Skip to content
Sign in
Artwork for The ITSM Practice: Elevating ITSM and IT Security Knowledge
Technology

The ITSM Practice: Elevating ITSM and IT Security Knowledge

Luigi Ferri

Join Luigi Ferri, an experienced ITSM & IT Security Professional, in 'The ITSM Practice.' Explore IT Service Management and IT Security, uncovering innovations and best practices with insights from leading organizations like Volkswagen Financial Services, Vodafone, and more. Each episode offers practical guides and expert discussions for learning and growth. Ideal for all ITSM and IT Security Professionals!

Stay Connected:
LinkedIn: https://www.linkedin.com/in/theitsmpractice/
Youtube: https://www.youtube.com/@theitsmpractice
Website: http://www.theitsmpractice.com

Play
Open in
  • 29 episodes
  • weekly
  • Avg 10 min
  • English

Episodes 29

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S3 · E32
    Tuesday · 13 min

    Your SOC Stops at the Firewall. Should It? - Part 2

    What happens when a cyber-physical threat crosses Cybersecurity, Physical Security, Facilities and IT Operations? This episode explores how SOC teams can correlate signals, establish incident ownership, define escalation thresholds and build a unified operating model to protect critical infrastructure and business services. In this episode, we answer to: If Physical Security sees one part of an attack and the SOC sees another, who sees the whole threat? When multiple departments are involved in the same security event, who owns 100% of the incident and its outcome? How should organizations respond to cyber-physical threats before they cause an outage, compromise or business impact? Resources Mentioned in this Episode: Le Monde website, article "France scales up anti-drone measures to industrial level as threat rises", link https://www.lemonde.fr/en/economy/article/2026/03/10/france-scales-up-anti-drone-measures-to-industrial-level-as-threat-rises_6751296_19.html ABJ Academy website, article "Can Private Security Shoot Down Drones?", link https://abjacademy.global/drone-blog/can-private-security-shoot-down-drones/ GOV.UK website, article "£1.85 million competition launched to counter illegal UAS use around prisons and sensitive sites", link https://www.gov.uk/government/news/185-million-competition-launched-to-counter-illegal-uas-use-around-prisons-and-sensitive-sites Frost & Sullivan website, report "Dedrone Final Report", link https://www.frost.com/wp-content/uploads/2025/08/Dedrone-Final-Report.pdf Dedrone website, page "Critical Infrastructure", link https://www.dedrone.com/industry/critical-infrastructure C-UAS Hub website, article "Telecom Giant Orange Enters Counter-Drone Market with ‘As-a-Service’ Model", link https://cuashub.com/en/content/telecom-giant-orange-enters-counter-drone-market-with-as-a-service-model/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E31
    October 6 · 7 min

    Your SOC Stops at the Firewall. Should It? - Part 1

    Does your SOC really protect the entire business, or does its visibility stop at the firewall? In this episode of The ITSM Practice Podcast, Luigi Ferri explores drone threats against data centers and what they reveal about gaps between Cybersecurity, Physical Security, Facilities, IT Operations and Business Continuity. Discover why CISOs need to rethink the traditional cyber attack surface and focus on protecting the complete service. In this episode, we answer to: Where should the SOC security perimeter really end? How can CISOs identify the true attack surface of a critical business service? Who owns the incident when Cybersecurity, Physical Security and Facilities each detect different parts of the same threat? Resources Mentioned in this Episode: Bird & Bird website, article "European Commission Counter-UAS Action Plan", link https://www.twobirds.com/en/insights/2026/uk/european-commission-counter-uas-action-plan Commercial UAV News, article "How Counter-UAS Infrastructure Is Building the Foundation for Commercial Drone Operations", link https://www.commercialuavnews.com/counter-uas-europe-commercial-drone-infrastructure Digitalisation World website, article "Drones and Datacenters: An Unexpected Aerial Adversary Amidst the AI Boom", link https://digitalisationworld.com/blogs/58771/drones-and-datacenters-an-unexpected-aerial-adversary-amidst-the-ai-boom BBC News, article "Amazon Says Drones Damaged Three Facilities in UAE and Bahrain", link https://www.bbc.com/news/articles/cgk28nj0lrjo DW website, article "Germany Investigates Drone Flights Over Industrial Park", link https://www.dw.com/en/germany-investigates-drone-flights-over-industrial-park/a-70021895 Maris-Tech website, article "CUAS (Counter Unmanned Aerial Systems): A Complete Guide for Defense & HLS Teams", link https://www.maris-tech.com/blog/cuas-counter-unmanned-aerial-systems-a-complete-guide-for-defense-hls-teams/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E30
    September 29 · 14 min

