Sep 16, 2026 · 22 min · 9 segments
In this episode of CYBR.SEC.CAST, Michael Farnum and Sam Van Ryder sit down with Dale Hoak, CISO at RegScale, to explore why compliance should be the starting point for cybersecurity - not the finish…
Dale HoakGuest
Michael FarnumHost
Sam Van RyderHost
We were going back and forth on what we were going to talk about on the topic here.
And we've had this conversation a million times with our different customers, Sam specifically on the OT side.
like having to deal with what's actually compliant because the compliance, and Sam, I think you can talk to this, the compliance on the OT side, it just takes it to a whole nother level.
And I guess my thing here, though, the issues are the same, right? It's the question of, you know, is it cybersecurity or is it compliance? Am I doing checkbox or not? And I guess that leads me to the question, where do you find, where do you see a good alignment of compliance and security together? Like what's effective? Yeah.
And if you use it as the foundation to the building, you have a good, solid start.
It just can't because it's a written word that's adjudicated by somebody up in the atmosphere, up in the cloud.
And they're taking a look at you once a year or once every three years, right? The idea is how do I remain compliant, right? 24-7, 365, right, without, you know, stacking your books or work up on one compliance person that is scrambling around all the time trying to keep everybody in line or, you know, first, second, and third lines of defense that don't talk to each other.
You know, you have compliance and risk and security that really, they don't like talking to each other.
So the idea is, yeah, compliance should be the start, but the idea is cyber resilience.
The day that I used to compromise one machine, that same compromise now compromises 100 machines, and it's moving horizontal before you can stop it.
So if you are in the compliance space and you are doing a snapshot in time, type of compliance, you're way behind the power curve.
Yeah, that was a conversation I had at Black Hat last week was similar to that.
It wasn't necessarily compliance focused, but it was, we've been preaching for, I don't know, 10 years, assume breach, assume breach, assume breach.
And now it's, but it wasn't always assume exploitation or that that's exploitable.
We were going back and forth on what we were going to talk about on the topic here.
And we've had this conversation a million times with our different customers, Sam specifically on the OT side.
like having to deal with what's actually compliant because the compliance, and Sam, I think you can talk to this, the compliance on the OT side, it just takes it to a whole nother level.
And I guess my thing here, though, the issues are the same, right? It's the question of, you know, is it cybersecurity or is it compliance? Am I doing checkbox or not? And I guess that leads me to the question, where do you find, where do you see a good alignment of compliance and security together? Like what's effective? Yeah.
And if you use it as the foundation to the building, you have a good, solid start.
It just can't because it's a written word that's adjudicated by somebody up in the atmosphere, up in the cloud.
And they're taking a look at you once a year or once every three years, right? The idea is how do I remain compliant, right? 24-7, 365, right, without, you know, stacking your books or work up on one compliance person that is scrambling around all the time trying to keep everybody in line or, you know, first, second, and third lines of defense that don't talk to each other.
You know, you have compliance and risk and security that really, they don't like talking to each other.
So the idea is, yeah, compliance should be the start, but the idea is cyber resilience.
The day that I used to compromise one machine, that same compromise now compromises 100 machines, and it's moving horizontal before you can stop it.
So if you are in the compliance space and you are doing a snapshot in time, type of compliance, you're way behind the power curve.
Yeah, that was a conversation I had at Black Hat last week was similar to that.
It wasn't necessarily compliance focused, but it was, we've been preaching for, I don't know, 10 years, assume breach, assume breach, assume breach.
And now it's, but it wasn't always assume exploitation or that that's exploitable.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
