Razorwire Cyber Security & InfoSec Insights

Awards you have to pay to win, events you have to pay to attend and conferences that expect speakers to work for free. When did recognition and expertise in cybersecurity become something you have to buy?
Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by security consultant and regular community speaker James Bore and Gary Hibberd, co-founder of Consultants Like Us and the Real Cyber Awards and Conference.
Pay to play takes many forms in cybersecurity, from awards that come with entry fees and expensive tickets to events charging vendors thousands for access to decision makers. At the same time, large commercial conferences can expect experienced speakers to give up days of preparation, travel at their own expense and appear on stage in return for little more than exposure.
Jim, James and Gary look at where legitimate commercial arrangements end and questionable practices begin. They discuss what gives an award credibility, when paying for access to an event can be worthwhile and why the way cybersecurity treats its speakers could ultimately affect the quality of the events themselves.
Three key talking points
When recognition comes with a price tag
Not every paid award works the same way. From outright offers to buy recognition to free entries followed by expensive ceremony tickets, we look at the different forms pay to play can take and why credibility depends on what happens behind the award.
Should cybersecurity speakers be paid?
Community events and large commercial conferences operate very differently. We discuss when speaking for free makes sense and why expectations should change when an event is making significant money from exhibitors and attendees.
Good speaking takes work
A short conference talk can take days of preparation. James and Gary get into the work behind becoming a strong speaker, why experience and preparation matter and what happens when events prioritise sponsored slots over good content.
If you're deciding which awards and events deserve your time, or building a reputation as a cybersecurity speaker, this conversation is for you.

On what makes an award mean something:
"It's lovely to win an award, but you win it based on merit. You don't win it because you paid for it."
James Rees
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

In this episode, we covered the following topics:
The Pay to Play Awards Industry
Find out how paid recognition can range from blatant offers to buy an award to less obvious costs that only appear once you've been shortlisted.
What Makes an Award Credible?
An impressive trophy does not necessarily mean much. We discuss judging, verification and why the process behind an award determines whether the recognition carries any weight.
Paying for Access to Decision Makers
Vendors can spend significant sums for a seat in the room with CISOs and other senior buyers. Discover why some of these events deliver useful conversations while others fall far short of what was promised.
The Real Cost of Speaking for Free
Speaking is rarely just the time spent on stage. We get into preparation, travel and accommodation and why the economics look very different for community events and commercial conferences.
Community Events vs Commercial Conferences
James regularly speaks at community events without charging. Explore why contributing to an event built around the community is different from providing free content to a profitable conference.
The Problem With 'Exposure'
Exposure can be valuable early in a speaking career, but it has limits. We discuss why established speakers are increasingly willing to turn down events that expect expertise for nothing.
Why Conference Content Suffers
When experienced speakers walk away and sponsored slots fill the gaps, audiences notice. Find out how decisions about speaker budgets can affect the quality and value of an event.
Learning to Become a Better Speaker
Public speaking is a skill rather than something that simply happens when someone walks onto a stage. James and Gary discuss preparation, practice and learning the craft.
Knowing When to Say No
Not every award, event or speaking opportunity deserves your time. We explore why knowing what you want from an opportunity matters before agreeing to take part.

Resources Mentioned
The Real Cyber Awards and Conference
Security BSides
Cyber OSPAs
Connect with your host James Rees
Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.
Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.
With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
LinkedIn: Razorthorn Security
YouTube: Razorthorn Security
TikTok: Razorwire Podcast
Instagram: Razorwire Podcast
Twitter: @RazorThornLTD
Website: www.razorthorn.com
All rights reserved. © Razorthorn Security LTD 2025

If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do?
Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode I'm joined by James Millington, Healthcare Field CTO for EMEA at IGEL, with more than 25 years' experience across virtual desktops, endpoint security and healthcare technology.
The way we use endpoints has changed repeatedly. Computing moved from centralised mainframes to PCs, back towards virtual desktops and then into SaaS and cloud services. Hybrid working accelerated that shift again, while rising hardware costs, Windows upgrades and increasingly distributed workforces are forcing organisations to reconsider what they actually need sitting on a user's device.
Jim and James look at why the endpoint may be due another rethink. They discuss the security and cost implications of maintaining traditional operating systems, how immutable endpoints change the approach to endpoint protection and what happens as AI creates another generation of applications and risks for security teams to control.
Three key talking points:
Do we still need Windows at the endpoint? As applications move into SaaS, VDI and the cloud, the role of the endpoint is changing. We look at whether organisations still need a full traditional operating system on every device and what alternatives become possible when workloads run somewhere else.
Moving from detection to prevention Endpoint security has traditionally relied heavily on detecting problems and responding to them. Discover how reducing what can run or change on an endpoint alters that model and removes attack surfaces before they need to be monitored.
The endpoint problem AI could make worse Shadow AI gives employees another way to introduce software and move information beyond organisational controls. We discuss how controlling what can execute locally could become increasingly important as AI workloads start moving from centralised services onto endpoints.

