Pete Cordero creates cybersecurity leadership education for executives, with a focus on helping leaders question their CISOs about cyber threats, preparedness, and governance. His 2025 program update covers topics including nation-state threats, ransomware, and security frameworks.
Pete Cordero is most useful for executive cybersecurity education on threats and CISO governance.
Best for
A cybersecurity advisory firm wanting executive briefings on nation-state threats and CISO governance.
Not for
Consumer privacy campaigns or general security awareness for everyday home users.
Key takeaways
Cyber risk is a leadership problem, not just a security team problem.
Turn a broad worry into a specific question for the CISO.
A framework counts only if leadership monitors it and funds it.
Check first: Ask for session recordings, audience data, fees, booking, and deliverables before contacting them.
Main ideas
Cyber risk is a leadership problem, not just a security team problem · Turn a broad worry into a specific question for the CISO · A framework counts only if leadership monitors it and funds it
Pete Cordero creates cybersecurity leadership education for executives, especially leaders responsible for critical infrastructure. Their 2025 Hacking The Cyber Threat update turns subjects such as nation-state activity, ransomware, and security frameworks into questions executives can put to their CISOs.
Cordero connects technical risks to executive oversight.
In the update’s written materials, they move from threats such as Volt Typhoon and Salt Typhoon to practical governance questions: whether leaders monitor all six NIST CSF 2.0 functions, test backups and ransomware response, track vulnerability fixes, and understand controls for wire transfers and mobile access.
The work helps readers prepare for a substantive CISO briefing, rather than simply learn threat names.
The posts also show a teaching format that combines short video parts with numbered executive questions.
Pete Cordero's posts argue that cyber risk in critical infrastructure is a leadership problem before it is a technical one, and that executives show leadership by asking their CISO specific questions and demanding evidence.
Read more
The 2025 update to the Hacking The Cyber Threat program names threat actors—APT Volt Typhoon and Salt Typhoon—links them to the energy, water, transportation, and communications sectors, and pairs each video segment with numbered questions executives can put to their security leaders. Cordero focuses on governance and resourcing, recovery readiness, and everyday controls—business email compromise, wire transfers, and mobile access—that boards can act on.
Cyber risk is a leadership problem, not just a security team problem
Cordero's material is written for executives, corporate directors, audit committees, and risk owners—not security practitioners.
Read more
Senior leaders in critical infrastructure need enough grounding in current threats to challenge their CISOs, while security leaders should bring the material to executives rather than keep it within the security function. Without informed questions, oversight becomes a formality.
The 2025 update is addressed to "leaders and executive teams in all 16 U.S. Critical Infrastructure Sectors," and the announcement post asks CISOs and IT directors to share it with their leadership teams.
Turn a broad worry into a specific question for the CISO
Cordero uses numbered questions for executives, following each broad concern with sub-questions that demand evidence, not reassurance.
Read more
Leaders who work through them can distinguish a program that operates from one that exists on paper—and make a concrete request instead of simply expressing concern.
In Part II, question 3 asks how senior leadership is informed about and continuously monitors mitigation of every identified vulnerability—critical, high, medium, and low—from vulnerability scans, assessments, and penetration tests across network, cloud, web, mobile, wireless, and operational technology.
A framework counts only if leadership monitors it and funds it
Cordero puts framework adoption at the start of the update, framing it as an oversight question, not a technical one.
Read more
Executives should know which framework the CISO uses, how it works, and whether leadership monitors it.
Cordero singles out NIST CSF 2.0 and its six functions—Governance, Identify, Protect, Detect, Respond, Recover—and calls for executive management to implement and regularly monitor all six.
The same principle applies to resources: leadership should provide what the CISO needs across personnel, operations, and technology.
Question 1 of Part II asks whether the CISO has implemented a framework and briefed senior leadership on its implementation. Question 7 of Part III asks whether senior leadership has provided the CISO with the strategic resources needed for the best enterprise-level security posture across personnel, operations, and technology.
Name the threat actors and tie them to the audience's own systems
Cordero names China-linked APT groups Volt Typhoon and Salt Typhoon, describes intrusions into U.S. energy, water and wastewater, transportation, and communications sectors, and gives audiences a sense of the scale of the infrastructure they oversee.
Read more
Cordero also expects CISOs to track nation-state tactics and test for them through regular threat hunts and government mitigation guidance.