    ITIL 5: The 6C Model for AI

    AI that summarizes an incident is one thing. AI that disables accounts, isolates endpoints and blocks connections is another. In this episode of The ITSM Practice Podcast, Luigi Ferri explains the ITIL 5 6C Model for AI and why CIOs, CISOs and MSPs need to stop asking, “Are we using AI?” and start asking, “What are we allowing AI to do?” In this episode, we answer to: What is the ITIL 5 6C Model for AI? How much authority should MSPs give AI to decide and act? Who is accountable when autonomous AI gets a decision wrong? Resources Mentioned in this Episode: ITIL website, article "AI Governance in Organizations", link https://www.itil.com/Itil-News-and-Announcements/itil-ai-governance-organizations ITIL website, white paper "ITIL AI Governance White Paper", link https://www.itil.com/-/media/itilsite/site-assets/documents/itil-ai-governance/itil-ai-governance-white-paper-2025.pdf PeopleCert Community website, article "AI Governance in Service Management", link https://community.peoplecert.org/home/clubs/itil/blogs/ai-governance-in-service-management PeopleCert Community website, article "What ITIL AI Governance Teaches Us About Maturity in an AI-Enabled World", link https://community.peoplecert.org/public/clubs/itil/blogs/what-itil-ai-governance-teaches-us-about-maturity-in-an-ai-enabled-world ITIL website, article "Governing AI in organizations – new ITIL guidance is making a difference", link https://itil.com/Itil-News-and-Announcements/itil-version-5-ai-governance-guidance ITIL website, article "ITIL AI Governance (Version 5): categorizing and assessing AI, and deploying appropriate controls", link https://www.itil.com/Itil-News-and-Announcements/itil-version-5-ai-governance-controls PeopleCert Community website, article "ITIL (Version 5): A Value Stream Perspective", link https://community.peoplecert.org/public/clubs/itil/blogs/itil-version-5-a-value-stream-perspective Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E29
    September 22 · 19 min

    Should Your CMDB Know Your Business Risk?

    A critical vulnerability is not automatically a critical business risk. If your CMDB only tells you which server is affected but not the customer, service, contract, SLA, or revenue behind it, you are missing the information that matters. This episode explains why CISOs need a business-aware CMDB to connect technical risk with real business impact. In this episode, we answer to: Can your CMDB tell the CISO what a security incident actually means for the business? How do you prioritize vulnerabilities based on customers, SLAs, contracts, and revenue at risk? Why is connecting CMDB, ITSM, CRM, and ERP data critical for risk-based security decisions? Resources Mentioned in this Episode: PeopleCert website, course "ITIL 4 Practitioner: Service Configuration Management", link https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-4-practitioner-service-configuration-management-3800 PeopleCert website, case study "SITA", link https://www.peoplecert.org/-/media/folders-reorganized/pdfs/itil-maturity-model/cs-sita.pdf ServiceNow website, guide "CMDB Design Guidance", link https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/white-paper/wp-cmdb-design-guidance.pdf BMC website, article "Best Practices for the Common Data Model", link https://docs.bmc.com/xwiki/bin/view/Service-Management/IT-Service-Management/BMC-Helix-CMDB/ac254/Managing-the-common-data-model/Best-Practices-for-the-Common-Data-Model/ Device42 website, article "CMDB Architecture Best Practices: Aligning Design with IT Objectives", link https://www.device42.com/cmdb-best-practices/cmdb-architecture/ Device42 website, guide "The Technical Guide to CMDB Best Practices", link https://www.device42.com/cmdb-best-practices/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E28
    September 15 · 13 min

    Is Your Security Stack Too Big?

