There's a question every board eventually asks its security team: are we secure? And there's a comfortable answer that gets offered back - we're ISO certified, we passed the audit, the box is ticked. Roopesh Srivastava has spent twenty years learning that those two things aren't the same, and this conversation is about the space between them.
Compliant isn't the same as secure
Ask Roopesh what belief he'd push back on hardest, and he doesn't hesitate: that being compliant means being secure. He's sat across from plenty of companies proud of their certifications - ISO, SOC 2, the lot - and his response is blunt. A certificate tells you a company has taken an approach. It doesn't tell you the company is safe.
"Having a firewall with no rules is no worth. You could be compliant by having a firewall, but what makes you secure is a different thing entirely." - Roopesh Srivastava
Compliance isn't useless. It's just a floor, not a finish line. A firewall with no rules still shows up on the checklist. A policy nobody follows still counts as a policy. Real security is a lot of moving parts working together properly, and no audit can promise you that.
The weakest link has never been the technology
So where does the real work sit? Not in the tooling, Roopesh says. Tools come and go - you buy something today, it's out of date tomorrow, you swap it out. Chasing the next tool is a short game.
What holds is people and process. For most of the last decade, he points out, the weakest link in almost any system hasn't been the software - it's been a person. Someone who lost a credential, clicked the wrong link, got talked into something they shouldn't have. And that leads him somewhere a lot of security teams still resist: security can't live with one department in the corner. Everyone in the building is part of it, whether they realise it or not.
That changes what a security leader is even there to do. Less gatekeeper, more enabler. Set security up as a separate function that sits in judgement over everyone else, and you become the person the business quietly works around. Build it into how the business already runs, and it stops being a blocker.
And with third parties, start by looking
One thread runs underneath all of it: you can't secure what you can't see. Roopesh is direct about where third-party risk begins - not with a clever control, but with an inventory. The breaches he's watched land in recent years tended to come through a vendor someone had approved and then forgotten. Until you actually know who you've let in, the rest is guesswork.
The risk was never the certificate on the wall. It's everything the certificate doesn't capture, the rules behind the firewall, the person behind the keyboard, the vendor nobody wrote down.
