Podcast Episode 7

Episode 007 33 min

Michael Brooks, vCISO and Director of Cyber Risk Services at Trava

with Michael Brooks · Trava

0:00 / 33:00

Also on Spotify, Apple Podcasts, YouTube, Podbean, Player FM

Episode 7 of The Security Podcast of Silicon Valley, published August 10, 2021. Host Jon McLachlan talks with Michael Brooks, then a vCISO and director of cyber risk services at Trava, after a career that runs from the help desk in the military to the National Security Agency, the White House Communications Agency and an Air Force command. Michael explains what a vCISO does, the four ways to handle a risk (accept, mitigate, monitor or transfer), the questions to answer before a breach, and why ignoring a risk accepts it. The talk covers ISO 27001 as a door to new markets, third party risk and supply chain attacks, a client with no backup facing ransomware, cyber insurance setting a floor for security, and why it all comes back to the data. About 33 minutes.

Episode notes

In this thought-provoking episode of a YSecurity.io production, we welcome Michael Brooks, the Chief Information Security Officer at Trava, to dissect the complex world of cyber risk, ransomware attacks, business preparedness, and risk management strategies. Michael brings a wealth of knowledge and experience, offering deep insights into the foundational challenges and strategic imperatives of cybersecurity.

At the heart of our discussion is the critical importance of data security. Michael prompts us to consider the intrinsic value of our data, urging businesses to reflect on whether they can operate without certain datasets. This perspective shifts the conversation from theoretical security measures to practical, business-critical imperatives. It's not just about protecting data for the sake of compliance or fear of breaches, but recognizing data as the lifeblood of modern business operations.

Michael delves into the anatomy of ransomware attacks, shedding light on the tactics used by attackers and the vulnerabilities they exploit. He emphasizes the need for businesses to not only fortify their defenses but also to cultivate a deep understanding of their risk profile. This involves identifying which data sets are vital for business continuity and ensuring they are adequately protected against potential threats.

The conversation also explores the broader landscape of cyber risk management, highlighting the importance of preparedness and resilience. Michael shares strategies for businesses to assess their vulnerabilities, implement robust security protocols, and develop incident response plans. He stresses that risk management is not a one-size-fits-all solution but requires a tailored approach that aligns with the unique needs and risk tolerance of each organization.

Listeners will gain practical advice on enhancing their cybersecurity posture, from the technicalities of safeguarding against ransomware to the nuances of cyber risk management. Michael's insights underscore the significance of understanding the value of data and the critical role it plays in determining security priorities.

Join us for an engaging and enlightening conversation with Michael Brooks on navigating the complexities of cyber risk and the pivotal steps businesses can take to ensure their data—and by extension, their operations—are secure. Whether you're a cybersecurity professional, a business leader, or simply interested in the dynamics of digital security, this episode offers valuable perspectives on protecting what matters most in the digital age.

Hosted by Jon McLachlan — co-founder of YSecurity.

The deep dive

Ignoring a risk accepts it

Michael Brooks, then a vCISO at Trava: a career spent protecting information, what a vCISO does, the four ways to handle a risk, the questions to answer before a breach, why ignoring a risk accepts it, the question behind every security job, a certification that opens doors, third party risk, the worst day without a backup, cyber insurance pushing security from the back end, and why it all comes back to the data.

By Jon McLachlan, host 26 min read

Episode 7 of The Security Podcast of Silicon Valley came out on August 10, 2021, with Jon McLachlan hosting. The guest was Michael Brooks, then a vCISO and director of cyber risk services at Trava, a cyber risk management company in Indianapolis (Podbean, LinkedIn, Trava).

Michael’s case is that security comes down to two things. Know which data the business can’t run without, and make every decision about risk on purpose, because a risk nobody looks at still gets accepted.

This page follows the conversation in order: a section for each part of it, twelve figures, fourteen clips from the tape, an article from Michael’s LinkedIn newsletter, the full transcript, and five tools: a quiz, a scorecard for how ready you are before a bad day, a calculator that weighs accepting a risk against fixing it, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.

From the help desk to vCISO

Jon’s introduction walked through Michael’s career: director of IT operations at the National Security Agency, IT audit and compliance at the National Guard Bureau, presidential response officer at the White House Communications Agency, then CIO, CISO and commanding officer in the Air Force. After that came a senior advisor role at United States Special Operations Command, cyber defense work at PwC and Amgen, then Abacode, where Michael was a vCISO for the first time and senior vice president of RevOps, and then Trava.

Michael’s LinkedIn dates the National Security Agency role to 2006 through 2009 and the Air Force command to 2014 and 2015, and describes 20 years of Air Force cyber operations leadership. It lists Abacode from December 2018 to April 2021, with the title CISO and senior vice president (LinkedIn).

“my background is primarily military.”

Michael Brooks, at 1:45

Michael started an IT career in the military on the help desk and moved into security roles with more and more responsibility.

“I think the military and the DOD sometimes looks at information much more differently than the business world does in terms of its criticality and importance.”

Michael Brooks, at 2:06

Eight cards. 2006 to 2009: director of IT at the NSA. 2009 to 2011: director for IT audits and compliance, National Guard Bureau. 2011 to 2013: presidential response officer, White House Communications Agency. 2014 to 2015: CIO, CISO and commanding officer in the Air Force. 2015 to 2017: senior advisor at USSOCOM. Next: cyber defense roles with PwC and Amgen. 2018 to 2021: at Abacode, CISO and SVP of RevOps, a first vCISO role. Filled, at the episode: a vCISO and director of cyber risk services at Trava. Quote: "my background is primarily military."
Michael's path before the episode. Sources: the episode and LinkedIn.

What a vCISO does

Jon asked what the V stands for, and how a CISO differs from a CSO.

“it’s a market term for virtual chief information security officer.”

Michael Brooks, at 4:59

Michael called it a fractional CISO. It fits a company with a specific need for a security leader, or a company that doesn’t need a full-time security executive, and it means on-demand support.

“it’s all about risk management”

Michael Brooks, at 5:36

The job is to bring cyber expertise into the company, so it can look at cyber risk the way it looks at financial risk or health risk, and protect its data. Wikipedia describes the virtual CISO, also called the fractional CISO, as a role that grew popular in the 2010s, for organizations that may not be large enough to support a full-time executive CISO (Wikipedia).

Listen · Michael Brooks on episode 7, from 4:55
About 35 seconds: Michael on what a vCISO is. The clip stops on its own. Read the full transcript.
Three cards. Virtual: the V in vCISO, a market term. Fractional: part of a CISO's time, for a company that doesn't need a full-time security executive. Filled, risk management: cyber expertise brought in, so the company can weigh cyber risk the way it weighs financial risk. Below: Wikipedia says the role grew popular in the 2010s, for organizations too small to support a full-time CISO. Quote: "it's all about risk management"
What a vCISO is, in Michael's words. Sources: the episode and Wikipedia.

Accept, mitigate, monitor or transfer

Jon asked whether one person can be the CISO for more than one company at the same time. Michael said yes, and that Trava does it with a program that has defined end goals and starts from best practices and foundations.

The process starts with a baseline risk assessment of where the risk sits. Then management decides what to do with each risk: accept it, mitigate it, monitor it or transfer it. Working through those decisions builds a security program inside the business.

“So it’s always a priority game.”

Michael Brooks, at 7:40

Nobody has unlimited resources or funding. Wikipedia’s article on risk management lists similar options, from transferring a risk to a third party, often for a fee, to retaining it (Wikipedia). The calculator below weighs accepting a risk against paying to cut it.

Listen · Michael Brooks on episode 7, from 6:56
About 30 seconds: Michael on the risk assessment and the four choices. The clip stops on its own. Read the full transcript.
Three boxes joined by arrows: assess a baseline of the risk, management decides, and, filled, build a security program. Below, four compartments for the decision: accept, live with it. Mitigate, cut it down. Monitor, keep watching it. Transfer, hand it to a third party. Then: nobody has unlimited resources or funding, so each decision is a choice about what comes first. Quote: "So it's always a priority game."
From a baseline assessment to a decision on each risk. Source: the episode.

Before the bad day

Jon asked whether two companies had ever needed Michael at the same time. Michael has dealt with issues across companies, and said the answer is to work ahead of them, at the foundational level.

“Do we know what one smells like?”

Michael Brooks, at 8:48

The questions come before any event: where the data is, who has access to it, what the team would do in an event, whether it would recognize one, and whether it could respond.

“you don’t want to be making this stuff up”

Michael Brooks, at 8:56

Most of Michael’s work is that proactive part: notification procedures that people understand, security controls that work, and inventories that get done. A breach is an eventuality, so the time to plan is before it, much like a fire drill at school.

“fail to prepare, then prepare to fail.”