If you're reviewing your endpoint strategy, facing another expensive hardware refresh or considering how AI changes what employees should be allowed to run locally, this conversation is for you.

On rethinking the endpoint:
“Really, what are my users accessing and where are they accessing it? And is it time to rethink that endpoint?”
James Millington
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics:
The Cycle of Centralised Computing From mainframes and PCs to VDI, SaaS and cloud services, computing keeps moving between the endpoint and the data centre. Explore why that cycle matters to today's endpoint strategy.
Why VDI Never Really Went Away VDI has moved in and out of fashion for decades. Find out why healthcare remained a strong use case and how remote and hybrid working changed the conversation again.
Rethinking the Windows Endpoint If applications and data increasingly live elsewhere, does every employee still need a conventional Windows environment? We discuss what organisations should consider.
The Cost of Hardware Refreshes Rising hardware costs and Windows upgrade requirements are putting endpoint budgets under pressure. Discover why extending device life is becoming more attractive.
Security by Design Explore how an immutable operating system changes endpoint security by restricting what can be altered or installed rather than relying solely on detecting problems afterwards.
Protecting Data in Distributed Healthcare Healthcare is moving closer to patients, creating more distributed endpoints. We discuss why keeping sensitive information off those devices can reduce the consequences of loss or theft.
Moving Beyond BYOD Some organisations are reconsidering bring your own device programmes. Find out why greater control and standardisation are coming back into the conversation.
Controlling Shadow AI As employees experiment with AI applications, organisations need to decide what can run locally. We explore how endpoint controls can limit unauthorised workloads.
AI Comes Back to the Endpoint AI started heavily centralised but cost and performance are driving some workloads towards local devices. Discover what this latest shift could mean for endpoint security.

Resources Mentioned
IGEL
Citrix
VMware
Microsoft Windows 365
Microsoft Azure Virtual Desktop
Zscaler
Gartner: Use Immutable Endpoints to Defeat Ransomware, Stop Configuration Drift, and Guarantee Rapid Recovery
PCI DSS
HIPAA and Cloud Computing Guidance
Ollama
Connect with your host James Rees
Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.
Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.
With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
LinkedIn: Razorthorn Security
YouTube: Razorthorn Security
TikTok: Razorwire Podcast
Instagram: Razorwire Podcast
Twitter: @RazorThornLTD
Website: www.razorthorn.com
All rights reserved. © Razorthorn Security LTD 2025

Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat?
Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions.
Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value.
We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again.
Three key talking points:
When a conference stops being worth it
A ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors.
Why smaller events feel different
Community and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate.
People don't go to events to be sold to
Expensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.

If you're choosing which cybersecurity events deserve a place in your calendar, or organising one and wondering what will actually make people turn up, this conversation is for you.

On why smaller events work:
" You actually make it small and targeted and tailored. And that's how you engage."
James Bore
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics:
How Cybersecurity Events Have Changed
Explore how major industry events have moved from places to discover technology and meet the community towards a much more commercial model.
Is InfoSec Europe Still Worth Attending?
A new £50 ticket charge sparks a wider discussion about what attendees actually get from one of cybersecurity's biggest events.
The Rise of Community Events
Discover why BSides and other smaller events are becoming the preferred choice for security professionals looking for different conversations and ideas.
Too Many Cybersecurity Events
The calendar is packed with conferences, dinners and roundtables. We discuss why more choice is making people increasingly selective about where they spend their time.
Escaping the Vendor Pitch
Learn why exhibition floors dominated by sales conversations can struggle to engage the CISOs and security professionals vendors most want to meet.
Why Relationships Matter
People still buy from people. We explore why informal conversations and genuine relationships can offer more value than another product demonstration.
What Makes a Good Conference Speaker
Interesting events need people with something meaningful to contribute. Find out why practitioners, specialists and different perspectives matter.
Having a Reason to Attend
Going to an event simply because it is there is not enough. We discuss why attendees need a clear idea of what they want from their day.
Can Big Conferences Be Fixed?
Bigger does not necessarily mean better. Explore whether smaller, targeted events built around particular audiences could offer a better model for cybersecurity.

