Jake Bernardes Wants Security That Can Prove Itself

Jake Bernardes has built his career on a plain test of security: can the business keep running, and is there evidence to prove it? He is now working on that question at Gambit Security.

Jake Bernardes doesn’t think much of a tidy folder of screenshots. Ask him what’s wrong with compliance and that’s where he starts: “a beautifully organised set of screenshots that says very little about what’s happening now.”

What he wants to know is simpler. Does the control work? And if it stopped working, what would tell you?

He has had a few places to ask it. Two years as a missionary in Hamburg. Mainframe security at IBM for FTSE 100 clients. Consulting at KPMG, Baringa Partners and NCC Group, then in-house security jobs at SingleStore, Whistic and Anecdotes. Today he is at Gambit Security, working on cyber resilience, and he runs a vCISO practice called JLBCyber. He invests through Lockstep, Squared Circle Ventures and U & I, and hosts a podcast, Random Access Memories.

Knocking on Doors in Hamburg

Hamburg came first. Bernardes spent two years there as a voluntary missionary, learning German and working on community rehabilitation programmes with local councils. The main thing it taught him, he says, was “learning to listen before assuming you’ve got something useful to say.” Knocking on doors in a language you’re still picking up gives you quick feedback. You get used to rejection. You get curious.

It shows in how he walks into a new team. Telling people everything they’re doing wrong is “rarely a useful starting point,” he says. Better to ask what they’re trying to do and what’s in the way. He adds that religion is a big part of his life and shapes how he approaches business relationships.

Mainframes and the Cost of Getting It Wrong

His first job in security was at IBM, as a Product Specialist on mainframes for FTSE 100 clients. “Mainframes aren’t necessarily the glamorous end of security,” he says. But big organisations depended on them, and a mistake had real consequences.

The work left him with a habit he hasn’t dropped. Don’t turn up with a list of controls. Find out who uses the system, what it supports and what happens if it goes down. That question now sits at the centre of what he does at Gambit Security.

Making It Repeatable

At KPMG, Baringa and NCC Group he went from GDPR and penetration testing work to building an ISO 27001 practice from nothing. It reached $1 million in under a year. He doesn’t want the revenue to be the story. People bought it, he says, because they had a reason: a customer demanded it, a procurement team asked for it, or they needed confidence before the next stage of growth. And knowing a subject, he found, isn’t the same as building a service. The work has to be repeatable, and it can’t rely on one person knowing everything.

Saying yes mattered too. It brought him three promotions in two years and took his family to live in the Middle East and the USA.

At SingleStore there was no security policy when he arrived. Within eighteen months the company held five major certifications. Along the way the pandemic hit, and he stepped in as interim Head of IT for a team spread around the world. Doing both jobs made the link obvious. “A security strategy only gets you so far if someone can’t access the tools they need to do their job.”

He isn’t sentimental about the certifications. They were milestones. The basics sound dull. “Policies, ownership, access and evidence can sound fairly uninteresting, but getting them right makes everything else easier.” What he cared about was building something the business could run “without every decision or problem having to come back to me.”

Warts and All

At Whistic he argued for sharing security information “warts and all.” Bernardes won’t call that a sacrifice. The awkward part, he says, is that honesty brings questions you might otherwise dodge. Admit a gap and you have to explain why it matters and what you’re doing about it. The phrase doesn’t mean publishing sensitive detail for anyone to read. It means giving the right people an accurate picture.

The alternative, he reckons, is worse. Every company has weaknesses, and good buyers know it. “I’d much rather build trust on an honest answer that stands up later.”

Letting Go at Anecdotes

At Anecdotes he grew the security team from one person to six, across GRC, AppSec, IT and Field. The hard lesson was simple to state. Hiring people doesn’t stop you being the bottleneck. When you’re used to doing everything, you keep reviewing every decision. It feels useful. It stops anyone else owning anything.

So he worked on clarity: priorities, and who decides what. He had to accept that someone might solve a problem differently and still solve it well. “If everything still requires your approval, you haven’t really built the capacity you think you have.”

