Episode 69: Built Wrong: Why Cybersecurity Is Failing and What We Must Do About It with Richard Bird

<p>Richard Bird, a 25-year cybersecurity veteran and former Global Head of Identity at JP Morgan Chase, joins Den Jones to deliver a frank, data-driven indictment of how cybersecurity has been measuring the wrong things for decades. They explore why increased spending hasn&#39;t made organizations safer, what three metrics actually matter, and how to rebuild on outcomes over activity.</p><p><br>EPISODE HIGHLIGHTS:<br></p><ul><li>Richard Bird&#39;s Career JourneyRichard describes his accidental entry into identity at JP Morgan Chase, managing a global function before moving to startups and VC.Key quote: &quot;I&#39;m in the third stage of my career. I&#39;m learning something new every day... none of which were things that I was ever exposed to prior to about 2018, 2019.&quot;<br></li><li>Announcing the Book: Built WrongRichard introduces <em>Built Wrong: Why Cybersecurity is Failing and How We Can Rebuild It</em>, a systemic diagnosis backed by over 110 citations.Key quote: &quot;The most important thing that I&#39;m trying to answer with this book is are we getting safer today versus where we were yesterday?&quot;<br></li><li>The Hacker in a Hoodie IndexA presentation sparked the metaphor comparing adversary ROI against defender spending.Key quote: &quot;The bad guys are doing six times better on the invested dollars that they&#39;re using to attack things than we&#39;re doing on the dollars that we&#39;re spending to protect things.&quot;<br></li><li>Measuring Activity Instead of OutcomesCybersecurity fails to measure performance in financial terms. FBI IC3 data shows losses grew from $800M to over $21B in ten years alongside rising security spend.Key quote: &quot;We&#39;re spending more money and losing more money. This is not a business that anybody would invest in.&quot;<br></li><li>The Myth of the Sophisticated AdversaryMost breaches are not novel or sophisticated; the same problems recur yearly.Key quote: &quot;We can&#39;t even fix the problems that we know about... hundreds of thousands of breaches and exploits every single year, and we haven&#39;t improved on a single one.&quot;<br></li><li>Stop Using the Word &quot;Risk&quot;Risk is a financial term. Allowing excessive standing privileges that lead to a breach is a bad decision, not risk.Key quote: &quot;Risk is what is left over when you have done what you are able to... none of that was risk. That was all self-chosen.&quot;<br></li><li>Self-Perpetuating Mythology30 years of wrong metrics reinf