Jane Frankland

The question is put plainly: when an agent acts, who answers for it?

• The argument is made in a panel setting rather than as a solo claim.
• Frankland's co-panellists were Ejona Preci, Group CISO at LINDAL Group, and Daniel Maier-Johnson, CISO at Kuehne+Nagel International AG; their contributions belong to the panel, not to Frankland alone.

At the Gartner Security & Risk Management Summit in London, Frankland joined the session "Executive Story: Cybersecurity Leadership, Liability, and Control in the Agentic AI Era" and pressed the accountability question with the two CISOs.

Read original

Each decision seemed reasonable at the time.

• Frankland sets out the tension: too much access creates risk, but too much friction stops people doing their jobs.
• The practical test is whether governance is actually working.

An Okta webinar on 29 October, framed around the question "When does the right access become the wrong access?", with Graham Cluley and Jen Vaccaro McParland. Frankland framed the session around access drift and governance.

Read original

Frankland argues that this gap opens up risk and calls for a more continuous, real-time view of controls and risk.

• Pravinder A., Security GRC Manager (VP) at Crown Agents Bank, described compliance as visibility: what you can see now that you could not see before, what you can evidence, and how to scale assurance and third-party oversight without simply adding people.
• The post carries an advertising label and appears in a paid-partnership format.

A conversation with Joseph Byrne of Vanta, plus a Vanta session from Pravinder A. on compliance, audit readiness, risk management and third-party oversight in a regulated environment. Frankland also announces a follow-up webinar with Jill Henriques of Vanta on visibility, accountability and governance.

Read original

Frankland challenges the reasons people give for ruling themselves out — too old, too established in another career, the wrong background, started too late — and argues that careers are not always linear, and one question can restart them.

Isabel Höhn received an IN Security scholarship to attend the Black Hat Briefings in Europe a couple of years earlier and is now Head of Security Strategy and Risk at ALDI SÜD.

• Frankland reports the people, confidence and direction Höhn gained in her career.
• Separately, Alisha Chambers said nine years earlier in an exchange on X that she would have gone into cyber if she had known about it; she is now Head of Security Engagement & Culture at Tesco.
• The question Frankland put at the time — "What if it isn't too late?" — is the line both stories hang on.

Both stories were revisited in person at the same London event, years after they began: one about a couple of years earlier, the other about nine years earlier.

Read original · Original 2

In the recap of the Gartner summit, the described value was talking to CISOs about what they are wrestling with inside their organisations and to vendors about what they see across customers, plus closed-door roundtables where peers compare notes.

• Keynotes and analyst sessions were attended where possible and replays were relied on for the rest, so the preference for conversation is stated as a preference, not a dismissal of stage content.
• The same post invites early registration for next year, showing that events are both attended and promoted in this work.

The Gartner Security & Risk Management Summit in London drew around 2,500 cybersecurity, risk and IT leaders and featured hundreds of sessions. The reflection endorses the roundtable format rather than the keynote programme.

Read original

It shows their topic range, the seniority of the room and a specific point of view on AI accountability.

A recap of the London summit, which Frankland describes as bringing together around 2,500 cybersecurity, risk and IT leaders.

• They say much of the value came from conversations rather than stages: talking to CISOs about challenges inside their organisations and to vendors about what they see across customers, as well as closed-door roundtables where peers compare notes.
• They list an agenda spanning AI, leadership, resilience, risk, regulation, architecture, people and the changing CISO role, and name their panel contribution: alongside Ejona Preci, Group CISO at LINDAL Group, and Daniel Maier-Johnson, CISO at Kuehne+Nagel, on “Cybersecurity Leadership, Liability, and Control in the Agentic AI Era.”
• The panel’s central question: when an AI agent acts, who answers for it?
• They also mention nearly 30 years in cybersecurity and bringing one of their children along to help with filming.

For brands planning a campaign

A strong fit for a keynote or panel on AI governance, CISO leadership or accountability. The agentic-AI question offers a ready-made session hook, and the named co-panellists show the calibre of speakers this person is booked alongside.

Readers can assess the format and tone against their brand expectations.

A commercially labelled post built around an interview with Joseph Byrne of Vanta.