One post cites CISA figures: more than 152,000 public drinking water systems, over 16,000 wastewater treatment systems, more than 6,413 power plants, and more than 2.5 million miles of pipelines carrying nearly all of the nation's natural gas. The announcement post says the update was released in response to that week's power outage in Spain and Portugal and the Volt Typhoon and Salt Typhoon intrusions.
Recovery readiness and everyday controls are where executives can act
Beyond threat awareness, Cordero pushes executives toward verifiable decisions: whether the organization has simulated a ransomware attack with senior leadership or the board in the room; whether backups exist and are tested at intervals leadership has approved; and whether the organization has accepted a stated level of data loss if recovery fails.
Read more
On the operational side, Cordero points to business email compromise, internal controls to prevent unauthorized wire transfers, the CISO's ability to quickly reach the nearest FBI field office and the IC3 Recovery Asset Team after a bad transfer, and whether mobile, application, and wireless access are protected by a secured enterprise mobility management suite that leadership has been briefed on.
Question 2 of Part II asks whether the organization has run a ransomware simulation with senior leadership or board participation, whether it has good backups of all data, and whether those backups are tested at intervals approved by senior leadership in case data is unrecoverable and loss remains at an acceptable level.
Deliver continuing education in short, timestamped segments for busy leaders
Cordero treats format as part of the teaching.
Read more
The 2025 update was recorded as one long video, then split into three short parts for leaders to watch at their leisure.
A table of contents appears in the opening minute, and each part is paired with relevant questions.
The update is continuing education for people who have completed Cordero's eight-hour program, though it was published more widely.
The full 31-minute update was posted on YouTube, and the LinkedIn release was divided into parts of roughly 11, 8, and 12 minutes. The announcement post says the video is for leaders who have completed the eight-hour online program, then notes that Cordero decided to share the 2025 update with everyone.
First written as an update for program alumni and shared on YouTube with that audience, the update was then opened to leaders and executive teams across all 16 critical infrastructure sectors, with a separate short message for Communications Sector leaders.
Answers: What does Cordero teach, and where does a newcomer start?
Read more
This post is the clearest table of contents for the 2025 program and shows how they connect sector scale to executive questioning.
Cordero explains why senior leaders in critical infrastructure need to ask their CISO better questions.
The post supplies CISA figures: 152,000 public drinking water systems, more than 16,000 wastewater treatment systems, more than 6,413 power plants, more than 2.5 million miles of pipelines, and the Communications Sector's links to energy, IT, financial services, emergency services, and transportation.
It also lays out the Part I video contents: NIST CSF 2.0, today's cyber threat actors, malware, common vulnerabilities and exposures, mobile app security, and business email compromise.
For brands planning a campaign
Useful as a keynote opener: the CISA numbers give an audience a concrete reason to care, and the Part I list shows what a briefing or workshop can cover.
Answers: Why is this update framed as urgent, and who is it for?
Read more
A newcomer learns the trigger events and the program's positioning as continuing education for leaders.
Cordero says the 2025 update is for leaders who completed an 8-hour online program and focuses on APT Volt Typhoon and Salt Typhoon.
The stated reasons for sharing are the Spain and Portugal power outage and intrusions into U.S. energy, water and wastewater, transportation, and communications sectors.
The full 31-minute update was posted on YouTube; the LinkedIn attachment is only the first minute with the table of contents.
For brands planning a campaign
Supports a workshop series aimed at alumni or prior trainees: the update model gives an advisory firm a ready format for recurring threat briefings tied to current incidents.
Answers: What does Cordero want executives to ask about ransomware and framework governance?
Read more
It is the most concrete question set for a leader preparing to challenge a CISO.
Part II covers ransomware, the cost of a breach, notable data breach examples, and today's nation-state actors. Cordero's first three questions for executives ask whether the CISO has implemented a framework such as NIST CSF 2.0 and whether all six functions—Governance, Identify, Protect, Detect, Respond, and Recover—are monitored; whether enterprise antivirus and antimalware are updated and ransomware simulations and tested backups exist; and how senior leadership monitors mitigation of vulnerabilities from scans, assessments, and penetration tests.
For brands planning a campaign
Can be turned into a workshop exercise: participants use the three questions to audit their own CISO reporting and identify gaps in board-level oversight.
Answers: How does Cordero translate nation-state threats into board-level questions?
Read more
It shows the specific governance and operational checks behind the threat names.
