Curated read
Cyber at the Top: Choosing the Right Cybersecurity Partners—A CISO's Playbook
How to pick vendors you'll still trust five years from now.
Hugh Thompson, RSA Conference, February 2, 2026. A conversation with Tal Arad, former CTO and Group CISO at Carlsberg Group. This is Trygg's summary. The full piece stays on RSA Conference.
The useful part is how to tell a partner you will still want in five years from a pitch you will regret in five months.
Join to save this for later.
Three lessons
Start with the problem you need to solve
Ask whether the vendor is closing a gap you already have, before you look at features, dashboards, or AI claims. That gap might be a new risk, a messy operation, or too many tools. Then get to a technical proof of concept, and put the people who will install it in the room. A partner who can describe a realistic timeline, including what will not go to plan, is showing you more than a polished pitch can.
Check that it fits what you already run
A product has to live inside the service desk, workflows, reporting, and habits people already have. Arad's example was a phishing-simulation tool that could not use the report button the company had already trained everyone to click. A second button would have undone that training. If you operate in more than one country, language and local rules are part of the same check.
Keep the relationship after the signature
A common miss is buying a broad platform and using only a slice of it. Another is letting the vendor go quiet once the contract is signed. Stay in touch with shared updates, clear expectations, and outcomes you can measure. The partners worth keeping will tell you what is best for your organization even when it costs them a sale. The ones who disappear after the sale tend to get a reputation among other security leaders.
Choose the partner you would still trust five years from now
Arad's test is simple. Pick someone you can picture still wanting to sit down with five years from now. The best cybersecurity partners are not defined by a flashy promise. They are defined by honesty, fit, and showing up when something breaks.
What this means for the partnership
The article describes the behaviors that build trust. Trygg can help put those behaviors into practice, by making an information security partnership visible and accountable.
| What the article recommends | How Trygg supports it |
|---|---|
| Clear expectations and measurable outcomes | Controls, assigned responsibilities, and supporting evidence give the client and the security partner a shared view of what needs attention and what has been completed. |
| Ongoing engagement after the sale | Maintaining security information and reviewing progress creates a basis for continuing collaboration throughout the relationship. |
| Alignment with the client's business | Organizing information about vendors, applications, employees, locations, and processes helps connect security work to the organization's actual operations. |
| Consistent follow-through and accountability | Documented work and evidence help clients assess whether recommendations are being carried out. |
| Honest advice that serves the client | Visibility into gaps and progress gives both parties a stronger basis for discussing priorities and investment decisions. |
Those connections follow the article: business fit, shared accountability, measurable outcomes, and staying engaged after the sale.
Trygg can make the work, the evidence, and the responsibilities visible. The partner still has to earn the trust. The people giving the advice have to show they know the work, say what they mean, and act in the client's interest.
Trust is built through clear expectations, shared visibility, and consistent follow-through. Trygg gives organizations and their information security partners a shared foundation for managing controls, documenting evidence, and tracking progress, so clients can see how their security program is being maintained.
The article is a useful outside reference for why the relationship matters. Trygg is how that relationship shows up in everyday work.
ISO/IEC 27001:2022
In an ISO/IEC 27001 program, choosing a security vendor and staying with them is supplier work. These are the controls an auditor will ask about when that choice is in scope.
- A.5.19 Information security in supplier relationships
- A.5.20 Addressing information security within supplier agreements
- A.5.21 Managing information security in the ICT supply chain
- A.5.22 Monitoring, review and change management of supplier services