Security Confidential S7 E10 Ranbir Bhutani

Manoj Tandon:
Hello everyone, this is Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have Ranbir Bhutani join us. Ranbir is an expert in all things cybersecurity. He’s a vCISO; he’s been in the business for a long time. He’s the CEO of Cyber Culture LLC. He’s also a partner at Ingram Advisory Group. He’s got an education from the University of Maryland Global Campus, a Master’s in Cybersecurity. He’s the real thing. Welcome to the show, Ranbir. Thank you for being here.

Ranbir Bhutani:
Thank you, Manoj, for the introduction. I really appreciate it.

Manoj Tandon:
Hey, so there are a couple of things we want to start with. Tell us about Ingram Partners and Cyber Culture. What are these two organizations? What’s the mission here?

Ranbir Bhutani:
Yeah, definitely. Ingram Advisory Group—I just joined their partnership recently. Pretty much their focus is more advanced level from a cybersecurity and strategic standpoint, helping organizations of any size, working with their C-level or Board of Directors and trying to solve a problem as far as securing their data. It’s not technically virtual CISO, but more advisory than anything else. Definitely a great company. Working with the CEO and just the synergies—we’re really doing big things. I can’t say too much about it, but you definitely may see some posts on LinkedIn in the near future.

So that’s Ingram Advisory Group. Cyber Culture, on the other hand—to your question—I launched the business in August of 2020 because I finally realized that there is a need on the consulting side for companies, private, public, and even federal sectors, for somebody to come in as an expert regardless of background in cybersecurity or technology, or even human resources as an example. The point was there was a need for somebody to come in and help solve a problem and see the bigger picture. Truth be told, going into any organization, some of them have some form of cybersecurity program in place, or none at all if they’re smaller to medium-sized. Even larger organizations sometimes may need some guidance for somebody to come in and understand their business and secure their data from a very strategic level. Naturally, proving that cybersecurity is a sound return on investment—in the case if they were expanding or experienced ransomware. It’s a five million dollar ransomware, which happened a few years ago as you’re aware. And naturally, yes, they had a whole security team, but sometimes you need a third party coming in to give guidance and advice to help solve a problem and secure your data.

Manoj Tandon:
So, let me ask you at a personal level, why not take a cushy job in the corporate world as a CISO rather than deal with all the vagaries of the vCISO world?

Ranbir Bhutani:
Well, that’s a great question. Why not, right? Naturally, if you think about it, CISOs are already between a rock and a hard place. Let’s say their maximum time spent in any organization is two years, maybe three years pushing it.

I’ve done everything that I possibly could in helping the organization—from developing a program, compliance, to developing an operations center using a third party—but naturally there’s a lifespan because at the end of the day you can only do so much for the company. CISOs are still between a rock and a hard place. I don’t want to hear it when people tell me, “No, they’re on the board,” or “No, they report to the CTO, CIO, or CEO.” Those roles have specific specializations in what they do. A Chief Operating Officer’s focus is operations. They’re not going to know cyber. A Chief Technical Officer may know technologies and cybersecurity technologies, but they’re not going to understand it fully. Cybersecurity ultimately has become its own entity and always has been; it unfortunately has always been wrapped under IT. So naturally, the CISO is the middleman. It’s like those memes on LinkedIn where you see the boardroom table and then you see the little kids’ table. The CISO is sitting right there. So it’s just like, “Okay, well why am I still here? Why am I not a Cybersecurity Executive Officer?”

Manoj Tandon:
But why has it developed that way? What is your opinion on it?

Ranbir Bhutani:
It’s interesting. Going back my 20-plus years, back in time where antivirus was good enough—like, “Hey, you’re good.” Even today, we’re going to do a little myth-busters thing here in a second. Jokes aside, CISOs are finally starting to get that respect. But hence the route of going the virtual CISO route. It circles back to your question where you can come in and really understand the organization and solve a problem, even for a limited time.

