Episode
Hero Culture and a $1 Million Mistake
- Published
- May 26, 2026
- Duration seconds
- 1203
- Processing state
not_requested- Canonical source
- https://threat-talks.com/hero-culture-and-a-1-million-mistake/
Actions
POST https://stenobird.com/v1/public/podcasts/threat-talks-your-gateway-to-cybersecurity-insights-6755159/episodes/hero-culture-and-a-1-million-mistake/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/threat-talks-your-gateway-to-cybersecurity-insights-6755159/hero-culture-and-a-1-million-mistake.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
A company skips a security check two days before Black Friday and loses $1 million when transactions land in the wrong bank accounts. A machine learning team is told no on production data access, gets it via SharePoint anyway, and a year later the data is on contractor laptops nobody can account for. Two stories, one pattern: when security blocks, the risky work doesn’t stop – it just happens without you. Lieuwe Jan Koning, Co-founder and CTO at ON2IT Cybersecurity, sits down with Sina Yazdanmehr, Founder and Managing Director of Aplite GmbH, on the prevention paradox, why a “no” from the CISO is an illusion of control, and how a technical security team turns into a business partner instead of a roadblock. Timestamps 00:00:00 Introduction 00:01:55 The $1 million Black Friday story 00:04:14 Hero culture rewards shipping, not prevention 00:06:55 The prevention paradox 00:08:00 NIS2 and executive accountability 00:09:00 Avoiding the Department of No 00:12:18 Production data on contractor laptops 00:16:13 The technical CISO as business partner Key Topics Covered Why hero culture quietly trains organizations to bypass security under deadline pressure The prevention paradox: why the person who avoids a loss never gets the credit What happens after a CISO says no: shadow workflows, friendly handovers, and data on laptops nobody owns What a counter-proposal in risk-based language gets you that a flat refusal does not Related ON2IT Content & Referenced Resources Aplite GmbH: https://aplite.de Previous Threat Talks with Sina Yazdanmehr (Security Culture part 1): https://youtu.be/1JnAsXDCKzM?si=qFlMxC617E30U1dW Previous Threat Talks with Sina Yazdanmehr: https://www.youtube.com/watch?v=wBodTl_nY1w Previous Threat Talks with Sina Yazdanmehr: https://www.youtube.com/watch?v=fBw…