    Is your security stack actually protecting you, or are you just paying for too many tools? This episode looks at security tool sprawl, unused capabilities, overlapping products, skills gaps and vendor dependency. Before buying another security product, understand what you already have, what your team can actually operate and what would really happen if you switched a tool off. In this episode, we answer to: Are you paying for security tools you do not actually need? Is your team using the security capabilities you already pay for? Should you consolidate security tools or invest in specialist products? Resources Mentioned in this Episode: Meriplex website, blog article “Cybersecurity Services for Mid-Market Businesses: What You Really Need in 2025”, link: https://meriplex.com/cybersecurity-services-for-mid-market-businesses/ HashiCorp website, blog article “The risks of cybersecurity tool sprawl: Why consolidation is a strategic priority”, link: https://www.hashicorp.com/en/blog/the-risks-of-cybersecurity-tool-sprawl-and-why-we-need-consolidation MES Computing website, article “What Midmarket CIOs Must Prove By EOY 2026: Fewer Platforms, Faster Security, Measurable Outcomes”, link: https://www.mescomputing.com/news/2026/business/what-midmarket-cios-must-prove-by-eoy-2026 CyberNeurix website, blog article “Security Tool Consolidation in 2026: Why CISOs Are Deleting Tools Instead of Buying Them”, link: https://blogs.cyberneurix.com/blog/security-tool-consolidation-2026/ Red Canary website, blog article “Why CISOs under consolidation pressure are embracing Microsoft Security solutions”, link: https://redcanary.com/blog/microsoft/tool-consolidation-microsoft/ Bitdefender Business Insights website, article “The Security Platform Is Dead. Long Live the Security Platform.”, link: https://businessinsights.bitdefender.com/security-platform-is-dead-long-live-security-platform Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E27
    September 8 · 11 min

    24/7 IT Support: Why Coverage Is Not Capability

    24/7 support does not automatically mean 24/7 capability. In this episode of The ITSM Practice Podcast, Luigi Ferri explores how MSPs can design profitable 24/7 IT support using follow-the-sun models, AI, automation, Level Zero support, intelligent routing, and service tiers, while protecting engineering capacity, customer experience, SLAs, and margins. In this episode, we answer to: How can MSPs deliver effective 24/7 IT support without replicating expensive engineering capability across every time zone? How can AI, automation, and Level Zero improve incident management, troubleshooting, routing, and follow-the-sun handovers? How can MSPs balance SLA performance, customer experience, engineering capacity, and profitability in a 24/7 support model? Resources Mentioned in this Episode: TechMonarch website, article “How to Scale Managed IT Services for Growing Businesses Without Compromising Quality”, link: https://techmonarch.com/blog/how-to-scale-managed-it-services-for-growing-businesses-without-compromising-quality/ Splashtop website, article “5 Strategies for Scaling IT Operations”, link https://www.splashtop.com/blog/5-strategies-for-scaling-it-operations Convergence Networks website, article “How to Overcome the 10 Biggest Managed Services Challenges”, link: https://convergencenetworks.com/blog/managed-it-services-challenges/ Advance IT website, article “From Startups to Scale-Ups: Key Trends in Scaling Operations for Long-Term Growth”, link: https://www.advanceit.sg/blog/from-startups-to-scale-ups-key-trends-in-scaling-operations-for-long-term-growth ScottMadden, website, article “IT Organizational Structures Explained: Finding the Best Fit”, link: https://www.scottmadden.com/insight/it-organizational-structures-explained-finding-the-best-fit/ BPM website, article “Scaling IT Security Operations”, link: https://www.bpm.com/insights/scaling-it-security-operations/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E26
    September 1 · 11 min

    The Last Human-Only Leadership Generation: How AI Is Transforming the Workforce

    AI is no longer just a technology tool, it is becoming part of the workforce. In this episode, Luigi Ferri explores why AI represents a workforce transformation rather than a technology project, and how CIOs, CISOs, and business leaders must rethink governance, digital workers, AI leadership, cybersecurity, and Enterprise Service Management to successfully manage hybrid human-AI teams. In this episode, we answer to: Why is AI a workforce transformation rather than just another technology implementation? How should CIOs and CISOs govern and manage digital workers alongside human employees? What leadership, governance, and cybersecurity challenges emerge when AI agents become part of the workforce? Resources Mentioned in this Episode: ServiceNow website, article "Autonomous Workforce", link https://www.servicenow.com/platform/autonomous-workforce.html Atomicwork website, article "The AI Workforce: What it actually is and how to make it work for your service teams", link https://www.atomicwork.com/itsm/ai-workforce-guide Digital Workforce, article "Business Automation. Orchestrated.", link https://digitalworkforce.com NICE Cognigy website, article "AI Agent Examples and Use Cases for Enterprise Contact Centers", link https://www.cognigy.com/ai-agents/examples-ai-agents DOMO website, article "Customer Support AI Agents: What They Are and How to Build Them for Best Results", link https://www.domo.com/blog/customer-support-ai-agents-what-they-are-and-how-to-build-them-for-best-results IBM website, article "Better customer service with AI agents", link https://www.ibm.com/think/topics/ai-agents-in-customer-service Torq website, article "The Economics of an Agentic SOC: How AI Reduces Security Operations Costs", link https://torq.io/blog/economics-agentic-soc/ KuppingerCole website, article "The Emerging AI Security Operations Center (SOC)", link https://www.kuppingercole.com/research/lc81057/the-emerging-ai-security-operations-center-soc Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E25
    August 25 · 8 min

