top of page

Episode #


IBM's Andy Piazza on the Importance of Integrating Security into Business Operations

Show Notes

In this week's episode of the Future of Cyber Risk podcast, David speaks to Andy Piazza, Global Head of Threat Intelligence at IBM X-Force, a threat intelligence sharing platform. They discuss the day-to-day responsibilities of IBM's threat intelligence team in creating strategy and overseeing threat collection, the ways in which threat actors are leveraging ransomware today, and why businesses should lean into their security vendors to help them stay protected. They also discuss the best skills for security practitioners, overcoming visibility challenges, and clear and concise communication is key.

Topics discussed:

  • What a day in the life of the head of threat intelligence is like, and how Andy works to drive strategy, support clients, and inform threat collection teams.

  • Why the biggest thing businesses get wrong is treating security as a separate department, and why securing data is a basic requirement, not a separate cost center.

  • How threat actors work today, why they're focused on "double extortion," and why we need to think differently about ransomware.

  • Why businesses should rely more on their security vendor's capabilities instead of trying to build it themselves.

  • How to overcome the challenges that will arise as security teams gain more visibility into OT devices.

  • Advice to security practitioners, including the need for more concise communication and why it's crucial to understand your team's processes.

Quotes from Episode


"Securing your data has to be a part of your business line. It is a basic requirement now to put an alarm on a physical building. It should be a basic requirement to put a certain amount of security in front of your data. Now, we should no longer be thinking about it as a separate cost center that security wants to do. Security doesn't exist without the business, right? So I think that's the part of the thing that we have to change, right, is we have to think about it as one business operation, and security is trying to enable and protect those business operations." (10:41--11:13)


"Big decisions are made on single slides, not 30 slides. So if you're a practitioner on the analyst or security operations, security engineer, learn to communicate clear and concise as quickly as possible for decision makers." (40:35; video #4)

bottom of page