Let’s say they spend 10 to 15 hours a month with the company. Within a year, I think they can get them up to speed. From a virtual CISO standpoint, naturally it makes sense to come in and guide them because as an outsider coming in and not being part of corporate America, corporate America gives you very real limitations as a CISO. Let’s say you go back to the board and you’re like, “Okay, well we have all these vulnerabilities we need to address,” but the C-level executives don’t understand that language. It’s very technical for them. A lot of CISOs are very technical, but the technical jargon stays with the technical team. The way I see it, especially coming in as a virtual CISO, I keep it very strategic, very high-level, showing them the dollars and cents with a few data points. Because now it tells them a story saying, “Okay, well how much money would it have cost us if we were to be breached?”

Manoj Tandon:
Do you have a methodology that you use for that, Ranbir?

Ranbir Bhutani:
Oh yeah, it’s very easy actually. It’s actually a CISSP question: Single Loss Expectancy. You take the value of your asset—your digital assets, physical assets—times it by, let’s say, 25 percent as a loss, and then you can actually calculate risk in terms of numbers. Naturally, you don’t need all the finances of an organization, but at least understanding the cost value of all their assets, their digital assets, and what they pay for mostly IT-related services. Naturally, as a very high-level deliverable on a bar graph, for example, it shows them the bigger picture. That’s very strategic. To them, that makes sense rather than throwing them a vulnerability report. They’re not going to understand the different findings. The CEO is going to be like, “I don’t know what this is. Does this make us money? No.” And that’s that.

Manoj Tandon:
So let’s do a little myth-busting here. First myth: “I buy the latest and greatest product stack and I have 100 percent cybersecurity.” Your thoughts?

Ranbir Bhutani:
Not true. You can never have 100 percent cybersecurity. It is an ongoing cycle down to security training and awareness for your staff and employees so they don’t go click-happy downloading phishing or ransomware. If they see something suspicious, they can actually report it because they’re getting that training.

As far as training goes, I’d push monthly trainings because a lot of employees just read past the trainings or go through them quickly. They’ll review them and say, “Okay, well I didn’t do anything wrong.” Well, you introduced malware and now you’re costing us two million dollars. I’m not saying that employee will get terminated, but it goes to show that educating your employees is very, very important and crucial to understanding cybersecurity as a whole. Another recommendation is an ambassador program. Have each department have a designated ambassador to train their employees from time to time or even do games with them or incentives.

Manoj Tandon:
No, that’s great. In fact, it gets to the point—is Cyber Culture LLC the name of your firm?

Ranbir Bhutani:
Yeah.

Manoj Tandon:
Are you trying to establish a culture of cybersecurity in the organization?

Ranbir Bhutani:
Yes. It’s interesting you’re bringing that up, hence the name of the business. The day I thought of it, I was like, “Well, what am I trying to do here? I want to change the culture of cybersecurity forever.” I know I’m doing it with some of the clients that I’m working with so they understand that now cybersecurity is even bigger than anything else out there. I mean, there are over 700,000 cyber jobs out there in the U.S. Deloitte posted an article not long ago. Those numbers are probably even bigger than that. Everyone is getting the idea that our field is growing. Here’s the catch, though—I don’t think a lot of organizations are getting it. Naturally, what’s to say if you bring in a virtual CISO plus collaboration with somebody from the product line selling cybersecurity products? It becomes a two-for-one because not only do you have an expert with you, but they’re not going off-script.

Trying to sell a client a product is one thing, but it goes down to starting at the top, understanding the organization, becoming very strategic, and solving a problem by introducing technologies they’re lacking or needing. That’s a no-brainer to bring in guys like us—or gals like us.

Manoj Tandon:
Yeah, and you know what? You just mentioned the everyday employee in the company. They are the largest cybersecurity asset, right? You had some good ideas there—you know, do monthly training, get an ambassador in place. What about companies that have adopted penalizing measures as part of their policies? Should employees be penalized, or are we better off with a different approach to this?

Ranbir Bhutani:
That’s a very interesting question because that word just sounds like, “Okay, well now you’re in trouble.”

Manoj Tandon:
Yeah, and there was one company that we won’t mention where, if you failed your phishing attempts three times, you got fired.

Ranbir Bhutani:
I don’t agree with terminating employees because they failed an exam. Not everybody’s great at exams because people get really nervous or anxious taking exams or tests. Everyone’s experience is different.