Part III focuses on China APT Volt Typhoon, China APT Salt Typhoon, and U.S. government mitigation recommendations. Questions 4–7 ask executives about mobile device, app, and wireless access and whether the CISO uses an Enterprise Mobility Management Suite; business email compromise education, wire-transfer controls, and FBI IC3 Recovery Asset Team relationships; how the CISO keeps current on nation-state tactics, techniques, and procedures, conducts threat hunts, and considers U.S. government mitigations including out-of-band network management and the 2023 NSA Network Infrastructure Security Guide; and whether leadership has given the CISO resources for personnel, operations, and technology.
For brands planning a campaign
A keynote can pair the Volt Typhoon and Salt Typhoon examples with these questions, then a workshop can rehearse the CISO conversation; the business email compromise and FBI IC3 item is especially concrete for finance and risk leaders.
Answers: Which sector does Cordero speak to directly, and how does the message look in the wild?
Read more
It is the quickest example of them addressing a specific critical infrastructure audience.
A short post aimed at leaders and executives in the Communications Sector.
It names companies and organizations—Verizon, AT&T, Charter Communications, Alcatel-Lucent Enterprise, T-Mobile, Comcast, Spectrum, CISO ExecNet Leadership, Institute of Corporate Directors, Public Sector Audit Committee Forum, and cybersecurity enterprise risk management—but provides no detailed argument or question set.
Ask for those materials before using it as a standalone briefing.
For brands planning a campaign
Shows a ready-made sector-targeting approach for a communications-focused campaign. Ask for the substantive briefing material from the other posts to build out the campaign.
Mobile, business email compromise, and everyday controls2
Ransomware, breach cost, and recovery readiness1
Nation-state threats to critical infrastructure
Cordero's 2025 program update centers on nation-state actors, naming APT Volt Typhoon and Salt Typhoon and describing intrusions into the energy, water and wastewater, transportation, and communications sectors.
Read more
They argue these threats have to be understood by senior executives, not only security teams, and use CISA figures to convey scale: more than 152,000 public drinking water systems, over 16,000 wastewater treatment systems, 6,413 power plants, and 2.5 million miles of pipeline carrying most of the nation's natural gas. They give two reasons for releasing the update: a recent power outage in Spain and Portugal, and the Volt Typhoon and Salt Typhoon intrusions.
For brands planning a campaign
Gives a keynote a ready-made structure: tie named threat actors to the infrastructure the audience operates, then scale the risk with numbers they can picture. The material is easy to adapt for specific sectors.
Parts II and III of the update attach numbered question sets for executives and leadership teams to put to their CISOs.
Read more
The questions cover framework adoption, antivirus and antimalware coverage, backup testing and acceptable data loss, monitoring of vulnerability and penetration-test findings, mobile and wireless access and enterprise mobility management, business email compromise and wire-transfer controls, the CISO's relationship with the nearest FBI field office and the IC3 Recovery Asset Team, currency of nation-state tactics and regular threat hunts, and whether leadership has given the CISO the resources for a strong posture.
Numbered lists pair each question with specific sub-questions, helping leaders turn a general concern into a concrete request for evidence.
For brands planning a campaign
The question sets work as workshop scaffolding. A facilitator can hand executives the actual questions, walk through the reasoning behind each, and have participants map answers to their own organizations rather than listen to a lecture.
Cordero puts cybersecurity frameworks at the start of the update.
Read more
They ask whether the CISO has implemented a framework and explained to senior leadership how it works, and single out NIST CSF 2.0, naming its six functions — Governance, Identify, Protect, Detect, Respond, Recover — and calling for all six to be implemented and regularly monitored by executive management. Governance, boards, and leadership remain central: the update explicitly addresses executives, corporate directors, and audit and risk audiences as well as security staff.
For brands planning a campaign
Supports a governance-oriented briefing for boards, audit committees, and executive risk owners, focused on oversight and resourcing decisions rather than technical controls.
Part II of the update covers ransomware, the current cost of a cyber breach, notable data breach examples and their impacts, and today's nation-state actors.
Read more
The accompanying executive questions ask whether the organization has run a ransomware simulation with senior leadership or board participation, whether backups exist and are tested at agreed intervals, whether the business has accepted a level of data loss if recovery fails, and how leadership tracks mitigation of critical through low vulnerabilities from scans, assessments, and penetration tests.
Recent breach examples and cost framing make recovery and backup decisions feel immediate to a non-technical audience.
