Are Your Security Tools Actually Protecting You?

Your security tool says you're protected. So does your BAA, your SOC 2 report, and the maturity score you handed your board. None of that means any of them are telling the truth. Zach Stewart is a hands on CISO who spends his days doing exactly what this show is about: buying technology in a market built for the people selling it, then fighting to get it funded and adopted inside his own company. He's someone ITBroker.com works with directly, which is exactly why he's here. No product to pitch, no reason to give a polished answer. Max and Zach cover where to even start when you're hired into a mature security program, how to sell security to a business that treats it as a tax, where to find budget nobody knew they had, and the technical traps that catch people who should know better. Check before your next audit, your next renewal, or your next incident does it for you. What You'll Learn What "hands on" actually means for a CISO day to day, beyond the risk register and the slide deck How to evaluate a vendor's tool instead of their sales deck What a SOC 2 report and a signed BAA don't actually tell you Why SSO is quietly sold back to you as a premium feature, and how to push back When it makes sense to run your own SOC versus outsourcing to MDR Why a one to ten security maturity score means nothing to your board In this conversation: (00:00) - Cold open: what XDR actually means, and nobody has a straight answer (01:12) - Intro: Zach Stewart, hands on CISO (01:22) - What "hands on" actually means for a CISO day to day (04:10) - Day one priorities when you're hired into a maturing security program (06:19) - Velocity, change management, and where risk actually lives (10:25) - Why you can't just stop patching, even when updates break things (13:51) - What GRC actually means, stripped of the jargon (16:05) - How to quantify risk in terms the business actually understands (20:37) - Running risk as a dashboard, not a one time report (22:39) - Frontier risk: when there's no case law yet and no proof it'll happen (25:31) - Why visibility is the one thing a risk program can't work without (26:46) - Spotting real maturity versus theater in the first 30 days (49:20) - Show me the tool, not the slide deck (01:05:18) - A new vendor says they're secure because of SOC 2. What else to check (01:08:35) - The HIPAA BAA loophole nobody reads closely enough (01:23:29) - SSO can cost more than the product it's attached to (01:33:14) - The real math behind running your own SOC, and where MDR falls short (01:40:07) - Test your backups. Actually test them (02:03:09) - The company running its entire security budget at under a dollar per employee (02:06:30) - Outage risk and breach risk need two different plans (02:22:28) - When a customer contract forces corporate owned devices (02:28:39) - Why a one to ten maturity score means nothing to your board (02:48:24) - Passkeys are useful. Most companies deployed them wrong (02:57:47) - The SSO coverage gap nobody's counting (03:07:02) - The breach where almost anything would have stopped it What We Mentioned DSPM (Data Security Posture Management) DLP (Data Loss Prevention) IDP (Identity Provider) and zero trust identity SASE (Secure Access Service Edge) EDR (Endpoint Detection and Response) SOC 2 and HIPAA BAAs MDM / UEM and mobile device management MDR (Managed Detection and Response) and SOC staffing models NIST CSF Passkeys and passwordless authentication About Zach Stewart Zach Stewart is a hands on CISO and security leader who has built security and risk management programs from the ground up across multiple organizations. He works directly with ITBroker.com, which is why he's on the show: no product to sell, no incentive to give a polished answer. His focus is on the practical gap between what gets purchased and what actually gets implemented, and how security leaders can build real organizational credibility rather than just checking compliance boxes. LinkedIn: https://www.linkedin.com/in/zacharykstewart/ Company: https://steno.com About the Show Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you're in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom Full Transcript Click here to view the episode transcript.