 Oct 2025, 13 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17965019-the-ciso-s-financial-reality-check-building-security-that-pays-for-itself.mp3

Send us Fan Mail In this episode of ClearTech Loop, Jo Peterson sits down with Bil Harmer, Founder & CEO of Killswitch Advisory, to explore a topic every security leader wrestles with — how to make cybersecurity pay for itself. Harmer brings more than two decades of experience leading programs for startups, governments, and global financial institutions. He’s blunt, practical, and focused on one truth: cybersecurity isn’t a cost center — it’s a financial model. Jo and Bil break down what that means for CISOs under pressure to do more with less: • Why security is a cost of survival, not safety • How to redefine cyber risk as financial risk • Why governance now starts with procurement • What “acceptable loss” really looks like in practice • How to spot hidden AI clauses in your SaaS contracts before your data trains someone else’s model This episode cuts past the theory and gets into the business side of cybersecurity — where financial fluency is now just as important as technical skill. 🎧 Listen to the full episode here. 💌 Subscribe to the ClearTech Loop newsletter: https://www.linkedin.com/newsletters/7346174860760416256/ 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_00: Hey everyone, thank you so much for joining.
[0:09] SPEAKER_00: You're here today with us on ClearTech Loop.
[0:12] SPEAKER_00: We're in the know and on the move.
[0:13] SPEAKER_00: I'm Joe Peterson.
[0:14] SPEAKER_00: I'm the Vice President of Cloud and Security for Clarify 360 and the chief analyst at ClearTech Research.
[0:21] SPEAKER_00: And I'm here today with Mr.
[0:22] SPEAKER_00: Bill Harmer, who is the V CISO of Kill Switch Advisory.
[0:26] SPEAKER_00: Hi, Bill.
[0:27] SPEAKER_01: How are you doing?
[0:28] SPEAKER_00: I'm doing great.
[0:29] SPEAKER_00: Thank you so much for giving your time today.
[0:32] SPEAKER_01: My pleasure.
[0:33] SPEAKER_01: My pleasure.
[0:34] SPEAKER_00: Yeah.
[0:34] SPEAKER_00: So in case folks are new to the podcast, ClearTech Loop is a focused podcast series, and we're delivering sharp real-time insights at the intersection of cybersecurity, cloud, and AI security.
[0:46] SPEAKER_00: And this session is part of a series of conversations with IT and security leaders that are navigating a new era of risk and responsibility.
[0:54] SPEAKER_00: But it's not just about protection.
[0:57] SPEAKER_00: We ask what they see on the horizon and how they're preparing for it now through a three-question lens.
[1:03] SPEAKER_00: But before we get into the questions, Bill, tell us what you're doing with KillSwitch Advisory.
[1:09] SPEAKER_01: So I started Kill Switch Advisory to uh bring um an adult in the room to the startup world.
[1:15] SPEAKER_01: Um, you know, I have I have nearly 30 years in startups and cybersecurity.
[1:20] SPEAKER_01: Um I have uh four exits out of six startups.
[1:25] SPEAKER_01: Um, and I'm looking to bring that to the community and help startups grow.
[1:32] SPEAKER_00: I think it's it's uh a great niche, and you can bring a wealth of experience.
[1:38] SPEAKER_00: Um let's get right into the questions.
[1:41] unknown: Sure.
[1:43] SPEAKER_00: Thanks.
[1:43] SPEAKER_00: From a CISO's perspective, how should you be thinking about cybersecurity in terms of dollars and business impact?
[1:50] SPEAKER_01: Um, cybersecurity should honestly be uh proportional to the risk accepted.
[1:57] SPEAKER_01: Um what is it that you can and can't accept?
[2:00] SPEAKER_01: Uh I think looking at it as a percentage of IT budget is is a bad way to go.
[2:06] SPEAKER_01: Um, I think looking at it as a percentage of revenue, maybe.
[2:10] SPEAKER_01: Um the the honest truth is CISOs uh need to look at their business and understand how they make money.
