# Cybersecurity is a Business Risk, So Why are We Still Talking Tech?

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 26 Aug 2025, 13 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17731244-cybersecurity-is-a-business-risk-so-why-are-we-still-talking-tech.mp3

Send us Fan Mail Think your security strategy is airtight? Think again. In this episode, Brad Moldenhauer — VP and CISO-in-Residence at Zscaler — lays out the brutal truth: most companies are underestimating the financial and existential risks lurking in their systems. He’s not pulling punches. From AI that predicts attacks before they happen to material risks that could bankrupt you overnight, Brad explains how the old-school view of cyber is blinding businesses to what really matters — and how to fix it before it's too late. In This Episode: • Why your “cyber strategy” could trigger an extinction-level event • The business risk mistake even seasoned CISOs still make • How to stop spending $100 to fix a $5 problem • Why ignoring AI governance might be your last mistake • The one shift that turns CISOs into true executives Why You Should Listen: If you’re a CISO still talking controls instead of customers — you’re already behind. This isn’t just another tech talk. It’s a wake-up call from one of the most strategic minds in cybersecurity. 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_00: Hey guys, thanks so much for joining.
[0:10] SPEAKER_00: I'm Joe Peterson.
[0:11] SPEAKER_00: I am the Vice President of Cloud and Security for Clarify 360, and I am the chief analyst at ClearTech Research.
[0:17] SPEAKER_00: And you're joining us here for ClearTech Loop in the know and on the move.
[0:22] SPEAKER_00: I'm here with Mr.
[0:23] SPEAKER_00: Brad Moldenauer, VP and CISO in Residence at Zscaler.
[0:27] SPEAKER_00: Hi, Brad.
[0:28] SPEAKER_01: Hey Joe, how's it going?
[0:30] SPEAKER_00: It's going great.
[0:31] SPEAKER_00: Thanks.
[0:32] SPEAKER_00: In case you guys are just joining us, um, ClearTech Loop is a focused podcast series.
[0:37] SPEAKER_00: We're delivering sharp real-time insights at the intersection of cybersecurity, cloud, and AI security.
[0:44] SPEAKER_00: And this session is part of a series of conversations with IT and security leaders that are navigating a new era of risk and responsibility.
[0:53] SPEAKER_00: So it's not just about protection.
[0:55] SPEAKER_00: We ask what they see on the horizon and how they're preparing for it through a three-question lens.
[1:01] SPEAKER_00: But before we begin the questions, let's take a minute and talk about Brad and what his role entails.
[1:08] SPEAKER_00: Brad, over to you.
[1:09] SPEAKER_01: Yeah, yeah.
[1:10] SPEAKER_01: So yeah, thanks.
[1:11] SPEAKER_01: Um, so as you mentioned, VP and uh CISO and residents here at Zscaler have an incredibly broad role.
[1:18] SPEAKER_01: But I would I would say to sum it up, you know, I I really drive um global security transformation and innovation across all facets of Zscaler's uh business uh strategy, uh products and operations, but I have an incredibly strong focus on customer value creation, which is really where I like spending my time.
[1:42] SPEAKER_01: Unfortunately for me, I probably spend about 90% of my time uh in that capacity.
[1:46] SPEAKER_01: So yeah.
[1:48] SPEAKER_00: I think that's great.
[1:49] SPEAKER_00: And I know that that's something that you feel passionately about, visiting with customers, talking to them about their needs, helping them find a solution and a path.
[1:59] SPEAKER_00: So that's awesome.
[2:01] SPEAKER_00: Um so thanks for joining today.
[2:03] SPEAKER_00: Let's let's dig into the questions.
[2:05] SPEAKER_00: The first one, I promise three.
[2:07] SPEAKER_00: From a CISO's perspective, how should you be thinking about cyber risk in terms of dollars and business impact?
[2:15] SPEAKER_01: Yeah, so that's that's an interesting one because I think that I've always done this.
[2:21] SPEAKER_01: And I've been obviously advising a lot of customers uh that are publicly traded, you know, with the the recent cyber materiality um role.
[2:29] SPEAKER_01: But right, you know, I I don't know, I don't know who taught me this, but I I definitely owe them uh a modicum of thanks.
[2:36] SPEAKER_01: But you know, I was I've always kind of had a design goal, right?
[2:41] SPEAKER_01: And my design goal to really simplify it, because I think, you know, for the longest time, I think the rest of the business kind of looked at us as just incredibly esoteric and probably uh a pain in the you know what.
[2:52] SPEAKER_01: But I think, you know, when I started talking and using terms like, you know what my goal is here is my design goal is no material or significant event that could impact my shareholders, my stakeholders, or my customers, and doing that with the lowest cost and the least amount of friction.
[3:13] SPEAKER_01: I mean that was always my goal.
[3:15] SPEAKER_01: And I think it's kind of served me well.
[3:18] SPEAKER_01: And I'm I I've I'm really starting to see um, you know, CISOs writ large, you know, that are becoming much more of uh, you know, I think we've always had the technical acumen, but we needed to grow that business acumen and then you know kind of connect it with our risk management sensibilities, right?
