Executive Cybersecurity Masterclasses

Awareness → Readiness → Action

Small room, in person cybersecurity masterclasses for CISOs, executives, security leaders, and the teams they run. Every class ends with work you can put in front of your organization the following week.

Next class: The Big 4 Model · Tuesday, January 12, 2027 · Washington, DC

Every Masterclass

A Working Session for Cyber Leaders, Not a Webinar

Built for Decision Makers

For the CISOs, CIOs, and executives who approve the security budget, sign the risk acceptance, and answer to the board.

Board Briefing Practice

Three times during class, you brief a partner playing your most difficult stakeholder and practice cyber risk in business terms.

You Leave with a Plan

Every module ends with a written action, an assigned owner, and a cybersecurity plan for your organization.

CPE Credits and Certificate

4 CPE credits, a Certificate of Completion, a printed workbook, and 30 days of access to all materials.

The Gap Is Not Effort; It Is a Leadership Model That Has Not Kept Pace with the Modern Cyber Landscape

Cybersecurity leaders work hard, invest wisely, and push their teams toward maturity. They follow frameworks such as NIST CSF, CMMC, and ISO 27001, deploy modern tools, and communicate risk with discipline. Yet incidents still occur, gaps still emerge, and boards still question progress. These outcomes do not reflect a lack of effort. They reflect an industry that now outpaces traditional leadership models.

Even strong CISOs and executives struggle to see the hidden gaps that sit between governance, technology, operations, and people. These gaps do not appear in dashboards or compliance reports. They show up in misaligned priorities, unclear ownership, and teams that communicate in different languages. Leaders often sense that something is missing, but they cannot pinpoint the source with precision.

Cyber Risk Is National Security Risk

Sixteen critical infrastructure sectors run on systems that private organizations own and operate. Nation state actors have been found pre positioning inside those networks, not to steal data, but to hold the ability to disrupt operations at a time of their choosing. An intrusion at a defense supplier, a hospital network, a water utility, or a state agency is not only a business problem.

If your organization supports a federal mission, handles Controlled Unclassified Information, or sits anywhere in the defense industrial base, the decisions these masterclasses ask you to make are part of the country’s defense posture, not only your organization’s. Both instructors served the nation: Dewayne Hart for twenty years in the U.S. Navy, and [Co-instructor name], a retired Marine with federal service at DHS. They teach every lesson from that experience.

“Every audience deserves the Cyber Truth, real insight that drives real protection.”

— Dewayne Hart

The Big 4 Model

01 Governance

Clear risk decisions with accountable owners

02 Technology

Investments that change decisions, not dashboards

03 Operations

Proven coverage across the attack surface

04 People

A named leader answers for every outcome

Mindset

The shared root beneath all four

Hidden gaps live between the domains. The Big 4 Model manages all four domains as one cyber defense system.

Years in cybersecurity and defense

1 +

Keynotes delivered

1 +

Years U.S. Navy, retired Chief Petty Officer

Founded SEMAIS, a Service Disabled Veteran Owned Small Business

Open Enrollment for 2027

Three half day executive cybersecurity masterclasses in Washington, DC, from January through March 2027. Choose a masterclass to see the full agenda, pricing, and registration.

Half-Day Masterclass

4 CPE

CISO-Level

The Big 4 Model: Winning Cyber Defense Under Pressure

For CISOs and security leaders who own the program. Score your program honestly across governance, technology, operations, and people. Prove which controls hold when they are tested. Leave with a plan to move from assumed compliance to operational ownership.

Tuesday, January 12, 2027

Washington, DC Region · [Start time] to 1:00 PM

Half-Day Masterclass

4 CPE

Executive-Level

Governing AI and Cybersecurity Before the Attack

For CEOs and senior executives accountable for cyber and AI risk. Identify the attacker’s exposure window, assign clear ownership for each gap, and make the governance decisions now rather than during an incident.

Tuesday, February 9, 2027

Washington, DC Region · [Start time] to 1:00 PM

Half-Day Masterclass

4 CPE

Board-Level

The Duty of Inquiry: Board Oversight of Cyber and AI Risk

For directors, trustees, and the executives who brief the board. Learn the questions a board is expected to ask about cyber and AI risk. Leave with an oversight record that holds up when regulators, auditors, or courts review what the board asked and when.