For brands planning a campaign
A workshop can run the ransomware scenario and backup and recovery questions as a live exercise, producing concrete decisions about testing cadence and acceptable data loss rather than general awareness.
Mobile, business email compromise, and everyday controls
Part I of the update covers NIST CSF 2.0, today's cyber threat actors, malware, common vulnerabilities and exposures, mobile app security, and business email compromise.
Read more
Part III returns to those topics with executive questions about mobile device, mobile application, and wireless access; whether the CISO uses a secured enterprise mobility management suite; whether leadership has been briefed on how that environment is protected; how the organization educates staff about business email compromise; what internal controls prevent unauthorized wire transfers; and whether the CISO can reach the nearest FBI field office quickly if a transfer goes wrong.
For brands planning a campaign
Useful for sessions aimed at operational and finance leadership, where the practical payoff is tighter wire-transfer controls and mobile access decisions rather than threat-actor background.
The 2025 update was delivered as one 31-minute video posted in full on YouTube, then split into three shorter LinkedIn videos of roughly 11, 8, and 12 minutes for leaders to watch at their leisure, with a table of contents shown in the first minute.
Read more
Each part pairs the video segment with the relevant numbered questions, and the posts close with long tag lists spanning InfraGard, the National Council of ISACs, sector ISACs, NERC, FERC, ISC2, and governance and audit forums.
A separate post addresses leaders in the Communications Sector directly.
In one post, Cordero says the update is for leaders who have completed the eight-hour online program and asks CISOs and IT directors to share it with their leadership teams.
Short, clearly timed video segments with a stated table of contents, aimed at executives with limited attention and supported by written question lists.
Cordero's posts present each item as educational content tied to their own program. Ask whether any sponsorship, paid partnership, or product offer is involved.
For brands planning a campaign
The modular format suits a keynote followed by a series: a live executive session, then short recorded segments and question sets that leadership teams can work through on their own schedule.
Pete Cordero's posts do not name a sponsor, client, employer, or commercial partnership.
Read more
The organizations they name — InfraGard, sector ISACs such as WaterISAC and Health-ISAC, NERC, FERC, ISC2, and the telecom companies tagged in their Communications Sector message — read as audience tags and reference lists; none of the posts states a working relationship with them. The one named business they describe as their own is the executive cybersecurity program.
Hacking The Cyber Threat
Owned business · 2025-05-07
Cordero describes an eight-hour online cybersecurity leadership program for executives and a 2025 update, released as three short videos plus a full 31-minute version.
Read more
In a post from May 2025, they call the update part of their program and say it is for leaders who have completed it.
Pete Cordero publishes executive-level cybersecurity education built around one repeated idea: people who own critical infrastructure risk should be able to question their CISO and get evidence back.
Read more
Start with the 2025 update to the Hacking The Cyber Threat program, released as three short video segments of roughly 11, 8, and 12 minutes, alongside the announcement post with the table of contents.
Parts II and III each end with numbered questions for a CISO—the most portable part of the material, usable as a reading list, board agenda, or workshop script.
Topics include nation-state actors (APT Volt Typhoon and Salt Typhoon) tied to named sectors, NIST CSF 2.0 and framework oversight, ransomware and tested recovery, and everyday operational controls such as business email compromise and mobile access.
A separate short post addresses Communications Sector leaders directly.
Three creators cover adjacent ground.
Shawn Edwards writes from inside a communications network operator, including board work on the C2 ISAC, for readers seeking the operator's view of sector collective defense rather than an executive briefing.
Sandra Roberts writes directly to CISOs about demonstrating business value, AI adoption, security culture, and quantum readiness—closer to the practitioner's seat than the board's.
Stephanie Atkinson covers industrial and critical-infrastructure security through a technology-analyst and awards lens, offering the broader market and product picture alongside the governance argument.
Both write about communications-sector cybersecurity as a shared responsibility across companies rather than a single-vendor problem.
Read more
Edwards describes Zayo as a founding member of the C2 ISAC alongside AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, and Verizon, and argues that trusted sharing of indicators, vulnerabilities, and operational lessons makes the whole sector better at anticipating and responding.
Cordero makes the same collective-defense case from the audience side, including a post addressed specifically to Communications Sector leaders.
Edwards' compliance and government security work (CMMC, FedRAMP, NIST 800-171, SOC 2, ISO 27001) also overlaps with Cordero's framework and oversight emphasis.