    ENISA Cyber Exercises: Why Testing Cybersecurity Isn't Enough

    Are cyber exercises actually improving your cybersecurity resilience, or just satisfying compliance requirements? In this episode, Luigi Ferri explores ENISA's cyber exercise methodology, the gap between testing and real capability improvement, the role of MSPs in incident response, and why organizations must focus on measurable cyber resilience instead of annual audit-driven exercises. In this episode, we answer to: Why are cyber exercises important for improving cybersecurity resilience rather than just meeting compliance? What is the difference between testing cybersecurity and improving organizational cyber resilience? How can organizations ensure cyber exercise findings lead to measurable capability improvement? Resources Mentioned in this Episode: ENISA website, guideline "ENISA Technical Advisory for Secure Use of Package Managers", link https://r.search.yahoo.com/_ylt=AwrkMQ3LAHFqUAIA0Av04olQ;_ylu=Y29sbwNpcjIEcG9zAzIEdnRpZAMEc2VjA3Ny/RV=2/RE=1787000268/RO=10/RU=https%3a%2f%2fwww.enisa.europa.eu%2fsites%2fdefault%2ffiles%2f2026-03%2fENISA%2520Technical%2520Advisory%2520-%2520Package_Managers_Final.pdf/RK=2/RS=gKGJNKMoHHsXF59MpNiBxFeSfpU- Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E24
    August 18 · 11 min

    Projects Deliver Outputs. Services Deliver Outcomes.

    Projects Deliver Outputs, Services Deliver Outcomes: The Ownership Crisis Nobody Discusses. Discover why the biggest risk in any IT project begins after go-live. In this episode, Luigi Ferri explores the critical difference between project outputs and service outcomes, why Service Ownership is essential for long-term business value, and how IT Service Management (ITSM), Product Management, and Business Capability Management must work together to drive sustainable success. Learn why organizations have an ownership problem. In this episode, we answer to: Why is the day after go-live often the most dangerous stage of a project? What is the difference between a Product Owner and a Service Owner, and why does it matter? How can organizations improve long-term business outcomes through Service Management and clear ownership? Resources Mentioned in this Episode: PMI Institute, article "Pulse of the Profession 2024", link https://www.scribd.com/document/709988299/PMI-Pulse-of-the-Profession-2024-Report Balanced Scorecard Institute, article "Is Your Strategy Execution Crumbling as a Result of Too Many Projects?", link https://balancedscorecard.org/blog/is-your-strategy-execution-crumbling-as-a-result-of-too-many-projects/ PwC website, article "PwC Middle East Transformation and project management survey part 1", link https://www.pwc.com/m1/en/publications/transformation-and-project-management-survey.html Business Chief website, article "MIT Sloan: Why so many business digital transformations fail", link https://businesschief.asia/digital-strategy/mit-sloan-why-so-many-business-digital-transformations-fail MIT website, article "5 reasons companies struggle with digital transformation", link https://mitsloan.mit.edu/ideas-made-to-matter/5-reasons-companies-struggle-digital-transformation Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E23
    August 11 · 16 min