Jon McLachlan, at 9:38

Listen · Michael Brooks on episode 7, from 8:36
About 25 seconds: Michael on the questions to answer before an event. The clip stops on its own. Read the full transcript.
Five numbered questions: where is the data? Who can reach it? What would we do in an event? Would we recognize one, and have we seen one before? Could we respond? Below, three cards for the work that follows: notification procedures that everyone knows, security controls that work, and, filled, inventories that are done and kept current. Quote: "you don't want to be making this stuff up"
The questions to answer before an event, and the work that follows. Source: the episode.

Clients who want the help

Jon asked which clients Michael likes working with most. Michael said there’s ego in the field, and the best clients know they need help and want it.

“there’s a lot of ego in the cybersecurity space”

Michael Brooks, at 10:15

The push to get better can come from a new enterprise business opportunity, a compliance requirement, an investment requirement or a board. Whatever the reason, Michael said, the work runs on relationships and trust, and nobody has all the answers.

“Control what we can control and know how we’re going to react to the rest of it.”

Michael Brooks, at 11:16

Michael gets the most traction working with people who are open and honest, and willing to take a critical look at how they work. Jon pointed to the humility in that.

The basics go a long way

Michael turned the point on the field itself.

“So for an industry that’s full of experts, we seem to have an awful lot of issues.”

Michael Brooks, at 12:04

Jon added the opportunity in it, the number of data breaches, and the responsibility to put a dent in the problem. Michael’s answer was the basic blocking and tackling of cybersecurity, which brings a lot of risk down to an acceptable level.

“So if you brush your teeth and you wash your face, those things go a long, long way to effective security for your business.”

Michael Brooks, at 12:32

Listen · Michael Brooks on episode 7, from 12:18
About 20 seconds: Michael on the basics. The clip stops on its own. Read the full transcript.

What you don’t know, you accepted

Jon said it takes guts to be a CISO, since the CISO tends to get blamed when things go wrong. Michael’s start was in IT, where the military teaches early that data carries a classification. Top secret data comes with a description of the harm its loss can cause, and Michael learned fast that the job is protecting the information.

Wikipedia notes that Top Secret is the highest classification in the United States, for information whose unauthorized disclosure could be expected to cause exceptionally grave damage to national security (Wikipedia).

From there Michael drew a rule for business: value the data, protect it, and speak up when the protection isn’t there. The decision then belongs to the business.

“risk ignorance is a form of risk acceptance”

Michael Brooks, at 14:16

Knowing a risk and accepting it on purpose is a different story, and a business decision. For that, security leaders have to explain risk in terms the business can decide on.

“We’ve got to speak your language.”

Michael Brooks, at 14:33

Michael thinks CISOs get a bad name when they can’t do that, and that their value is underappreciated. Michael described a friend, a CISO at a Fortune 500 company, worn down by pervasive threats and data that is always at risk. Michael said a bad event will come eventually, and Jon compared it to a car accident for someone who keeps driving.

Listen · Michael Brooks on episode 7, from 13:58
About 35 seconds: Michael on risk ignorance and risk acceptance. The clip stops on its own. Read the full transcript.
Two cards. Without knowing: nobody looked, so the business carries the risk anyway. Filled, on purpose: the risk is known, explained in business terms, and accepted as a business decision. Below: the security leader's part is to value the data, speak up when the protection isn't there, and explain the risk in terms the business can decide on. Quote: "risk ignorance is a form of risk acceptance"
Two ways a risk gets accepted. Source: the episode.

The question behind the job

Michael gave credit to the security people who protect networks and data every day. The importance of that work comes down to one question.

“What can your business do today without access to secure data and systems?”

Michael Brooks, at 15:47

Not much, so the data has to be secure, available, and accessed only by the people who need it. Technology moves fast and everybody wants the most productivity out of it, so security will always involve trade-offs.

Listen · Michael Brooks on episode 7, from 15:33
About 35 seconds: Michael on the question behind security work. The clip stops on its own. Read the full transcript.
Quote: "What can your business do today without access to secure data and systems?" Below, three compartments for what that asks of the data: secure, so it's protected. Available, there when needed. Filled, limited, open only to those who need it. Then: technology moves fast and everyone wants the most out of it, so security always comes with trade-offs.
The question, and what it asks of the data. Source: the episode.

A stamp that opens doors

Jon asked about Michael’s best day as a CISO. Every day is a good day when you’re making an impact, Michael said, and some stand out more than others. Among the most rewarding: a client earning a high-level certification such as ISO 27001.

“there’s so much business and opportunity on the other side of that certification.”

Michael Brooks, at 17:06

The path is grueling. The auditors come in, the processes get walked through, the documentation gets written, and the business shows it provides effective security. Then someone puts a stamp on it, the company is validated, and more customers want to do business with it. A certification can move a company from the mid-market into the enterprise market. Wikipedia describes ISO/IEC 27001 as a standard for setting up, running and improving an information security management system, including how a company assesses and treats its risks (Wikipedia).

The other good days come from pointing out a significant risk that can be fixed, and watching a client see how the fix brings it down to an acceptable level. Michael pointed to single ransomware events hitting the U.S. economy at large. In the months before the episode came out, a ransomware attack led the Colonial Pipeline to halt operations on May 7, 2021 (Wikipedia), and on July 2, 2021, an attack through Kaseya’s VSA software reached about 60 managed service providers and caused downtime for over 1,000 companies (Wikipedia).

Jon added that security often gets pigeonholed as overhead, or as the work that keeps a company out of the news, when it can open up top end growth.

Listen · Michael Brooks on episode 7, from 16:52
About 40 seconds: Michael on a certification as a best day. The clip stops on its own. Read the full transcript.
Four boxes joined by arrows: the work, documents written. The audit, auditors come in. The stamp, validated. Filled, the market, into the enterprise. Below: ISO/IEC 27001 sets the requirements for an information security management system, including how a company assesses and treats its risks. Quote: "there's so much business and opportunity on the other side of that certification."
What a certification opens, in Michael's best days. Sources: the episode and Wikipedia.

A business capability

Michael agreed.

“you have to look at it like a business capability.”

Michael Brooks, at 19:12

Production is a business capability, and so is distribution. Security and IT are the same, there to enable the business. Competitive advantage may be a buzzword, Michael said, but it’s true: performing to a defined standard, and proving you can protect a customer’s data, builds the trust that gets a company into new markets.

“third party risk is first party risk in a connected world.”

Michael Brooks, at 19:52

Jon took it further. In an interconnected world everything depends on everything else, so a new dependency brings all its risks with it.

Listen · Michael Brooks on episode 7, from 19:33
About 20 seconds: Michael on trust, assurance and third party risk. The clip stops on its own. Read the full transcript.

When one vulnerability spreads

Michael pointed to supply chain attacks. One exploited vulnerability affects 10 people, then the drinking water, then everybody. SolarWinds was the example: nobody knew how widespread it was, and finding out would take a long time.

“Patch your systems. That’s what you need to do, right?”

Michael Brooks, at 20:29

The aim is to protect the systems without shutting everything down, and Jon put it as enabling the business to run more securely, efficiently and effectively. Michael called it a complete partnership. Wikipedia describes a supply chain attack as one that targets less secure elements in the supply chain (Wikipedia). Wikipedia’s article on the 2020 breach says it was first publicly reported on December 13, 2020, and that within days at least 200 organizations around the world were reported affected (Wikipedia).

Listen · Michael Brooks on episode 7, from 20:06
About 25 seconds: Michael on supply chain attacks and patching. The clip stops on its own. Read the full transcript.
Four boxes joined by arrows: one vulnerability exploited, 10 people affected, the drinking water affected, and, filled, everybody downstream. Below: the 2020 breach, with SolarWinds among the vectors, was first reported publicly on December 13, 2020. Within days, at least 200 organizations were reported affected. The first step Michael names: patch your systems. Quote: "third party risk is first party risk in a connected world."
How a dependency's risk becomes yours. Sources: the episode and Wikipedia.

The worst day

Jon asked about Michael’s worst day as a CISO. The hard days start with a call after the event: what happened, how and why, and how to get to restoration and the business back on its feet. Hardest of all are clients who didn’t see the value of a backup application or restore procedures, and then got hit with ransomware.

“start over or pay the ransom.”

Michael Brooks, at 21:55

Those are the only options left. Michael described business owners who spent five or 10 years building a company to 10, 15, 20 or 50 million dollars, and then watched it go to its knees because a critical system wasn’t backed up and its data was gone.

“it’s like losing that research paper that you typed up”

Michael Brooks, at 22:22

Only much worse. Wikipedia describes ransomware as malware that holds a victim’s data hostage until a ransom is paid, by encrypting it or threatening to publish it (Wikipedia).

Listen · Michael Brooks on episode 7, from 21:45
About 35 seconds: Michael on a client with no backup. The clip stops on its own. Read the full transcript.

Bad events are inevitable, so the approach has to be proactive.

“You have to look at risk management as a discipline.”

Michael Brooks, at 22:51

Security and technology are a business capability, the data has value, and the work is put in place as a program, so it can be managed and monitored going forward.

