Climbing the Stack

How do you go from Director to CIO? Host Matt Peters, CEO of Fixify, sits down with IT executives who've made the climb to unpack the pivotal decisions, career-defining moments, and hard-won lessons that got them there. If you're a VP or Director of IT looking for practical advice to reach the C-suite, this is the podcast that finally focuses on your journey—not just the latest tech trends. Real stories. Real strategies. Real career growth.

Climbing the Stack is a technology podcast hosted by Fixify, with 15 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Fixify hosts Climbing the Stack, a technology show with 15 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Climbing the Stack

  From engineer to C-suite: why financial fluency and storytelling separate real executives | Matthew Sharp

  Aug 6, 202637 min

  Matthew Sharp came up as a computer and electrical engineer, moved through independent testing and audit work, and then took a sales role he was convinced would be the devil's work. Four years selling specialized security services taught him the opposite. He often walked into meetings knowing more about a client's business than the CISO across the table did, down to how they segmented revenue on their financial statements. Now CISO at Xactly and co-author of The CISO Evolution, his argument in this episode is that technical leaders stall on the climb to the C-suite because they cannot connect security to the business, and the fix is more concrete than the conference-stage line about speaking the language of business. That fix starts with learning to read the three financial statements, and he points to John Tracy's How to Read a Financial Statement for the single graphic that ties them together. He gets into moral authority versus formal authority from Covey, why he steers clear of the RFP as both buyer and seller, and the body, mind, heart, and spirit sabbatical (Everest base camp, the Camino de Santiago, Mandarin study, a month teaching English in Vietnam) that gave him cross-cultural empathy for why someone in a hard economy might turn to ransomware. At Xactly he walks through the India-based Center of Excellence, a Snowflake security data lake, a 24x7 AI SOC, and machine learning that forecasts the sales pipeline so his team clears cyber diligence on the deals most likely to close. He closes on where this goes next, with third-party diligence negotiated between MCP servers and a human in the loop, instead of an army of people slinging spreadsheets. Topics discussed: - Reading the three financial statements to speak to executives - Moral authority versus formal authority in security leadership - Steering clear of the RFP as buyer and seller - Body, mind, heart, spirit sabbatical and cross-cultural empathy - India Center of Excellence built on a Snowflake data lake - Machine learning forecasting the sales pipeline to prioritize cyber diligence - Jobs-to-be-done hiring that scales with AI agents - Third-party diligence negotiated between MCP servers

  ListenShow Notes
• 

  Climbing the Stack

  From engineer to C-suite: why financial fluency and storytelling separate real executives | Matthew Sharp

  Aug 6, 202637 minS0

  <p>Matthew Sharp came up as a computer and electrical engineer, moved through independent testing and audit work, and then took a sales role he was convinced would be the devil's work. Four years selling specialized security services taught him the opposite. He often walked into meetings knowing more about a client's business than the CISO across the table did, down to how they segmented revenue on their financial statements. Now CISO at Xactly and co-author of The CISO Evolution, his argument in this episode is that technical leaders stall on the climb to the C-suite because they cannot connect...

  ListenShow Notes
• 

  Climbing the Stack

  A CEO sorted every employee into three AI buckets. Where would your team land? | Fred Bret-Mounet

  Jul 21, 202636 min

  Fred Bret-Mounet , VP of Security, Compliance and IT / CISO at Accela, started his security career in 2001 at @stake, one of the handful of firms that invented security consulting. He was excellent at building Fort Knox. When he moved to the receiving end of those consulting reports, he realized recommending Fort Knox at all cost was the worst advice he could give. The framework he uses instead is the California speed limit. The sign says 65 or 75, but drive 85 without brandishing a gun or threatening anyone and there are no consequences. Those extra miles per hour are called velocity, and the CISO's job is to mark the line, explain what can be crossed, and let the business make an educated risk decision. Fred tells Matt why AI has collapsed reinvention cycles from every five to ten years to six months, and how a CEO asked him to sort employees into three buckets: forward thinkers, trainable, and the resistance brigade. He grades his students on the same principle, failing anyone who submits AI as the end product and warning that skipping it as an input earns an F too. He predicts that organizations that do not automatically patch everything internet accessible will be dealing with breaches quarterly, if not monthly, by year end, since attackers will reverse engineer a patch in minutes. He also explains why your first line of response to security events must be entirely automated, and why he blows up relationships with his own team on a weekly basis, trading two-week fix demands for two months, to land the ideal business outcome. Topics discussed: - Reinvention cycles collapsing from a decade to six months - Sorting employees into three AI adoption buckets - The Tesla full self-driving analogy for calibrating AI trust - Auto-patching everything internet accessible before attackers reverse engineer fixes - Fully automated first response to security events - Detecting phishing through intent rather than message syntax - The speed limit framework for advising on business risk - Publicly disavowing your team to reach the right business outcome

  ListenShow Notes
• 

  Climbing the Stack

  A CEO sorted every employee into three AI buckets. Where would your team land? | Fred Bret-Mounet

  Jul 21, 202636 minS0

  <p>Fred Bret-Mounet, VP of Security, Compliance and IT / CISO at Accela, started his security career in 2001 at @stake, one of the handful of firms that invented security consulting. He was excellent at building Fort Knox. When he moved to the receiving end of those consulting reports, he realized recommending Fort Knox at all cost was the worst advice he could give. The framework he uses instead is the California speed limit. The sign says 65 or 75, but drive 85 without brandishing a gun or threatening anyone and there are no consequences. Those extra miles per hour are called velocity, and the...

  ListenShow Notes
• 

  Climbing the Stack

  CIO vs. CISO: Resolving the ROI-versus-risk conflict when you hold both | Georgeo Pulikkathara

  Jul 7, 202644 min

  When Georgeo X. Pulikkathara joined iMerit Technology as CISO, the role came with infrastructure responsibility attached. His solution was to take the CIO title too and fund security controls directly from that budget. It's a structure he'd spent years viewing as a conflict of interest (CIO manages toward ROI, CISO manages toward risk), and this episode is his case for when it works. He also lays out how he presents security budget to boards: tied to specific revenue deals, never to abstract risk ratings, with three solution options already on the table (the premium version, the cheap version, and the one most organizations actually choose) so he never has to go back for emergency money mid-year. He shares PFC Romeo, the military decision framework now embedded in his IT org: Problem statement, Facts (objective only, no opinions), Considerations (political, emotional, who's going to take it the wrong way), Recommendations (always two viable options, not one good and one bad). He walks through his tiered security architecture, anchored at Tier 0 with identity and MFA through production cloud environments and CI/CD pipelines, and explains why he operates from the assumption that attackers have already bypassed endpoint protection tools like Defender ATP and are targeting identity and production infrastructure instead. That assumption comes from experience: when an AI company became a client, his team detected 13 North Korean threat actors in a single week, running IP proxies and AI-generated faces to get past HR screening that most organizations aren't built to catch. He closes with the 2016 interview at Santander Consumer Bank where the CSO laughed so hard at his five-year CISO prediction that he refused to hire him, and what Georgeo built in that window to prove it right on schedule. Topics discussed: Using CIO budget to fund security controls directly Building financial fluency through a 4-5 month SMU program pre-C-suite Real-time back channel coaching IT leads during live client calls Tiered security model anchored at Tier 0 identity with endpoint bypass assumption Tying board security asks to specific revenue deals with three solution options PFC Romeo framework for structured team escalations and decisions Physical printed incident response plans for ransomware network lockout Detecting North Korean threat actors through IP proxy and AI identity controls

  ListenShow Notes

Recent guests on Climbing the Stack. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.