A lot of leaders fail to understand that when you put that pressure over your employees, it creates a negative impact on the business. You may actually start losing employees. And because the cyber field has such high demand right now, talented people have options. My goal is changing the culture of cybersecurity in the sense that it becomes its own entity. Until organizations start listening, we’re going to continue going down the same reactionary path of, “Oh, we’ve been hacked. Now let’s get a vCISO to fix our problem.”It doesn’t work that way.

Manoj Tandon:
How do you get employees engaged then? How do you get them to understand the “why” behind what you’re doing?

Ranbir Bhutani:
Educate them. Share the knowledge. Have them understand it. Whether they’re interested or not doesn’t matter—they’re hearing some of that information. Offer incentives. Make a game out of it. Make it fun. Why are we all working? We’re doing it because we’re passionate about it—or people are chasing money, whatever motivates them. But we’re here to share knowledge, and it doesn’t cost anything to share knowledge. Rather than saying, “Okay, well instead of giving knowledge, I’ll give you a five-thousand-dollar bonus.” That only motivates someone temporarily.

Manoj Tandon:
Exactly. Well, let’s do another quick myth here. There are a whole bunch of people who think, “Well, I achieved compliance, so that’s good enough. I’m done with cyber.” What are your thoughts?

Ranbir Bhutani:
Some companies think that cyber insurance protects them from being hacked. I’m not kidding you. It goes back to saying cybersecurity never stops. It’s ongoing. You can have the best technologies, the best people, the best program. Now what? Attackers are still evolving. They’re businesses too.

Technology is one thing—it breaks. But the bigger challenge is getting employees to understand that cybersecurity is ongoing. Cybersecurity can actually be really fun when you involve the end users and show them how attacks happen.

Manoj Tandon:
There’s definitely an entertainment value to that.

Ranbir Bhutani:
Absolutely. People don’t realize how innocent everyday tasks can get them compromised. Whether you’re in HR, accounting, operations, or maintenance—if you gamify cybersecurity and offer incentives, people become engaged. Even something simple like a restaurant gift card. The point is everyone is interacting instead of sitting in silos. An ambassador program is amazing because now you have representatives from each department communicating and collaborating.

Manoj Tandon:
So, as a vCISO, why do you think companies are so reactionary to cybersecurity?

Ranbir Bhutani:
Because suddenly they owe millions of dollars due to ransomware. Nine times out of ten, I’ll say don’t pay the ransom. They already have your data. It’s probably already being sold on the dark web. The real question is: what can we do to prevent this from happening in the future? Cybersecurity is about protecting the value of your business and your data.

Manoj Tandon:
Do you have thoughts on how we take cybersecurity from a cost center to a revenue center?

Ranbir Bhutani:
That’s a great question because everyone assumes cybersecurity is just a cost. They think, “We have to spend millions on technology and people just to protect our data.” But nobody thinks about the future impact of a breach.

If a company gets hacked, there’s the direct cost of the ransomware or incident, but also loss of customers, media exposure, shareholder concerns, and reputational damage.

Manoj Tandon:
It’s a percentage of business, right?

Ranbir Bhutani:
Exactly. Look at Target. They publicly discussed losses tied to their breach. People forget that breach happened through an HVAC contractor. That gets into the Internet of Things and network segmentation. A lot of organizations put everything on one network. So now your databases with personally identifiable information are communicating with web servers. That creates major problems.

Manoj Tandon:
When companies hear about frameworks like Zero Trust, NIST CSF, or CIS Controls, they often think these are huge, expensive initiatives. Can small businesses really implement Zero Trust?

Ranbir Bhutani:
Absolutely. To me, Zero Trust is fundamentally a concept centered around least-privileged access. Users should only have access to the tools and systems necessary for their jobs. If you apply that concept consistently throughout your environment, you create a very strong foundation.

Manoj Tandon:
A lot of organizations have messy Active Directory environments though.

Ranbir Bhutani:
Exactly. I’ve seen organizations where maintenance employees somehow have access to networking resources. That makes absolutely no sense. Who’s auditing? Who’s tracking access? Zero Trust is really an auditing and governance process. It’s about ensuring employees only have access to what they truly need.

