Signal to Noise with Mike Walsh: “Resilience isn’t just bouncing back; it’s bouncing back without a scratch.”

What matters for practitioners, by practitioners.

Welcome back to Signal to Noise, the series where we cut through the cybersecurity clutter to uncover what truly matters to industry practitioners. This month, we had the privilege of sitting down with Mike Walsh, a 13 year professional leading security at a technological healthcare company. Mike’s perspective on balancing cost, value, and resilience brings new insight into how cybersecurity leaders think about their investments, time, and strategies in a landscape saturated with noise.

Each interview in this series aims to distill the core concerns and actionable insights of those on the front lines of cybersecurity. Let’s dive into what Mike had to say.

1. How do you define the term “signal to noise”?

For Mike, “signal to noise” boils down to a cost-to-value ratio. If a tool or solution is producing more noise than actionable insights, it’s simply not worth it—there’s no value. As he puts it, “When you start filtering out so much noise that you lose the signal, you’ve hit the tipping point.” It’s a delicate balance, where too much reduction in noise can lead to missing critical signals.

His approach emphasizes finding tools and practices that provide meaningful, actionable information without overwhelming teams with irrelevant data. In Mike’s eyes, the goal is efficiency: achieving the highest possible value from the least amount of noise.

2. What’s your take on the FUD/AI marketing we see in the industry?

Mike acknowledges that while AI is indeed a game changer, the fear, uncertainty, and doubt (FUD) surrounding it isn’t entirely unwarranted. “AI can go horribly wrong,” he says, referencing issues like hallucinations or security failures, much like the early days of the internet when new risks were poorly understood. Now, niche AI tools are popping up everywhere, and while many rely on similar AI backends, the real challenge is determining whether a tool is trustworthy and adds value.

For Mike, AI tools must pass the trust test. He looks for transparency—whether a vendor can explain how their platform works—and often references frameworks like OWASP's Top 10 for AI to guide his evaluations.

3. How do you prioritize and value your time when it comes to security?

Mike wears many hats, from security policies, training and covering risks and mitigations across the enterprise. He’s also built a strong backbone of a security program, where his team divides their time across answering customer security reviews, managing vendor security programs, overseeing governance, risk, and compliance (GRC), and expanding vulnerability management. Each of these is vital to keeping his organization secure, and they all compete for Mike’s attention.

He emphasizes the importance of vendor security programs, as third-party incidents often pose significant risks. He also spends a lot of time talking—whether with internal stakeholders or customers—to ensure security standards are upheld. For Mike, time is a resource that must be allocated with care, focusing on areas that keep the company in business and its reputation intact.

4. How do you prioritize and value your investments in security?

Hiring the right people is Mike’s top priority. “Even with all the tools in the world,” he says, “if you don’t have the people to make sense of them, they’re not worth it.” He prioritizes tools that offer efficiency, automation, and intuitiveness—solutions that save time and are easy to understand without extensive training.

Mike highlights Wiz as an example of a tool with excellent documentation, which allows his team to quickly inspect and understand everything it does. He stresses the importance of a solution’s usability, noting that the best tools are the ones you don’t have to spend months learning to operate effectively.

5. Any advice you’d give to security vendors looking to add value to your organization?

Mike’s advice is simple: don’t try to do too much. “Beware the person who practices 1,000 kicks once,” he warns. Vendors that try to reinvent multiple wheels with buzzwords aren’t going to get far. Instead, Mike values vendors that specialize and can prove they offer something truly unique.

“Show me how your solution goes above and beyond competitors,” he says. “Otherwise, you’re just adding to the noise.”

6. How do you define resilience?

Resilience, for Mike, depends on the situation. “The first thing I want is always more details,” he says. But resilience, whether in a personal or professional context, is about how easily an organization can recover from an event. For instance, during the pandemic, resilience meant shifting to work-from-home with zero impact.

For Mike, true resilience is demonstrated by how self-sufficient an organization is in recovering from incidents like ransomware attacks. The most resilient companies are those that can bounce back without needing an expert to walk them through it. If they can handle the situation internally and get back to business quickly, that’s resilience.

Takeaways:

• Signal to noise is a balancing act: Tools should provide actionable insights without overwhelming teams with irrelevant data. Too much filtering can lead to missing critical information.

• AI brings both promise and peril: While AI offers significant advantages, it’s still an evolving field that requires careful scrutiny to ensure security and trustworthiness.

• People matter most: Tools are only as good as the people who use them. Hiring skilled staff is Mike’s top priority, with investments in tools that offer efficiency and ease of use coming second.

• Simplicity beats buzzwords: Vendors should specialize and demonstrate their value clearly, without trying to reinvent everything at once.

• Resilience is self-sufficiency: The ability to recover quickly and effectively from incidents, without external help, defines true organizational resilience.

Wrap Up:

As we wrap up this edition of Signal to Noise, Mike Walsh’s insights remind us that cutting through the clutter in cybersecurity isn’t just about having the latest tools—it’s about having the right people, the right mindset, and solutions that actually deliver value. Stay tuned for more interviews with industry leaders who are helping shape the future of security.

Stay secure and stay curious, my friends!

Damien