Cybersecurity veteran Vince Romney joins the Squeeze team to explain why strong security posture fuels business growth — and what every consumer-direct marketer needs to do right now to avoid becoming easy prey for sophisticated cyber-crime organizations.
Listen wherever you get your podcasts
Key takeaways
- Security's job is to match controls to business risk appetite — not to make data inaccessible in the name of safety.
- Modern cyber criminals operate as structured corporations; automated bots probe every new IP and open port within seconds.
- Password managers are the single highest-ROI security action for most businesses — ~99% of successful intrusions exploit passwords, not technical vulnerabilities.
- SOC 2 Type 1 certification is the right starting point for growing companies before committing to a full Type 2 annual audit.
- Financial fraud via fake invoices and executive impersonation is a multi-billion-dollar industry; voice confirmation + dual approval is a simple, effective countermeasure.
- Security scope must evolve as the business grows — new physical assets, software, and international data flows all expand the attack surface.
- GDPR fines can reach 4% of gross revenue, making international data privacy compliance a business-critical concern, not a back-burner IT issue.
Security as a Business Enabler, Not a Blocker
Vince Romney, fractional CISO at Digital Defense Security and a 23-year U.S. Air Force veteran, opens with a reframe that cuts through the usual fear narrative: security done right is what lets a business confidently generate revenue. The goal isn’t zero-risk lockdown — that just makes data unusable — it’s matching security controls to the company’s actual risk appetite.
The Threat Landscape Is Bigger Than You Think
Forget the hoodie-in-a-basement stereotype. Romney describes today’s adversaries as fully structured corporations — complete with CEOs, CFOs, and hundreds of employees — whose sole business is cyber crime. Known as Advanced Persistent Threats (APTs), most operate out of Russia, North Korea, Iran, and China. Automated bots scan the internet continuously; the moment a port opens or an IP goes live, they probe it. Businesses of every size are targets — there is no flying under the radar.
- Financial fraud (“business email compromise”) is a multi-billion-dollar-a-year industry on its own — attackers impersonate vendors or executives to trick finance teams into wiring money.
- Cyber crime revenue, broadly defined, now runs into the trillions of dollars annually.
- GDPR fines in Europe can reach 4% of gross revenue — a company-ending number for thin-margin businesses.
Right-Sizing Security to Your Stage
Romney’s framework is straightforward: spend security dollars proportional to actual risk. A garage-based widget seller doesn’t need a six-figure SIEM platform, but they absolutely need basic hygiene. As the company grows — physical assets, server rooms, software development lifecycle, international data flows — the security scope must grow with it. Skipping that evolution because “we already invested in this” is a board-level mistake Romney has seen firsthand.
SOC 2: What It Is and Why It Matters
Squeeze has held a SOC 2 certification for four consecutive years, and Romney walks through why. SOC 2 comes from the AICPA and covers confidentiality, integrity, availability, and privacy of data. He recommends most companies start with a Type 1 (point-in-time snapshot) before committing to a Type 2 (full-year audit), allowing teams to build competency before the clock starts. For Squeeze, the cert provides immediate trust signals in enterprise sales conversations. The next milestone Romney flags is ISO 27001 — a broader security operations standard worth targeting as the company scales further.
Practical Steps Any Business Can Take Today
- Password managers — Romney’s top low-hanging-fruit recommendation. In Air Force cyber operations, roughly 99% of successful network compromises came from leveraging passwords, not technical exploits.
- Multi-step financial controls — require a voice confirmation plus a second approver before any wire transfer, regardless of how urgent the request appears.
- Security awareness training at every level — including call-center staff on day one; keeping employees’ “spidey sense” sharp is more scalable than any technical control.
- Trust but verify — CEOs should request artifacts and audit evidence, not just assume the security team is handling it.
- Annual risk assessments — Romney’s team rebuilds Squeeze’s from a clean template each year to avoid blind spots from the prior year’s assumptions.
Closing Thought
Security teams are often labeled “the sales-prevention department” — the same reputation legal carries. Romney and the Squeeze hosts agree the right mindset shift is recognizing that a security professional with genuine business context is an asset, not an obstacle. What leadership follows up on signals what the organization actually values.
Your job as a security professional is to enable the business and make the security controls match the risk appetite of the business.
— Vince Romney
This is no longer some dude in a hoodie in a basement. These are corporations that conduct cyber crime — full-on hundreds of employees, CEO, CFO, COO.
— Vince Romney
99% of the time it's because we managed to leverage passwords. We rarely had to do a technical hack.
— Vince Romney
What you follow up on is what's important to you — that's what you signal to your organization.
— Nate Cay
Episode chapters
- 00:11 — Introductions & Why Cybersecurity Matters to Consumer Direct
- 02:38 — Security as a Business Enabler, Not a Blocker
- 06:11 — Right-Sizing Security to Company Stage
- 07:20 — The Modern Cyber Crime Landscape: APTs & Automated Bots
- 09:26 — How Attackers Make Money: Extortion, Fraud & Stolen Data
- 11:21 — Squeeze's SOC 2 Journey: Four Years of Certification
- 16:29 — Password Managers & Financial Fraud Prevention
- 19:11 — Trust But Verify: CEO Accountability in Security
- 22:01 — What Comes After SOC 2: ISO 27001, Risk Assessments & GDPR
- 24:07 — Final Takeaways & Parting Wisdom
Frequently asked questions
What is a fractional CISO and does my company need one?
A fractional CISO (Chief Information Security Officer) provides executive-level security strategy on a part-time or contract basis — ideal for mid-sized companies that need expert guidance without the cost of a full-time hire. If you're handling client data, processing payments, or pursuing enterprise customers, a fractional CISO can right-size your security program to your actual risk appetite.
What is SOC 2 certification and why do clients care about it?
SOC 2 is an audit framework from the AICPA that validates a company's controls around confidentiality, integrity, availability, and privacy of data. Enterprise and financial-services clients often require it as a baseline trust signal before signing contracts. Type 1 is a point-in-time snapshot; Type 2 covers a full audit period of six months to a year.
How do cyber criminals actually make money from a data breach?
The two primary methods are extortion (ransomware) and sale of stolen data or trade secrets. A third major vector is business email compromise — tricking finance teams into wiring money to fraudulent accounts by impersonating vendors or executives.
Why are password managers considered such a high-impact security tool?
Vince Romney notes that in his Air Force cyber operations experience, roughly 99% of successful network compromises leveraged passwords rather than sophisticated technical exploits. Password managers eliminate reused, weak, and easily guessed credentials — the most common attack entry point.
At what company size should you start taking cybersecurity seriously?
From day one of transacting online, according to Romney — even a one-person business collecting credit cards needs basic security hygiene. The key principle is scaling investment proportionally: a small operation doesn't need enterprise SIEM software, but it absolutely needs fundamentals like strong passwords, patched software, and awareness of phishing.
What comes after SOC 2 for a growing company's security roadmap?
Romney recommends annual risk assessments to continuously re-evaluate your environment, and points to ISO 27001 as a longer-term Northstar for overall security operations. If the business expands internationally, a dedicated data privacy function to address regional regulations like GDPR becomes necessary.