    MSPs: Your AI Contracts Are Obsolete

    AI is transforming Managed Service Providers (MSPs) from managing technology to managing AI behavior. This episode explains why traditional service design, governance, contracts, and risk models are no longer sufficient for AI-enabled services. Learn how AI impacts ITIL service management, AI governance, MSP liability, ISO 42001, NIST AI RMF, the EU AI Act, and why AI ownership, accountability, and updated contracts are now business-critical. In this episode, we answer: How does AI change the nature of IT services and MSP service design? Why are traditional MSP contracts, governance models, and risk frameworks becoming outdated with AI? Who is accountable and liable when AI-enabled services make decisions or cause incidents? Resources Mentioned in this Episode: Simmons + Simmons website, article "The EU AI Act: A Quick Guide", link https://www.simmons-simmons.com/en/publications/clyimpowh000ouxgkw1oidakk/the-eu-ai-act-a-quick-guide ISO website, standard "ISO/IEC 42001:2023", link https://www.iso.org/standard/42001 European Parliament website, regulation "EU AI Act: first regulation on artificial intelligence", link https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence NIST website, AI Risk Management Framework, link https://airc.nist.gov/airmf-resources/airmf/ NIST website, The NIST AI Risk Management Framework, link https://www.nist.gov/itl/ai-risk-management-framework ISO website, article "AI management systems: What businesses need to know", link https://www.iso.org/artificial-intelligence/ai-management-systems European Commission website, regulation "AI Act", link https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E22
    August 4 · 9 min

    DARE25: Why Defense Isn't Enough

    Discover why traditional cybersecurity defense is no longer enough in the AI era. Luigi Ferri explores the DARE25 framework, dynamic risk management, governance, Purple Teaming, accountability, and adaptive leadership. Learn how Enterprise Service Management, IT Service Management, and cybersecurity leaders can build resilient organizations by prioritizing behavior, faster adaptation, and continuous learning. In this episode, we answer to: Why is traditional cybersecurity defense no longer enough in the age of AI? How does the DARE25 framework improve risk management, governance, and organizational resilience? Why are accountability, adaptive leadership, and Purple Teaming essential for modern cybersecurity? Resources Mentioned in this Episode: Marco Amadei, creator of the DARE25 Digital Risk Management Framework, link https://www.linkedin.com/in/marco-amadei-0087844/ APMG website, article "Digital Risk Management Certification (DARE25)", link https://apmg-international.com/product/digital-risk-management-certification-dare25 APMG website, article "Introduction to AI in Risk Management", link https://apmg-international.com/article/introduction-ai-risk-management Strategic Digital Risk Management – an unofficial LinkedIn page sharing insights, research, and updates on the DARE25 Framework, link https://www.linkedin.com/company/strategicdigitalriskmanagement/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E21
    July 28 · 13 min

    ISO 28000: Your Resilience, Their Budget

    In this episode of the ITSM Practice Podcast, Luigi Ferri explores why supply chain resilience has become one of the biggest strategic challenges for Government Managed Service Providers (MSPs). Using practical examples from healthcare and public services, he explains how ISO 28000 shifts the conversation from protecting internal systems to managing the security and resilience of the organizations you depend on. Discover why supplier failures, inherited risk, and third-party dependencies are becoming the greatest threats to service continuity, cybersecurity, and operational resilience in government and regulated industries. In this episode, we answer: Why is ISO 28000 becoming essential for Government Managed Service Providers and supply chain resilience? How can third-party suppliers and subcontractors become the weakest link in your cybersecurity and operational resilience strategy? Why should CISOs focus on inherited risk and supplier dependencies rather than only internal security controls? Resources Mentioned in this Episode: The Standards Institution of Israel website, article "SI ISO 28000 :2022 Specification for security management systems for the supply chain", link https://www.sii.org.il/en/iso-28000 ANSI website, article "What Is ISO 28000?", link https://blog.ansi.org/anab/what-is-iso-28000/ Wikipedia website, article "ISO 28000", link https://en.wikipedia.org/wiki/ISO/PAS_28000 NIST website, publication "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations", link https://csrc.nist.rip/Pubs/sp/800/161/r1/2PD SITS website, article "NIS2, DORA & Co: Aren’t we all part of someone’s relevant supply chain?", link https://sits.com/en/blog/nis2-dora-supply-chain/ UK Government website, notice "Research on cyber security in supplier management and procurement", link https://www.gov.uk/government/publications/research-on-cyber-security-in-supplier-management-and-procurement Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E20
    July 21 · 19 min