Manoj Tandon:
How big do you think the insider threat is?

Ranbir Bhutani:
The corporate world is still stuck in very outdated structures and management models. A lot of organizations don’t fully understand how internal access and permissions create risk. And during acquisitions, that risk multiplies.

Manoj Tandon:
What guidance do you give organizations going through mergers and acquisitions?

Ranbir Bhutani:
As a virtual CISO, I conduct security risk reviews before acquisitions. I review things like: Encryption, SaaS environments, MFA implementation, Endpoint protection, and Legacy systems. I present everything in a very high-level format using color coding—green, yellow, red—so leadership can immediately understand the risk profile of the company they’re acquiring. If an organization is still running outdated systems like Windows XP, that’s a major red flag. The idea is helping leadership understand the hidden cybersecurity costs associated with acquisitions.

Manoj Tandon:
So let’s get into the green zone and cloud infrastructure. That’s another favorite part, and it’s again under the Zero Trust umbrella. There’s this notion that if they’re on Amazon or Microsoft Azure, as the case may be, that they’re inherently secure.

Ranbir Bhutani:
[Laughter] No cloud infrastructure, regardless of the name, is secure unless the organization secures it themselves. They don’t sell it to you pre-packaged. Let’s say you hire support services, for example. Naturally, it’s the onus on you to lock down those environments, from wherever your databases sit to wherever your web servers sit. Not getting too technical and keeping it light, you’ve got to validate that. You’ve got to make sure that you have segregation within your networks.

Manoj Tandon:
You’re telling me Amazon won’t do all that for me? When I get an S3 bucket up there, it’s not totally secure?

Ranbir Bhutani:
Nope. It is as bare as bare can be with your operating system supporting the applications that you’re running based on the business.

Manoj Tandon:
So let’s step back. When you go into a company and you’re brought in to help them with cyber and provide them guidance, what are your ABCs? What are your process steps that you walk them through on how the program should be properly built?

Ranbir Bhutani:
That is a great question. First things first, I really want to understand their business as if I’m the owner, or as if I’m stepping into the owner’s shoes, as far as what their focus is and what they do. Naturally, that gives me a sense of, “Okay, this is what they do. This is why they’re in business, whether it’s products or services.” Then it’s understanding their data.

Manoj Tandon:
Now, I’ve got to stop you just for a second there because I think this is a place where a lot of cybersecurity professionals have trouble. A lot of them believe that their job is technical. “Why do I care how you sell your widgets and how that works?” I think you’re on the right track and I agree with you. I just want our audience to hear it from someone else.

Ranbir Bhutani:
Regardless of our cyber world or our technical world—because Manoj, you and I can go as technical as can be in this conversation—that’s not the focus. It’s not going to help anyone because what if you’re talking to someone who has no idea of the technical jargon? Or to them, they don’t even care about it. That’s a lot of C-level executives and Boards of Directors for you. They’re in the roles that they are because they’re good at what they do. The point is that, as cyber professionals, we need to start thinking strategically. We need to ask ourselves, “How do we come in and solve a problem?” If you want to be a virtual CISO or start your own business, then you’ve got to be very strategic because now you’re talking to these high-level folks. If you say “vulnerability” or “CVE,” you’ll never hear from them again.

Manoj Tandon:
That’s so true. So you’re starting there. You understand the business first and foremost. Now what? What are we doing as step two?

Ranbir Bhutani:
Step two is understanding what type of data they’re housing, if they’re using an MSP, if they’re using third-party services, and then really trickling down and understanding where their data points are—not technical, but just an overall general understanding. The other part of it is understanding the cost of their assets. I don’t need all of their financials. I just need to know what they own—employee laptops, desktops, devices, peripherals, and so on. This gives me an idea of the value of the organization’s assets, even with depreciation. Then I can take that information and calculate the financial impact if they were attacked.