Two cards. No backup: ransomware hits a critical system that wasn't backed up, and the options left are to rebuild from scratch or pay. Filled, a program: managing risk as a discipline, security counted among the business's capabilities, and the data treated as worth protecting. Below: the owners Michael described had built companies worth 10 to 50 million dollars over five to 10 years. Quote: "You have to look at risk management as a discipline."
A worst day, and the approach that heads it off. Source: the episode.

Insurance from the back end

Michael brought up cyber insurance, which was getting tougher to get. Jon added that rates were way up and underwriting was reacting to cyber crime. Insurers were taking losses, and Michael compared it to large home insurers that ran the numbers and stopped insuring homes in one state, leaving about 50,000 homeowners looking for new coverage.

Michael thinks cyber insurance could drive security improvements.

“I’ll call it from the back end.”

Michael Brooks, at 24:02

Insurers will set a minimum acceptable level of risk and the due diligence it takes to be eligible, the way a driver has to wear a seatbelt and follow the speed limit. Only after that, if something happens, does the claim come up. Jon added that this is when the insurance kicks in, which keeps the economics viable for everyone. Michael was already evaluating policies for clients, so they understood the minimum requirements and were doing the eight or nine things a claim would depend on. Wikipedia describes cyber insurance as a specialty product that protects businesses from risks tied to information technology (Wikipedia).

Listen · Michael Brooks on episode 7, from 23:52
About 25 seconds: Michael on insurance driving security improvements. The clip stops on its own. Read the full transcript.

A score for cyber risk

Jon asked whether insurers would look for certifications such as ISO 27001, FedRAMP, FIPS or Common Criteria, a stamp that says a company is operationally more mature. Michael expects industry standard scoring, something like a FICO score for cyber risk.

Behind it would sit a data model and actuarial tables that state the cyber risk of a company in plain terms, and part of Trava’s work was building toward that. In a connected world the score covers the company’s upstream and downstream connections too, which is where Michael expects zero trust to emerge as a viable technology. Michael also hopes for self-healing IT that patches its own vulnerabilities.

“you’re still going to need the humans in the loop there”

Michael Brooks, at 26:22

Wikipedia describes zero trust architecture as a design where users and devices aren’t trusted by default, even on a privileged network (Wikipedia). FedRAMP is the U.S. government’s program for assessing and authorizing cloud products (Wikipedia).

Listen · Michael Brooks on episode 7, from 25:23
About 40 seconds: Michael on scoring cyber risk. The clip stops on its own. Read the full transcript.
Four boxes joined by arrows: a minimum the insurer sets, due diligence to be eligible, a claim if something happens, and, filled, a score like a credit score. Below: like a driver who buckles up and keeps to the speed limit. Behind the score: a data model and actuarial tables, with a company's upstream and downstream connections counted too. Quote: "I'll call it from the back end."
Cyber insurance as a push from the back end. Sources: the episode and Wikipedia.

Humans in the loop

Jon joked that Michael had two or three startups in that answer. Michael’s view is that cyber risk can be modeled the way financial and health risks are, with different factors.

“I think it would be a tragedy of our age”

Michael Brooks, at 27:02

The tragedy would be to have technology this wonderful and fail to work out how to use it and secure it. Michael sees the same question on the global stage, where some countries are going all in on cyber, and it trickles down to every business and the businesses it works with.

Jon asked whether a fully automated system would ever replace the CISO. Michael expects more connection and more reliance on technology, but doesn’t see robots turning on us. It’s up to us how we apply technology, and security has to be part of it from the start.

“it’s extraordinarily difficult to go back and bolt it on after the fact.”

Michael Brooks, at 29:28

Jon agreed, and described computers as tools at our service. Engineers and programmers write the code, and the machines can’t think for themselves.

“They do exactly what we tell them to do.”

Jon McLachlan, at 29:43

Listen · Jon McLachlan on episode 7, from 29:41
About 15 seconds: Jon on computers as tools. The clip stops on its own. Read the full transcript.

It all comes back to the data

Jon asked for advice for anyone thinking about becoming a CISO. Go for it, Michael said, and don’t lose sight of the main thing.

“the main thing is the data”

Michael Brooks, at 30:29

Confidentiality, integrity and availability come down to the data: who has access to it, whether it’s there when it needs to be, and whether it’s accurate. Michael’s example is a bank account. You check it on your phone and assume the money is there and correct. Down for an hour, you assume maintenance. A day, three days or a week is where it gets scary, and that’s the work security people do. The job is protecting the data and its availability, without policies that disrupt the business or hold people back.

Wikipedia describes the balanced protection of confidentiality, integrity and availability, the CIA triad, as the main focus of information security (Wikipedia). Jon agreed that it’s all about data: access control, authorization and authentication exist to protect it, and a program is nothing if you can’t trust the data going into it.

Listen · Michael Brooks on episode 7, from 30:49
About 30 seconds: Michael on the bank example. The clip stops on its own. Read the full transcript.
Four boxes joined by arrows for a bank balance that isn't there: an hour, probably maintenance. A day, still out. Three days, still out. Filled, a week, scary. Below, three compartments: confidentiality, who has access. Integrity, is it accurate? Filled, availability, is it there? Quote: "the main thing is the data"
How long can the data be gone? Michael's bank example. Source: the episode.

Start with the basics

Michael’s parting thoughts were about the time we live in, with the chance to do things that have never been done before. Technology is wonderful, Michael said, but it has to be used correctly and kept secure.

“We have to stay in control of it.”

Michael Brooks, at 32:46

Michael’s closing advice was to put the foundational security practices in place first, and build from there.

“Do the basics right.”

Michael Brooks, at 32:59

What happened after the tape

Trava’s second round. On August 8, 2022, Inside Indiana Business reported a $4.5 million second seed round for Trava, led by Mercury Fund and Elevate Ventures. Trava had launched out of High Alpha in December 2020 and said it had grown more than 600% since its first seed round (Inside Indiana Business). That first round, $3.5 million led by TDF Ventures, came in March 2021 (Help Net Security). The December 2020 launch release paired a virtual CISO service with a cyber insurance platform for small and midsize businesses (BusinessWire).

Trava today. Trava’s site lists advisory services, a vCISO among them, along with compliance readiness, FedRAMP 20x, AI risk management, penetration testing and managed programs (Trava). Its About page lists Dan Katt as CEO, co-founder Rob Beeler as CTO and co-founder Jim Goldman as an advisor, and calls security and compliance “growth enablers” (Trava).

Michael since. LinkedIn lists Michael as founder and principal cyber executive of VetNet Cyber since May 2021, business information security officer at CVS Health from August 2022 to April 2024, and since September 2025, CMMC strategy and engagement director at A-LIGN (LinkedIn). Wikipedia describes CMMC as an assessment framework and assessor certification program for standards published by NIST (Wikipedia).

Signing for the risk. On October 26, 2026, Michael published “Know What You’re Signing For: Commander’s Intent for CMMC Affirming Officials” in a LinkedIn newsletter, CMMC 2026: Year of Affirmation. The article says the executive who signs for a company’s security “decides what the company will and won’t tolerate,” the same choice Michael described on the tape (LinkedIn).

A timeline. December 8, 2020: Trava launches with a vCISO service and a cyber insurance platform. August 10, 2021: episode 7, Michael on the show. August 2022, filled: CVS Health, Michael becomes business information security officer. August 8, 2022, filled: second seed round, $4.5 million for Trava, led by Mercury Fund and Elevate Ventures. September 2025, filled: A-LIGN, Michael becomes CMMC strategy and engagement director. October 26, 2026, filled: an article on the executive who signs for a company's CMMC security. Below: Trava's site today lists a vCISO among its advisory services, with compliance readiness, FedRAMP 20x, penetration testing and managed programs.
Trava and Michael after the episode. Sources: BusinessWire, Inside Indiana Business, Trava and LinkedIn.

The same themes on this show. Episode 14 had Biff Clark of Coefficient Technologies on a CISO on demand, MSP risk and cyber insurance. Episode 58 had Jacob Berry, then field CISO at Clumio, on why customers buy backups for integrity and availability. Episode 56 had Kayne McGladrey, then field CISO at Hyperproof, on continuous evidence and when to hire a CISO. Episode 37 had Jon and Sasha Sinkevich on standards that open the door or close the deal. Episode 47 had Clea Ostendorf, then field CISO at Code42, on insider risk and who owns the risk.

Did you catch it? A seven-question quiz

Seven questions from the episode. Each answer links the moment in the transcript or its section.

Quiz · seven questions

Did you catch it?

Pick an answer to see whether you caught it.

  1. What does the V in vCISO stand for?

    a. "it's a market term for virtual chief information security officer." Transcript, 4:59.

  2. After the baseline risk assessment, what does management decide for each risk?

    c. Management picks one of the four for each risk. See Accept, mitigate, monitor or transfer.

  3. In Michael's words, what is risk ignorance a form of?

    b. "risk ignorance is a form of risk acceptance" Transcript, 14:16.