Resources Mentioned
James Bore on LinkedIn
Infosecurity Europe
Black Hat
Security BSides
Hack Glasgow
SteelCon
The Real Cyber Awards and Conference
Connect with your host James Rees
Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.
Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.
With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
LinkedIn: Razorthorn Security
YouTube: Razorthorn Security
TikTok: Razorwire Podcast
Instagram: Razorwire Podcast
Twitter: @RazorThornLTD
Website: www.razorthorn.com
All rights reserved. © Razorthorn Security LTD 2025

What does it actually look like to break into InfoSec from the outside, with no technical background, no industry contacts and no idea what half the acronyms mean?
Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this interview episode, I'm joined by Irina Sordiya, a GRC and compliance professional based in Montreal who came into information security from a finance background.
Not everyone who works in information security started out in IT. Irina's route in began at a career fair where she stumbled into a fintech startup looking for someone who could translate financial regulation into language a dev team could understand. From there she moved into auditing at KPMG and eventually crossed to the other side, leading security posture and compliance in-house.
This is a conversation for anyone considering a career in InfoSec or in the early stages of one. Irina talks openly about feeling like an outsider, not understanding the acronyms and slowly realising that GRC isn't about technical knowledge, it's about understanding risk, building trust and communicating with people. She and Jim also get into the growing problem of grifters in GRC, where Canadian regulation is heading and why the InfoSec community is one of the most welcoming places to build a career.
Three key talking points:
You don't need a technical background
Irina came from a finance degree with no IT experience and a job interview where she was asked if she knew what an auditor does. She got the job. This episode is proof that soft skills, empathy and a risk mindset can take you further than most people expect.
G is for grifter in GRC
As regulatory pressure has increased, so has the number of people selling shortcuts. Overpriced courses, AI-generated templates, agents claiming to replace the CISO. Irina and Jim discuss why this preys on people trying to break in and why there's no substitute for doing the work.
The risk mindset as a North Star
The best advice Irina received early on was to develop a risk mindset. It's what helps you step back from hundred-page policies and ask what you're actually trying to protect, and why it matters more than technical knowledge for anyone in GRC.

If you're thinking about getting into InfoSec or wondering whether you belong, this conversation is for you.
On what she'd tell herself on day one:
"I would have told myself not to be scared going into this and that there will be always helpers along the way who care about what they do and put ego on the side."
Irina Sordiya
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics:
From Finance to InfoSec
Irina's journey started at a career fair with no IT knowledge. Find out how a finance background opened the door to a career in information security.
Auditor to In-House
As an auditor, an exception means "see you next year." In-house, it means "see you next week." We discuss what changes when you cross to the other side.
Building Trust as a GRC Professional
Discover why empathy and relationship building matter more than policy enforcement.
AI Governance Is Still Anyone's Guess
No country has got AI governance right yet. We discuss why most organisations are working it out as they go, why ISO 42001 is becoming a starting point and what that means for anyone working in GRC.
AI as a Tool for InfoSec Professionals
We discuss where AI can genuinely help with the grunt work of GRC without replacing the thinking that makes the role valuable.
G Is for Grifter in GRC
With overpriced courses, AI-generated templates and agents claiming to replace the CISO, we get into why the noise is making it harder for genuine newcomers.
The Risk Mindset
The best advice Irina received: develop a risk mindset. We discuss why it matters more than technical knowledge.
Why the InfoSec Community Is Worth Joining
Irina's experience has been overwhelmingly positive. We talk about why InfoSec professionals tend to share and support rather than gatekeep.
The Future of Entry-Level Roles
If AI takes over the grunt work that junior professionals learn from, how does the next generation develop?