Now I can tell a story. I can say, “In the case that you get attacked, this is what it’s going to cost you.” And then I take it a step further: “What if you lose customers? What’s the cost per customer?” If it’s a financial institution, every member or account holder has a value attached to them. That changes the whole ballgame. Then I typically provide a few reports. One is a threat report that shows where some of their weaknesses are based on departments, not technical infrastructure. That makes sense to executives. They’re going to ask, “Why is our HR department rated a nine out of ten risk?” Then I explain the potential business impact if a breach were to happen there. The other report is essentially a report card. Just like school grades—A through F. Departments get grades. Executives immediately understand that concept. They’ll say, “Why is operations getting an F?” Suddenly cybersecurity becomes tangible and relatable.

Manoj Tandon:
That’s good. That makes it tangible for them. Let me ask you about a friction point here. Since you used the word MSP, do the MSPs’ feathers ever get ruffled over this whole thing? Do they say, “Well, I can do this for less. Just buy McAfee or CrowdStrike and you’re good”?

Ranbir Bhutani:
MSPs sell, sell, sell. But when you ask them about their actual cybersecurity program internally, sometimes you get crickets. A lot more MSPs than people realize don’t have mature cybersecurity programs themselves. Honestly, it can be beautiful for a virtual CISO to partner with an MSP because now you can help them fix both internal and external problems. They can better understand the client and better understand which technologies actually help the business instead of just pushing products.

Everybody’s trying to get into cybersecurity these days, and that’s fine. But there’s a difference between selling tools and strategically solving problems.

Manoj Tandon:
That’s good. There’s a way forward and you have that figured out. Now, getting back to your process, how do you build the budget? Often we see sticker shock. People are like, “You’re asking me to spend what?” They think they can spend ten bucks per user per month and they’re done.

Ranbir Bhutani:
That’s a great question. From a strategic standpoint, yes, cybersecurity costs money. But the beauty of what we do is we prove return on security investment. Let’s say a breach would cost a company one million dollars, but all the preventative technologies and services combined cost three hundred thousand dollars, including my services. Well, I just saved you seven hundred thousand dollars right there. That’s not even accounting for customer loss, media exposure, or reputational damage.

Manoj Tandon:
But if I play devil’s advocate, I’d say, “Ranbir, my insurance company is the one paying the million dollars, not me. So why do I care?”

Ranbir Bhutani:
That tells me that leadership doesn’t care about the security of their data. At that point, there’s not much you can do until they experience a breach. Then they’ll call you and say, “We got breached. Can you come in and unbreach us?” But you can’t undo a breach. You can only help implement preventative measures moving forward. And now they’re going to spend far more money than they would have originally. They’ll pay forensic firms thousands of dollars an hour, their cyber insurance premiums will skyrocket, and they may even lose coverage altogether. What’s interesting now is cyber insurance companies are starting to validate controls. One of my clients was told that if they didn’t implement MFA across all laptops by a certain date, their insurance wouldn’t be renewed. Before, it was just checkboxes. Now insurers actually want proof.

Companies still think cyber insurance protects them from getting hacked, and that honestly boggles my mind.

Manoj Tandon:
Well, there’s a lot there, which gets into the topic of mitigation versus outsourcing of risk. Where is the point of diminishing returns? How does a company come to terms and say, “Look, we’re never going to be 100 percent secure; there will always be some risk”? At what point do you say, “Some risk we just have to accept and we’re going to try to address it as best we can?”

Ranbir Bhutani:
Yeah, that’s a great question. I’m going to bring up Ingram Advisory Group here. There is a strategic methodology that shows organizations where they are based on their risk level. It’s all based on their networks and infrastructure and gives them an idea of their current maturity level.

One of the other consultants I work with, who’s a very experienced veteran, said the lowest he’s ever seen was probably around 50 or 60 percent as far as security maturity within an infrastructure environment.

A lot of small businesses are exposed to third-party risk in a very big way because they’re part of supply chains. They might be upstream or downstream vendors. They might even be something as simple as the HVAC contractor.

Manoj Tandon:
Do they understand that? Are you seeing boards, CEOs, and CFOs understand what their relationship to third-party risk actually is?

Ranbir Bhutani:
Yes and no. Either way, we come in and explain it at a very strategic, layman’s level. With third-party vendors, how do you know if their data is secure? How do you know what they’re doing to protect your information?

