Why Your CISO Reporting Structure Is a Security Risk | John Shin, RSI Security

Most companies treat cybersecurity as an IT problem. John Shin has spent 20 years proving it's a business problem — and the gap between those two frames is where organizations get exposed. John Shin is the founder and managing director of RSI Security, a cybersecurity advisory and audit firm serving Fortune 500 companies and SMBs. He started as a night-shift data center tech, got called into a boardroom during a breach, couldn't answer the financial questions — and built his career around closing that gap. In this episode, Rob DeVita and John break down what's actually driving breaches right now, why the CISO reporting structure matters more than most executives realize, and what a mature security program actually looks like — versus what most companies are doing. What you'll learn: Why 50% of breaches come from social engineering — and what no amount of tooling can fix about that The reporting structure that separates accountable CISOs from ones who get buried Why employees are using personal AI tools behind your back — and what to do about it The $100/user investment that outperforms most enterprise security budgets How mature security programs add 10% enterprise valuation — and why it matters in M&A Why the cybersecurity talent pipeline is 2–3 years behind where the industry actually is Building teams that perform under pressure, handle conflict well, and stay engaged