From Air Force Cables To Fractional CISO With David Swisher
David Swisher, founder of Protego Cybersecurity, is our guest in this edition of our Founder Spotlight Series.
David spent over eight years on active duty in the US Air Force—starting in IT before it was truly called IT—where he handled everything from physical cabling to early mainframes.
Today he runs Protego Cybersecurity, a firm that brings seasoned CISOs to small and medium-sized businesses on a fractional basis, leveraging a career spanning over 35 years in global IT infrastructure, GPS technology, and semiconductor manufacturing.
I sat down with him for the podcast to talk about his journey from Desert Storm to cybersecurity founder, why he believes businesses over-index on technology, and how to build a security-first culture. His answers are lightly edited for length and clarity.
The conversation
Could you tell us a little bit more about you and the work you do?
I’ve been in the IT space and cyberspace for over 35 years. My journey actually starts straight out of high school—I went straight into the Air Force. Desert Storm was happening around 1990 or 1991, and coming from a military family where discipline was very ingrained, it just made sense. I got into IT before it was called IT, back in the days of mainframes, dumb terminals, coax cables, and vampire clamps.
After eight years of active duty, including three years in Misawa, Japan, Y2K was approaching in 1999. I saw a great opportunity to segue into the civilian market because my skills were in absolute demand. I spent 13 years working with a manufacturing company specializing in high-precision GPS for automated agriculture, starting as a network engineer and eventually running global IT infrastructure.
After that, I spent eight years at a semiconductor manufacturing company rebuilding global operations, data centers, networks, and building out an internal SOC and SIEM. Later on, after moving into sales and consulting roles, I kept seeing companies treating IT and security purely as a cost center to cut back on when things get tough.
That is where Protego was born. Protego is rooted in Latin and means "protector." I created Protego to bring seasoned CISOs to small and medium-sized businesses on a fractional basis, so they can sit alongside CEOs and CFOs to design what security needs to look like—not only for today, but to survive tomorrow.
Is securing the business being treated as an afterthought something you're finding very common?
創 Absolutely. Business education compartmentalizes security into IT from the very beginning. But as a business leader, you have so many responsibilities that you just want an "easy button," and security feels so complex that leaders hand it off to IT. The market creates this situation too—big technology companies send the message, "If you want to be secure, buy my product."
Technology is part of your cybersecurity posture, but it’s not the only thing. You have people and process that lead to technology. For three decades, we’ve over-indexed on technology to solve people and process problems, yet we’re still fighting the exact same issues, like passwords.
Security needs to be treated like safety in a construction company. They lead with a safety-first mindset, but they are still a construction company. Security needs that same cultural integration into how the business operates.
When you say cultural, you're talking about how the people in the company operate?
Exactly. When you’re sitting at your keyboard, receive an email, and think, "Hmm, that just doesn't look right," actual security culture is knowing the right thing to do and stopping to do it—rather than rushing through to deal with the fallout later.
Most security professionals are fearful because every company is effectively one click away from a breach—a 50/50 chance on whether an employee clicks a link or enters their credentials. Annual or quarterly awareness training doesn't build culture. Culture starts with leadership defining it, but execution depends on the person in the mirror holding the line.
For a massive company with hundreds or thousands of employees, how do you pull off creating that security culture?
We tie business directly to security. Only two things truly matter to a CEO: making money and protecting that money. If you aren't protecting that stream, you can't grow.
When we sit down with leadership, we don't start with software. We flip it on its head: we start with people, move through process, and then align technology to support what those two defined. Security impacts everyone from the janitor to the CEO. Mapping that out from a business perspective, rather than just selling more tech, is where we see success.
When you work with companies, do you spend a couple of days with them or monitor their processes? How does that work?
We take the executive community through an intensive interview process. It usually takes a couple of weeks of detailed conversations to map everything out. From there, we deliver a customized roadmap showing Priority 1 and Priority 2 investments of time and money. The template is standard, but the prescription is unique to that specific company.
Do clients call you in before they need you, or after they've been hacked as a preventive measure?
It depends on whether we are in offensive mode or defensive mode.
Defensive mode involves compliance frameworks (like PCI) or coming in after an incident where a company needs to ensure they don't lose customers or supply chain partners.
Offensive mode is proactive—preparing businesses for the digital age and AI through network connections, panels, and strategic planning before a crisis hits.
What are your thoughts around AI, and how do you see this impacting businesses in cybersecurity?
AI and machine learning have been around for decades, but now it's accessible to people who aren't technically savvy, which makes it complex.
When AI amplifies what a human can execute, it’s an incredible win. For instance, security teams deal with "log fatigue" from the sheer volume of data noise. Using AI to parse logs frees humans up to make strategic decisions.
However, when non-technical users use autonomous agents without understanding how things work under the hood, it gets dangerous. That's where controlled workplace culture and awareness become essential.
Where does your job stop when you work with clients? Do you stick with them to make sure they follow the plan?
In the beginning, we sign contracts committing to best efforts together and build KPIs to track whether we're on target or deviating. Some clients just want the program delivered on a retainer basis, but our best possible outcome is helping a mid-cap company mature to the point where they are ready to hire a full-time, dedicated CISO. We step in as sherpas—we carry the load with you, solve the structural problems, and then fade into the background as security becomes second nature to your operations.
Do you actually recommend tools for them to use, or do you help them implement that?
Yes, we do. Having been in this space for 35 years, I know the vendor landscape well. We bring the right technology partners to the table, manage those relationships on the client's behalf, run the projects, and track the KPIs—ensuring the technology fits the client's actual needs on their own terms.
If you could share one final cybersecurity tip for a founder listening to achieve a quick win, what would that be?
Understand that how we manage security in companies is evolving, and you have to evolve with it. Stop over-indexing on technology and hoping for the best. The cybercrime industry is only growing and getting more enabled. You need to build a cybersecurity mindset across your organization—just as you would build a marketing, sales, or operations team. It doesn't require a team of 50; it requires a change in mindset and perspective.
Where's the best way for people to learn more about Protego or work with you?
You can find Protego Cybersecurity and me on LinkedIn, or visit protegocybersecurity.com.
Closing thoughts
David’s background emphasizes a core principle: technology alone cannot safeguard a business if the underlying human processes and operational mindset are ignored. If you're building in cybersecurity or managing a growing business, here's what to take away:
People and process come before tools: Align your culture and daily workflows before buying software to enforce them.
Security is a cultural element, not a cost center: Treat security with the same operational integration as sales, marketing, or workplace safety.
Use AI to amplify, not replace: Leverage automation to eliminate log fatigue so human decision-makers can focus on strategic defense.
Build toward maturity: Leverage fractional executive expertise early on to establish governance until you are ready for full-time internal leadership.
Want more conversations with founders?
Follow David Swisher on LinkedIn and learn more at protegocybersecurity.com