Tuesday, March 16, 2027

Washington, DC Region · 9:00 AM to 1:00 PM

Executive Sessions

Private Sessions for Your Board or Leadership Team

From 30 minute insight sessions to half day private masterclasses, built around your priorities and scheduled around your organization.

The Big 4 Model: Winning Cyber Defense Under Pressure

From assumed compliance to operational ownership.

Tuesday, January 12, 2027 [Start time] to 1:00 PM Washington, DC Region 4 CPE

Every Program Behind the Incident Numbers Passed an Assessment

That problem is the reason for this class. Compliance proves a control exists in policy, on an invoice, or in a training record. Compliance never proves the control holds under adversary pressure. Organizations measure compliance every year and measure consequence almost never, which is how a program can be green on reporting day and fail on a specific Tuesday. The gap is not a tooling gap. The gap is the difference between an assumed control and an owned control.

Four Domains, Three Levels, One Honest Score

The four domains are governance, technology, operations, and people, with mindset as the shared root beneath all four domains. Each domain scores at one of three levels.

Most programs sit at Assumed across all four and still rate as compliant. That is a useful finding, not a failure.

What you own by 1:00 PM

You leave with a completed Big 4 Scorecard: twenty points across the four domains, each scored against evidence you recorded and rolled into one readiness number. You also leave with four metrics that carry named owners, a tested assumption about a control you thought was working, and a 90 day mesh plan you can put in front of your executive committee.

What You Will Work Through

The day runs six modules across three phases — score the program, prove what holds, own the four domains — and you teach the work back three times along the way.

Phase 1 · Score

M1

The Four Domains and the Loop

Scope and holding condition for each domain, mindset as the root, your four blind spots, and the point where the loop’s return leg breaks.

A model you can hold in your head

M2

Scoring Your Program

Four diagnostic questions answered with evidence, then Assumed, Measured, or Owned for each domain, with the evidence recorded.

A scorecard built on evidence, not assurance

Phase 2 · Prove

M3

The Pressure Test

The same four answers run against your worst day, including the first hour of an incident: control verification, response capability, leadership readiness, accountability.

You know which domain fails first

M4

Blind Spots as Engineering Gaps

Log source coverage, technique mapping, validation cadence, and detection as code, each with the metric that makes the gap countable and assignable.

Gaps that can be counted and owned

Phase 3 · Own

M5

Signal Over Noise

From findings ingested, to the few exploitable on mission systems, to one page carrying one decision and one owner.

One page, one decision, one owner

M6

The Operational Mesh

Unify governance, integrate technology, operationalize users, then validate and improve, in that order, plus 90 days of moves that each produce evidence.

Four domains at Measured in 90 days

Built for Washington and the Mission It Supports

The four domains map to all six NIST CSF 2.0 functions: governance to Govern; technology to Identify and Protect; operations to Detect, Respond, and Recover; and people across all six, from roles and accountability to awareness training. Detection coverage is measured against MITRE ATT&CK, validation cadence follows NIST SP 800-137 and SP 800-84, and known exploited vulnerabilities under CISA BOD 22-01 set the remediation clock. For agencies, the same four scores feed FISMA reporting and RMF ongoing authorization. For the defense industrial base, the scores map to NIST SP 800-171 and CMMC.

A nation-state actor does not test your compliance posture. The test is whether anyone owns the control. The session stays vendor-neutral throughout.

Secure checkout on PayPal. Pay with PayPal or card, and choose your number of seats at checkout.

Sending a team? Contact us for group rates or call (470) 409-8316.

What Your Seat Includes

Four hours of live, in person instruction and scoring workshops
The Big 4 Scorecard: domain scoring instrument, evidence worksheet, one page readout template, and the 90 day mesh planner
4 CPE credits and a Certificate of Completion
Printed student workbook
Networking break
30 days of access to all materials plus instructor follow up

Is This Built for You?

