Shay Colson is a Co-founder and Managing Partner at Intentional Cybersecurity, a risk assessment and strategic advisory firm. After spending his early career as a security engineer for the US Government, he worked for a global consulting firm. 

The evolving cyber landscape constantly presents new challenges that require businesses to elevate their cybersecurity posture. With the release of NIST CSF 2.0, organizations now have a stronger framework to guide their approach, focusing on governance as a critical function. This addition emphasizes the importance of integrating cybersecurity as a core business function rather than treating it as a siloed IT function. How can organizations adapt to this evolving landscape while improving resilience and reducing risk?

Governance now leads NIST CSF 2.0 as the primary function, emphasizing the importance for organizations to clearly define cybersecurity ownership, responsibilities, and decision-making processes. Organizations need to move beyond treating cybersecurity as a technical issue to recognizing it as a core business function. And, as threat actors become more sophisticated and leverage AI to accelerate cyber attacks, businesses need to adopt governance models that promote agility, resilience, and proactive risk management. This means integrating security and privacy frameworks into business operations.

In this episode of She Said Privacy/He Said Security, Jodi and Justin Daniels speak with Shay Colson, Managing Partner and Co-founder of Intentional Cybersecurity, about the critical role governance plays in building cyber resilience. Shay explains how companies can use frameworks like NIST CSF 2.0 to implement scalable cybersecurity strategies without overextending their resources. He also shares insights on the intersection of security and privacy, AI-driven risk assessments, and why focusing on the basics is essential before adopting advanced solutions.