  4. What question does Michael say the work of security people comes down to?

    a. "What can your business do today without access to secure data and systems?" Transcript, 15:47.

  5. Which best day as a CISO did Michael describe?

    c. "there's so much business and opportunity on the other side of that certification." Transcript, 17:06.

  6. For a client hit by ransomware with no backup, what options are left?

    b. "start over or pay the ransom." Transcript, 21:55.

  7. What does Michael tell people thinking about becoming a CISO is the main thing?

    a. "the main thing is the data" Transcript, 30:29.

Are you ready before the bad day?

Eight questions on getting ready before an incident, built from the episode. Each tip links the section behind it.

Scorecard · eight questions

Are you ready before the bad day?

Answer for your company as it runs today. If two answers fit, pick the lower one.

  1. Do you know where all of your data is?

    • No
    • For the main systems
    • Yes, in an inventory we keep current

    Michael asks it first, before any event. See Before the bad day.

  2. Are your critical systems backed up, and have you tested a restore?

    • No
    • Backed up, never restored
    • Backed up, restores tested

    Without a backup, Michael's clients were left to start over or pay. See The worst day.

  3. Can you list everyone with access to each critical system?

    • No
    • For some systems
    • Yes, reviewed on a schedule

    Access is the second question Michael asks before an event. See Before the bad day.

  4. Do you have an incident plan, with notification procedures people understand?

    • No
    • Written, never practiced
    • Written and practiced

    Michael compares it to a fire drill at school. See Before the bad day.

  5. Does each known risk have a written decision: accept, mitigate, monitor or transfer?

    • No
    • The biggest risks do
    • Every one, signed off by management

    A risk nobody looks at still gets accepted. See What you don't know, you accepted.

  6. Do you patch every system on a schedule?

    • When something breaks
    • Most systems, most months
    • Every system, on a schedule

    "Patch your systems. That's what you need to do, right?" See When one vulnerability spreads.

  7. Do you know the risks your vendors and partners bring in?

    • No
    • For the biggest ones
    • Yes, checked before we sign

    "third party risk is first party risk in a connected world." See A business capability.

  8. Do you know what your cyber insurance requires of you before a claim?

    • No, or no policy
    • Roughly
    • Yes, and we do it

    Michael was evaluating policies so clients knew the minimum requirements. See Insurance from the back end.

Not ready yet

Start with where the data is, who can reach it, and a test restore from your backup.

Some of the basics

Write down a decision for each known risk, and practice the plan.

Ready before the bad day

Keep the inventory, the patches and the drills on a schedule.

Accept or fix?

The calculator weighs the choice from Accept, mitigate, monitor or transfer: live with a risk, or pay to cut it.

Calculator

Accept or fix?

Four numbers: the chance the event happens in a year, what it would cost, what the fix costs a year, and how much the fix cuts the chance.

$50,000a year on average if you accept the risk
$40,000a year on average with the fix, its cost included
$30,000the most the fix can cost a year and still pay for itself

At a 10% chance a year of a $500,000 loss, accepting the risk costs about $50,000 a year on average. A fix at $20,000 a year that cuts the chance by 60% brings that to about $40,000, its cost included. A fix like this pays for itself on average while it costs less than $30,000 a year.

The defaults are placeholders, so put in your own numbers. The results are yearly averages: in the year the event happens, it costs the full amount. Monitoring and transferring, the other two choices, aren't in the model.

From the NSA to CMMC

Michael’s path, the field around it, and this show. Filter by topic.

Timeline

From the NSA to CMMC

  1. The National Security Agency

    Michael becomes director of IT there, until September 2009 (LinkedIn, on this page).

  2. National Guard Bureau

    Director of IT audit and compliance, until February 2011 (LinkedIn).

  3. White House Communications Agency

    Presidential response officer, until August 2013 (LinkedIn).

  4. An Air Force command

    CIO, CISO and commanding officer in the Air Force, until June 2015 (LinkedIn).

  5. USSOCOM

    CIO senior advisor and global portfolio manager at Special Operations Command, until July 2017 (LinkedIn).

  6. Abacode

    CISO and senior vice president of RevOps, until April 2021 (LinkedIn).

  7. Trava launches

    High Alpha launches Trava with a virtual CISO service and a cyber insurance platform (BusinessWire, on this page).

  8. The 2020 breach

    A supply chain compromise, with SolarWinds among the vectors, is first reported publicly (Wikipedia, on this page).

  9. Trava's first seed round

    $3.5 million, led by TDF Ventures (Help Net Security).

  10. VetNet Cyber

    LinkedIn lists Michael as its founder and principal cyber executive from this month (LinkedIn).

  11. Colonial Pipeline

    A ransomware attack leads the company to halt pipeline operations (Wikipedia, on this page).

  12. Kaseya VSA

    An attack through Kaseya's software reaches about 60 managed service providers (Wikipedia, on this page).

  13. This episode

    Michael on the show, then a vCISO at Trava (Podbean).

  14. Episode 14

    Biff Clark on a CISO on demand, MSP risk and cyber insurance (episode 14).

  15. CVS Health

    Business information security officer, until April 2024 (LinkedIn).

  16. Trava's second seed round

    $4.5 million, led by Mercury Fund and Elevate Ventures (Inside Indiana Business, on this page).

  17. Episode 37

    Jon and Sasha Sinkevich on standards that open the door or close the deal (episode 37).

  18. Episode 47

    Clea Ostendorf on insider risk and who owns the risk (episode 47).

  19. Episode 56

    Kayne McGladrey on continuous evidence and when to hire a CISO (episode 56).

  20. Episode 58

    Jacob Berry on why customers buy backups (episode 58).

  21. A-LIGN

    CMMC strategy and engagement director (LinkedIn, on this page).

  22. Signing for the risk

    Michael's newsletter article for CMMC affirming officials (LinkedIn, on this page).

What to do this week

Five things, in the order of the episode.

  1. Write down each risk decision. For each risk you know about, record whether you accept, mitigate, monitor or transfer it, as in Accept, mitigate, monitor or transfer. Run the calculator on the biggest one.
  2. Answer the questions before an event. Where is the data, who can reach it, and what would you do in an event, as in Before the bad day. The scorecard covers the rest.
  3. Test a restore. Restore the system the business can’t run without from its backup, as in The worst day.
  4. Patch, and list your dependencies. Patch your systems, and list the vendors whose risk becomes yours, as in When one vulnerability spreads.
  5. Get help with it. Our vCISO Services give you a senior security leader part time, with a team behind them, SOC 2 Type 2 runs the program that gets you the report buyers ask for, and 24/7 Monitoring & Response watches your infrastructure and responds hands-on. If you want to talk it through, book 15 minutes with us.

Key takeaways

  1. Decide every risk on purpose

    After a baseline risk assessment, management decides to accept, mitigate, monitor or transfer each risk, because nobody has unlimited resources.

  2. Answer the questions early

    Know where the data is, who has access to it and what you would do in an event, before one happens.

  3. The basics do most of the work

    Basic blocking and tackling brings a lot of risk down to an acceptable level.

  4. Ignorance is acceptance

    A risk nobody looks at still gets accepted. A risk you know about and accept is a business decision.

  5. Speak the business's language

    Security leaders have to explain risk in terms the business can decide on.

  6. Certification opens markets

    A certification such as ISO 27001 can move a company from the mid-market into the enterprise.

  7. Their risk is your risk

    In a connected world, a vendor's or partner's risk becomes your own.

  8. Back up what you can't lose

    Without backups and restore procedures, a ransomware victim can only start over or pay.

  9. Insurance may raise the floor

    Michael expects insurers to set the minimum security a company needs to be eligible for cyber insurance.

  10. It comes back to the data

    Protecting data means controlling who has access, keeping it available and keeping it accurate.

Chapters

Tap a chapter to play from there.

Pull quotes

“my background is primarily military.”

Michael Brooks ·

“it's a market term for virtual chief information security officer.”

Michael Brooks ·

“it's all about risk management”

Michael Brooks ·

“So it's always a priority game.”

Michael Brooks ·

“Do we know what one smells like?”

Michael Brooks ·

“you don't want to be making this stuff up”

Michael Brooks ·

“fail to prepare, then prepare to fail.”

Jon McLachlan ·

“there's a lot of ego in the cybersecurity space”

Michael Brooks ·

“Control what we can control and know how we're going to react to the rest of it.”

Michael Brooks ·

“So for an industry that's full of experts, we seem to have an awful lot of issues.”

Michael Brooks ·

“risk ignorance is a form of risk acceptance”

Michael Brooks ·

“We've got to speak your language.”

Michael Brooks ·

“What can your business do today without access to secure data and systems?”

Michael Brooks ·

“there's so much business and opportunity on the other side of that certification.”

Michael Brooks ·

“third party risk is first party risk in a connected world.”

Michael Brooks ·

“Patch your systems. That's what you need to do, right?”

