Why Security Fundamentals Still Fail, and How Culture and Tabletop Exercises Fix Them: Lessons From Forrester's David Levine

Watch on: Spotify, Apple, YouTube

David Levine spent ten years as a CISO at Ricoh before moving into a peer advisory role at Forrester, where he now works with security leaders across government, private industry, and a range of company sizes. That transition gave him something most CISOs never get: a direct comparison between his own program's challenges and what dozens of other organizations experience.

What he found surprised him. The problems he assumed were specific to his environment turned out to be common across the industry. On this episode of the Cybersecurity Ecosystem Show, he covered why the security fundamentals remain unfinished at most organizations, what separates the programs that succeed, how executive tabletop exercises drive real change, and what vendors should understand about selling to security leaders.

Here are the main lessons from the conversation.

The fundamentals are still the problem

David's assessment of the industry starts with patching, prioritization, and asset inventory. These are not new problems, and that is the point.

"I always felt like I struggled with the fundamentals. My teams did," he said of his time as a CISO. "It wasn't for a lack of wanting to do better. It's just not easy. And it's really easy to get distracted by the latest and greatest and all the other things you have to do, and then the fundamentals start to slip."

He expected the picture to improve as the industry matured. It has not. "I have conversations all the time around we're still struggling with patching. We're still struggling with prioritization. We're still struggling with asset management or full asset inventory." Organizations may have a partial handle on each, but few have end-to-end visibility into everything in their environment.

AI makes this harder, not easier. It introduces a new category of assets to discover and manage, including agents, and it changes the vulnerability picture. David expects frontier AI models to generate vulnerability volume that overwhelms existing processes. "Instead of having 10 new vulnerabilities you gotta deal with in short order, you may have 500 you have to deal with in short order. And they may not even be vetted when they come to you."

Why capable teams still fall behind

David is careful not to attribute the gap to a lack of understanding. "I don't think that it's the leaders and the people don't understand what they need to do. They just don't have the bandwidth, the cycles, or the budget to do everything all the time."

The constraints are familiar: budget pressure, staff pressure, and the expectation to do more with less, which he saw firsthand in government last year. AI adds a resource drain on top of that. "It consumes a massive amount of resources. And that takes time away from other things." Leaders are left working through a prioritization list with insufficient capacity to cover it.

The organizations that stay on top of the fundamentals tend to be very large, well funded, well staffed, and mature. David does not claim they are problem-free, but they are in a materially better position. For everyone else, the question is how to make progress under constraints, and his answer centers on people rather than tools.

Culture and leadership support determine program success

Asked what the successful programs have in common beyond budget, David pointed to people: the CISO, the company culture, and the support the CISO receives from the board and executive leadership.

"If they understand the landscape today and they are duly informed and they are supportive of IT and security and they understand its importance," he said, the program can succeed. He added one qualifier he returns to often with clients: that support has to be grounded in reality. Not all risks are equal, and leadership needs an accurate picture rather than a theoretical one.

He described one well-known company, unnamed, as an example. The leaders over security and IT are grounded and capable, they have the support of their hierarchy, and they have funding. The result is a comprehensive security, IT, and GRC program whose components work together.

That last point addresses a problem David underestimated during his CISO tenure. He experienced friction between IT and security and assumed it was partly situational. Working with clients showed him otherwise. "This is much more of a problem pervasively than I would have thought." The two functions depend on each other, and the successful organizations have built mutual respect and a shared understanding of each other's drivers. "Not saying they agree on everything, but they have a good relationship."

People are the biggest security risk

David's position on risk has been consistent for years: the largest risk in security is people, because nearly every incident traces back to a human decision.

"Just about any event I was ever involved in, if you really rolled back and dove into root cause, sure you could say it was ransomware or phishing. But what fundamentally happened is that typically somebody made a mistake, somehow, some way. Not necessarily on purpose. But somebody either did something they shouldn't have, didn't do something they should have, and that led to a thing that led to the thing that caused the incident."

He is equally clear that no amount of training eliminates this. "I never did and I never will stand in front of a group of people and go, I will never fall for a phish. You're totally kidding yourself if that's what you're saying. You catch a well-educated, well-trained person on the wrong day with the right attack, and it's a pretty good chance something's gonna happen." Controls that limit blast radius remain essential. But because people are unpredictable, education and engagement are not optional.

The approach that works, in his experience, answers one question for every audience. "No matter what it is we're trying to do, I have to fundamentally answer the what's in it for me question. It's just human nature." Employees need to understand how security affects them directly, whether that is protecting the company's goals or protecting their own income.

Turning phishing tests from punishment into skill-building

David's example of this principle in practice came from the first phishing simulations he ran as a CISO. The initial reaction was strongly negative.

"People were mad. They got really upset. They're like, this is terrible. Why are you tricking us? This is gonna end up in my HR file."

He responded by contacting everyone who complained and reframing the exercise. "This is to help you. This is a skill set that helps you not only at work, it helps you at home and with your family, and you can teach other people what you're learning here. This isn't about crime and punishment."

The shift in attitude followed. "It switched pretty quickly over time to go from people being upset to, you almost had me on that one. That was a good one. Or hey, when are you doing the next one?" The same principle applied to annual training: his team replaced lengthy PowerPoint sessions with five-minute animated videos based on real cyber scenarios, and employees began asking when the next episode was coming.

Influence, reciprocity, and replacing "no" with "no, but"

Much of David's advisory work is not about security mechanics. "I have a lot of conversations not about the nuts and bolts of cybersecurity, but about influence and storytelling."

His guidance on influence is practical. Lead by example. Be helpful before asking for help. "You want somebody to do something for you, do something for them. Maybe you have to do that first." If the security team has budget and IT is struggling to fund something, fund it. "They'll remember that." Reciprocity builds trust, and trust is what makes cross-functional work possible.

