MTMG's IT Roundtable with Dave Phillips: Chip Away at the Stone: Risk-First Security for Small Teams

Dave Phillips, Chief Information Security Officer at OSHEAN, the nonprofit consortium serving more than 160 hospitals, schools, libraries, and government agencies across Rhode Island and Southeastern Massachusetts, joins Paul Knittle to explain how to build a cybersecurity program when you can't do everything at once. He covers why frameworks like NIST CSF 2.0 should be run as a program rather than a checkbox, how an honest self-assessment surfaces the gaps that matter, and why reporting progress against a framework tells a board more than a list of security tools. Dave also shares how he approached the job as OSHEAN's first CISO by treating the organization like one of his own customers and ranking every finding by probability and business impact, and why he sees AI helping attackers find weaknesses faster than defenders can fix them. The conversation closes with a preview of OMC26, OSHEAN's member conference on November 12 and 13, 2026. **Key Events** 00:00 Welcome & Guest Intro 01:00 Lessons from Armored Fiber 03:00 Frameworks Are Not Checkboxes 07:00 Start Small, Be Honest About Gaps 09:00 Security Is a Leadership Issue 11:00 Chipping Away at the Stone 13:00 Deciding What to Defend First 16:00 AI on Attack and Defense 18:00 When Generative AI Is Just Noise 22:00 What to Expect at OMC26 • **Tip worth stealing**: Run an honest self-assessment against a framework, rank each gap by how likely it is to be exploited and how hard it would hit the business, then fix the highest-risk items first. Dave calls it chipping away at the stone, and says three to five years of it gets you to a mature security program. • **Worth a look**: OMC26, the OSHEAN Member Conference, November 12 and 13, 2026 — Dave previews the security track on frameworks, GRC, and asset management. https://oshean.org/events/omc26/ **Connect with Us:** • Check out our website: https://www.mtmg.eu • Learn more about the amazing software we use to create these podcasts (Descript): https://get.descript.com/mtu0tl2zr3g7 • Want the same microphones we use? Get a discount (use coupon code "MTMG" for 10% off): https://www.maono.com/?ref=ulcbmcjk • Suggestions or want to appear on a future episode? Email: podcast@mtmg.eu • Need expert help to maximize your IT investments? Reach out: info@mtmg.eu • Don't forget to subscribe to the Podcast and follow us on LinkedIn! https://www.linkedin.com/company/mtmg-eu