The Rook Sun, 17 May 2026 19:41:05 -0400 https://therook.buzzsprout.com en-us © 2026 Corvus Cybersecurity - The Rook yes 01920812-ff20-5ded-addc-1a215ee5127f David Shaw episodic false Most security podcasts are built for practitioners. The Rook is built for the people who have to make decisions about security without being security experts.

Hosted by David Shaw — CISSP, fractional vCISO, and GRC consultant with 20 years in the seat — The Rook delivers board-ready intelligence for founders, PE operating partners, M&A attorneys, and executives who own security risk when security isn’t their day job.

Every episode covers one topic in depth with examples from a real incident, a regulatory development, a threat pattern, or a market shift. No vendor hype. No practitioner jargon. Just what it means for the business you're running or the deal you're working on — and what to do about it.

New episodes every other Tuesday.

]]> Buzzsprout (https://www.buzzsprout.com) David Shaw https://storage.buzzsprout.com/wgbzdiil2yoftlleg1c6flrax7wk?.jpg The Rook The Deal You Didn’t Know You Made: Cyber Risk in M&A The Deal You Didn’t Know You Made: Cyber Risk in M&A Send us Fan Mail

In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs.

In this episode:

  • How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligence
  • How Marriott bought a four-year-old, undetected breach when it acquired Starwood
  • Why the standard M&A cybersecurity questionnaire fails to catch material risk
  • How R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teams
  • The four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisions
  • What sellers should be doing now to protect deal value
  • Three artifacts every buyer should require, not just three questions to ask



The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

]]> Send us Fan Mail

In this episode of The Rook, David Shaw, founder of Corvus Cybersecurity and principal vCISO, examines the most consistently overlooked risk in M&A transactions: inherited cyber exposure. From Yahoo's misrepresentation of its breach history during the Verizon acquisition to the Marriott-Starwood breach that went undetected for four years, the pattern is the same. Cybersecurity due diligence gets a questionnaire, while financial and legal diligence get exhaustive scrutiny. The result is that acquirers close deals and inherit compromised environments, undisclosed incidents, and compliance gaps that carry real remediation costs.

In this episode:

  • How Yahoo's misrepresentations to Verizon held through signing, and what saved Verizon wasn't diligence
  • How Marriott bought a four-year-old, undetected breach when it acquired Starwood
  • Why the standard M&A cybersecurity questionnaire fails to catch material risk
  • How R&W insurance carve-outs and cyber insurance pre-existing condition exclusions are changing the stakes for deal teams
  • The four-stage cyber due diligence process used on the buy side, and the three-bucket model for translating findings into deal team decisions
  • What sellers should be doing now to protect deal value
  • Three artifacts every buyer should require, not just three questions to ask



The Rook · Corvus Cybersecurity · corvus-cyber.com · David Shaw, CISSP, GLEG

]]> David Buzzsprout-19078341 Mon, 27 Apr 2026 03:00:00 -0700 1219 full false