[3:36] SPEAKER_01: And I just love it when I'm talking to CISOs that are um, you know, not just looking to you know implement controls, but actually um kind of really inform their portrait of risk, if you like, you know, to have these discussions with CFOs, CEOs, and and board members.
[3:56] SPEAKER_01: Um so yeah, I you know, and then the other thing too, I I I had a conversation which I think is perfect for this, but um, and it was based upon cyber materiality, which is kind of feeds right into your your question.
[4:10] SPEAKER_01: But you know, I I broke it down like this any for-profit company, you know, has a mission, and regardless of what that is, it's inextricably linked to growing revenue, managing margins, cutting costs, and in some cases, you know, pumping earnings per share for the shareholders.
[4:28] SPEAKER_01: And you know, this individual had you know aspirations to kind of grow into the CISO role that he currently just uh has.
[4:34] SPEAKER_01: And I was like, look, you know, if you're not helping the organization along those lines, look, I don't I don't mean to be blunt, but you know, frankly, you know, you're not the executive that you have aspirations of becoming, you're simply doing your job, you know, showing the business.
[4:49] SPEAKER_01: I think you know, if we can show them how we can, you know, uh enable emerging tech for competitive differentiation and you know, approaches for managing risks that come with that kind of change, um, you know, that uh you know would I think improve business velocity, time to market, you know, through just minimize friction and greater employee productivity and yield.
[5:14] SPEAKER_01: You know, that's the kind of stuff the CFO wants to hear, right?
[5:17] SPEAKER_01: And I just feel like more and more CISOs are able to really tell that story now, as opposed to, you know, kind of just being, all right, do we got to get that guy's approval?
[5:27] SPEAKER_01: You know, so yeah.
[5:29] SPEAKER_00: Well, and then you make such a great point because I see the forward thinking and the matured CISOs having conversations that are relevant to other C levels, right?
[5:45] SPEAKER_00: Speaking their language is opposed to speaking our language, yeah, because they don't get our language, just like we don't get theirs, in fairness, you know?
[5:54] SPEAKER_00: Right, yeah, so I mean so okay, second question.
[5:59] SPEAKER_00: In your opinion, what is the best way to integrate cyber risk into the business's overall financial risk model?
[6:08] SPEAKER_01: Yeah, so um, and again, I you know, I've never really um I've never you know had any roles in finance, but you know, the more and more uh people that I've worked with, and that is I you know started growing in stature within you know my previous companies, you know, I I I'm telling you, CISOs really need to uh we've all dealt with SOX and usually probably Section 302, but look, you go back to SOX and the financial materiality, you know.
[6:36] SPEAKER_01: I mean, there are line items in the balance sheet for you know materiality uh by nature and materiality by impact.
[6:43] SPEAKER_01: Walk back from the financials, from the business process, you know, from the company's value chain.
[6:50] SPEAKER_01: What is it that affects the business or your customer?
[6:54] SPEAKER_01: And that should be the focus of cyber materiality assessments, you know.
[6:59] SPEAKER_01: And it's funny when I'm I'm kind of you know having this discussion and I'm I'm seeing you know people struggle with this.
[7:07] SPEAKER_01: I'm like, all right, look, um, what are the macro business processes that would have material impact to your business if they were offline or unavailable?
[7:16] SPEAKER_01: They understand that.
[7:18] SPEAKER_01: And you know, when they start thinking about it, I'm like, you know, and again, I I I have a habit of simplifying things, but look, most organizations, it's probably something like, you know, book, order, pay, build, ship, close, communicate.
[7:31] SPEAKER_01: If you can't book an order, you miss revenue, material impact.
[7:36] SPEAKER_01: If you can't ship a product, you miss revenue, material impact.
[7:41] SPEAKER_01: If you can't pay employers or suppliers, material impact.
[7:45] SPEAKER_01: Now that you kind of have an understanding of what could really um, you know, maybe start off as something like an operational risk and cascade into something significant.
[7:57] SPEAKER_01: I I think that's um you know really how CISOs need to think about integrating cyber risk you know into the the businesses, overall financial risk models.
[8:08] SPEAKER_01: I think if you look at it from that perspective, and again, I I'm not gonna encounter too many CFOs who who don't know what I'm talking about when we have that discussion.
[8:18] SPEAKER_00: And that's a great lens to look at it through, right?
[8:21] SPEAKER_00: And I'm a fan of, you know, I learned been an engineer for a long time, and one of the phrases that stays with me is keep it simple.
[8:29] SPEAKER_00: Yeah, yeah, right?
[8:31] SPEAKER_00: Keep it, keep it simple.
[8:32] SPEAKER_00: And yeah, yeah.
[8:34] SPEAKER_01: And yeah, you know, it's uh I know salespeople hate me uh, you know, when I when I say this, but sometimes, you know, I'll be talking to um a CISO, and look, all of us in any kind of walk of life are guilty of this, and it's the misperception of risk.
