No SBOM, No Trust

More from The ITSM Practice: Elevating ITSM and IT Security Knowledge All episodes →

1. 

   S3 · E25 · 25 Aug 2026 · 9 min

   ENISA Cyber Exercises: Why Testing Cybersecurity Isn't Enough

   Are cyber exercises actually improving your cybersecurity resilience, or just satisfying compliance requirements? In this episode, Luigi Ferri explores ENISA's cyber exercise methodology, the gap between testing and real capability improvement, the role of MSPs in incident response, and why organizations must focus on measurable cyber resilience instead of annual audit-driven exercises. In this episode, we answer to: Why are cyber exercises important for improving cybersecurity resilience rather than just meeting compliance? What is the difference between testing cybersecurity and improving…

2. 

   S3 · E24 · 18 Aug 2026 · 11 min

   Projects Deliver Outputs. Services Deliver Outcomes.

   Projects Deliver Outputs, Services Deliver Outcomes: The Ownership Crisis Nobody Discusses. Discover why the biggest risk in any IT project begins after go-live. In this episode, Luigi Ferri explores the critical difference between project outputs and service outcomes, why Service Ownership is essential for long-term business value, and how IT Service Management (ITSM), Product Management, and Business Capability Management must work together to drive sustainable success. Learn why organizations have an ownership problem. In this episode, we answer to: Why is the day after go-live often the…

3. 

   S3 · E23 · 11 Aug 2026 · 17 min

   MSPs: Your AI Contracts Are Obsolete

   AI is transforming Managed Service Providers (MSPs) from managing technology to managing AI behavior. This episode explains why traditional service design, governance, contracts, and risk models are no longer sufficient for AI-enabled services. Learn how AI impacts ITIL service management, AI governance, MSP liability, ISO 42001, NIST AI RMF, the EU AI Act, and why AI ownership, accountability, and updated contracts are now business-critical. In this episode, we answer: How does AI change the nature of IT services and MSP service design? Why are traditional MSP contracts, governance models,…

4. 

   S3 · E22 · 4 Aug 2026 · 10 min

   DARE25: Why Defense Isn't Enough

   Discover why traditional cybersecurity defense is no longer enough in the AI era. Luigi Ferri explores the DARE25 framework, dynamic risk management, governance, Purple Teaming, accountability, and adaptive leadership. Learn how Enterprise Service Management, IT Service Management, and cybersecurity leaders can build resilient organizations by prioritizing behavior, faster adaptation, and continuous learning. In this episode, we answer to: Why is traditional cybersecurity defense no longer enough in the age of AI? How does the DARE25 framework improve risk management, governance, and…

5. 

   S3 · E21 · 28 Jul 2026 · 14 min

   ISO 28000: Your Resilience, Their Budget

   In this episode of the ITSM Practice Podcast, Luigi Ferri explores why supply chain resilience has become one of the biggest strategic challenges for Government Managed Service Providers (MSPs). Using practical examples from healthcare and public services, he explains how ISO 28000 shifts the conversation from protecting internal systems to managing the security and resilience of the organizations you depend on. Discover why supplier failures, inherited risk, and third-party dependencies are becoming the greatest threats to service continuity, cybersecurity, and operational resilience in…

6. 

   S3 · E19 · 14 Jul 2026 · 7 min

   PSD3: Who Owns Trust?

   PSD3 is more than a compliance requirement, it's a test of organisational maturity, security leadership, accountability, and decision-making. Discover how Enterprise Service Management, IT Service Management, and cybersecurity principles help organisations balance security, customer trust, and clear ownership to build resilience beyond regulatory compliance. In this episode, we answer: How does PSD3 reveal an organisation's maturity and decision-making under pressure? When should security lead, and when should it step back to enable business ownership? Who is truly accountable for trust,…

7. 

   S3 · E18 · 7 Jul 2026 · 11 min

   The Hidden Cost of Untrusted Data

   Why do organizations struggle to trust their operational data despite having plenty of it? In this episode of The ITSM Practice Podcast, Luigi Ferri explains the critical difference between data quality and data integrity, and why CIOs must build operational trust before launching digital transformation initiatives. Learn practical ITSM strategies to improve data governance, CMDB accuracy, operational accountability, and Enterprise Service Management. In this episode, we answer to: What is the difference between data quality and data integrity, and why does it matter for CIOs? Why do…

8. 

   S3 · E16 · 30 Jun 2026 · 10 min

   ITIL 5 Foundation: Exam Success

   Preparing for the ITIL 5 Foundation exam? Discover why successful candidates focus on understanding the ITIL Value System, Value Chain, Governance, AI Capability, Four Dimensions, and Service Lifecycles as one connected system instead of isolated chapters. Learn smarter study strategies to improve your exam performance and master ITIL 5 concepts. In this episode, we answer to: Why is the ITIL Value System the foundation for understanding the entire ITIL 5 framework? How does AI Capability depend on governance, knowledge management, and operating models? How can you study the ITIL 5…

9. 

   S3 · E17 · 23 Jun 2026 · 8 min

   PSD3: Governance Before Technology

   In this episode, Luigi Ferri explores why organisations often take the wrong first step when preparing for PSD3 compliance. Rather than rushing into new tools, fraud platforms, or transformation programmes, PSD3 readiness begins with observation. Learn how incident response, governance, decision authority, and organisational behaviour under uncertainty reveal the real gaps that PSD3 exposes. Discover why governance maturity and clear accountability are critical for building a resilient PSD3 strategy. In this episode, we answer to: Why is the first step towards PSD3 compliance so often the…

10. 

    S3 · E14 · 16 Jun 2026 · 13 min

    AI Security Strategy: Why Midmarket Organizations Get It Wrong

    Why do most AI security strategies fail in the midmarket? In this episode of The ITSM Practice Podcast, we explore why successful AI security is not about buying more AI tools but about building the right foundation first. Learn how identity management, telemetry quality, governance, and operational maturity determine AI security success. We discuss AI readiness, MSSP evolution, cybersecurity automation, SOC transformation, and practical AI security roadmaps for midmarket organizations. Discover why AI augments security teams rather than replacing them and how organizations can achieve…