Edwards writes from inside a network operator about building and staffing programs, with operational posts announcing an industry body and recruiting a compliance and government security leader. Cordero writes for executives overseeing security functions, teaching them what to ask their CISO and offering the buyer's and overseer's view rather than the operator's.
Both treat security leadership as a governance and business-value problem.
Read more
Roberts lays out what CISOs must do to show how security investments support business goals, adapt to AI as both threat and tool, protect data as privacy rules tighten, build a security-conscious culture, and keep up with regulation—the same ground Cordero covers in asking whether leadership monitors the framework and funds the CISO. Her quantum post argues that boards and executives, whose tenures outlast the average CISO's, must sustain long-term roadmaps, matching their insistence that oversight outlive personnel changes.
Roberts addresses CISOs directly, in their own voice and from their seat.
Cordero writes for the executives and board members above the CISO, offering questions they should ask.
Readers seeking a practitioner's framing of the same problems should read Roberts; those preparing to brief non-security leadership should read Cordero.
Both focus on securing critical infrastructure, and both point audiences at CISA and NIST resources.
Read more
Atkinson argues there is no excuse for leaving programmable logic controllers unsecured across water, waste, and utility systems, lists the connected devices that are too often an afterthought, and flags the national-security-versus-responsible-party problem when a small or rural utility owns the asset. Cordero makes the same ownership and scale argument from the other direction, using CISA counts of drinking water systems, wastewater plants, power plants, and pipeline miles, and pointing to CISA performance goals and NIST guidance for defenders.
Atkinson works as a technology market analyst, writing with a broad, direct advocacy voice across IoT, AI, edge computing, and industry award lists. Cordero focuses on cybersecurity and executive education, using structured question sets and numbered video segments rather than commentary and industry news.
Pete Cordero’s material is aimed at executives and CISOs, especially leaders responsible for critical infrastructure.
Read more
Their 2025 update pairs short videos on threats and security frameworks with questions executives can use to assess CISO oversight.
The content is relevant to an executive briefing or governance workshop.
For a campaign requiring a particular professional audience, ask them for audience survey results or another documented source showing roles and seniority.
The posts here contain no documented sponsorship, brand-partnership, or paid-collaboration offer.
Read more
What Cordero publishes is Cordero's own cybersecurity leadership education: a 31-minute 2025 program update hosted on YouTube and split into three shorter LinkedIn videos (11, 8, and 12 minutes), plus question sets that senior executives can put to their CISOs.
Those posts name no rate, no package, no partner terms, and no outreach address, so a buyer cannot build a partnership plan from them.
Whether Cordero accepts sponsored work at all is not established either way by the posts here; the honest reading is that no offer is documented here, not that none exists.
Two gaps matter for a campaign.
First, there is no published inquiry route, so the contact path for commissioning an executive briefing or workshop series is unverified.
Second, there is no stated format — sponsored video, paid keynote, branded series, or advisory retainer — that a buyer could compare against budget.
An engagement may still be possible, but the terms would have to be established directly rather than sourced from a published page.
This section should be revisited if a sponsorship page, media kit, or booking contact is found.
Strong fit on substance and audience. Booking terms are not established by the posts here.
Read more
Brief
A cybersecurity advisory firm wants a seasoned expert to deliver executive briefings on nation-state threats and CISO governance, including a keynote and a workshop series.
Reasons
Cordero's reviewed work is built for this brief. The 2025 Hacking The Cyber Threat update offers executive-facing education on nation-state actors, critical infrastructure risk, and CISO oversight—not general security awareness.
The topic list maps closely to the brief: APT Volt Typhoon and Salt Typhoon, intrusions into energy, water and wastewater, transportation, and communications, ransomware, breach cost, NIST CSF 2.0, mobile app security, business email compromise, vulnerability and penetration-test follow-up, and FBI IC3 relationships.
The published question sets give a workshop a ready structure. Questions 1–6 ask executives to test framework adoption, backup testing, acceptable data loss, mobile and wireless controls, BEC and wire-transfer controls, threat-hunt cadence, and CISO resourcing.
The format is modular. One 31-minute update was split into roughly 11-, 8-, and 12-minute LinkedIn parts with a table of contents, which suits a keynote plus follow-on modules or pre-work.