This session is built for the people who run the program: CISOs and deputy CISOs; CIOs and CTOs who share ownership of security; directors of security operations, vulnerability management, and GRC; security architects and program managers who carry out the plan; federal ISSMs, authorizing official designated representatives, and defense contractor security leadership. It is not a hands on technical course for SOC analysts or security engineers seeking lab work.

Governing AI and Cybersecurity Before the Attack

An executive masterclass for the leaders held accountable.

Tuesday, February 9, 2027 [Start time] to 1:00 PM Washington, DC Region 4 CPE

Why This Now Reaches Your Desk

Cyberattacks no longer require advanced skill. Exploited vulnerabilities have overtaken stolen credentials as the leading way attackers get in. AI has shrunk the time from disclosure to working exploit from months to hours. Employees are pasting company data into AI tools no one approved. A few seconds of audio is enough to clone a voice, and an AI written request to move money is indistinguishable from a real one. When something goes wrong, regulators, inspectors general, insurers, and customers will ask what leadership knew and when. That answer is written before the attack, not after.

Six Windows, Not One

Most programs measure disclosure to patch and report it as risk. Attackers use all six, and your exposure is your widest window, not your average.

Vulnerability — disclosure to verified fix
Configuration — drift to correction
Policy— threat change to policy update
Operations — compromise to containment
Decision — risk known to decision made
Adoption — AI tool live to governed

You set a tolerance for each one and name who owns closing it, moving from static leadership, where decisions wait for the next meeting, to dynamic leadership, where leaders decide in advance and machines enforce each decision.

What You Own by 1:00 PM

You leave with a scored 25 point readiness checklist and a tolerance set for each exposure window. You also leave with three committed actions that carry named owners and dates, a first hour command card, and a one page stakeholder report you can send the same week.

How the Day Is Structured

The day runs six modules across three phases, and each phase pairs a foundation with an applied action. You teach the work back three times along the way.

Phase 1 · Recognize

M1

AI Powered Threats and the Speed Gap

Recognize deepfakes, AI written fraud, and exploits that arrive in hours, then measure all six exposure windows and set a tolerance for each.

Approvals an attacker cannot hijack

M2

Secure AI Adoption

Adopt AI through signed gates with named owners for the data, the model, and the user, and protect the human judgment your organization needs.

Innovation without new exposure

Phase 2 · Govern

M3

Continuous Exposure Management

Scope to crown jewels, rank by what an attacker can actually reach, prove the controls you paid for fire, and fix at machine speed.

Proof that risk is going down

M4

Building a Defensible Program

Map the obligations that bind you, pre delegate decision rights, enforce baselines as code, and score each Big 4 domain on evidence rather than policy.

A program that holds up to scrutiny

Phase 3 · Act

M5

Stakeholder Reporting and Your 90 Day Plan

Translate tech talk into stakeholder talk, close the gap between budget and technical need, and leave with three committed moves.

A plan you own by Monday

M6

Resilient Leadership Under Fire

Command the first hour, including decision rights, the notification clocks, the call list, communications, and continuity, rehearsed in a live scenario.

A rehearsed crisis response

Mapped to Federal Policy and the Mission It Protects

The program is anchored to NIST CSF 2.0 and the NIST AI Risk Management Framework. Known exploited vulnerabilities under the CISA KEV catalog and BOD 22-01 set the clock that matters. Configuration management follows NIST SP 800-128, continuous monitoring follows SP 800-137, the first hour of response follows NIST SP 800-61 Rev. 3, and rehearsal uses NIST SP 800-84 and CISA Tabletop Exercise Packages.

The AI module sets a firm line: Controlled Unclassified Information, PII, PHI, and export controlled data never enter a public model, and vendor FedRAMP authorization is checked wherever it applies. The first hour module confirms which notification clocks actually bind your organization, including DFARS 252.204-7012 for defense contractors and agency incident reporting for federal programs. The session stays vendor neutral throughout.

Secure checkout on PayPal. Pay with PayPal or card, and choose your number of seats at checkout.

Sending a team? Contact us for group rates or call (470) 409-8316.

