Richard Bird

The world has never spent more on cybersecurity, and organizations have never lost more to it. Three decades of rising budgets and rising losses is not a technology failure — it is a measurement failure, and everyone in the system was paid to leave it in place. Drawing on thirty years inside the industry he critiques, including eleven years at JPMorgan Chase, Richard Bird takes boards and executives through why the reports they receive describe activity rather than protection, and why the incentives in the market reward the appearance of security over its performance. This is the argument at the center of his book Built Wrong, delivered for the room that signs the checks. Bird closes with what a board should be asking instead, and what an honest answer sounds like coming back.

Attendee Results:

• Recognize the difference between a security metric that measures activity and one that measures protection.
• Understand why three decades of rising spend has not produced falling losses.
• Learn the specific questions a board can put to a security leader that cannot be answered with activity data.
• Identify the incentives inside their own organization that reward the appearance of protection.
• Leave with a defensible standard for what an honest security report contains.