The intended audience matches the brief: executives, leaders, CISOs, corporate directors, audit and risk audiences, and critical infrastructure sectors. Cordero also says the update is for leaders who completed an eight-hour online program and asks CISOs and IT directors to share it with their leadership teams.
Cordero says they have assisted more than 300 FBI National Academy law enforcement executives and hundreds of corporate directors and executives. The post presents this as self-reported experience, supporting their positioning for an executive-briefing engagement.
Gaps
Video transcripts are unavailable, so delivery quality, pacing, and presentation skill cannot be assessed. Ask for session recordings; fit otherwise rests on Cordero's written descriptions of the program.
The posts provide no audience metrics or composition data. A firm needing proof of executive reach should ask for audience surveys or registration data.
The posts provide no sponsorship page, media kit, published rate, or inquiry route. Ask directly about fees, booking, and deliverables.
When to choose a specialist
Poor fit based on the posts.
Read more
Brief
A consumer privacy app wants a paid short-form social series teaching everyday password hygiene and home Wi-Fi safety to a general U.S. consumer audience, with a product demonstration and affiliate link.
Reasons
The content is B2B and focused on critical infrastructure. It speaks to senior executives, CISOs, boards, audit and risk audiences, and sector ISACs—not to home Wi-Fi, password managers, family device security, or general consumer privacy tips.
The format does not match. The posts feature long-form executive education: a 31-minute program update, three shorter LinkedIn video parts, and written question sets for leaders. They show no short-form, product-led, consumer-style content.
The posts provide no data on viewer roles, seniority, consumer share, or engagement. Ask for audience data before making a consumer-reach claim.
The posts provide no documented paid-collaboration format, rate, package, affiliate arrangement, sponsored-video offer, or inquiry address. Ask whether Cordero offers paid collaborations and, if so, for the terms.
The one sector-specific post reviewed is thin. It names communications companies and governance groups but offers no detailed argument, demonstration, or call to action. A sector-targeted, consumer-adjacent version would need substantial new content.
Gaps
The posts do not say whether Cordero accepts sponsored work. Ask directly whether they take on sponsored projects.
The posts provide no booking contact or media kit. Ask Cordero for a commissioning contact and details of any consumer-series offer.
A worked campaign example
Angle
Build the engagement around one idea from the posts: senior leaders must be able to ask their CISO the right questions about nation-state threats—and can learn, rehearse, and turn those questions into a board-level action list.
Brief
Good-fit brief: a cybersecurity advisory firm engages Cordero for a keynote and workshop series on nation-state threats and CISO governance for critical infrastructure executives.
Gaps
The posts provide no fee, booking contact, or commercial format. The advisory firm should confirm terms directly.
The video updates are not available as transcripts. Ask for recordings to assess the delivered sessions; this keynote plan reflects the program's written descriptions.
Ask for audience metrics before making co-marketing reach claims.
The post says Cordero assisted law enforcement executives and corporate directors. Ask for evidence of paid keynote or workshop experience.
Keynote
Audience
Executive teams, board and audit committee members, CISOs, and risk owners in energy, water and wastewater, communications, and transportation.
Flow
Open with Cordero's CISA scale figures: 152,000 public drinking water systems, more than 16,000 wastewater treatment systems, 6,413 power plants, more than 2.5 million miles of pipeline, and the communications sector's links to energy, IT, financial services, emergency services, and transportation.
Explain why the update was released: the Spain and Portugal power outage and the Volt Typhoon and Salt Typhoon intrusions into U.S. critical infrastructure.
Cover the Part I agenda: NIST CSF 2.0, today's threat actors, malware, common vulnerabilities and exposures, mobile app security, and business email compromise.
Add the Part II material on ransomware, breach cost, notable data breaches, and nation-state actors.
Close with the first three executive questions from Part II: framework adoption and monitoring across the six NIST CSF 2.0 functions; antivirus and antimalware coverage, ransomware simulation, and tested backups; and leadership monitoring of vulnerability and penetration-test findings.
Length
4560 minutes
Title
From Volt Typhoon to Board Questions: What Critical Infrastructure Leaders Need to Ask Their CISO
Materials
Use Cordero's published executive question sets as the workshop backbone.
Create a blank participant version for each leader to record their organization's answers.
Offer short recorded pre-work modules in the reviewed format: one overview segment and three shorter parts on the program topics.
For sector-specific sessions, add material beyond the short Communications Sector post. Ask for a full sector briefing.