What Your Seat Includes

Four hours of live, in person instructor led training
The Big 4 Leadership Toolkit: the 25 Point AI and Cyber Readiness Checklist, accountability RACI, first hour command card, and stakeholder reporting template
4 CPE credits and a Certificate of Completion
Printed student workbook
Networking breaks
30 days of access to all session materials plus instructor follow up

Who Should Be in the Room

This session is built for the people who answer for the program: CEOs, CFOs, COOs, and general counsel; chief risk, compliance, AI, and data officers; CIOs, CTOs, and CISOs who brief the executive team; federal agency, defense contractor, and critical infrastructure leadership. It is not a hands on technical course for SOC analysts or security engineers seeking lab work.

The Duty of Inquiry: Board Oversight of Cyber and AI Risk

From briefed to answerable.

Tuesday, February 9, 2027 [Start time] to 1:00 PM Washington, DC Region 4 CPE

Boards Are Briefed on Cyber Risk and Still Cannot Answer for It

Modern attacks target payment approvals, vendor bank detail changes, and executive impersonation. Those are business processes, which puts them inside the board’s remit by definition. Most boards still receive cyber as an IT update: volume they cannot act on, assurance without evidence, and minutes that record the topic was discussed without recording what was decided. When a regulator, an inspector general, an insurer, or plaintiff’s counsel asks what the board knew and when, the answer is whatever the record shows.

Duty, Inquiry, Record

The session never asks a director to operate anything. It builds the three things a board is actually accountable for.

The board sets the strategy, the risk appetite, and the framework, and sends them down as requirements the technical organization can build to. It then draws the truth back up: what is unfunded, what is unstaffed, and what was accepted by someone without the authority to accept it.

What the Board Owns by 1:00 PM

Directors leave with a one page board mandate that carries the crown jewels, the risk appetite, the tolerances, and what requires board approval. They also leave with an obligations map, a minutes standard for risk acceptance, a board pack standard, a CISO engagement model, a rehearsed board crisis card, and three questions to send management within seven days.

How the Morning Is Structured

The morning runs six focused modules across three phases, and each phase pairs a foundation with an applied action. Directors teach the work back three times along the way.

Phase 1 · Duty

M1

Cyber and AI as a Governance Matter

Name the crown jewels, scope board reporting to them, put an owner against AI risk, and confirm the verification rule that seniority cannot waive.

A written list of what this board oversees

M2

Regulation, Disclosure, and Personal Liability

Map SEC disclosure, FISMA, CMMC, state breach law, and contract terms, set the questions the board must have asked, and fix how decisions are minuted.

An obligations map and a minutes standard

Phase 2 · Inquiry

M3

Strategy, Appetite, and Sending the Framework Down

Own the strategy, state appetite in writing, name one framework, and turn tolerance into a requirement engineering can build to.

A one page board mandate

M4

Drawing Requirements Up, and Using Your CISO

Surface what the board is not told, demand evidence with a date, hold executive sessions with the CISO, and require funding requests framed as exposure and cost.

A board pack that reports decisions

Phase 3 · Record

M5

Crisis Oversight and the First Hour

Set the escalation threshold, the authority boundary, the notification clocks, privilege, and the extortion position, then rehearse them in a live tabletop.

A rehearsed board crisis card

M6

The Oversight Cadence and Your 7 Day Plan

Decide where oversight sits, bring cyber into enterprise risk, budget, and M&A, and put the next review dates in the calendar.

A dated oversight cadence

Oversight when the mission is national security

The session is anchored to the Govern function of NIST CSF 2.0, the part of the framework written for oversight, and to the NIST AI Risk Management Framework. For agencies, the oversight record is what inspectors general examine in the annual FISMA evaluation and what GAO and Congress review after an incident. For public companies, SEC rules require disclosure of how the board oversees cybersecurity risk and of material incidents within four business days. For the defense industrial base, CMMC requires a senior official to affirm compliance, and the False Claims Act holds contractors liable when those affirmations prove false.

The session closes on the two threats most likely to reach the boardroom next: an AI failure and a cloned voice message from the CEO. Directors leave knowing which questions to ask, when to ask them, and how to document the answers. The session stays vendor neutral throughout.

Secure checkout on PayPal. Pay with PayPal or card, and choose your number of seats at checkout.

Sending a team? Contact us for group rates or call (470) 409-8316.

