Security Confidential S17 E10 Dr. Shayla Treadwell

Manoj Tandon:
Hello everyone! This is your host, Manoj Tandon, with another episode of Dark Rhino Security’s Security Confidential. Today, we have another phenomenal guest joining us. But first, a quick reminder—we’re all victims of the algorithm, so please hit Like and Subscribe to show some love. That way, we can keep bringing you these amazing speakers with immense knowledge and talent.

Today, we are honored to welcome Dr. Shayla Treadwell. Dr. Treadwell is an executive leader specializing in risk management, cybersecurity, and IT assurance. With many years of experience, she co-founded The Treadwell Agency, which advises organizations on digital transformation, cyber risk, and compliance. She’s known for developing effective cybersecurity risk management practices and sustainability programs. Her recent research focuses on AI governance and assurance, and she has a strong background in organizational leadership—exploring how leadership and security practices intersect to drive resilience.

Welcome to the show, Shayla. We appreciate you being here.

Shayla Treadwell:
Thank you. Thank you for having me today.

Manoj Tandon:
We always start with the background. Were you always a cybersecurity nerd, or did you come from somewhere else?

Shayla Treadwell:
I came from a different place. Going back to my undergrad at Bradley University in Illinois, I distinctly remember not knowing what I wanted to be. I just knew I loved learning. I earned a degree in business with a management major and a legal studies minor. I was even one class away from a music minor. I was doing everything until my mom told me to come home!

After graduation, I joined a leadership development program at a Fortune 500 company. That’s when they took “the marketing girl” and placed her in external IT. At first, I thought, how am I going to help here? But it was my first opportunity to see how technology impacts external customers. From there, I worked on SAP and CRM systems.

In my next rotation, I was placed in internal IT. Around that time, when the Obama administration launched the Affordable Care Act, insurance companies had to interact directly with consumers for the first time. I worked with a large healthcare company in a project management role, balancing backend developers, frontend developers, and communications teams. That’s when I began learning about regulations and security. HIPAA became central to my work.

What really launched my career into cyber was a role at Discover Financial. I became Chief of Staff to a phenomenal leader in information security. Initially, I thought I’d just be preparing PowerPoints and speaker notes. But quickly, I realized I needed to understand everything—how to run an information security program, what cybersecurity really meant.

At the same time, I was in my doctoral program. I learned that companies traditionally only cared about money. Information security was about protecting financial data. But that expanded quickly. Cybersecurity became this broader Venn diagram, protecting not just money, but people, processes, reputations, and beyond.

So my journey evolved from business objectives into translating them into technical requirements—bridging that business-to-cyber gap.

Manoj Tandon:
That’s a huge gap. Technical practitioners often struggle to translate controls into something business leaders care about: saving, making, or protecting money.

Shayla Treadwell:
Exactly. Cybersecurity may not be “new” anymore, but aligning with business goals remains critical. Every program must reflect the organization’s risk appetite. Are they willing to take on more risk, or are they in a highly regulated, risk-averse environment?

Manoj Tandon:
Risk measurement has been a controversial topic here. Ultimately, you can only do three things with risk: accept, transfer, or mitigate it.

Shayla Treadwell:
Absolutely. But I emphasize the distinction: information security and cybersecurity aren’t the same. InfoSec is business-focused; cybersecurity also covers areas like cyberbullying and reputational issues beyond direct business impact. Too often, people imagine cyber folks in hoodies in basements. In reality, we have goals, KPIs, and so do adversaries. It’s practical, day-to-day work.

Manoj Tandon:
So where do people fall on the continuum of resilience? How do you counsel them to actually adopt the practices you recommend?

Shayla Treadwell:
Resilience is often misunderstood. It’s separate from cybersecurity but interconnected. Resilience includes business continuity, service continuity, and disaster recovery—all distinct. For example, in credit card companies, service continuity focuses on preventing downtime for consumers (they must be able to swipe). Business continuity considers the company’s ability to record and process those transactions. Disaster recovery is about getting back up immediately after a failure.

Understanding where someone sits in that continuum is key, and balancing those perspectives is critical for survival.

Manoj Tandon:
So cybersecurity (or rather InfoSec) is really a people and process problem—technology just supports it.

Shayla Treadwell:
Yes. People, process, and technology—in that order. It’s about end users, customers, and adversaries. Technology is only a tool.

Manoj Tandon:
Adversaries study your people. Business email compromise, for example, is a process exploit, not a tech exploit.

Shayla Treadwell:
Bingo. Incentives and KPIs often drive behaviors that undermine security. If you incentivize employees to prioritize speed over security, or customer reps to click everything, you’ve created a vulnerability. Governance, risk, and compliance (GRC) needs to account for this across both technical and non-technical teams.

Manoj Tandon:
That’s a big mindset shift—and potentially a cost-saving one too.

Shayla Treadwell:
Exactly. It’s not about removing technology but optimizing it. If policies and behaviors are aligned, technology becomes more effective.

Manoj Tandon:
Let’s bring AI into this. Everyone has to talk about it today. AI governance—oxymoron or reality?

Shayla Treadwell:
Not an oxymoron. AI governance forces us back to basics: asset management and access management. Do you know what’s connected to your systems? Do you know who can access it? With LLMs, the question is: what were they trained on, what can they access, and are they contained?

The challenge is that many vendors have already turned AI on without asking. Governance means scoping usage, aligning with your ethical contract with customers, and disclosing appropriately.

Manoj Tandon:
But in reality, orgs often just ban ChatGPT. That fails 100% of the time.

Shayla Treadwell:
Exactly. People will use it anyway—without guardrails. I’d rather guide usage safely than ban it. It’s like telling a child not to touch the stove. Competition is using it, so you can’t avoid it. Provide guidelines, not prohibitions.

Manoj Tandon:
If you don’t, data will be exposed—and you can’t “untrain” a model.

Shayla Treadwell:
Correct. That’s why hygiene and scope matter. Also, give people safe environments to experiment—like digital twins for testing resilience or tabletop exercises. Used right, AI can strengthen resilience.

Manoj Tandon:
AI should be a co-pilot, not a replacement.

Shayla Treadwell:
Exactly. Use it to fortify yourself and understand the why. Stay curious. That’s the real key in cybersecurity—understanding the “why,” not just the “how.”

Manoj Tandon:
Beautifully said. Shayla, before we wrap, anything you’d like to plug?

Shayla Treadwell:
Yes—I’m co-chair of the Minnesota Cybersecurity Summit, October 21–22. Minnesota is unique—it hosts headquarters for all 16 critical infrastructure sectors. This year’s theme is Fearlessly Forward. We’ll discuss quantum, AI, and other emerging areas. You can attend in person or follow along on LinkedIn for updates.

Manoj Tandon:
And if people want to connect with you?

Shayla Treadwell:
Please reach out on LinkedIn. Send a message—I love connecting with people. If I don’t know the answer, I probably know someone who does. Remember, this isn’t a competition—we’re all on the same side. And no matter your background—communications, marketing, or computer science—you may already have a competency cyber needs. It’s just about finding the right fit.

Manoj Tandon:
Wonderful words to end on. Shayla, it’s been a pleasure. Please come back—we didn’t even get through half the questions!

Shayla Treadwell:
Thank you so much. This was a blast, and the hour flew by.