[2:17] SPEAKER_01: They need to know exactly how they make money because that'll tell them what they can and can't survive.
[2:22] SPEAKER_01: Um just because, and I I've used this example before, and I I'll continue to use it because if you look at General Electric, when they're looking at what intellectual property is important to them, the washing machine division is not terribly important in the sense that you know it's colors and features.
[2:36] SPEAKER_01: Um, and if something happens, it's it's in you know, it's gonna hurt the bottom line, but it's not gonna hurt it the same way that the jet engine division would.
[2:44] SPEAKER_01: Um so that gives you the idea of how you should be allocating your cybersecurity dollars against the risk to it's not the risk of something happening, it's the risk of what you cannot survive.
[2:55] SPEAKER_01: So that's more the way I think you should be looking at it.
[2:59] SPEAKER_00: Right.
[2:59] SPEAKER_00: And that, you know, to your point, that changes by vertical, right?
[3:04] SPEAKER_01: And it changes on a daily basis, too.
[3:06] SPEAKER_01: Um, you know, you you may have a shift in your business model.
[3:09] SPEAKER_01: And this is again, you know, why CISOs absolutely need to have a seat at the table, because those business shifts sometimes don't get trickled down to the the personnel as quickly as they should.
[3:21] SPEAKER_01: And if a CISO is defending or putting money into or building a program which are not typically easy or agile and can't be adjusted super fast, you can't suddenly change your strategy.
[3:33] SPEAKER_01: But you know you don't and you don't know that the board has decided, oh, we're going to focus on division A instead of division B because we know in the future division B is going to have some uh resource issue that's gonna cause problems.
[3:47] SPEAKER_01: So we're gonna get out of that business and get into this business, but you're still thinking B is important and you're sinking your your dollars into that.
[3:54] SPEAKER_01: That's why we've got to be there understanding what is happening with the company and how are we driving this company so that we can properly protect it.
[4:02] SPEAKER_00: That's great advice.
[4:04] SPEAKER_00: And I, you know, it just made me think about a CISO that I know, quite clever gentleman, I think, and he um he has his whole team read the 10K.
[4:15] SPEAKER_01: There you go.
[4:18] SPEAKER_00: Because, you know, and you know it and I know it, we do a really great job of training technicians, but we have a hard time helping them make that next leap uh to leaders in terms of their communication sometimes and what they should be focused on.
[4:35] SPEAKER_00: And I thought that was a great way for him to sort of teach them to think like the leaders of the organization were thinking.
[4:44] SPEAKER_01: Yeah, you you know, read the 10K, listen into the forward statements um for a public company, private companies, that's a little more difficult because they're not around.
[4:52] SPEAKER_01: Um, and that's where you got to figure it out.
[4:54] SPEAKER_01: That's I think a big challenge that we have.
[4:56] SPEAKER_01: But no, absolutely.
[4:57] SPEAKER_01: Um, it it just makes them more adaptable.
[5:00] SPEAKER_01: The security world, I don't know how well uh a lot of us deal with acceptable loss.
[5:08] SPEAKER_01: Um, but that should be in our lexicon.
[5:10] SPEAKER_01: We should be talking about acceptable loss.
[5:12] SPEAKER_01: We should look at our business and say it's okay.
[5:14] SPEAKER_01: If I lose my marketing department, laptops, uh, they get compromised, big deal.
[5:18] SPEAKER_01: Format them and go.
[5:20] SPEAKER_01: Um, unless I'm a marketing company, right?
[5:22] SPEAKER_01: Like, I mean, that would be a horrific thing if I was a marketing company uh delivering marketing services to my clients.
[5:28] SPEAKER_01: Um, so so understanding those types of uh situations and being current, it's this is not static.
[5:33] SPEAKER_01: We don't fire and forget here.
[5:34] SPEAKER_01: You know, we have to be looking at this every day to understand what's happening.
[5:38] SPEAKER_00: Yeah, really great point.
[5:39] SPEAKER_00: So, next question in your opinion, what is the best way to integrate cyber risk into the business's overall financial risk model?