Michael Brooks ·

“start over or pay the ransom.”

Michael Brooks ·

“You have to look at risk management as a discipline.”

Michael Brooks ·

“I'll call it from the back end.”

Michael Brooks ·

“you're still going to need the humans in the loop there”

Michael Brooks ·

“it's extraordinarily difficult to go back and bolt it on after the fact.”

Michael Brooks ·

“They do exactly what we tell them to do.”

Jon McLachlan ·

“the main thing is the data”

Michael Brooks ·

“Do the basics right.”

Michael Brooks ·

About the guest

Michael Brooks, vCISO and Director of Cyber Risk Services, Trava

LinkedIn credits Michael Brooks with 20 years of cyber operations leadership in the U.S. Air Force. Michael's roles include director of IT at the National Security Agency, director of IT audit and compliance at the National Guard Bureau, presidential response officer at the White House Communications Agency, and CIO, CISO and commanding officer in the Air Force. After a senior advisor role at USSOCOM, Michael worked in cyber defense at PwC and Amgen, was CISO and senior vice president of RevOps at Abacode, and was a vCISO and director of cyber risk services at Trava at the time of this episode. Michael has since been business information security officer at CVS Health and, from September 2025, CMMC strategy and engagement director at A-LIGN.

Trava ↗ LinkedIn ↗ Michael Brooks's experience on LinkedIn ↗Michael's article for CMMC affirming officials, LinkedIn, October 26, 2026 ↗CMMC 2026: Year of Affirmation, Michael's LinkedIn newsletter ↗Trava ↗

About the host

Jon McLachlan is co-founder of YSecurity, the on-demand cybersecurity team for startups, and of Cyberbase.ai. The Security Podcast of Silicon Valley is hosted by Jon McLachlan and Sasha Sinkevich. Jon McLachlan on LinkedIn ↗

Context and sources

  • Episode 7 on Podbean: Michael Brooks, vCISO and Director of Cyber Risk Services at Trava. Source ↗
  • Michael Brooks's experience on LinkedIn: the National Security Agency, the National Guard Bureau, the White House Communications Agency, the Air Force, USSOCOM, Abacode, VetNet Cyber, CVS Health and A-LIGN, with dates. Source ↗
  • LinkedIn, October 26, 2026: Michael's article on the executive who signs for a company's CMMC security, in the newsletter CMMC 2026: Year of Affirmation. Source ↗
  • BusinessWire, December 8, 2020: High Alpha launches Trava in Indianapolis, a cyber risk management and insurance platform for small and midsize businesses, with a virtual CISO service. Source ↗
  • Help Net Security, March 26, 2021: Trava raises a $3.5 million seed round led by TDF Ventures, with High Alpha Capital and M25. Source ↗
  • Inside Indiana Business, August 8, 2022: Trava raises a $4.5 million second seed round led by Mercury Fund and Elevate Ventures. Source ↗
  • Trava: advisory services including a vCISO, compliance readiness, FedRAMP 20x and AI risk management, penetration testing and managed programs. Source ↗
  • Trava, About: the leadership team, with Dan Katt as CEO and co-founders Rob Beeler and Jim Goldman. Source ↗
  • Wikipedia, Chief information security officer: the virtual or fractional CISO, a role that grew popular in the 2010s for organizations too small for a full-time CISO. Source ↗
  • Wikipedia, Risk management: ways to handle a risk, from transferring it to a third party to retaining it. Source ↗
  • Wikipedia, Classified information in the United States: Top Secret is the highest classification, for information whose disclosure could cause exceptionally grave damage. Source ↗
  • Wikipedia, ISO/IEC 27001: requirements for an information security management system, including assessing and treating risks. Source ↗
  • Wikipedia, Colonial Pipeline ransomware attack: on May 7, 2021, the company halted all pipeline operations to contain the attack. Source ↗
  • Wikipedia, Kaseya VSA ransomware attack: on July 2, 2021, an attack reached about 60 managed service providers and their customers, with downtime for over 1,000 companies. Source ↗
  • Wikipedia, Supply chain attack: an attack that targets the less secure elements in an organization's supply chain. Source ↗
  • Wikipedia, 2020 United States federal government data breach: a supply chain compromise, SolarWinds among the vectors, first reported publicly on December 13, 2020. Source ↗
  • Wikipedia, Ransomware: malware that holds a victim's data hostage until a ransom is paid. Source ↗
  • Wikipedia, Cyber insurance: a specialty insurance product for risks tied to information technology. Source ↗
  • Wikipedia, Zero trust architecture: users and devices aren't trusted by default, even on a privileged network. Source ↗
  • Wikipedia, FedRAMP: the U.S. government's program for assessing, authorizing and monitoring cloud products. Source ↗
  • Wikipedia, Information security: the balanced protection of confidentiality, integrity and availability, the CIA triad. Source ↗
  • Wikipedia, Cybersecurity Maturity Model Certification: an assessment framework and assessor certification program for standards published by NIST. Source ↗

Transcript

Automatic transcription. Jon McLachlan hosts this episode with Michael Brooks, then a vCISO and director of cyber risk services at Trava. There is no diarization on the tape, so speaker labels were assigned from the content and checked against reference recordings of each voice from this episode, and a few short lines may sit with the wrong speaker. Names and terms were normalized where the recognizer misheard them (Jon McLachlan, Michael Brooks, Trava, Abacode, USSOCOM, MacDill, RevOps, Amgen, SolarWinds, FedRAMP). Words in [brackets] are best guesses where the audio is unclear, and [...] marks words no decode made out. Speech is transcribed as spoken, though many repeated words and false starts are left out, and so are short backchannels such as "yeah" where they overlap the other speaker.

Read the full transcript 6,636 words

Jon McLachlan

Welcome to the Security Podcast of Silicon Valley. I am here today with a very special guest, Michael Brooks, who is a vCISO at Trava, which actually is itself a security company. But he actually started his career at the NSA, the National Security Agency, as director of IT operations. From there, he moved forward to the National Guard Bureau, where he was an IT audit and compliance senior manager. After that, he spent a good chunk of time at the White House Communication Agency as a presidential response officer to help him facilitate communication between White House and military. And you're the CIO, CISO, commanding officer at the United States Air Force Central Command. That's awesome. And the CISO senior advisor for global program manager at USSOCOM. What does that stand for, Mike?

Michael Brooks

Yeah, that's United States Special Operations Command here in Tampa on MacDill Air Force Base.

Jon McLachlan

Gotcha. All right. So that's when you moved to Florida?

Michael Brooks

That's when we moved, that's when we moved to Florida, yeah.

Jon McLachlan

Yep. Very nice. And then after that, you're a director of cyber defense portfolios at PwC and Amgen, senior manager of global cyber defense, followed by vCISO. Looks like your first virtual CISO role. And senior vice president of RevOps at Abacode. Abacode. Thank you. Which lands you now at Trava. So you've had a rich and interesting career across both military and private industry. So welcome to the show, Mike. It's great to have you.

Michael Brooks

Yeah, thanks. It's good to be here with you, Jon, and I appreciate it. You know, yeah, my background is primarily military. You know, I did, started off my IT career in the military. I actually started it off on the help desk and then just kind of progressed from there. Started to get into the security roles. You started to continue to get promoted and into jobs with higher and higher levels of responsibility, and you had a great time. I had a wonderful time. And, you know, it's, I think the military and the DOD sometimes looks at information much more differently than the business world does in terms of its criticality and importance. And so, yeah, looking forward to talking with you today.

Jon McLachlan

Awesome. Super happy to have you on. One of the things that really drives who we are often comes from our childhood, right? And maybe there's a couple events or some inspirational moments from your childhood that you'd be willing to share. What was it that sparked your passion that you joined the Air Force and had all of that great service under your belt, and then, you know, you stuck with security all the way through? Is there something that happened or that connected you to the security world from your childhood?

Michael Brooks

Yeah, that's a great question. And thinking about that, I'm a twin. So I started off my life with a buddy before I even entered the world. I'm an identical twin. I'm actually what's called a hidden twin. My mom didn't know she was having twins, so I was a bit of a surprise when I came out. And that theme's kind of stuck with me throughout my life. I've been in some unexpected places and done some unexpected things. I come from a big family. I had five brothers growing up. So it was always about more feeling part of a pack or feeling part of a clan. You know, so that was really, really important to me. I played sports my whole life. So always part of teams, right? Always progressing towards a goal, working hard to achieve something, getting better and better. And my dad was actually a police officer growing up as a kid. So there was a, you know, very strong respect for authority growing up as a kid. And I think all of that really shaped kind of me and my life path. And I don't, I didn't realize that kind of as I, as I was doing it, but looking back, I can see how all those things did play a big role in my life choices. My decision to join the military strictly was just to get some money for college. You know, I was playing football in a small Division II school and wasn't really going anywhere there. And so I said, oh, maybe if I joined the military, I can just get money for college. And I wanted to join the FBI. That was my kind of goal coming out of high school, right? And maybe my dad influenced that with his police service. And so the military seemed like a really good fit. And so, you know, as I joined the military, I fit right in. It seemed well. I enjoyed kind of the camaraderie and being part of a unit, being part of a mission, and having kind of a higher purpose. And you just continued on from there.

