Outlines a seven-step methodology for building an effective InfoSec program by focusing on the "art," or people side, of security. The author, Todd, draws on over two decades of experience to argue that success hinges on cultivating strong relationships and ensuring alignment with the company's risk tolerance, as most organizations are indifferent to information security. The book advocates for the "neighborhood watch" model where security responsibilities are shared across the company, rather than centralized, emphasizing key processes like documentation, governance, security architecture, and communication as vital cornerstones for establishing a security culture. Finally, the text suggests measuring success through simple, relatable metrics like an employee's ability to identify and report phishing emails and policy violations, to demonstrate the program’s return on investment to leadership.