[5:48] SPEAKER_01: Truthfully, cyber risk is the financial risk model.
[5:52] SPEAKER_01: Um, like it it it we need to get away.
[5:55] SPEAKER_00: Well, some would argue with you.
[5:57] SPEAKER_01: Yeah, I know, I know.
[5:58] SPEAKER_01: Uh we need we just need to get away from uh sort of looking at the the the numbers of vulnerabilities and the potential.
[6:07] SPEAKER_01: That's for us to decide how the risk gets addressed.
[6:11] SPEAKER_01: Um, but we need to be having the discussion and understanding how do we tie our actions back to the dollars of the company.
[6:19] SPEAKER_01: So if we're looking at, you know, let's go to the washing machine division and we think that there's a potential uh vulnerability in the washing machine division that could cost us.
[6:28] SPEAKER_01: And it's not that we would get attacked and something would happen.
[6:32] SPEAKER_01: Boards don't care about that.
[6:33] SPEAKER_01: They want to know that if they get attacked and something happens, how much does it cost?
[6:37] SPEAKER_01: Right?
[6:38] SPEAKER_01: And so you can do the financial modeling on that side.
[6:40] SPEAKER_01: And that's when I start looking at um new software coming out, I am asking every one of these startups, how do you tie my financials into this?
[6:47] SPEAKER_01: How can you tie my financials into this?
[6:49] SPEAKER_01: Because then I can look smarter and make a better decision when I go back.
[6:52] SPEAKER_01: And I can say, look, I understand if we're going to uh we're gonna pick up and move our manufacturing out of China to uh Alabama because we need to bring stuff back on shore, whatever the decision is.
[7:06] SPEAKER_01: There's a financial cost to that.
[7:08] SPEAKER_01: There's risks, there's logistics, there's a whole bunch of stuff that goes with it.
[7:11] SPEAKER_01: There are cyber issues that happen as well, because anytime there's disruption, there's a potential for a cyber attack.
[7:17] SPEAKER_01: And that's, you know, any good cyber threat will come during a point of transition.
[7:22] SPEAKER_01: Um, so you should be in there having that discussion around well, here's some of the risks that we lose.
[7:27] SPEAKER_01: We we lose some of the risks that are inherent with being offshore in another country.
[7:31] SPEAKER_01: We lose the risks of being offshore in a country such as China, which has a higher uh known issue around uh threats, uh cyber threats, um, bringing it back on shore.
[7:40] SPEAKER_01: But being on shore, we're going to have other issues.
[7:43] SPEAKER_01: And that's how we should be integrating cyber risk into the financial risk models because that's how we make decisions on the business.
[7:50] SPEAKER_01: Those decisions to move a manufacturing plant, to open a new line of business, or to change code, right?
[7:58] SPEAKER_01: We're we're gonna rewrite everything from uh Ruby to go.
[8:01] SPEAKER_01: Um, those are decisions that are made for reasons, whatever the reasons are, I don't care at right now, but they're going to have financial impact reasons, and we discuss them usually around the financial aspect to say, okay, you know, it will make the code, the recoding, it will make the code faster, better, easier to support.
[8:17] SPEAKER_01: The easier to support means it's cheaper to support.
[8:20] SPEAKER_01: That's really what it is.
[8:21] SPEAKER_01: But we'll we'll couch that and and cover it up in the it makes our customers happier.
[8:25] SPEAKER_01: Uh, but making our customers happier is better for the bottom line because we don't churn as fast, right?
[8:30] SPEAKER_01: So everything's a financial decision, and that's how we just have to bring cyber into it as well.
[8:34] SPEAKER_00: Yeah.
[8:35] SPEAKER_00: And yeah, no, that's that's a great answer.
[8:39] SPEAKER_00: Last question How should the CISO be thinking about AI adoption in terms of its use to secure emerging threats, and then from an organizational governance perspective?
[8:51] SPEAKER_01: That's a really interesting one because we are if you if you had walked around RSA and you saw all yeah, you saw all the AI security solutions out there, right?
