Chasing Entropy Episode 006: From Hammers to Hope with Wendy Nather

8 snips

Jun 3, 2025

Wendy Nather, a cybersecurity trailblazer known for her innovative concept of the 'security poverty line,' shares her unconventional career journey. She discusses her transition from Unix systems at a Swiss bank to pivotal CISO roles. Wendy emphasizes the need for empathy in cybersecurity leadership, arguing that understanding people is key to success. She highlights how resource constraints impact security practices and calls for a collaborative approach between security and business operations. Her insights inspire a more inclusive view of cybersecurity careers.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

ANECDOTE

Wendy's Unplanned Career Path

Wendy Nather's cybersecurity career began unexpectedly with a Swiss bank's IT outsourcing task force.
She continuously said "yes" and improvised roles, including creating the security strategist role at Duo.

INSIGHT

The Hammer Metaphor for Security

Understanding security requires practical experience beyond just building tools.
Vendors often miss nuances only a practitioner would know, like how a skilled carpenter knows their hammer.

INSIGHT

Understanding the Security Poverty Line

Many organizations operate below the "security poverty line" with inadequate budgets and outdated tech.
Lack of resources leads to vulnerable infrastructure that impacts the broader digital ecosystem.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

In this episode of Chasing Entropy, I sit down with cybersecurity trailblazer Wendy Nather for an honest, insightful, and occasionally hilarious conversation that spans career origin stories, hammer metaphors, and how empathy is the secret weapon of modern security leadership.

From Swiss Banks to Strategy

Wendy Nather’s journey into cybersecurity is anything but conventional. From wrangling Unix systems at a Swiss bank to being unexpectedly appointed head of EMEA security, her career has been a series of “say yes and figure it out later” moments. Her creation of the security strategist role at Duo (where she helped bring Dave onboard) laid the groundwork for today’s Advisory CISO model—distinct from field CISOs and rooted in trust-building and strategic influence.

Understanding the Security Poverty Line

Wendy unpacks her now-famous concept of the “security poverty line,” a lens for understanding how underfunded, understaffed organizations struggle to meet industry best practices. It's a call to move beyond judgment and toward practical empathy—especially when small businesses with outdated gear and little budget become backdoor vulnerabilities in the broader digital ecosystem.

The Human Side of Cybersecurity

The conversation dives deep into the need for empathy, especially at the CISO level. Wendy argues that real leadership in security isn’t about technical perfection—it’s about understanding people, building influence, and leading with compassion. For those just entering the field, she reminds listeners that many roles in cybersecurity today didn’t even exist a decade ago, and that we’re all still “making this up as we go.”

Agentic AI, Zero Trust, and a Spoon

The pair also reflect on the rise of agentic AI and its implications for zero trust architectures. Wendy challenges the assumption that AI introduces completely new risks, suggesting instead that it’s a matter of awareness, contract transparency, and figuring things out as a community. She also revisits her “spoon” analogy from past keynotes: good security design should be as intuitive as using a spoon—hard to mess up, universally usable.

Final Thoughts

Wendy closes with advice for veterans and newcomers alike: surround yourself with peers you trust, keep learning, and don’t buy into gatekeeping myths that overvalue technical credentials. What really matters is adaptability, collaboration, and understanding the bigger picture.

Subscribe to Chasing Entropy on your favourite podcast platform and join us next time as we continue to unravel the systems and stories shaping cybersecurity.