DevSecOps: Responsibility Without Authority

More from The ITSM Practice: Elevating ITSM and IT Security Knowledge All episodes →

1. 

   S3 · E17 · 5 May 2026 · 9 min

   Who Owns Cloud Security?

   A single question can expose a major cloud risk: who is responsible? This episode breaks down the cloud shared responsibility model, revealing how unclear ownership, misconfigurations, and weak governance lead to data breaches, and how ISO/IEC 27017 helps close the gaps. In this episode, we answer to: Who is really accountable for cloud security failures? Why do misconfigurations cause most cloud data breaches? How does ISO/IEC 27017 strengthen cloud security governance? Resources Mentioned in this Episode: ISO Standards website, standard ISO/IEC 27017:2015, link…

2. 

   S3 · E16 · 28 Apr 2026 · 8 min

   CISO Strategy: Where Product Security Fails at Scale

   Most organisations manage only build and operate, ignoring growth, where security risk explodes. Luigi Ferri reveals how CISOs miss the most critical phase, where scaling, DevOps, and rapid decisions create hidden security debt. This episode challenges leaders to shift from reactive controls to full product lifecycle governance before risk turns into incidents. In this episode, we answer to: Why is product growth the most dangerous phase for cybersecurity risk? Are CISOs governing product lifecycle or just reacting to failures? How does DevOps accelerate delivery but weaken security…

3. 

   S3 · E13 · 21 Apr 2026 · 8 min

   ITIL 5 Exposed: Accountability Without Authority

   ITIL 5 exposes a critical ITSM flaw: Service Owners held accountable without authority. Discover how broken governance, security vs delivery conflicts, and unclear decision rights undermine outcomes. Learn why real accountability starts before operations, and how to redesign Enterprise Service Management for true leadership. In this episode, we answer to: Why are Service Owners accountable but not empowered in ITIL 5? How does the security vs delivery tension reveal weak ITSM governance? Resources Mentioned in this Episode: PeopleCert website, article "Understanding the evolution of ITIL",…

4. 

   S3 · E7 · 14 Apr 2026 · 9 min

   PSD3 Explained: Payments Security & Fraud

   PSD3 is reshaping payments security, moving beyond PSD2’s access model to address fraud, scams and trust abuse. This episode explains why strong authentication is no longer enough, how APIs become critical to trust, and what banks and fintechs must change to stay secure, compliant and resilient. In this episode, we answer to: What makes PSD3 fundamentally different from PSD2 in payments security? Is strong customer authentication enough to stop modern fraud? How do APIs influence trust, performance and security under PSD3? Resources Mentioned in this Episode: Stripe website, article "What…

5. 

   S3 · E6 · 7 Apr 2026 · 10 min

   AI Governance Illusion: Hidden Risks & Accountability in ITSM

   AI governance maturity can be misleading. Many organizations rely on frameworks, policies, and dashboards that signal control but fail to reflect true understanding of AI systems. This episode explores the Governance–Understanding Gap, highlighting why unclear decision ownership and limited system insight create hidden risks in AI, ITSM, and Enterprise Service Management environments. In this episode, we answer to: What is the worst decision an AI system could realistically make in practice? Which AI system in the organization is least understood and hardest to explain? If an AI system makes…

6. 

   S3 · E4 · 24 Mar 2026 · 8 min

   ISO 31000 vs MoR: Closing the Risk Management Gap

   Enterprise Risk Management (ERM) often looks mature—risk registers, ISO 31000 alignment, MoR processes—yet fails to influence real decisions. In fintech and regulated environments, risk governance must shape judgment, not just document compliance. This episode explores why ISO 31000 and MoR lose impact under pressure, and how to align risk appetite, decision-making, and operational execution before risk accumulates. In this episode, we answer to: How can ISO 31000 truly influence enterprise decision-making in fast-moving fintech environments? Why does Management of Risk (MoR) become…

7. 

   S3 · E3 · 17 Mar 2026 · 7 min

   ITIL 5: Stop Explaining Failures. Start Owning System Decisions

   In this episode of the ITSM Practice Podcast, Luigi Ferri explores how ITIL 5 shifts leadership from explaining incidents to owning systemic decisions. In complex service ecosystems, governance must move upstream—before automation, architecture, and risk scale. True IT Service Management leadership is no longer about post-incident justification, but about accountable decision design in Enterprise Service Management. In this episode, we answer to: How does ITIL 5 redefine accountability in modern IT Service Management? Why is governance shifting upstream in complex, automated service…

8. 

   S3 · E2 · 10 Mar 2026 · 9 min

   ITIL 5, SCF and the Compliance Illusion

   In this episode of the ITSM Practice Podcast, Luigi Ferri challenges the illusion of security frameworks and compliance culture. Exploring the Secure Controls Framework (SCF), ISO, NIST and ITIL 5, he exposes governance immaturity, framework sprawl and risk misalignment. A sharp reflection on cybersecurity governance, enterprise risk management and why compliance without thinking weakens leadership. In this episode, we answer to: Is compliance replacing real risk-based security governance? Why do organizations accumulate ISO, NIST and SCF instead of clarifying risk ownership? How does ITIL 5…

9. 

   S3 · E1 · 3 Mar 2026 · 9 min

   ITIL 5 for CIOs: Governing AI-Driven Digital Systems at Scale

   ITIL 5 marks a decisive shift in IT Service Management. Moving beyond ITIL 4, it reframes services as AI-enabled digital product–service systems governed through data-driven decision models. This episode explores governance, accountability, CIO and CISO implications, and why ITIL 5 transforms service management into system leadership in an AI-native world. In this episode, we answer to: How does ITIL 5 redefine IT Service Management in an AI-native environment? What changes from ITIL 4 to ITIL 5 in governance, digital products, and value streams? What does ITIL 5 mean for CIOs and CISOs…

10. 

    S2 · E54 · 24 Feb 2026 · 8 min

    Why IT Maturity Is the Hidden Risk in IT Carve-Outs

    In this episode of The ITSM Practice Podcast, Luigi Ferri explains why IT maturity is the decisive factor in successful IT carve-outs. From dependency mapping to ITIL v3 governance and continuity stress testing, the episode shows how disciplined IT Service Management prevents disruption, cost overruns, and failed separations during complex enterprise transitions. In this episode, we answer to: Where is the real boundary between what IT owns and what a carved-out unit must take? What breaks first when a shared IT service disappears during a carve-out? Why does IT governance need to come…