Jon McLachlan

Oh, that's great. And then eventually, after that service, you ended up in the NSA, which same boat as the FBI kind of floats into, you know, national service. So you're actually a vCISO. And I'm not sure that all of our listeners know exactly what that V stands for, or maybe even how a CISO is different from a CSO. Maybe you could share with us exactly how you see your role as a vCISO.

Michael Brooks

Yeah, absolutely. So essentially, it's a, you know, it's a market term for virtual chief information security officer. You can think of it as a fractional chief information security officer for those companies that either have a very specific need for some augmentation from a security leader or somebody with some security expertise, or a company that's in a position where they don't have a need for a full-time resource, an executive level security resource. So it fits very well into kind of a fractional or virtual model to where it's, you know, on-demand support, as-needed support. And really, a chief information security officer, in my mind, and from the experience and the things that I've done, it's all about risk management, right? So, it's who can bring some experience and expertise into the organization from a cyber perspective so that we can look at cyber risk to the organization much the same way we would look at financial risk or health risk. And it just provides that expertise so that we can start solutioning things appropriately to make sure that the data is protected.

Jon McLachlan

So, all right, no, that makes perfect sense. And so, it's, it's almost like a contract. You could contract and you, you're on demand, kind of helping navigate that complex risk space, help smaller organizations maybe can't afford or don't have a need for the full-time CISO on board yet. So could you actually be a CISO for more than one company at the same time?

Michael Brooks

Yeah, I actually can. And that, we do do that. You know, at Trava, we've got a very specific programmatic approach to that. And I would say that, you know, that's where it is important to be able to kind of structure this in a program so that that advisory support is being done and put in place and executed in the balance of an actual program with defined end goals. And it's based on best practices, right? Which is really where we start from a security perspective. So we've got to make sure that the foundational things are in place and we can build from there. So typically the process is, we'll do some sort of risk assessment, right? We'll do a baseline risk assessment and say, okay, where is there risk within the organization? And then it really becomes a management decision from there in terms of, okay, how are we going to deal with this risk, this digital risk or this cyber risk? Are we going to accept it? Are we going to mitigate it some way? What are those strategies? Are we going to monitor it, transfer it? And so we really help companies kind of through that process. And then by going through that process, we actually are building effective security programs inside of the business and providing advice on security solutions and mitigation efforts and all of those things, because unfortunately, in today's digital world, nobody has an unlimited amount of resources and funding. So it's always a priority game. So yeah.

Jon McLachlan

Of course, of course. So I mean, I also imagine that part of that role is, okay, you have to prepare and build the fundamentals up. But if there is a security event, you might be front and center to help navigate the ins and outs, play-by-play, mission-critical recovery sort of mode on a security event. Have you ever had two companies at the same time need your services? Or it's been pretty smooth sailing so far. You haven't had, been pulled in too many directions all at once.

Michael Brooks

Yeah, the great question. You know, there are always issues, right? Especially in this space. So, yeah, I mean, I've had to deal with multiple issues across companies. And again, I think the way that, you know, the way to approach this is really proactively, right? So it's like, as long as we can have the conversations up front and we can start making some smart decisions and start understanding security capabilities. And again, at that foundational level. So do we know where all the data is? Do we know who has access to everything? Do we know what we would do if an event did occur? Do we know what an event even looks like? Do we know what one smells like? Have we seen them before? Can we even respond to such a thing? Right? And so I can tell you from experience, you don't want to be making this stuff up, you know, once, once something happens. So the work that I do mostly is really in that kind of proactive sense to make sure that notification procedures are in place and understood, that security controls are in place and working, that inventories are being done. And again, from a foundational security perspective, and just kind of managing that going forward. And then it's an eventuality that a breach is going to occur. I mean, I think, you know, [assume breach], yeah, it's going to happen, right? So when it does happen, how ready are we? And what's our plan? And, you know, much like doing fire drills in school, it makes a lot of sense to talk about that before the event.

Jon McLachlan

Exactly. No, it reminds me of that cute little saying: fail to prepare, then prepare to fail.

Michael Brooks

Exactly. Exactly.

Jon McLachlan

And having a plan in place, I'm sure, helps make those tense moments at least a little bit smoother, not making anything up as you go. So, I mean, in terms of everyone that you get to work with, then, are there certain qualities, or, you know, do you pick favorites sometimes, or maybe qualities that help make those sorts of relationships better, or that you would prefer to work with those types of clients or customers more than some of the others?

Michael Brooks

Yeah, I'm going to dig on my own tribe here for just a little bit. You know, there's a lot of ego in the cybersecurity space, right? And so I like to work with folks with companies that realize they need the help and truly want the help, right? That's, that to me is a huge, a huge qualifier, right? To find out, okay, we know we need help, right? We know we're not as good as we could be. We know we're exposed, you know, and they're, and they're truly looking to get better. And that could be because of a business opportunity, right? Maybe they've got an enterprise business opportunity now that's in front of them that they didn't have before. So security matters a little bit more than it did before. Maybe it's a compliance requirement, right? Maybe it's just, maybe it's an investment requirement. Maybe it's a board desire. You know, got to kind of dig into that to find out. But to me, it's like working with the right people is a lot about relationships and trust, right? And just understanding that, hey, you know, you don't have all the answers. I don't have all the answers, right? But together, we can come up with the best answer that's the best fit for you, best fit for your company. We keep you safe and we can do everything that we can do, right? Control what we can control and know how we're going to react to the rest of it. And that to me is, those are the best folks to work for. And I get the most traction and the most reward with working with people like that that are open and honest and truly looking to take a critical look at how they're doing things, understand the importance of it, and are ready and willing to kind of do what's necessary to improve their security posture.

Jon McLachlan

Yeah, definitely. I like how it goes back to people and relationships and a sense of humility almost, you know, which is very refreshing, especially in the security space, because you're right. Sometimes we do bump into some egos here and there.

Michael Brooks

Yeah, it's interesting. I mean, the cybersecurity space, you know, and I'll, you know, I'll dig on myself here too. I mean, it seems like there's a lot of experts, but there's also a lot of issues, right? So for an industry that's full of experts, we seem to have an awful lot of issues.

Jon McLachlan

And a lot of opportunities too. I mean, look at the number of data breaches out there. And I feel a great deal of responsibility to put a real dent in that actual problem that everyone faces, right?

Michael Brooks

Right. And then, you know, people say it all the time, but it is true. I mean, a lot of this risk literally gets mitigated to a very acceptable level if you do implement the basic blocking and tackling of cybersecurity, right? So if you brush your teeth and you wash your face, those things go a long, long way to effective security for your business.

Jon McLachlan

Yes, I couldn't agree more. And you know, in some sense, it does take a lot of guts to be a CISO because they will tend to get blamed for things when stuff goes sideways, because of that hesitation about wanting that type of exposure, that type of pressure. But clearly you've taken the leap, and it sounds like you're very comfortable in that space. So, maybe you'd be willing to share a truth that you see about the world or a piece of inspiration that helped push you over that line and took up the mantle without hesitation. Maybe there was hesitation. I don't know.

Michael Brooks

Yeah, not really. You know, when I started my career, it wasn't in cybersecurity, right? I was in IT. And you learn very early on in the military, as you're getting access to data and access to information. That data has a classification attached to it. And when you start getting access to things like top secret information, right? And you read the description of what that means and it can cause exceptionally grave harm and damage, right? You really quickly realize that it's about protecting the information. And then, you know, when you're in that, in that world, you realize it's your responsibility to make sure that those protections are in place, right? From an electronic and a digital standpoint. So, I think you've got to have an appreciation for the value of the data. And I think once you do that, then you can really start to really make sure that it's protected, okay, right? And making sure that we're taking the appropriate measures to protect it. And when we're not, you got to speak up to the business. And it's a business decision at the end of the day, right? That risk ignorance is a form of risk acceptance, right? But if you know about the risk and you willingly accept the risk, that's a different story. That's a business decision. Yeah. And I think what I've got to do, or what we've got to do as security leaders and security professionals, is we've got to bring that to you in a way that makes sense, right? We've got to speak your language. I can't come to you with things that don't make sense and you can't make a decision based around them. And we see, I think that's where the CISOs can really start to get maybe a little bit of a bad name in terms of the value that they're bringing. I think it's way underappreciated. I have friends of mine, you know, I was talking to a good friend of mine, he's a enterprise CISO, Fortune 500 company, and, you know, sharing with me, I'm exhausted, Mike. I'm exhausted. You know, the threats are pervasive. They're everywhere. The data is always at risk. People don't understand how important it is. You know, we're not that far away from a very, very bad day. And, you know, there's not much I can do to protect it, you know. And it just wears on me, you know, after a month, a year, five years, 10 years. You know, it's just, because, again, it's an eventuality. I mean, it is going to happen.

