Before You Approve the 2027 Security Budget
That cybersecurity budget request about to land on the CFO's desk is full of acronyms and tool names, and the number probably went up again.
// Corvus Podcast
The Rook
Security strategy for the business you’ve built.
Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts.
Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant in security leadership since 2006 — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk without a dedicated security function.
Every episode covers one topic in depth: a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you’re running or the deal you’re working on — and what to do about it.
// Available on
// Episodes
Latest Episodes
The Leverage is the Data
Ransomware Without Downtime: The Shift to Data Exfiltration and Exposure David Shaw explains that ransomware leverage is shifting from encrypting systems...
The $200,000 Gap
There are roughly 35,000 CISOs worldwide serving an estimated 359 million businesses. That 10,000-to-1 ratio is not a hiring problem.
Notice Is the New Negligence
Most executives think the Known Exploited Vulnerabilities catalog is an IT problem.
Your Compliance Program Is Not a Security Program
A clean audit doesn't tell you whether your company is secure. It tells you something much narrower, and the gap between what the audit answers and what...
The Deal You Didn’t Know You Made
David Shaw examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo-Verizon to Marriott-Starwood, the pattern is the same — cybersecurity due diligence gets a questionnaire while financial and legal diligence…
// About the Show
Why The Rook?
In chess, the rook controls the open file — a support piece that enables every other piece to win, operating at scale across the board rather than in the weeds of tactical skirmishes. That is the fractional vCISO role exactly.
The rook is also a corvid — part of the crow family, tied to the Corvus brand. The Rook is made for the buyer, not the practitioner: the PE partner evaluating portfolio risk, the founder-CEO facing an audit request, the M&A attorney whose deal team needs a cyber read. These people think in strategy, risk, and outcomes. The show speaks their language.
Hosted by David Shaw, CISSP, GLEG — Founder of Corvus Cybersecurity and a practicing vCISO in security leadership since 2006. Read his analysis on The Corvus Brief.
One Topic
One real incident, regulation or market shift per episode
No Jargon
Business impact, cost of inaction, decision frameworks — not vulnerabilities and CVEs
For Leaders
PE partners, M&A attorneys, founder-CEOs, and CFOs who own security risk