    No SBOM, No Trust

    Discover why the Software Bill of Materials (SBOM) is rapidly becoming a strategic necessity for Managed Service Providers (MSPs) and enterprise IT leaders. In this episode, Luigi Ferri explains how software supply chain attacks such as Log4Shell and SolarWinds transformed SBOMs from technical documentation into essential tools for IT governance, cyber resilience, software supply chain security, and operational trust. Learn the four stages of SBOM maturity and how MSPs can strengthen transparency, improve vulnerability management, and build competitive advantage through continuous software dependency visibility. In this episode, we answer to: Why are Software Bill of Materials (SBOMs) becoming essential for Managed Service Providers (MSPs)? How can MSPs improve software supply chain security and gain complete visibility over software dependencies? What are the four stages of SBOM maturity that help organizations strengthen governance, resilience, and operational trust? Resources Mentioned in this Episode: US NTIA - National Telecommunications and Information Administration website, article "Software Bill of Materials", link https://www.ntia.gov/page/software-bill-materials US NTIA - National Telecommunications and Information Administration website, white paper "Software Consumers Playbook: SBOM Acquisition, Management, and Use", link https://www.ntia.gov/sites/default/files/publications/software_consumers_sbom_acquisition_management_and_use_-_final_0.pdf US NIST website, Executive Order 14028 "Improving the Nation's Cybersecurity: NIST’s Responsibilities Under the May 2021 Executive Order", link https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity US NTIA - National Telecommunications and Information Administration website, link Carnegy Mellon University - Software Engineering Institute, article "The SEI SBOM Framework: Informing Third-Party Software Management in Your Supply Chain", link https://www.sei.cmu.edu/blog/the-sei-sbom-framework-informing-third-party-software-management-in-your-supply-chain/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E19
    July 14 · 6 min

    PSD3: Who Owns Trust?

    PSD3 is more than a compliance requirement, it's a test of organisational maturity, security leadership, accountability, and decision-making. Discover how Enterprise Service Management, IT Service Management, and cybersecurity principles help organisations balance security, customer trust, and clear ownership to build resilience beyond regulatory compliance. In this episode, we answer: How does PSD3 reveal an organisation's maturity and decision-making under pressure? When should security lead, and when should it step back to enable business ownership? Who is truly accountable for trust, fraud prevention, and customer protection under PSD3? Resources Mentioned in this Episode: Stripe website, article "What platforms and marketplaces can expect from PSD3", link https://stripe.com/guides/what-platforms-and-marketplaces-can-expect-from-psd3 Deloitte Luxembourg website, article "Shedding light on PSD3/PSR", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/perspectives/shedding-light-on-psd3-psr.html European Payments Council website, article "What do the PSD3 and PSR mean for the payments sector?", link https://www.europeanpaymentscouncil.eu/news-insights/insight/what-do-psd3-and-psr-mean-payments-sector Advapay website, article "PSD2 vs PSD3/PSR: what’s new in the upcoming EU’s Payment Services Directive and Regulations", link https://advapay.eu/psd2-vs-psd3-whats-new-in-the-upcoming-eus-3rd-payment-services-directive/ PWC Ireland website, article "PSD3: Shaping the future of secure, innovative payments", link https://www.pwc.ie/industries/banking/insights/payment-services-directive-3.html Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E18
    July 7 · 11 min

    The Hidden Cost of Untrusted Data

    Why do organizations struggle to trust their operational data despite having plenty of it? In this episode of The ITSM Practice Podcast, Luigi Ferri explains the critical difference between data quality and data integrity, and why CIOs must build operational trust before launching digital transformation initiatives. Learn practical ITSM strategies to improve data governance, CMDB accuracy, operational accountability, and Enterprise Service Management. In this episode, we answer to: What is the difference between data quality and data integrity, and why does it matter for CIOs? Why do multiple departments report different numbers for the same operational metric? How can organizations build trusted operational data before starting digital transformation? Resources Mentioned in this Episode: Precisely website, article "Data Integrity vs. Data Quality: How Are They Different?", link https://www.precisely.com/blog/data-integrity/data-integrity-vs-data-quality-different Atlan website, article "Data Quality vs Data Governance: How Are They Different in 2026?", link https://atlan.com/data-quality-vs-data-governance/ Salesforce website, article "Salesforce Signs Definitive Agreement to Acquire Informatica", link https://www.salesforce.com/news/press-releases/2025/05/27/salesforce-signs-definitive-agreement-to-acquire-informatica/ Qlik Support Portal, article "Validating data", link https://help.qlik.com/talend/en-US/studio-user-guide/8.0-R2024-12/validating-data Informatica website, white paper "Informatice Data Quality and Observability", link https://www.informatica.com/content/dam/informatica-com/en/collateral/data-sheet/cloud-data-quality_data-sheet_3688en.pdf Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E16
    June 30 · 10 min

