What security leaders said, week 35

August 24, 2026 to August 30, 2026 · 1 entry from 1 leader

Grouped by topic: a week needs at least three entries before we draw up themes. Every person here is someone our record names as the current holder of a top security seat; role and company come from our record.

Boards and governance

1 entry on how security reaches the board and how oversight is organized.

August 26, 2026· Podcast appearance, Business Security Weekly (Audio)
Leslie Nielsen, Chief Information Security Officer at Mimecast
On linking cyber risk management to board-level decision outcomes
Connecting Cyber Risks to Board Outcomes & BHUSA interviews from Mimecast & Zscaler - Leslie Nielsen, Brett Stone-Gross, Dan Bowden - BSW #462
Our take
The CISO of Mimecast, in the seat since the announcement in September 2025, arrived from SVP and CISO at Klaviyo. The episode covers connecting cyber risk to board outcomes, with a guest discussing ransomware as extortion and data theft, third-party and cloud dependencies, and claims research, alongside conference interviews on agentic AI as human risk and on ransomware targeting managers. Our view on the board thread: translating cyber into resilience, financial exposure, regulatory impact and reputation is the right frame, but it only works if the numbers behind it are ones the CFO would also use, so build scenarios with finance and the risk function before the board meeting, not in it. We would add that dependency-driven interruption deserves its own line in board reporting, because outages that start at a supplier or cloud provider rarely show up in a control-maturity score. On agents as an extension of human risk, we agree in practice: giving each agent a named owner, scoped access and the same lifecycle controls as a person is a faster start than waiting for a new product category. Where we would push further is accountability, since an agent holding a human's credentials makes the deploying employee's access review the real control point. Watch whether boards begin asking for agent inventories the way they now ask about third parties.
Listen at Business Security Weekly (Audio) ↗