Who Owns Cloud Security?

More from The ITSM Practice: Elevating ITSM and IT Security Knowledge All episodes →

1. 

   S3 · E14 · 9 Jun 2026 · 11 min

   What DoDAF Can Teach Leaders About Architecture and Complexity

   Are modern enterprises losing control of their architecture? In this episode, Luigi Ferri explores why cloud adoption, outsourcing, SaaS expansion, and fragmented governance are creating hidden dependencies and increasing operational risk. Discover how the Department of Defense Architecture Framework (DoDAF) offers valuable lessons for improving architectural visibility, governance, resilience, and enterprise-wide coordination in today's complex digital ecosystems. In this episode, we answer to: Why are modern enterprises losing architectural ownership and visibility across complex digital…

2. 

   S3 · E13 · 2 Jun 2026 · 10 min

   Identity Is the New Perimeter

   AI is changing cybersecurity faster than most organizations can govern it. In this episode of The ITSM Practice Podcast, Luigi Ferri explores why identity has become the true enterprise perimeter. As organizations race to deploy Agentic AI, autonomous agents, cloud platforms, and APIs, many are building on identity governance models that were never designed for machine-scale decision-making. From Zero Trust Architecture and Identity & Access Management (IAM) to the lessons behind major breaches at MGM, Snowflake, and Uber, this episode examines a critical question: If enterprises struggled…

3. 

   S3 · E12 · 26 May 2026 · 10 min

   FINMA and ITIL 4: Building Resilient Swiss Banks

   FINMA Circular 2023/1 is transforming operational resilience from a compliance exercise into a strategic leadership priority for Swiss banks. In this episode, Luigi Ferri explains why ITIL 4 is far more than ITSM, it is a powerful enterprise operating model that connects governance, cybersecurity, risk management, supplier coordination, and business continuity to build truly resilient financial institutions. In this episode, we answer to: Why is operational resilience becoming the new license to operate for banks? How does ITIL 4 support FINMA resilience and cybersecurity requirements? What…

4. 

   S3 · E11 · 19 May 2026 · 6 min

   Broken Transmission: Why Fintech Strategy Fails

   Broken Transmission: Why Agile Fintechs Miss Strategy | In this episode of The ITSM Practice Podcast, Luigi Ferri explains why fintech strategy execution fails despite Agile delivery, strong squads, and constant releases. Learn how fragmented ownership, poor prioritization, and disconnected KPIs create operational misalignment, reducing business outcomes and authorization rate performance. In this episode, we answer to: Why do Agile fintech teams fail to execute business strategy effectively? How does fragmented ownership impact authorization rate improvement initiatives? Why do operational…

5. 

   S3 · E10 · 12 May 2026 · 9 min

   FINOS vs ISO 42001: What to Choose

   Fintech leaders: stop defaulting to ISO 42001. Discover how FINOS empowers you to design scalable, audit-ready AI governance before regulation forces your hand. Learn to align controls, reduce risk, and build governance by design—not by pressure. In this episode, we answer to: What makes FINOS a powerful alternative to ISO 42001? How can fintechs design governance before audits hit? Why does governance fail without alignment? Resources Mentioned in this Episode: FINOS website, article "AI Strategic initiative series: Building an AI Governance Framework - Key Takeaways from the NYC Workshop",…

6. 

   S3 · E16 · 28 Apr 2026 · 8 min

   CISO Strategy: Where Product Security Fails at Scale

   Most organisations manage only build and operate, ignoring growth, where security risk explodes. Luigi Ferri reveals how CISOs miss the most critical phase, where scaling, DevOps, and rapid decisions create hidden security debt. This episode challenges leaders to shift from reactive controls to full product lifecycle governance before risk turns into incidents. In this episode, we answer to: Why is product growth the most dangerous phase for cybersecurity risk? Are CISOs governing product lifecycle or just reacting to failures? How does DevOps accelerate delivery but weaken security…

7. 

   S3 · E13 · 21 Apr 2026 · 8 min

   ITIL 5 Exposed: Accountability Without Authority

   ITIL 5 exposes a critical ITSM flaw: Service Owners held accountable without authority. Discover how broken governance, security vs delivery conflicts, and unclear decision rights undermine outcomes. Learn why real accountability starts before operations, and how to redesign Enterprise Service Management for true leadership. In this episode, we answer to: Why are Service Owners accountable but not empowered in ITIL 5? How does the security vs delivery tension reveal weak ITSM governance? Resources Mentioned in this Episode: PeopleCert website, article "Understanding the evolution of ITIL",…

8. 

   S3 · E7 · 14 Apr 2026 · 9 min

   PSD3 Explained: Payments Security & Fraud

   PSD3 is reshaping payments security, moving beyond PSD2’s access model to address fraud, scams and trust abuse. This episode explains why strong authentication is no longer enough, how APIs become critical to trust, and what banks and fintechs must change to stay secure, compliant and resilient. In this episode, we answer to: What makes PSD3 fundamentally different from PSD2 in payments security? Is strong customer authentication enough to stop modern fraud? How do APIs influence trust, performance and security under PSD3? Resources Mentioned in this Episode: Stripe website, article "What…

9. 

   S3 · E6 · 7 Apr 2026 · 10 min

   AI Governance Illusion: Hidden Risks & Accountability in ITSM

   AI governance maturity can be misleading. Many organizations rely on frameworks, policies, and dashboards that signal control but fail to reflect true understanding of AI systems. This episode explores the Governance–Understanding Gap, highlighting why unclear decision ownership and limited system insight create hidden risks in AI, ITSM, and Enterprise Service Management environments. In this episode, we answer to: What is the worst decision an AI system could realistically make in practice? Which AI system in the organization is least understood and hardest to explain? If an AI system makes…

10. 

    S3 · E5 · 31 Mar 2026 · 7 min

    DevSecOps: Responsibility Without Authority

    DevSecOps promises shared security responsibility, but what happens when accountability shifts without decision authority? In this episode of The ITSM Practice Podcast, Luigi Ferri explores governance gaps, risk ownership, Security Champions, burnout, and structural ambiguity in DevSecOps. A sharp reflection for CISOs, AppSec leaders, and ITSM professionals navigating security governance and enterprise risk management. In this episode, we answer to: Who is explicitly allowed to accept risk in a DevSecOps operating model? What happens when developers receive security accountability without…