    ITIL 5 Foundation: Exam Success

    Preparing for the ITIL 5 Foundation exam? Discover why successful candidates focus on understanding the ITIL Value System, Value Chain, Governance, AI Capability, Four Dimensions, and Service Lifecycles as one connected system instead of isolated chapters. Learn smarter study strategies to improve your exam performance and master ITIL 5 concepts. In this episode, we answer to: Why is the ITIL Value System the foundation for understanding the entire ITIL 5 framework? How does AI Capability depend on governance, knowledge management, and operating models? How can you study the ITIL 5 Foundation exam more effectively by focusing on system thinking instead of memorizing chapters? Resources Mentioned in this Episode: Mind Mesh Academy website, article "ITIL® Foundation (Version 5) Study Guide", link https://www.mindmeshacademy.com/certifications/itil/itil-5-foundation/study-guide PeopleCert website, article "ITIL Foundation (Version 5)", link https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-5-foundation-version-50-4154 InProgress website, document name "Training Program - ITIL Foundation (Version 5)", link https://inprogressplus.com/wp-content/uploads/2026/05/Training-programme_ITIL5F_ENG_v2.0.pdf PeopleCert website, ITIL 5 Mock exams, link https://www.peoplecert.org/browse-mock-exams/it-governance-and-service-management/ITIL-1 1 World Training Official Channel YouTube Channel, video "Sample Paper | ITIL® Foundation Bridge (version 5)", link https://www.youtube.com/watch?v=-21MZIbPUDI Value Insights website, article "Are you ready to pass the ITIL® (Version 5) Foundation exam?", link https://www.valueinsights.ch/itil5-foundation-exam-quiz/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E17
    June 23 · 7 min

    PSD3: Governance Before Technology

    In this episode, Luigi Ferri explores why organisations often take the wrong first step when preparing for PSD3 compliance. Rather than rushing into new tools, fraud platforms, or transformation programmes, PSD3 readiness begins with observation. Learn how incident response, governance, decision authority, and organisational behaviour under uncertainty reveal the real gaps that PSD3 exposes. Discover why governance maturity and clear accountability are critical for building a resilient PSD3 strategy. In this episode, we answer to: Why is the first step towards PSD3 compliance so often the wrong one? How can incident response reveal governance gaps and decision-making weaknesses? What should organisations stabilise before launching PSD3 programmes, fraud initiatives, or policy transformations? Resources Mentioned in this Episode: Deloitte website, article "Shedding light on PSD3/PSR", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/perspectives/shedding-light-on-psd3-psr.html Schoenherr website, article "The EU's new Payments Services Package", link https://www.schoenherr.eu/content/the-eu-s-new-payments-services-package European Payments Council website, article "What do the PSD3 and PSR mean for the payments sector?", link https://www.europeanpaymentscouncil.eu/news-insights/insight/what-do-psd3-and-psr-mean-payments-sector MK Fintech Partners website, article "PSD3 is Here! How is it Different From Previous Directives?", link https://mkfintechpartners.com/2023/07/11/difference-psd1-psd2-and-psd3/ Finexer website, article "PSD3: All you need to know in 2025", link https://blog.finexer.com/psd3-all-you-need-to-know-in-2025/ Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E14
    June 16 · 13 min

    AI Security Strategy: Why Midmarket Organizations Get It Wrong

    Why do most AI security strategies fail in the midmarket? In this episode of The ITSM Practice Podcast, we explore why successful AI security is not about buying more AI tools but about building the right foundation first. Learn how identity management, telemetry quality, governance, and operational maturity determine AI security success. We discuss AI readiness, MSSP evolution, cybersecurity automation, SOC transformation, and practical AI security roadmaps for midmarket organizations. Discover why AI augments security teams rather than replacing them and how organizations can achieve sustainable cyber resilience through proper sequencing. In this Episode, we answer: Why do most AI security initiatives fail in midmarket organizations despite significant investments in AI-powered cybersecurity tools? How do identity management, telemetry quality, and governance impact AI security readiness and operational resilience? What should MSPs and MSSPs prioritize over the next 2–3 years to build effective AI security strategies and support midmarket clients? Resources Mentioned in this Episode: SailPoint website, ebook "Identity as the foundation: The modern zero trust blueprint for 2026", link https://www.sailpoint.com/identity-library/identity-security-essential-to-zero-trust-strategy Xage Security website, article "Zero Trust: A Proven Solution for the New AI Security Challenge", link https://xage.com/blog/zero-trust-proven-solution-for-the-new-ai-security-challenge/ Checkpoint website, article "How AI Phishing Attacks Became A Threat in 2025", link https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-phishing/ai-phishing-attacks/ EC-Council website, article "The Rising Threat of AI-Powered Phishing: What it is, How to Detect it, and How to Prevent it", link https://www.eccu.edu/blog/ai-powered-phishing-detection-prevention/ Your Alaska Link TV YouTube Channel, video "Hackers use AI to boost cyber scams and attacks", link https://www.youtube.com/watch?v=hRJqRFj0kRQ Microsoft Mechanics YouTube Channel, video "AI with Zero Trust Security", link https://www.youtube.com/watch?v=OnlN-2Q5QsE Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E14
    June 9 · 11 min