• It argues that organisations still gather evidence that controls work only periodically, even as systems, suppliers, people, roles, access and AI permissions keep changing.
• Frankland says this creates risk and presents a more continuous, real-time view as the alternative.
• The post also covers a Vanta session by Pravinder A., Security GRC Manager (VP) at Crown Agents Bank, on compliance, audit readiness, risk management and third-party oversight in a regulated environment.
• It highlights the key question of visibility: what you can see now that you could not see before, what you can evidence, and how to scale assurance without adding headcount.
• A follow-up webinar with Jill Henriques of Vanta is announced.

For brands planning a campaign

A template for a sponsored interview or webinar on governance, assurance and third-party risk. The format pairs a vendor spokesperson with a named practitioner, lending the commercial message outside credibility.

The outcome is named, dated and specific, making this a strong first read on this part of the work.

Frankland describes giving Isabel Höhn an IN Security scholarship a couple of years ago to attend the Black Hat Briefings in Europe, then catching up with her after the Gartner summit panel in London.

• Höhn is now Head of Security Strategy and Risk at ALDI SÜD.
• The post reports what the scholarship changed for her: the people she met, the confidence it gave her, the opportunities that followed and the direction her career took.
• Its rationale is simple: talent is everywhere but opportunity is not, and access to the right room at the right moment can change more than expected.
• The post includes a short video exchange.

For brands planning a campaign

Anchor content for a security brand running a community, talent or access programme: it shows a multi-year arc with an identifiable result, while the video offers an activation asset to license or co-produce.

It pairs naturally with the scholarship story and is the better entry point for the underlying belief rather than the programme detail.

Frankland recalls an exchange nine years ago on Twitter with someone then unknown to them, who said they would have gone into cyber if they had known about it.

• Their reply: “What if it isn’t too late?”
• The post introduces Alisha Chambers, now Head of Security Engagement & Culture at Tesco, after another meeting at the Gartner summit in London.
• It argues that people talk themselves out of opportunities because they feel too old, too established elsewhere, from the wrong background or too late to start — and that careers are not always linear.
• A short video accompanies the post.

For brands planning a campaign

The narrative half of a talent-pipeline campaign aimed at career changers, alongside the scholarship post. The question “What if it isn’t too late?” is a portable campaign line, tested here against a real outcome.

A quick way to assess whether their viewpoint fits a specific brief.

A commercially labelled post promoting an Okta webinar on 29 October with Graham Cluley and Jen Vaccaro McParland, framed around the question “When does the right access become the wrong access?”

• Frankland makes the problem concrete with drift scenarios: someone changes roles, a team reorganises, a contractor stays longer than expected, or temporary access becomes permanent — none of which looked wrong at the time.
• The post sets out the tension: too much access creates risk, while too much friction stops people doing their jobs.
• It closes by asking how you know your governance is actually working.
• Date and time are given in four time zones.

For brands planning a campaign

Jane Frankland's posts are a close match for a session on cybersecurity leadership and access governance. The drift examples can go straight into session material, and the vendor-plus-two-speakers format demonstrates a co-presented webinar.

They connect that question to changing expectations of control and accountability in cybersecurity leadership.

Opens with a question, then anchors it in a panel discussion with security leaders.

For brands planning a campaign

A fit for a keynote or executive discussion that makes AI governance concrete through questions of leadership, liability and accountability.

Examples: Source 1

They frame the challenge as a balance: reduce unnecessary access without creating friction that blocks work.

Starts with familiar workplace changes and builds to a practical governance question: how can an organization tell whether its controls work?

For brands planning a campaign

Useful for an access-governance campaign aimed at security and business leaders. A strong brief should address both risk reduction and day-to-day productivity.

Examples: Source 1

In a post marked as an ad, they discuss continuous visibility, proof of controls, audit readiness and third-party oversight, including a regulated-environment example.

Uses a changing-systems problem to explain why point-in-time checks may leave gaps, then points to practitioner conversations and a session as examples.

For brands planning a campaign

Potential fit for a campaign about ongoing assurance or risk visibility. The campaign should distinguish useful proof and oversight from compliance for its own sake.

Examples: Source 1

The examples connect scholarships and encouragement with confidence, relationships and new career possibilities.

Uses short video conversations and a personal question—“What if it isn’t too late?”—to make career entry feel approachable.

For brands planning a campaign

Relevant to campaigns about cybersecurity talent, inclusion, career development or professional events. The posts support a people-centered angle.

Examples: Source 1 · Source 2

They describe value in exchanging experience and questions, not only attending stage presentations.