[9:02] SPEAKER_01: Um, we are still discussing how do we secure AI.
[9:06] SPEAKER_01: I know, yet every security vendor is selling AI solutions and having not figured out how to secure them.
[9:12] SPEAKER_01: Um I I think the the the way to look at this is um this is the time, you know, there was all those discussions for years around CISOs should uh not be the department of no, they should be the yes and uh they should be open, etc.
[9:26] SPEAKER_01: Well, we're way past that now.
[9:27] SPEAKER_01: AI adoption is there.
[9:29] SPEAKER_01: Don't even try to stop it.
[9:31] SPEAKER_01: Find ways to uh to to integrate it and to allow the adoption to happen in a framework that you can at least see and have some modicum of control over it.
[9:43] SPEAKER_01: Um, and you know, that could be as simple as saying, look, okay, we understand that there's all sorts of uh solutions out there, but we're going with uh and pick one, Claude, uh, open AI, whatever.
[9:53] SPEAKER_01: We're you know, here's the one we're going to use.
[9:56] SPEAKER_01: So for you to play and try and do all those things, do it in one, get an enterprise version.
[10:01] SPEAKER_01: Um, have some control over it so you're not doing all the the um the uh personal ones.
[10:07] SPEAKER_01: Um on the apps that are bringing in the co-pilots.
[10:10] SPEAKER_01: The first thing I've said, and this is a PSA to anybody that's listening, go back and look at your SaaS contracts with all of your vendors because all of your vendors are going to bring co-pilots in.
[10:21] SPEAKER_01: If they bring copilots in and they have that standard clause in a SaaS contract, and I put these in my contracts for 15 years, it said, I will not use your data for any other purpose than uh stated in the services that you have purchased.
[10:36] SPEAKER_01: But I always had a carve out that said, except I can use it for performance-related metrics to or performance-related uh upgrades to make the systems better.
[10:46] SPEAKER_01: And and that was honestly built for things like disk read-write, um, query speed, network bandwidth, all the stuff that I needed to do to make the environment better.
[10:57] SPEAKER_01: Um, but if that contract if that clause still sits in there and they open up a co-pilot, then that training that database and training that LLM is making the system better.
[11:08] SPEAKER_01: So theoretically, they can use your data to train their LLMs.
[11:13] SPEAKER_01: So that one I say, go back and look at all of your contracts.
[11:15] SPEAKER_01: You've got you've got work to do there, but absolutely get through and just have the LLMs carved out, have AI carved out of that performance piece or have find a way to change that.
[11:26] SPEAKER_01: Um, because that you know, that's not malicious on the vendor's part.
[11:30] SPEAKER_01: There's no, I don't think there's a vendor out there that went, oh, you know, we'll plan this 10 years in advance so we can sneak it in, but it is in there and you want to get it out.
[11:39] SPEAKER_01: That's that's what I would say.
[11:40] SPEAKER_01: Um, and then from a from a governance perspective, um I'm not sure right now.
[11:46] SPEAKER_01: Um I think I think you really have to look at what your governance framework is for your company and see how AI fits into that because there's so many different ways to govern, there's so many different uh perspectives on that.
[11:58] SPEAKER_01: Um, that they will that will slide into some very easily as just another system with another data point.
[12:05] SPEAKER_01: Um, and in others, it will not work at all.
[12:09] SPEAKER_01: Like, you know, when you look at things like HIPAA and some of the the more rigorous uh frameworks that are out there for for compliance, um there's there's just too much looseness in AI right now for it.
[12:22] SPEAKER_00: Yeah, that's a really good point.
[12:24] SPEAKER_00: And what a great PSA for everybody about their software contracts.
[12:28] SPEAKER_00: That was a nugget.
[12:29] SPEAKER_00: So thank you for that nugget, and thank you for the time today.
[12:32] SPEAKER_00: I had so much fun talking to you as normal.
[12:36] SPEAKER_00: So um, everyone, thanks for tuning in, and we'll see you next time.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.