    What DoDAF Can Teach Leaders About Architecture and Complexity

    Are modern enterprises losing control of their architecture? In this episode, Luigi Ferri explores why cloud adoption, outsourcing, SaaS expansion, and fragmented governance are creating hidden dependencies and increasing operational risk. Discover how the Department of Defense Architecture Framework (DoDAF) offers valuable lessons for improving architectural visibility, governance, resilience, and enterprise-wide coordination in today's complex digital ecosystems. In this episode, we answer to: Why are modern enterprises losing architectural ownership and visibility across complex digital ecosystems? How can the Department of Defense Architecture Framework (DoDAF) help organizations manage complexity, interoperability, and governance? Why do modern outages and operational failures increasingly result from undocumented dependencies and architectural blind spots rather than individual system failures? Resources Mentioned in this Episode: US DoDAF Official Documentation, Department of Defense Architecture Framework (DoDAF) Version 2.02, link https://dodcio.defense.gov/Library/DoD-Architecture-Framework/ TOGAF® Enterprise Architecture Framework, TOGAF® Standard, link https://www.opengroup.org/togaf NIST Cybersecurity Framework (CSF) 2.0, link https://www.nist.gov/cyberframework Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

  • S3 · E13
    June 2 · 10 min

    Identity Is the New Perimeter

    AI is changing cybersecurity faster than most organizations can govern it. In this episode of The ITSM Practice Podcast, Luigi Ferri explores why identity has become the true enterprise perimeter. As organizations race to deploy Agentic AI, autonomous agents, cloud platforms, and APIs, many are building on identity governance models that were never designed for machine-scale decision-making. From Zero Trust Architecture and Identity & Access Management (IAM) to the lessons behind major breaches at MGM, Snowflake, and Uber, this episode examines a critical question: If enterprises struggled to govern human identities, how will they govern autonomous AI identities? Discover why AI governance without identity governance is impossible, why identity is evolving into the operational control plane of digital business, and what CIOs and CISOs must do before AI adoption outpaces organizational control. In this episode, we answer: Why is identity becoming the new perimeter in the age of AI? What risks emerge when autonomous agents operate without strong identity governance? How can organizations redesign trust before AI scales faster than governance? Resources Mentioned in this Episode: NIST website, Zero Trust Architecture (SP 800-207), link https://csrc.nist.gov/pubs/sp/800/207/final? NIST website, AI Risk Management Framework, link https://www.nist.gov/itl/ai-risk-management-framework European Commission website, EU AI Act, link https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai Dark Reading website, article "Okta Agent Involved in MGM Resorts Breach, Attackers Claim", link https://www.darkreading.com/application-security/okta-flaw-involved-mgm-resorts-breach-attackers-claim Cyberark website, article "The MGM Resorts Attack: Initial Analysis", link https://www.cyberark.com/resources/blog/the-mgm-resorts-attack-initial-analysis Blackfog website, article "Showflake Data Breach Explained", link https://www.blackfog.com/snowflake-data-breach-explained-key-lessons/ Cloud Security Alliance website, article "Unpacking the 2024 Snowflake Data Breach", link https://cloudsecurityalliance.org/blog/2025/05/07/unpacking-the-2024-snowflake-data-breach USA CISA website, article "Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester", link https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a? USA CISA website, advisory on MFA fatigue and modern identity attacks, link https://www.cisa.gov/news-events/alerts/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching-multifactor-authentication Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security. Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/ Graphics by Yulia Kolodyazhnaya

Showing 1–20 of 29 episodes