The CISO Before CISO's

About this episode

Scott Crawford's first security job didn't have a name yet. In 1998 he took over digital security at the International Data Center of the Comprehensive Nuclear-Test-Ban Treaty Organization in Vienna—next door to the IAEA, serving 150-odd signatory nations—and the title CISO hadn't been invented. He'd been a commercial pilot in Montana, then went back to grad school, then landed at UCAR in Boulder, where a grapevine of geophysicists pointed him at a job posting so skewed toward physical security that he told the hiring committee what was wrong with it. They hired him anyway. His master's thesis, written on site, was about building a regime of trust in an atmosphere of mutual distrust—which turns out to be a decent description of the next twenty-five years, spent as one of the industry's original analysts and eventually as head of information security research at 451 Research and S&P Global. In this episode, Scott tells Mehul why security is the only technology field where you have to model an adversary who is actively trying to defeat you, why the platform wars are really data-foundation wars, and why he's careful to say models emulate reasoning rather than reason. He also coins a term worth stealing—"Dave Barry's dog syndrome," the model that agrees with every correction you make as if you'd revealed something profound—and gets specific about cyber offense in the age of Mythos and Fable, why the absence of AI-driven exploitation in the wild is a lagging indicator, and where the open-weights fight actually gets decided. Two months into retirement, he's writing his own code, and he thinks the conventional idea of retirement no longer holds for anyone.