{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Distilled Security Podcast","title":"Episode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRC","html":"","width":"100%","height":180,"duration":6837,"description":"\nEpisode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRC\n\n\n\nEpisode 16 of the Distilled Security Podcast is here!\n\nIn this episode, Justin, Joe, and Rick christen the new studio and dive into some of the trickiest challenges in measuring, reporting, and governing security programs. From maturity models to board reporting, the conversation unpacks how scoring systems can mislead, how to communicate bad news effectively, and why boards need more than just “checkbox” cyber expertise.\nThe team also explores the rise of vGRC (Virtual GRC) services—what they are, how they differ from vCISO offerings, and when organizations should consider fractional models. And of course, no episode would be complete without a pour: this week, a rich Woodford Reserve Double Double Oaked bourbon.\n\nTopics Covered\nNew Studio Upgrade: Behind-the-scenes on mics, cameras, and why the couch had to go.\nMeasuring to the Score: The dangers of chasing maturity numbers instead of real security outcomes.\nScoping, Rubrics & Auditor Whim: Why assessments are subjective and how leadership often misunderstands the results.\nCultural Incentives: How bonuses, compliance checkboxes, and “auditor shopping” distort security reporting.\nPrepping for New Tools: Setting expectations with leadership when visibility spikes after deploying monitoring or vulnerability tools.\nBoards and Cybersecurity Expertise: Should cyber knowledge be mandated at the board level—or does it risk creating the illusion of safety?\nVirtual GRC vs. vCISO: What fractional GRC services really deliver, how they differ from vCISO roles, and why naming clarity matters.\nBourbon Review: Woodford Reserve Double Double Oaked — syrupy, smooth, and perfect for a holiday pour.\nHosts\nJustin Leapline\nJoe Wynn\nRick Yocum\nConnect with Us\n 🌐 Website: distilledsecuritypodcast.com\n 🐦 Twitter: @DisSecPod\n 📧 Email: hello@distilledsecuritypodcast.com","thumbnail_url":"https://img.transistorcdn.com/MJdG3-EB1xgpmosNU-oEduyFhaC1R3HoELIm4f9vQDM/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9iMjk1/MTk1NTkwZTA3OThl/NzAxOGMwZjM4NTEy/MjVmOS5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}