About this Episode
Hosts Aaron Lentz and Tim York talk to Scott Ostrander, Vice President and Chief Information Security Officer of SPS Commerce and Founding Member of MinnesotaCISO.
With the experience that comes with two decades at Medtronic and now leading security at a SaaS company, Scott shares how he builds trust, manages risk and leads with empathy in fast-paced environments. He breaks down the limitations of access reviews, how AI is reshaping identity verification and why listening matters more than immediate change. From deepfake threats to third-party visibility and vendor partnerships, Scott offers pragmatic insights and people-centered leadership advice for today’s CISOs.
Key Takeaways:
- (05:39) Deleting your biometric data reduces exposure if companies are sold or breached.
- (11:09) Culture and identity shape how security decisions are made in business.
- (16:30) Effective change depends on alignment and trust with the existing team.
- (26:32) AI deepfakes now challenge the reliability of identity verification.
- (28:22) Most organizations lack a clear view of their third-party risk landscape.
- (38:45) The real risk in access reviews is denying needed access.
- (43:46) Determining who has access to what remains difficult across SaaS ecosystems.
- (48:31) Trusted vendors offer insight and partnership, not just a sales pitch.
- (52:32) Trust builds when vendors stop selling and start listening.
Resources Mentioned:
