How to Build a Cybersecurity Program from Scratch | CISO Transformation Playbook
Source: YouTube · Prabh Nair · published Sep 20, 2026 · 1:13:04
In this "Coffee with PRB" masterclass, veteran CISO Ilias (Group CEO, Cyber Shelter) explains how to build a cybersecurity program from scratch—starting with risk appetite, not policies—arguing security exists to enable the business 1:34.
Key Takeaways:
• Start with risk appetite—align security risk ratings with enterprise/operational risk so "critical" means the same to the board 26:57
• Prioritize gaps by risk and effort: P0 = high-risk gaps fixable quickly with existing tools; gaps needing procurement get temporary alternative controls 22:38
• Maximize existing tools before buying—most use under 30% of current controls' capabilities 50:40
• Tailor controls to the business—security failures come from process failure, not technology 13:15
• Win budget via one-page business-language dashboards; management responds to financial impact, not vulnerability counts 52:29
• Build step by step: risk appetite → gap assessment → risk-rating → prioritization → roadmap linking maturity targets to risk appetite 56:22
These frameworks come from practical experience, not books; CISOs who block business agility risk losing relevance—security's job is enabling the business.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
How did you overcome the challenge and what is the message you want to give to the aspiring CESOS or GRC professionals? >> See there are few things one is knowledge and understanding and common sense and aptitude all of these are important >> today I'm joined by the Mr. as a group CEO of cyber shelter a cyber security leader with nearly three decades of cyber security leadership enterprise technology and more important the financial services which is handled one of the critical project what should be the formula we should consider to prioritize the security gaps we have 10 to 15 security gaps are there management have a limited budget how can we prioritize security gaps so that is see first thing about any security program is about your risk appetite an organization most organization will …