Jon McLachlan

It will happen eventually. Just like driving a car, you'll have in a car accident. Eventually, you just keep driving.

Michael Brooks

All the steps to avoid it.

Jon McLachlan

But statistically?

Michael Brooks

Yeah. I would give a lot of credit to all the security professionals that are out there each day, you know, protecting the networks and protecting the data. Because if you look at the importance and the significance of the work that these folks are doing, you know, it boils down to a simple question in my mind, right? What can your business do today without access to secure data and systems? So there's not a lot you can do in today's business world without data and without access to systems. So it's that critically important that that stuff is secure, that it's available, and then it's only accessed by the people who need it. And that's what the security folks are doing. So they're doing a great job. It's not an easy job. Technology is advancing rapidly and everybody wants to leverage it for the maximum amount of productivity. So that's always going to be a challenge, and you're always going to have those trade-offs.

Jon McLachlan

That's so true. That's such an inspirational message. Thank you for sharing that. I'm sure all of our listeners really appreciate that, the shout out. So tell me about the best day that you've had on your journey as a CISO.

Michael Brooks

Yeah, every day's a good day. You know, I think every day is a good day, especially when you're helping folks and you're making an impact, right? I think some of the, some of the days get called out a little bit more than others, right? I think some of my more rewarding days are seeing clients that I'm working with obtain a very high-level industry certification like an ISO 27001, right? And the reason that that's so important is because there's so much business and opportunity on the other side of that certification. And the path to getting that certification was grueling and it was a lot of work and a lot of effort went into it. And the auditors came in and we went through all of the processes and we wrote all the documentation and we can demonstrate that, you know, the business is actually providing, you know, effective security, and somebody comes in and puts a stamp on that, right? Because of that stamp, you know, you're validated and a lot more folks want to do business with you. You know, that's, that's, that's rewarding.

Jon McLachlan

Open up that top end growth for that small business. That can be really special. Yeah, that's [life-changing], right?

Michael Brooks

Yeah, it's, it can, you know, it can move it into the enterprise. It can move them from being a mid-market company into an enterprise company. The other thing is pointing out areas of significant risk that are, that can be fixed and can be mitigated, right? So working through that and then seeing the lights kind of go on that, oh, okay, you mean if we do this and we do that, then, you know, all of this kind of risk gets minimized down to an acceptable level? It's like, absolutely. You know what? And let's keep that under management. Let's, let's make sure we're staying engaged and we're staying proactive. You know, so I think just the opportunity to work with the clients and help them make good decisions, right, and improve their security posture, especially in today's world where you see single ransomware events impacting the U.S. economy at large. I mean, this is going to be a significant problem going forward that we're all going to have to work hard at together to get, to get better at.

Jon McLachlan

Absolutely. No, I'm excited to see the new technologies coming out that can help mitigate all of those new threats and those new risks. But I love that the best day for you is like helping companies open up and hit those goals, open up the top end growth, because I think a lot of times security gets put, pigeonholed into this place of like, oh, this is just risk management. This is overhead. This is, you know, if we do security right, we're just going to stay out of the news and that's, that's it. And that's really not the case at all. You can open up your top end growth with dotting your i's and crossing your t's.

Michael Brooks

Yeah, absolutely. I mean, you have to look at it like a business capability. You know, that's the way I view it. Like, how well are you, how well are you at doing this thing? Right. Just like production is a business capability, right? Distribution is a business capability. You know, security and IT is the same way. It is there to be an enabler. You know, people say it provides competitive advantage, right? That's a bit of a buzzword, but it's true. It can put you into markets or get you to do business with folks that are interested in doing business with you because it provides that level of trust and assurance that I'm at least performing to a defined standard and I can show you that. And I can prove to you that I can protect your data. And why is that important? Well, you know, third party risk is first party risk in a connected world. I mean, that's the way you think about it.

Jon McLachlan

And interconnected world, everything is dependent on everything else. And so, you know, when you pull in another dependency, you're pulling in all of the risks associated with it too.

Michael Brooks

Yeah, you can see that with these supply chain attacks, you know, you can see that there's unintended consequences all the way up and down the supply chain in terms of one vulnerability was exploited. And then, oh, no, wait a minute, now it's 10 people that are affected. Or no, wait a minute, now that's the drinking water. So it's everybody. You know, SolarWinds was a good example of that. It's like, how widespread is this? It's like, well, we don't even know. We won't know. It's going to take a long time to figure it out. Patch your systems. That's what you need to do, right? That's what you can do right now. So, you know, not losing sight of that, I think, is important. Just keeping focused on, you know, what are we here to do? And it's enable the business, right? It's, it's to protect the systems, but not in a disruptive way where it's like we're going to shut everything down and lock everything down.

Jon McLachlan

Enables the business to actually function more securely, more efficiently, more effectively.

Michael Brooks

Yeah, it's a partnership. You're absolutely right. That's a great word and a great way to say it. It's a complete partnership, and it should be viewed that way.

Jon McLachlan

So, what about the worst day that you've had as a CISO? What can you share about that, that day?

Michael Brooks

Yeah, it's just, I mean, if, you know, when things happen, it's just unfortunate, right? And when preventable things happen, it's really unfortunate. So, you know, getting called into a situation after the event has already occurred and starting to figure out, okay, what happened? How did it happen? Why did it happen? And then more importantly, how do we continue it very quickly? How do we move to, to restoration and getting the business back on its feet? And it's extraordinarily difficult when you start to work with folks that didn't realize the value of having a backup application or having restore procedures, or, oh, well, we got ransomware and there's really no way for us to get that data back. So, what do we do now? It's like you're out of options. I mean, it's, your options are, you know, start over or pay the ransom. It, it can be very, very damaging, especially when you're working with business owners who have spent the last five or 10 years of their life building this company, building it from an idea in their heads to a 10, 15, 20, 50 million dollar company. And now it's on its knees because of a security failure where a certain critical business system wasn't being backed up. And that data is now gone. And it's like losing that research paper that you typed up, you know, for three hours, only much, much worse. And it's that real.

Jon McLachlan

I know those experiences can be very painful, but I'm sure that they're glad to have someone like you to help them navigate all of that space if it does happen.

Michael Brooks

So yeah, I don't like those things, but again, that's, yeah, yeah, what if, and it will, and it will, right? That's, yeah, they're inevitable. That's where we come back to, you know, the approach. I think the approach has got to be right. It's got to be a proactive approach. You have to look at risk management as a discipline. You have to see security and technology as a business capability. You have to view the data as valuable, and you have to make sure that all those things are being put in place in a programmatic way so that you can manage it and monitor it going forward. To include the insurance piece, which is another interesting conversation on the cyber side, because cyber insurance now is getting tougher and tougher to get, you know.

Jon McLachlan

Isn't it? The rates are way up. The underwriting is reacting to what's going on out there in the cyber criminal space, right? So,

Michael Brooks

Yeah, you know, and there's a lot of loss there. And so, you know, I mean, you know, it's a plus or a minus in the world of the insurance companies, and they're starting to see minuses. And I can tell you, you know, I live in Florida. There's a couple of large home insurers that basically came out and did the analysis from the last year and said, you know what? That's too expensive for us. We're not insuring homes in Florida anymore. So there's like 50,000 homes that are now, I need to find a new insurance provider because of the risk. And again, it's a risk decision. So cyber insurance, I think, is going to be one of those areas going forward that is potentially going to drive security improvements just simply from the, you know, I'll call it from the back end. I mean, from the insurance side to say, hey, look, the minimal acceptable level of risk here is this, and these are the things that you need to be doing, being from a due diligence perspective, just to be eligible, right? So it's like you got to wear your seatbelt, you got to follow the speed limit, you got to do all these things right, right? And then if something happens, okay, now let's talk about it.

Jon McLachlan

Then the insurance starts to kick in, right? Just to help make it the economics viable, right? So everyone can enjoy a little bit of that sense of security that insurance does provide without ruining it, I guess, for everybody.

Michael Brooks

Yeah, and we do, you know, we do a fair amount of work there too. And I've done a lot more work here recently in the insured space, just doing evaluations of policies and making sure that folks understand what those minimum requirements are in terms of due diligence. It's like, hey, look, if you're going to submit a claim here, we've got to really make sure that you're doing these eight or nine things because it's critically important. They're going to want to know that.

Jon McLachlan

So do you think insurance companies are going to look for those certifications, the ISO 27001 or the, or I don't know, even like FedRAMP or FIPS certifications or Common Criteria or anything to help them get a rubber stamp that says, okay, this organization is operationally more mature and we could accept doing business with them?