Measurement
Pre- and post-session confidence ratings on asking CISO governance questions.
Completion of the one-page board memo.
A named gap list with owners and dates for framework, backup, mobile, BEC, and threat-hunt items.
Follow-up CISO briefing scheduled within 30 days.
Workshop
Length
Half day or two 90-minute sessions
Structure
Exercise 1 — Framework governance: participants map their current framework to Governance, Identify, Protect, Detect, Respond, and Recover, then identify which functions executive management does not regularly monitor.
Exercise 2 — Ransomware and recovery: use backup-testing and acceptable-data-loss questions as a decision exercise. Participants state a testing cadence and tolerated loss level, then compare them with what their CISO can evidence.
Exercise 3 — Everyday controls: work through mobile, app, and wireless access; enterprise mobility management; BEC education; wire-transfer controls; and whether the CISO has a relationship with the nearest FBI field office and the IC3 Recovery Asset Team.
Exercise 4 — Nation-state readiness: test how the CISO keeps current on tactics, techniques, and procedures; whether threat hunts are regular; and whether U.S. government mitigations such as out-of-band network management and the 2023 NSA Network Infrastructure Security Guide have been considered.
Final output: each participant leaves with a one-page board memo and a short CISO briefing agenda based on their own answers.
Title
Executive Questions for the CISO: A Governance Workshop
Choose Edwards when the client is a communications provider seeking a briefing from an operator's seat rather than a teaching program.
Read more
Edwards's posts describe building a provider's compliance and government-security programs around CMMC, NIST 800-171, FedRAMP, DFARS, SOC 2, ISO 27001, and PCI DSS, and serving as a director on the C2 ISAC board, where carriers including AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, Verizon, and Zayo share indicators, vulnerabilities, and tactics in a trusted setting. Edwards is a better match when the value lies in how a carrier assembles and defends those programs and how sector information sharing works in practice.
Pete Cordero's posts do not include an executive question set, threat-actor walkthrough, or session structure.
One announces a recruitment for a compliance and government-security leadership role, organizational news rather than teachable briefing content.
A firm choosing Edwards for a keynote and workshop series should ask for a custom curriculum, scenario exercises, and leave-behind materials; Cordero's published question sets already provide those materials.
Choose Roberts when the briefing centers on the CISO's relationship with the board and long-horizon planning rather than specific adversaries.
Read more
Roberts's posts argue that CISOs must show how security spending supports business goals, that board and executive continuity can outlast an average CISO tenure of under three years, and that organizations need roadmaps with timelines, resource plans, and vendor coordination that survive leadership changes.
One post addresses quantum readiness and the 'harvest now, decrypt later' pattern, in which encrypted data is collected now to be decrypted once quantum capability arrives.
That framing suits CISO and board audiences working on governance roadmaps and post-quantum migration planning.
The posts stay at the strategy level and point to outside studies rather than laying out adversary tactics, recovery testing, or questions leaders can put to their CISO. A firm that needs a threat-specific keynote and runnable workshop should ask Roberts to supply that content or plan to develop it in-house; the offering centers on governance framing, with the threat curriculum built around it.
Choose Atkinson when the audience is operational technology and state or local utility operators, or when the buyer wants an industry-analyst view across connected technology markets.
Read more
The reviewed commentary post argues that programmable logic controllers, modems, routers, smart cameras, servers, and gateways in water, wastewater, and grid systems are connected without adequate protection.
It points to CISA's Cross-Sector Cybersecurity Performance Goals, the Joint Cyber Defense Collaborative, NIST CSF, and NIST SP 800-82 for isolating OT edge devices from corporate IT networks.
It also identifies a responsibility gap: national-security assets are often owned by small, budget-limited local entities without skilled security staff.
That makes Atkinson a strong fit for briefings aimed at utility and industrial operators rather than enterprise CISOs.
The reviewed material comprises a direct commentary post and an awards press release spanning IoT and business technology categories, not a delivered executive program.
It includes no question set, nation-state briefing structure, or session design.
Choosing Atkinson trades Cordero's ready-made CISO governance materials for an operator-and-analyst perspective; the buyer should ask for an executive curriculum or plan to build one.
This profile draws on five LinkedIn posts about Cordero’s 2025 Hacking The Cyber Threat update and a message to Communications Sector leaders.
The posts and their executive question lists were reviewed; the videos they describe were not, so their content is represented only through Cordero’s written descriptions.