Resources Mentioned
Irina Sordiya on LinkedIn
KPMG
ISO 27001
ISO 42001 (AI governance)
SOC 1 / SOC 2
EU AI Act
CISM certification
PCI DSS
Connect with your host James Rees
Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.
Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.
With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
LinkedIn: Razorthorn Security
YouTube: Razorthorn Security
TikTok: Razorwire Podcast
Instagram: Razorwire Podcast
Twitter: @RazorThornLTD
Website: www.razorthorn.com
All rights reserved. © Razorthorn Security LTD 2025

Social engineering has been around since humans started talking to each other. The psychology hasn't changed, but AI has made the execution almost unrecognisable.
Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Bec McKeown, a chartered psychologist specialising in human performance under pressure.
Social engineering isn't a technology problem, it's a human one that cybersecurity has inherited. The psychology behind it hasn't changed since Cleopatra was using it to outmanoeuvre empires, but AI has transformed the speed, scale and sophistication of every stage, from automated reconnaissance that builds a complete profile in 30 minutes to real-time voice cloning that references your actual projects and travel schedule.
Bec and Richard bring two very different perspectives to the same problem. Bec explains how attackers engineer the conditions in which people make decisions rather than just crafting a convincing message, and why "people are the weakest link" misses the point. Richard shares what he's seeing as a practising CISO, from family members being targeted through gaming platforms to why measuring phishing click rates gives organisations a dangerous false sense of security.
Three key talking points:
They're not hacking people, they're shaping decisions: Social engineering works because attackers engineer the conditions under which decisions get made, not because people are careless. Bec explains why most security awareness training is solving the wrong problem by focusing on the message rather than the environment in which people are operating.
AI has turned social engineering into an automated pipeline: What used to take weeks of manual reconnaissance now takes 30 minutes. AI-powered OSINT can build a complete profile of a target and generate a tailored attack that references their projects, travel and communication style. Combined with real-time voice cloning, these layered attacks are becoming almost impossible to distinguish from a legitimate request.
Your family is now part of the attack surface: If the executive is too well protected, attackers go to the people around them. Children on gaming platforms are being cultivated to unknowingly share information about their parents' work and routines, and a compromised family device on a shared home network becomes a route into the corporate environment.

The psychology behind social engineering hasn't changed in thousands of years, but the tools to exploit it have. If your defences are still built around phishing simulations and click rate metrics, this episode will make you rethink.

On why social engineering isn't about fooling people:
"They're not hacking people, they're shaping the conditions in which people make decisions."
Bec McKeown
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics:
The History of Social Engineering From Cleopatra to Cold War intelligence operations, social engineering has worked for as long as humans have communicated. We discuss why the psychology behind it hasn't moved an inch.
Influence vs Manipulation Bec explains the difference between making someone do something they don't want to do and making them want to do it, and why that distinction matters for how we build defences.
AI-Powered Reconnaissance Find out how AI has turned open source intelligence into a fully automated pipeline that can build tailored attack scenarios from public data in under 30 minutes.
Deepfake Voice and Video Attacks We get into why real-time voice cloning combined with genuine project data and manufactured urgency makes modern social engineering attacks almost impossible to spot.
Layered Context Attacks Discover why the most dangerous attacks don't rely on a single trick but layer urgency, authority, familiarity and isolation together until there's no reason to doubt what you're seeing.
Family as an Attack Surface Children on gaming platforms are being cultivated to share information about their parents' work and routines. We discuss why the family network is now a recognised route into executive environments.
Gut Feeling and When to Trust It Bec and Richard explain why intuition is often the first signal that something is wrong and why corporate culture has trained people to ignore it.
Confirmation Bias in Action A group of colleagues all received the same phishing email, checked with each other and decided it must be legitimate because they'd all got it. We discuss why that instinct is exactly what attackers rely on.
Why Security Awareness Training Measures the Wrong Thing Phishing click rates going down doesn't mean your organisation is safer. We discuss why this metric wouldn't have prevented any of the major social engineering incidents of the last few years.

Resources Mentioned
Bec McKeown
Mind Science Ltd
Richard Cassidy
The Psychology of the Machines
Rubrik
Cialdini's Six Principles of Influence
Gary Klein / Recognition-Primed Decision Making
Trend Micro AI-powered OSINT research
Deepfake fraud - regulatory warning
Connect with your host James Rees
Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.
Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.
With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.
For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com.
If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.
LinkedIn: Razorthorn Security
YouTube: Razorthorn Security
TikTok: Razorwire Podcast
Instagram: Razorwire Podcast
Twitter: @RazorThornLTD
Website: www.razorthorn.com
All rights reserved. © Razorthorn Security LTD 2025