He also addressed security's historical reputation. "Security used to have the reputation of being the department of no. You put the no in innovation." His instruction to his teams was that even a necessary refusal should come with a path forward. "It's not no. It's no, but. No, we can't approve that, but here's something else you can do. Or here's how we can help you find another solution. It's not no and hang up the phone and walk away, because that's how you get the bad rap."

Executive tabletop exercises produce real change

Asked for examples of transformative work, David pointed to executive-level tabletop exercises. The distinction matters: these are not technical incident drills. "It's not at all about the bits and bytes of a cyber incident. It's about does that group of people, which should include the full executive team plus other key players, really fundamentally understand what their role is in an event and what kind of decisions they have to make?"

He described three cases.

In the first, a participant assumed a higher-level entity would handle a critical part of the response. David pressed: "That's great, but do you know that for a fact? Do you know what the rules of that are? Do you know to what extent they're gonna do that?" The pause that followed exposed an untested assumption. That exercise led to a second tabletop focused on recovery, which led to a third exercise, completed the week before the recording, in which the organization performed an actual recovery.

In the second, a large petroleum company ran a full executive tabletop with board members present. As the scenario progressed, the CEO recalled a manual process the company once used to maintain operations during disruptions. "He goes, we used to do this all the time, like manually. We have the process. Where is that process?" The company committed to resurrecting it.

In the third, HR and finance walked through a scenario together and reached the same conclusion at the end: they thought they knew what they needed to do, and they did not. "I'm like, that's worth gold."

David acknowledged that many organizations have run tabletops for years. His response is that many have not, and some have never run one. "Don't assume everybody's on the same page. They're not." The value is in having the conversation before an incident forces it.

How to run an executive tabletop well

David's guidance on facilitation addresses the ways these exercises go wrong.

Know the audience. An executive tabletop is an executive discussion, not a forensic walkthrough. Avoid jargon and check for understanding. Use a facilitator who is comfortable in front of senior leaders, listens carefully, and can recognize when the room is disengaging. Bring real-world examples rather than hypotheticals, and make sure the scenario fits the industry and company.

On method, he avoids leading the discussion. "I throw an inject or a piece of scenario out and I let it sit there and I let them discuss it. And then when we're done, I go, okay, here's all the things we should have talked about." He frames the exercise at the start as a safe environment: "There's no right or wrong. We're gonna find things. Now's the time to find it."

He also uses escalating questions to test depth. Asking who decides whether to pay a ransom now usually produces the right answer, that it is a business decision for the CEO and board rather than the CISO. So he pushes further. "Your CEO's on safari in Africa for two weeks and you have absolutely no access to them. Now what are you doing?" And if the decision is to pay: "How are you paying the ransom?" The follow-up questions are where the gaps appear.

Selling to CISOs: the difference between a partner and a vendor

For the founders and go-to-market teams in the audience, David offered a buyer's perspective. Security leaders are overwhelmed by outreach. By the time he left the CISO role, he had stopped responding to unsolicited sales contact, because answering every email and call would have consumed his entire day.

What works instead: sponsored CISO events and dinners, where the dynamic is different, and peer recommendations, which he described as the most effective channel of all.

As a buyer, his evaluation came down to one distinction. "I drew a pretty bright line between somebody who was a partner and a vendor." A vendor sells the product and reappears at renewal. A partner understands the business and shows up when things break. "When the bad thing happens or something goes down, are they there to help you and your team? Are they pulling out the stops to do everything they can?"

The partners he trusted most were the ones who occasionally advised against their own product. "They would go, I don't think that's what you should buy. That's not the best fit for you. That builds tremendous trust. So when they did come to the table and said, we think this thing is a good fit, you better believe I listened."

Where the market opportunity is

David sees two areas of demand. The first is AI governance. Forrester has a governance framework, but the tooling to support it is incomplete. "I don't know that it's all out there yet."

The second is the fundamentals, which did not go away when AI arrived and became more complicated because of it. Anything that helps organizations execute the fundamentals efficiently has a market. He singled out prioritization in particular, with a qualifier: it has to be based on real risk, not theoretical risk. "Not all risks, not all threats are the same. What's terrible for me may be nothing for you. But you gotta be able to know that and use that in the day to day."

Start with documented governance

David's point that AI governance tooling has not caught up with the need leaves organizations with the controls they can implement now: documented policy, defined roles, and clear rules for AI use.

The full conversation is worth your time, particularly the tabletop discussion for anyone responsible for incident readiness. You can reach David through Forrester or on LinkedIn at linkedin.com/in/david-levine-8907133.

Here are the key takeaways from this blog:

• The fundamentals remain unfinished: patching, prioritization, and asset inventory are still the common gaps, and AI adds new assets to discover and more vulnerabilities to process.

• Capacity, not understanding, is the constraint: leaders know what to do but lack the bandwidth and budget to do everything, so prioritization quality determines outcomes.

• Culture and leadership support separate successful programs: informed, supportive executives, a grounded CISO, and a working IT-security relationship matter more than any tool.

• People are the biggest risk, and training must answer "what's in it for me": reframing phishing tests as personal skill-building turned resentment into engagement.

• Executive tabletops expose untested assumptions: the value is in senior leaders discovering gaps in roles, decisions, and recovery before an incident does.

• Buyers want partners, not vendors: peer recommendations drive sales, and partners earn trust by showing up during incidents and advising against their own product when it is not the right fit.

• Prioritize on real risk: not all threats are equal across organizations, and the market need is for tools that help teams execute fundamentals based on actual exposure.

The Cybersecurity Ecosystem Show connects practitioners, investors, vendors, regulators, and everyone in between. New episodes drop weekly. Subscribe so you don't miss one.