Not all critical vulnerabilities are critical for every organization. Context, exploitability, and business impact determine what actually matters. Ray Espinoza, CISO at Inspectiv, brings over 20 years of security experience including roles as VP of Cloud Security at Medallia and CISO at Cobalt.io. In this episode, he makes the case that empathy and relationship building are the most underrated tools in a CISO’s arsenal, and shares how to manage cloud vulnerabilities without losing your mind or your stakeholders’ trust.
You can read the complete transcript of the episode here >
How do you build a security-centric culture through empathy?
Ray learned the hard way that coming in like a “bull in a china shop” does not work, even at a security company. His first leadership role at Proofpoint taught him to step back and understand the existing culture before trying to change it.
His framework for driving security culture:
- Understand the playing field first: How do people digest information? What is their appetite for security content? What has their experience with security been (often negative: annual compliance nagging or blame after incidents)?
- Lead with empathy: Most employees genuinely want to do the right thing. They are not “dumb employees making dumb decisions.” Treat them like customers, with respect and support.
- Create safe spaces: People need to feel comfortable saying “I did something wrong and I don’t know what to do” without fear of punishment.
- Deliver targeted training: Talking to an accounting team about secure coding is pointless. Show them the specific threats they will face. Real-world examples tied to their role are far more impactful than generic annual training.
The analogy is powerful: you cannot learn a foreign language by taking training once a year, yet organizations expect employees to make perfect security decisions with minimal education. Continuous, varied, and role-specific engagement is what actually shifts security culture from friction to flow.
How can security teams build effective partnerships with business units?
Security teams that lead with compliance demands get ignored. Ray’s approach starts with questions, not requirements:
- Ask how things work: Instead of “here’s what I need,” ask “how do decisions get made in your org? What’s the best way to get work prioritized?”
- Find alignment: Understand what other leaders are held accountable for and what metrics they report on. Position security work to support their goals, not compete with them.
- Build genuine relationships: Invest time in understanding what worries other leaders. When you know their pain points, you can frame security as enabling their success.
- Present options, not mandates: Instead of “you must do this,” present the risk, the options, and the consequences. Let business leaders make informed decisions.
The payoff: when you arrive at executive meetings with other GMs and the CFO united on a security initiative, you have a much stronger position than security operating alone. The CISO’s role is not to dictate what the business does but to drive education for better business decisions. This partnership approach is what building cybersecurity teams effectively looks like in practice.
How should security leaders prioritize cloud vulnerabilities?
Every new tool reveals more vulnerabilities, but resources remain finite. Ray’s prioritization framework:
- Context is everything: A critical vulnerability in an open source library used only in a back-end application is different from the same vulnerability in a front-facing service. It still needs remediation, but the timeline changes.
- Reclassify based on your environment: Just because a CVE is rated critical does not mean it is critical for your organization. Assess how it applies to your specific architecture.
- Check active exploitation: Is this being exploited in the wild right now? That pushes it up the stack. Is the exploit theoretical? That buys time.
- Build routine cadence: Pre-negotiate dedicated time from engineering, DevOps, and IT operations for security remediation work. This prevents security from being purely interrupt-driven.
For zero-day emergencies, run them through the incident response process. It already has communication components, stakeholder engagement, and decision-making frameworks. Having this structure means nobody freaks out when a vulnerability gets a marketing name and a website.
The goal is prioritizing vulnerabilities based on business risk rather than raw CVSS scores, which lack organizational context.
How should organizations manage and reduce security debt?
Security debt grows like the national debt: slowly at first, then unmanageably. Ray’s approach combines education and process:
- Articulate risk in business terms: Telling a CFO you have “a thousand medium-severity vulnerabilities” is meaningless. Showing that chaining three mediums together gives access to customer data changes the conversation entirely.
- Work within existing engineering processes: Join backlog grooming sessions. Get security work into the same pipeline as feature work so it does not require separate interrupt-driven processes.
- Leverage containers: Ephemeral containers allow teams to update base images with security fixes and deploy them through natural release cycles. This makes patching less disruptive.
- Use compliance as a forcing function sparingly: FedRAMP or SOC 2 requirements can motivate action when relationship-based approaches stall, but it should not be the primary lever.
The key insight: most operations teams resist patching because they fear breaking production. Their bonuses depend on uptime. Working with them to build good testing processes and automation removes that fear and makes security work feel natural rather than adversarial. This connects to how measuring security debt effectively requires understanding organizational dynamics.
How should organizations prepare for and respond to security incidents?
Ray’s incident response philosophy comes from years on the IR side of security. His framework has two parts:
Prevention through layered defense:
- Address risk with technology first (email filtering, endpoint protection, access controls)
- When technology fails, rely on strong security culture and continuous training
- Make education engaging: tie it to real incidents at well-known brands, not abstract fear
Response through transparency:
- Organizations are no longer judged on whether they have incidents (everyone does) but on how well they respond
- Transparent communication builds trust: here is what happened, what we know, what we are doing, and what it means to you
- Be the calm voice in the room. If the leader is not freaking out, nobody else should be either
- Build muscle memory through testing so that when the real incident arrives, the team executes without hesitation
The brands that maintain customer trust after breaches are the ones that communicate honestly and quickly. Trying to hide incidents or find gray areas in disclosure requirements always backfires. This aligns with best practices in incident response detection and recovery.