That’s where the conversation becomes very important because organizations often assume their vendors are secure without validation.

Manoj Tandon:
I think a lot of times we hear, “We’re a small company; we’re not a target. We just make widgets. Who cares about us?”

Ranbir Bhutani:
That’s a dangerous assumption. Years ago, I read about a company that owned around 200 laundromats. Their website was outdated and they didn’t care about cybersecurity because they thought their focus was simply quarters and revenue.

Well, their website got hacked because the database was sitting directly on the web server. The competing laundromat apparently worked with some hacker to compromise them.

The moral of the story is: never assume you’re not a target.

Attackers are busier than ever. They’re constantly scanning subnets and IP ranges using automated tools. A lot of organizations have already been hacked and simply don’t know it yet. Even large organizations. Even cybersecurity companies themselves have been compromised.

Manoj Tandon:
I agree with you. Yesterday we had Karim Hijazi on the program and he talked about that in detail—that many companies have already been hacked and attackers are just sitting dormant in those environments.

Ranbir Bhutani:
Exactly. It could be anyone—from a bored teenager to highly sophisticated threat actors. The point is they’re making enormous amounts of money doing this. That’s why they’re in that line of work.

Manoj Tandon:
Last question here: how do you see the cybersecurity landscape evolving as far as the threat space goes?

Ranbir Bhutani:
That’s a great question. I see cybersecurity finally becoming its own standalone department in organizations.You’ll have dedicated functions for security operations, insider threat, threat intelligence, incident response, vulnerability management, governance, risk, and compliance. That’s no longer just “IT.” Those are entirely different disciplines within cybersecurity.

The landscape is becoming much more advanced. We’re moving into areas like quantum computing, artificial intelligence, robotics, and increasingly intelligent systems. As scary as that sounds, that’s where we’re headed. Then you have Internet of Things devices, healthcare systems, connected infrastructure, and all these environments that organizations still aren’t properly securing. Hospitals, for example, have enormous risk. Imagine the consequences if a critical medical device failed because it was compromised. The potential liability and human impact are massive.

Then you look at the Metaverse and immersive technologies being used for education and business. The question becomes: who is securing those environments? Who is preventing those systems from being compromised during live sessions? It all goes back to the fact that organizations need outside perspectives. Processes become outdated over time. Structures become repetitive and inefficient. Just because someone has a title in an organization doesn’t mean the process itself is effective. At the end of the day, data is priceless. There is no real price tag on it. When your data gets stolen or sold to competitors, you have much bigger problems than just the initial breach.

Manoj Tandon:
I think you have a great mindset, and I’m sure you’re going to be immensely successful in the space.

Ranbir Bhutani:
Thank you. I definitely look forward to having more conversations with you, Manoj. It’s really been great. I’m glad you understand and that you get it. We’re really just trying to spread the word. We’re on an educational mission here, while also creating opportunities for people economically. Cybersecurity isn’t a solo thing anymore. Leaders have to collaborate. I get it—people have titles, egos, positions—but that mindset needs to go away. Everybody has to work together.

We’re all here to create, co-create, collaborate, and build something bigger together. Everybody wins. It’s not even about the money or the revenue. It’s about spreading a story because stories have endless value. They evolve and improve over time. But naturally, if we don’t stick together as cybersecurity professionals, then future leaders are just going to end up back at square one.

Manoj Tandon:
That’s a very spiritual outlook, but it’s a great way to end this conversation. People always remember the first part and the last part, so I hope they remember that because it’s a very nice outlook. Thank you for that, Ranbir.

Ranbir Bhutani:
Absolutely, Manoj. Maybe less than a year from now we’ll be on stages presenting to thousands of people.

Manoj Tandon:
I’d love that. And don’t be a stranger here. If you have new things you’d like everybody to know about, feel free to reach out to us. Even if we do a ten-minute short, we’d love to have you back.

Ranbir Bhutani:
Absolutely. Same here. Thank you so much for your time. I appreciate it. And definitely don’t be a stranger. I’m pretty sure we could do some big things together.

Manoj Tandon:
Love it. Sounds great. Take care.