The same team took Anecdotes to FedRAMP Moderate in six months. How, with a clock like that? Focus, he says. Keep the scope tight, name owners, find the hard dependencies early, and run the technical work and the assessment work side by side. Polishing internal workflows can wait. Required controls can’t. Speed, in his words, “has to come from making decisions and removing avoidable rework, rather than quietly accepting a gap nobody wants to discuss.”

He is quick to credit the people. “I had a team at Anecdotes that would run through walls for me, knowing I’d do the same for them.”

Revenue Without a Quota

He doesn’t carry a revenue quota, he says, but he isn’t shy about the commercial side. A CISO is an executive, and executives help drive the company forward, which usually includes revenue. It has made him ask why a customer is asking a question. A stuck deal might be a real security gap, or weak evidence, or an architecture nobody explained properly. Those need different answers. And if the same worry keeps showing up across deals, he would rather fix it than keep explaining it on calls. None of this, he says, justifies promising something the team can’t deliver.

Evidence Over Paper

Which brings him back to the screenshots. Too much GRC, he says, starts with the document everyone expects to produce. If he were designing a framework from scratch, he would start with evidence: pulled from the systems doing the work, with an owner, a timestamp and a test you can repeat. Reuse the same evidence across requirements where it makes sense. Show exceptions openly, including who accepted them and when they come up for review. That is what draws him to GRC engineering and FedRAMP 20x. He thanks Pete Waterman for changing what “compliance” means.

He would add one more thing: proof you can recover. A framework should tell you whether the business survives a disruption. Having the right settings on the day of the audit doesn’t answer that. Automation helps, but “someone still has to decide whether you’re checking the right thing.”

The Minimum Viable Business

At Gambit his focus is resilience. What does a business need in order to keep operating, and can it prove it can recover when things go wrong? The Minimum Viable Business is his way of asking. Which services have to work? What do they depend on? How long could the company live without them? What would recovery really look like? The point, he says, is that operational owners join the discussion instead of it all being handed to IT.

His vCISO clients, across consumer brands and technology companies, show why context matters. A consumer brand lives on taking orders, fulfilling them, keeping stores open and working with logistics partners. A B2B technology company worries about uptime, customer data and showing enterprise buyers it can be trusted. “The mistake is copying a familiar security roadmap before you’ve understood the business you’re supposed to be protecting.”

He thinks the threat side is shifting too. What leaders underestimate, he says, is what happens when attackers can automate more of the work between finding an opening and using it. AI doesn’t have to make every attack clever. Making parts of an attack cheaper and easier to repeat is enough to raise the pressure. He is wary of hype, but wouldn’t assume today’s limits will hold. So: know what has to keep working, and have evidence you can bring it back. “A plan says what you intend to do. A test gives you evidence about what you’re able to do.”

Humans in the Loop

Inside security teams, he expects AI and agent tools to prove themselves where the inputs, permissions and outcomes are well defined. Collecting evidence. Spotting changes. Preparing an investigation. Human review will get pickier. Signing off every tiny action defeats the point, but letting an agent change production because it sounds confident is, in his view, a bad idea. He asks whether an action is bounded, reversible and observable. People stay accountable. “A human in the loop only helps if they have enough context and time to challenge the action. Otherwise we’ve added a button and called it oversight.”

Keeping the Roles Straight

GDPR work once nearly cost him the birth of his daughter. There is always another deadline, he says, another reason this week is special. That moment made the cost plain. Family time had to be a commitment, not whatever was left in the diary. It also meant being honest about his capacity and building a team that didn’t need him on call. “I don’t think it’s credible to tell people to look after themselves while modelling the opposite.” Genuine emergencies exist. Treating everything as one, he says, is a leadership problem.

Juggling a day job, investments and a podcast only works if people know where they stand: what they get from him, when he’s free, who decides when he isn’t in the room. He keeps confidences apart too. What you learn in one role “isn’t automatically yours to use in another.”

On Random Access Memories, which followed an earlier show called Risking It All, he wants guests to talk about what shaped their judgement. The decision they got wrong. The conversation that changed their mind. If a guest gets past the answer they give at every conference and talks like a person, he says, that is when it gets good.

Paper, Promises and Proof

Ask him for the change he is working toward in one sentence and he has it ready. He wants security to stop resting on “paper, promises and insurance policies” and to be rooted in “data, provable evidence and continuous change.”