What Each Director Takes Home

Four hours of live, in person instruction and oversight workshops
The Director’s Oversight Toolkit: the 20 point oversight checklist, board mandate template, board pack standard, crisis card, and model minutes language
4 CPE credits and a Certificate of Completion
Printed director’s workbook
30 days of access to all materials plus instructor follow up

Who Should Be in the Room

This session is built for the people who oversee the program: board members and trustees, especially audit and risk committee chairs; corporate secretaries and board governance counsel; CEOs, general counsel, and CISOs who brief the board; federal advisory board and commission members with oversight duties. It is not a technical course, and no security background is required.

Private Sessions for Boards and Senior Leaders

Executives want clear insight and honest answers to hard questions. Dewayne delivers both in his executive sessions and private masterclasses.

These smaller settings allow deeper content than a traditional keynote and a conversational format that experienced leaders appreciate. Dewayne’s executive sessions can serve a senior leadership team, a board of directors, or CEO and CISO gatherings, where candid insight and proven strategy deliver the value seasoned leaders expect.

Senior Leadership Teams

Align the C suite on cyber risk, AI adoption, and what the security program must deliver this year.

Boards of Directors

Give directors the questions to ask, the answers to expect, and a clear view of the organization’s exposure.

CEO and CISO Gatherings

Candid insight and proven strategy for summits and retreats where experienced leaders expect real value.

Executive Sessions Built on Must Know Insight, Frameworks, and Strategy

Dewayne designs these sessions for smaller groups, with more depth and interaction tailored to the responsibilities and priorities of the people in the room. In the longer formats, he works closely with your senior leaders on their most urgent security decisions.

30 min

Insight Session

The must know risks and decisions for your leaders, delivered at the top of a meeting or retreat.

90 min

Executive Briefing

Deeper insight and discussion on one priority, with time for your leaders’ toughest questions.

Half day

Private Masterclass

A full working session with your leaders on their most urgent security decisions, built on the Big 4 Model and customized to your organization.

Customized to Your Priorities

Each session is customized to your audience, meeting format, areas of focus, and strategic priorities.

AI risk & secure adoption

Exposure management

Cyber readiness & board reporting

Security culture that holds under pressure

Plan a Session for Your Leaders

Dewayne has advised leaders at the Department of Veterans Affairs, the U.S. Army, Duke Energy, PwC, Kaiser Permanente, and Wells Fargo, and has spoken at the National Cybersecurity Summit and the GDS Group Security North America Summit. Every engagement begins with a planning call, so his message, depth, and style of interaction match your vision.

You Can Also Buy Dewayne's Books

Keep the insight working after the session ends. Cybersecurity Leadership: How to Develop a Successful Mentality and Win, The Cybersecurity Mindset: A Virtual and Transformational Thinking Mode, and CISSP Practice Questions and Explanations give leaders and practitioners the mindset, the leadership, and the credential. Bulk orders are available to give every attendee the same playbook.

Masterclass FAQ

Cannot find your answer? Dewayne personally reviews every inquiry.

How do I register?

Select View Agenda and Register on any masterclass, then complete registration. Your receipt is your registration confirmation, and class details will follow by email.

Can I register a group or pay by invoice?

Yes. Group seats for leadership teams are available. For group rates or to pay by invoice, email dewaynehart@dewaynehart.com or call (470) 409 8316.

Do masterclasses offer CPE credits?

Yes. Each executive masterclass is a half day session that awards 4 CPE credits: The Big 4 Model: Winning Cyber Defense Under Pressure, Governing AI and Cybersecurity Before the Attack, and The Duty of Inquiry: Board Oversight of Cyber and AI Risk. Every session includes a Certificate of Completion.

Where are the masterclasses held?

All three masterclasses take place in the Washington, DC Region at [Venue name, street address].

Who teaches the masterclasses?

Dewayne Hart, a retired U.S. Navy Chief Petty Officer, CISSP, and author, teaches with [Co-instructor name], a retired Marine with federal service at DHS.

What if I cannot attend?

Email dewaynehart@dewaynehart.com before the class. You can also transfer your seat to a colleague at no cost.