Combines event reflection, specific discussion themes and a personal anecdote. A separate event post marked as an ad previews a webinar and names its subject and speakers.

For brands planning a campaign

A fit for event participation or coverage that highlights peer learning and real leadership concerns. The post also includes an event-registration invitation, making event promotion part of the demonstrated format.

Examples: Source 1 · Source 2

Original disclosure

#ad

View example

Original disclosure

#ad

View example

View example

The post discloses no sponsorship or commercial relationship.

View example

Each explains a process step by step and answers the obvious objection: you do not need a platform, and here is what the work involves.

Riff's posts are operational walkthroughs of a SOC 2 audit — policies, controls, audit documentation, penetration tests — and argue that a platform is convenient, not required. Frankland's posts are event-led, focusing on leadership, liability and access governance rather than audit mechanics.

Read original · Original 2

Edmondson writes from inside executive search: mandates, assessment rubrics, why a strong CISO can be declined for a specific role, and how an interview process can end up selecting the best interviewer. Frankland writes from the practitioner and event side, focusing on control, accountability and access rather than hiring.

Read original · Original 2

Hunt frames the problem as a credibility gap and built a diagnostic product, Orbit, around it; their posts read like a direct sales argument. Frankland frames it through access governance, AI accountability and conversations with CISOs at events, without putting a named product at the centre of the argument.

Read original · Original 2

Riff covers the process in actionable detail: roughly twenty policies, about 100 to 150 controls, an evidence routine such as photographing locked doors every two weeks, a penetration test, the difference between a Type I single-day report and a Type II three-to-six-month observation period, and the lead time before any attestation exists.

• The posts also name the hard objection directly — someone said what Riff’s company does is a complete waste of money, and the response concedes the point before answering it — a workable structure for a sponsored post in a contested category.
• For vendors selling compliance automation or evidence collection to teams without a security function, that procedural detail is closer to the buyer’s real question than an executive keynote.

The specificity limits reuse for a CISO audience.

• These posts debate whether a platform is needed at all and end with a booking link, making them vendor-side explanations of a purchase decision rather than executive commentary.
• A governance vendor pursuing the access-drift and AI-accountability angles would be changing the subject: the material takes no position on role changes, contractor access that outlives its purpose, or who answers when an AI agent acts.
• It also speaks to founders approaching their first audit, not security leaders running an established programme.
• The vendor would be reaching a different audience.

Examples: Source 1 · Source 2

The posts focus on the hiring decision: executive search fits a specific mandate rather than ranking who is best; an outstanding CISO may be met and deliberately not put forward because the client needs something else; and an interview process can end up selecting the best interviewer rather than the best CIO.

• They also offer practical remedies: agree on assessment criteria before interviewing, write a rubric, and ask for evidence of decisions made when something went wrong and how resistance was handled.
• For a vendor whose message concerns a CISO’s standing with the board, or an event for leaders weighing their next move, this is a closer fit than an operational governance keynote.

Jane Frankland’s posts address a different buyer problem.

• They do not discuss access, assurance, control evidence or permissions, so a vendor selling identity governance would get a hiring-and-influence conversation instead of a translation from security detail to business outcomes.
• The posts also promote an advisory module Edmondson runs, which a sponsoring vendor would need to keep distinct from its own offer, and address candidates and hiring clients rather than practitioners who own governance day to day.

Examples: Source 1 · Source 2

Jane Frankland’s posts depict the problem in concrete scenes — a CISO who commands fifty security professionals then waits for the fifth agenda item and three minutes — and attribute it to a credibility gap rather than a knowledge gap, after thirty years of watching budget and influence go elsewhere.

• They then offer a structured exercise: take a leadership snapshot, map the two or three people who can say yes, and view the approval pipeline from those people’s positions.
• For a vendor running a workshop on influence, budget and board communication for security leaders, that framing is closer to their needs than event-recap and panel-format material.

Jane Frankland’s posts centre on a product, with a sign-up link and a call to run one stalled initiative through it.

• A sponsoring vendor would be placing its event beside another commercial offer and should agree on boundaries in advance.
• The argument is motivational and based on self-assessment; the posts do not explain the governance content needed for a campaign about access that drifts after a role change or reorganisation, point-in-time assurance, or permissions granted to AI tools and agents.
• A vendor whose message depends on those specifics would be trading domain detail for personal-effectiveness framing.

Examples: Source 1 · Source 2