Jul 20, 2026 · 1 hr 1 min · 12 segments
Jesper Borg-Alsson, Chief Security Officer for Northern Europe at Palo Alto Networks, explains why your current security strategy is built for threats that no longer exist. With 20+ years managing…
So you work with chief information security officers or the security leaders of these companies every day, right? Yes.
And when you look at how most organizations have built their security strategy, what's the specific thing that tells you that this was designed for a threat landscape that no longer exists? So tell us, give us the dibs on what are you learning looking at the technologies, you know?
Yes, if I look at the broader picture, obviously there's a bit of a difference between industries.
Some are super compliance heavy, right? I mean, financial industry is a great example.
Critical infrastructure organizations in the bigger space, like energy, very heavy on compliance as well.
So that is a clear driver for the security strategy, which unfortunately very often doesn't mean security is done for the business ambitions.
but it is done for achieving the check marks, right? And that is a very interesting conversation to get into.
But on the broader industry, cross-industry perspective, I would say it's very much building towards the resilience mindset.
So what are the things that we can do before an incident and how do we operate during an incident? And then most organizations, luckily today, are linking it to the post-incident.
I talk about it a lot, but we're at a changing point, an infliction point right now where that's simply not enough anymore, to be honest.
And how do we define that? Is that a technology problem or is that a thinking problem or is that a strategy problem?
I think it's a mix between a strategy problem and a almost, I wouldn't say awareness and education, but it's very close to, right? Because more and more organizations are, and we talked about that just before going on to the podcast, right? We talked about how organizational leaders are now becoming more and more aware of cybersecurity topics.
The other day I met a CEO of a company and we were having a conversation, you know, it was just a casual conversation.
And all of a sudden, because we were talking about what it does, I do and how I help organizations.
He was using like threat actor names and how they operated and TTP and expressions like that.
And at first I was like, was this CEO? I mean, is it a tech company? No, it wasn't.
But it was just one of those interesting conversations where It suddenly made me think that I need to ask you a question, Mr. CEO.
So you work with chief information security officers or the security leaders of these companies every day, right? Yes.
And when you look at how most organizations have built their security strategy, what's the specific thing that tells you that this was designed for a threat landscape that no longer exists? So tell us, give us the dibs on what are you learning looking at the technologies, you know?
Yes, if I look at the broader picture, obviously there's a bit of a difference between industries.
Some are super compliance heavy, right? I mean, financial industry is a great example.
Critical infrastructure organizations in the bigger space, like energy, very heavy on compliance as well.
So that is a clear driver for the security strategy, which unfortunately very often doesn't mean security is done for the business ambitions.
but it is done for achieving the check marks, right? And that is a very interesting conversation to get into.
But on the broader industry, cross-industry perspective, I would say it's very much building towards the resilience mindset.
So what are the things that we can do before an incident and how do we operate during an incident? And then most organizations, luckily today, are linking it to the post-incident.
I talk about it a lot, but we're at a changing point, an infliction point right now where that's simply not enough anymore, to be honest.
And how do we define that? Is that a technology problem or is that a thinking problem or is that a strategy problem?
I think it's a mix between a strategy problem and a almost, I wouldn't say awareness and education, but it's very close to, right? Because more and more organizations are, and we talked about that just before going on to the podcast, right? We talked about how organizational leaders are now becoming more and more aware of cybersecurity topics.
The other day I met a CEO of a company and we were having a conversation, you know, it was just a casual conversation.
And all of a sudden, because we were talking about what it does, I do and how I help organizations.
He was using like threat actor names and how they operated and TTP and expressions like that.
And at first I was like, was this CEO? I mean, is it a tech company? No, it wasn't.
But it was just one of those interesting conversations where It suddenly made me think that I need to ask you a question, Mr. CEO.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.