Michael Brooks

Yeah, I think there's going to be some, there's going to be some industry standard scoring, right, that's going to get applied, FICO score-ish. I don't know if that's going to be it, but, and that's some of the work that we're doing as well. There's going to be a data model that's going to be produced. There's going to be actuarial tables. Maybe they already exist, but they're going to be produced in a very clear way to say, what is the cyber risk of this entity? And it's not just you, again, in this connected world. It's who are you dealing with? Who's the upstream, downstream folks that you're connected with and talking to? And this is where zero trust, I think, is going to really start to emerge as a very viable technology going forward. And, I think, hopefully we can get to a state pretty soon of self-healing IT, right? Where it's like, if there's a vulnerability, it patches itself, it heals itself. If the data is lost or damaged, it destroys itself. And it's like we can get moved towards, you know, where we're leveraging a lot of this promise of technology to keep ourselves more secure. But I think you're still going to need the humans in the loop there, right? To kind of guide and provide that decision-making oversight.

Jon McLachlan

Yeah, definitely. I think you're on to like at least two or three different startup companies like going around in there.

Michael Brooks

Yeah, I'm going to stay focused [right] now. That's the way I view it. I'm on [...]. And again, I think if you can do the modeling on the financial side, you can do the modeling and simulation on the health side. You know, again, this is just risk at the end of the day. So the factors are a little bit different, but how we go about it and delivering success to me is the same. And look at all the great advances we've had because of technology, right? I think it would be a tragedy of our age to say, well, we had this wonderful thing called technology and we just couldn't figure out how to use it and secure it. So, you know, we lost all of this promise. You know, I think to me, that's really the tragedy that potentially comes out of all this.

Jon McLachlan

That's definitely part of that tragedy or the risk that we face like moving forward into a future. If we don't know, like, how to utilize all of this great technology because of the risk that it poses from a security perspective, then we're going to lose out on so much. So much.

Michael Brooks

Right. Yeah.

Jon McLachlan

Bigger picture.

Michael Brooks

Absolutely. And you see this, I mean, you see this on the global stage, right? Where some countries are advancing their cyber capabilities, right? And they're really, they're kind of going all in on cyber. And what does that mean? And how can I reposition myself from a cyber perspective, right? Economically, globally, politically. And then, you know, same for businesses. That's all going to trickle down to businesses, right? So, you know, as we kind of already talked about, what does having good cybersecurity mean for me as a business? What does it mean for those folks that I do business with? You know, it's going to start to mean more and more as these attacks and business disruptions continue to exacerbate.

Jon McLachlan

So it sounds like you, you know, you don't think CISO will ever be replaced by just a fully automated system. Maybe that role will be enhanced with all of this upcoming technology?

Michael Brooks

I think we're going to continue to get more and more connected. I think there's going to continue to be more and more reliance on technology. I mean, I can tell you my own personal life, sometimes it's just so frustrating the reliance on technology that we do have. You know, I always find myself in the airport struggling to get the faucet, the water faucet turned on because I can't get the sensor underneath the thing to realize my hands. And it's like, can I just turn the faucet on? It seems like it'd be a lot easier that way, right?

Jon McLachlan

But I'm with you on that one. But they never work.

Michael Brooks

Yeah, they don't seem to ever work. But, you know, I also don't think we're headed to, you know, if you've ever seen The Office, you know, Dwight is a character in that show, and he thinks that robots and technology are going to turn on us. I don't think we're headed to that point.

Jon McLachlan

So no [Skynet].

Michael Brooks

I, I don't think so. But, but I, I think, I think we are going to, again, continue to see, it's up to us how we apply and use the technology, right? And so that's, that's what we need to control, how are we applying this technology? How are we using it? And security has got to be a part of that equation, right? Otherwise, we're going to always be lagging in that area. And as we know, it's extraordinarily difficult to go back and bolt it on after the fact.

Jon McLachlan

That is so true. Well, I'm very optimistic about that future. And it's, it's, you know, it's like the world is what we make of it. It's so true. And computers, they're just these tools. They do exactly what we tell them to do. There's engineers, there's programmers, they write code. It's these machines, they're at our service entirely, 100%. They can't do, they can't think for themselves. They're just doing what they're programmed to do. And I think you're right. That security has to be a part of that story as we move forward into this future. So, if there's any listeners out there that are considering going down this CISO path or aspiring to become CISOs themselves, would you have any advice to share with them?

Michael Brooks

Oh, yeah, I would tell them to go for it. You know, I mean, I think, again, working at technology is exciting. It is very exciting. You know, I would say my advice that I give to folks that I mentor and talk to all the time is, you know, don't lose sight of the main thing, right? In this world, as a security professional, the main thing is the data, right? That is truly what is of value that needs to be protected. We say things like confidentiality, integrity, and availability, right? And to us, that means things, but really it's all about the data, who has access to the data, is it there when it needs to be there, and is it accurate? You know, and I use the, I use the bank example a lot because I think it's relevant. It's like, you know, you get on your phone and you log into your bank and you look at your bank account and everything's good. And then you do that again tomorrow, maybe, and then you check it again in a couple of days. And you always assume that it's going to be there and you always assume that it's going to be correct. What if it's not there? You know, maybe for an hour, that would be, oh, okay, I'll check back. They must be doing some maintenance. Okay, well, what if it's a day now? What if we're going into three days? What if we're going into a week? You know, that's the work that starts to get scary. That's the work that security folks are doing. So, you know, I think if you're interested in that, you know, and you should absolutely go into it, but you should go into it realizing that, that's the job, is protecting the data and the availability of the data and making sure that it's there, you know, not creating policies to disrupt the business or hold people back from doing their jobs.

Jon McLachlan

Yeah. I love the focus on the data. I couldn't agree more. It is all about data. And even when you're rattling off those access control or authorization or authentication, that's all just to help control and secure the data. At the end of the day, that is what matters. Like these programs that we have and they're running on these machines, they're, they're nothing if you can't trust the data, you can't trust the input that they're taking and computing, then the outputs don't mean anything either. So, exactly. Yep. Well, thank you so much, Mike, for jumping on the show with us today. This has been a really interesting discussion. You have any final thoughts for our listeners?

Michael Brooks

No, I really enjoyed it, Jon. You know, I like coming on and doing these things. I love talking about this stuff. I have a lot of conversations with folks. I think it's fascinating. You know, I mean, we're living in a wonderful time. I mean, if you think about the time that we're living in now, and what's possible, and, you know, how much opportunity we have in our lives to do things that have never been done before or just live to a much fuller degree, I think technology is wonderful. We just have to use it correctly. We have to stay in control of it. We have to make sure it's secure. That's, those would be my parting thoughts. And I would also, you know, I'll steal a line from my football coach's mantra: don't get beat on blocking and tackling, right? Do the basics right. Make sure your foundational security practices are in place, right? Make sure you're starting from a good place. Make sure you can get the basics down and that you can advance from there. So, I really enjoyed it. Thanks again for having me, Jon.

Jon McLachlan

Mike, no, thanks for joining us. And thank you to all of our listeners who have tuned in for the show. Stay tuned for our next one.

FAQ

Questions this episode answers

Who is Michael Brooks?
On this August 2021 episode, Jon introduced Michael Brooks as a vCISO at Trava, after roles at the National Security Agency, the National Guard Bureau, the White House Communications Agency, the Air Force, USSOCOM, PwC, Amgen and Abacode.
What is a vCISO?
A virtual, or fractional, chief information security officer. Michael described a role for companies that need a security leader on demand, without a full-time executive.
What are the four ways to handle a risk?
Accept it, mitigate it, monitor it or transfer it. Management makes the call for each risk after a baseline risk assessment.
Why is ignoring a risk the same as accepting it?
A risk nobody looks at stays in place, so the business carries it without deciding to. Knowing a risk and accepting it on purpose is a business decision.
What question sits behind security work?
Michael asks what a business could still do if it lost its secure data and systems. Not much, so the data has to be secure, available, and open only to those who need it.
Why does a certification such as ISO 27001 matter?
Michael counts it among the best days with a client: a stamp that validates the company's security, brings more customers, and can move it from the mid-market into the enterprise.
Why does third party risk matter?
In a connected world, a dependency brings its risks with it. Supply chain attacks, SolarWinds among them, spread from one exploited vulnerability to everyone who depends on it.
How will cyber insurance change security?
Michael expects insurers to set the minimum security a company needs to be eligible, like a seatbelt and the speed limit for drivers, and industry standard scoring of cyber risk.
What happened after the episode?
Trava raised a $4.5 million second seed round in August 2022. Michael later became business information security officer at CVS Health and, in September 2025, CMMC strategy and engagement director at A-LIGN.
Keep reading on the YSecurity blog
Related episodes
If this episode hits close to home
vCISO A vCISO with a full security team behind them. SOC 2 Type 2 Audit-ready in five months, not fifteen. 24/7 Monitoring & Response Someone is watching your infrastructure. Make sure it's us.
New episodes every other Tuesday

Got a story like this one?

We're always looking for practitioners who've been in the room when it mattered.

Apply to be a guest
SpotifyApple PodcastsYouTubePodbeanPlayer FMRSS