The security poverty line
Featuring
Wendy Nather
In this episode of Risk Grustlers, Nicholas Muy, CISO at Scrut Automation, sits down with Wendy Nather, Senior Research Initiatives Director at 1Password, to talk about a reality most people don’t want to admit: small organizations can’t implement the security controls everyone says they should have. This conversation digs into the “security poverty line,” why compliance feels impossible for lean teams, and what actually matters when you can’t do it all.
The security poverty line
The security poverty line
In this episode of Risk Grustlers, Nicholas Muy, CISO at Scrut Automation, sits down with Wendy Nather, Senior Research Initiatives Director at 1Password, to talk about a reality most people don’t want to admit: small organizations can’t implement the security controls everyone says they should have. This conversation digs into the “security poverty line,” why compliance feels impossible for lean teams, and what actually matters when you can’t do it all.
Listen on Your favourite platforms
Description
In this episode of Risk Grustlers, Wendy Nather joins Nicholas Muy to challenge how we think about compliance, affordability, and security maturity.
Wendy introduces the idea of the “security poverty line,” the invisible boundary keeping small organizations from achieving the same security outcomes as large enterprises. She breaks down why frameworks like PCI DSS work only when risks are narrowly defined, and how unclear scoping, hidden vendor pricing, and talent scarcity widen the gap.
Tune in as Wendy and Nick dismantle the “back to basics” advice, and explain why fundamentals like asset inventory, change control, and threat prioritization are anything but simple in a cloud-first world. Wendy also shares her practical prioritization pyramid, i.e., where to start when you can’t do everything, and it starts with a step most teams skip.
Highlights from the episode
- Why the “security poverty line” explains more about small team struggles than any budget conversation ever will.
- The research finding that should make every CISO uncomfortable: how much securing a company actually costs, and why the answer is more uncertain than you think.
- Wendy’s pyramid framework for what to focus on first when you can’t do everything, and why it deliberately doesn’t start with buying tools.
%201%20(1).avif){kind=icon}
Related Podcasts