[8:47] SPEAKER_01: And uh when when I hear a CISO kind of uh you know go off on something, I'm like, well, look, uh I don't know how else to say this, uh, but delicately, but you shouldn't spend a hundred dollars to fix a five dollar problem.
[9:00] SPEAKER_01: All right.
[9:00] SPEAKER_01: So that again goes back to really kind of understanding that value chain and you know how something could, you know, you know, maybe start off as something, you know, quite minor, you know, and really cascade into something as significant as a uh you know extinction level event.
[9:18] SPEAKER_01: And the other thing, too, that I I see and CISOs get better at is, you know, we can't just look at risk from a business perspective.
[9:26] SPEAKER_01: Yeah, like business risk is obviously important, but um, you know, we have a lot of examples from history where people did that and it cascaded into you know something that was unforeseen that impacted society writ large.
[9:40] SPEAKER_01: You know, um the ayacoca uh comes to mind, right?
[9:44] SPEAKER_01: And and some of the things that happened back in the 70s were you know they were saving you know money on a part that they owned a patent for.
[9:51] SPEAKER_01: And what happened?
[9:52] SPEAKER_01: A bunch of those you know, cars started blowing up.
[9:54] SPEAKER_01: And I don't think it was his intent to go out and kill people, right?
[9:57] SPEAKER_01: It was just, hey, I'm only looking at this from a business risk, not a customer risk or a societal risk.
[10:03] SPEAKER_01: And that's important, uh, really looking at it from that macro level.
[10:07] SPEAKER_00: Yeah, that's that's a good point.
[10:09] SPEAKER_00: And it wouldn't be a tech podcast today if we didn't talk about AI.
[10:15] SPEAKER_00: So it just wouldn't be, right?
[10:17] SPEAKER_00: So, how should the CISO be thinking about AI adoption in terms of its use to secure emerging threats and the other side of that coin from an organizational governance perspective?
[10:29] SPEAKER_01: Yeah, yeah.
[10:30] SPEAKER_01: Um, so and again, I you you and I just talked about this recently.
[10:35] SPEAKER_01: Um, you know, I think that um, you know, you really got to think long and hard.
[10:40] SPEAKER_01: And I look, I understand that if you're looking at, you know, some of the risks associated with this and you're like, all right, look, right now we've got other priorities.
[10:49] SPEAKER_01: Our acceptable use is just gonna be not to use this at all and restrict anyone in the business from using it.
[10:55] SPEAKER_01: You know, if you stay in that seat too long, I I think that could be an extinction level of it.
[11:00] SPEAKER_01: Um, but I mean, just some of the things that immediately come to mind with that is um, you know, some of the I and it's none of this is new in my opinion, but it's only getting stronger because of AI.
[11:12] SPEAKER_01: So if we take a look at, you know, driving security outcomes, like in the areas of proactive threat detection and response, you know, behavioral analytics, um, you know, pulling threat intelligence from multiple sources, you know, like the dark web, uh, you know, threat feeds, internal logs, um, scalability against sophisticated attacks, you know, and and I that's I've I've long felt that AI was always, you know, there historically there's been three ways that we treat risk.
[11:42] SPEAKER_01: We can prevent it, we can detect it, or we can respond to it.
[11:45] SPEAKER_01: I think AI kind of adds a new dimension where now we can predict it, right?
[11:50] SPEAKER_01: And how does it do that?
[11:52] SPEAKER_01: Well, the inference, right?
[11:54] SPEAKER_01: Um, we can discover patterns in data and then the prediction, you know, make what I would call highly accurate projections about the future based on data about the past, you know, because I think the secret weapon of even not even gen AI, but traditional AI and machine learning is it wields the power of prediction.
[12:12] SPEAKER_01: So, you know, think of it this way.
[12:14] SPEAKER_01: Um, you know, I love playing chess.
[12:16] SPEAKER_01: So think of it like playing chess with the same partner over and over, and then doing it with the same um, you know, well, with hundreds of other players.
[12:27] SPEAKER_01: And over time you learn your opponent's tendencies and you can anticipate their next move.
[12:32] SPEAKER_01: By drawing on the lessons learned from other opponents, you have more options to consider so you can adjust your own strategy accordingly.
[12:40] SPEAKER_01: So um I think that's that's a really interesting way to look at it is really automating and empowering you know what we're doing.
[12:49] SPEAKER_01: And you know what?
[12:50] SPEAKER_01: Maybe, just maybe, you know, we're gonna um you know keep keep pace, you know, with the threat actors and the volatility of that threat landscape.
[12:59] SPEAKER_00: It'd be nice.
[13:00] SPEAKER_00: That's that's a good that's a good hope.
[13:02] SPEAKER_00: That's a good hope.
[13:03] SPEAKER_00: Well, thank you for answering the questions, yeah, guys.
[13:06] SPEAKER_00: I hope you enjoyed that.
[13:08] SPEAKER_00: And I did, and I always learned something from Brad.
[13:11] SPEAKER_00: And so we'll see you next time.
[13:13] SPEAKER_01: Yeah, thanks for having me.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.