Building a cybersecurity culture in your company doesn't take a bigger budget — it takes a weekly habit. In this final episode of our encore series, returning guest snorkel42, a longtime Reddit voice in InfoSec, breaks down how he turned a company with zero dedicated security staff into one with a real security culture, just by committing to one small improvement every week instead of waiting on the next six-figure product.
We picked this one to bring back because of how it performed with you — not just downloads, but how much of the episode people actually stuck around for. That combination told us this conversation landed, and a lot of you came back to it more than once.
snorkel42 walks through where the term "security cadence" came from: a network engineering team, no InfoSec department, and a room full of unused tools nobody had the bandwidth to run. Instead of asking for more products, the team set a rule — one security change a week, no new vendor purchases allowed — for six months straight. What happened next is the real story: leadership noticed, and the team went from begging for resources to being handed them.
From there we get into what it actually took to build that cybersecurity culture day to day — the early challenges, how the team picked what to tackle first, and how a scrappy internal habit turned into something leadership actively championed. We also cover MFA, including why not all MFA is created equal, the SIM jacking risk that undercuts SMS-based codes, and the push-notification fatigue tactics attackers use to wear users down until they hit "yes" out of exhaustion. snorkel42 closes with a piece of advice worth sitting with: stop chasing the latest zero-day and start building your cybersecurity culture around how attacks actually function, start to finish. Do that, and ransomware protection comes along for free.
If you're the person in your company quietly carrying the security load, or you're trying to convince leadership that culture matters more than another line-item purchase, this one's for you.
00:00:00 — Cold open: you already own the tools you need
00:01:36 — Show intro and disclaimers
00:04:05 — Guest introduction: snorkel42's Reddit history and security cadence series
00:05:53 — Where the term "security cadence" came from
00:08:40 — Early challenges building the habit
00:44:57 — MFA, password security, and why not all MFA is equal
00:47:46 — SIM jacking and push-notification fatigue attacks
00:51:45 — Patching, WannaCry, and why chasing zero-days misses the point
