In the summer of 2015, George Wrenn arranged a customer visit with a second purpose tucked inside it. Executives would get out of the office and see how technology, business and cyber risk met in practice. Later, when the next security budget came up, they would have something more useful than a row of numbers to remember. Wrenn subsequently wrote that the experience helped persuade them to increase the budget. A field trip had done some of the work of a financial argument.
It is an unusually revealing episode for a cybersecurity career. Wrenn understood the technical problem. He also understood the people who had to pay for solving it. In his account of the workshop, he described carefully arranging the experience while having outside consultants help explain the risks. He wanted decision-makers to see the consequences for themselves. Even a boardroom, apparently, can benefit from a change of scenery.
That problem of understanding kept returning in his work. At Schneider Electric, it involved industrial systems and security leadership. At CyberSaint, the company he co-founded, it involved software for risk and compliance. At ZenPrivata, it involved privacy programs. The details differed, but the question connecting them was remarkably practical: how do you make a complicated concern clear enough that somebody can do something about it?
When the network reached the factory floor
Wrenn’s experience reached beyond office computers. As vice president of cybersecurity and chief security officer at Schneider Electric, he worked in a business where digital systems intersected with physical operations. His 2014 writing on industrial security examined what happened as operational technology joined the networks already used by information technology. Systems once managed in separate domains were acquiring Internet Protocol addresses, exposed interfaces and new routes for remote access.
The attraction was easy to understand. Remote management and monitoring offered convenience. The difficulty lay in what those connections exposed. Wrenn pointed to the integrity of commands, logic and access to programmable systems. In this setting, a security failure could affect the behavior of equipment. The concern extended to control rooms, transportation and electrical grids. A network diagram could have consequences well beyond the room where it was drawn.
His work at Schneider also included a security and compliance training program and helping products meet industrial standards internationally. Those responsibilities brought engineering, organizational habits and certification into the same working life. His later interest in shared frameworks makes sense against that background. Security had to travel across teams and products, with enough consistency that people could understand what was expected of them.
A framework with somewhere to go
Before CyberSaint, Wrenn had also worked in consulting and security leadership. At IBM, he helped large companies with compliance, security strategies and programs. A 2018 conference biography identified him as a research affiliate in management science at MIT Sloan and noted his US patents in cloud security. His experience combined the technical subject with the machinery organizations use to manage it: plans, standards, responsibilities and decisions.
CyberSaint, founded in 2016, gave that combination a commercial home. Wrenn’s fellow founders included Padraic O’Reilly and Scott Schlimmer. CyberStrong, its software platform, was designed to help organizations assess their programs, understand the results and manage improvements. The pitch drew on established security frameworks, including NIST, rather than requiring customers to invent a complete vocabulary for risk on their own.
“It is time to manage cybersecurity as a dedicated business function.”
George Wrenn
The sentence sounds almost modest. Its implications are demanding. A business function needs measures people can inspect, a way to allocate resources and a means of seeing whether changes helped. A security program needs to survive the conversation with the rest of the business. Wrenn wanted that conversation to be possible without translating every technical finding from scratch.
In his argument for the NIST framework, he described the value of drawing on collective experience. A shared framework can carry knowledge from many organizations into one organization’s decisions. The practical attraction is that a team starts with something others have already considered. It still has to do the work of applying it to its own circumstances. A borrowed map is useful only when someone looks at the road.
Making the report survive the meeting
Wrenn’s writing could be quite concrete about responsibility. In a 2017 commentary for small defense contractors, he discussed preparing for NIST requirements, making a plan with milestones and considering qualified outside help. He also emphasized that using a cloud provider did not remove an organization’s responsibility for protecting covered information. Outsourcing could change who performed tasks; someone inside the business still had to own the outcome.
It was advice aimed at people trying to keep a business running while navigating an unfamiliar set of requirements. The acronyms were abundant. The task beneath them was comprehensible: know what applies, decide how to meet it and keep track of the work. Wrenn’s subject could be forbidding, but the management questions were recognizably ordinary.
CyberSaint’s November 2019 governance-dashboard release approached the other end of that process. Executives could examine risk and compliance across business units, regions, projects and asset types. Wrenn pointed out that a CISO might have to explain the enterprise-wide position to a board and also speak to executives responsible for individual units. One audience did not stand in for the other.
The distinction matters. A useful report needs to connect with the responsibility of the person reading it. A director looking across the company and a manager looking at a particular operation may need different views of the same underlying work. Wrenn’s approach treated communication as part of managing security, with its own audience, purpose and practical consequences.
The classroom and the conference table
His academic work sat alongside those commercial concerns. Wrenn spent years as a graduate fellow at MIT, undertaking research and advanced coursework across several schools and programs. He also contributed to curriculum and teaching for MIT Sloan executive education on the NIST Cybersecurity Framework. The audience for that kind of work included leaders whose responsibilities touched security even when their training lay elsewhere.
At the 2018 NIST Cybersecurity Risk Management Conference in Baltimore, he participated in a panel considering the past, present and future of Internet of Things security. Research affiliate Rafi Yahalom attended too. It was a setting that connected his industrial-security experience with broader questions about how connected devices should be managed. His work moved among the company, the classroom and the conference table.
Wrenn also wrote about artificial intelligence in cybersecurity, explaining approaches such as neural networks and their possible applications to identifying malware relationships. His interest preceded the current everyday familiarity of generative AI. The emphasis was on what techniques could contribute to a security problem. For a working leader, an interesting method still needed an intelligible use.
Privacy gets its own roadmap
By January 2021, Wrenn was discussing a related management challenge at ZenPrivata. The company, which he founded with Schlimmer, introduced a privacy-as-a-service offering built around establishing a baseline and a roadmap. Wrenn emphasized the ability to communicate an organization’s privacy position to leadership and obtain support and resources. The need to make a program understandable had followed him into another venture.
A baseline and a roadmap are wonderfully sober concepts for a technology company. They ask where you stand and what you intend to do next. ZenPrivata’s early offer addressed controls, collaboration and a shared plan for privacy work. It put organizational coordination beside technical and regulatory complexity. Before a program can move forward, the people involved need some agreement about the route.
In January 2023, Privacy Observatory 2.0 was announced, with Wrenn identified as founder and CEO. The product was presented as a way for companies of different sizes to safeguard data and manage changing requirements. The ambition remained familiar: give people a structure for understanding an issue, then make it easier to carry out the work.
The next chapter has other names
CyberSaint’s leadership had meanwhile changed. Jerry Layden, who joined as chief revenue officer in 2018, assumed CEO responsibilities in September 2021. Wrenn belongs in the company’s story as a co-founder and former CEO. The handoff is part of that story too. Companies grow through successive periods, and the people responsible for one chapter are not automatically responsible for every chapter that follows.
- 2016CyberSaint is founded.
- 2021Jerry Layden assumes the CEO role.
- 2024A $21 million Series A is announced.
In March 2024, CyberSaint announced a $21 million Series A led by Riverside Acceleration Capital. That financing belongs to the company’s subsequent development, rather than serving as a shorthand for Wrenn’s personal fortunes. It marks another stage for a business whose early purpose had been to make cybersecurity clearer, more actionable and more measurable.
The people in the picture
Wrenn died on June 7, 2024. He had lived much of his life in Cambridge and Acton. Colleagues remembered the person around the work as well as the executive inside it. Schlimmer recalled offsites with productive days, shared dinners and movies that were entertaining partly because they were terrible. Team-building apparently survived some questionable programming decisions.
Those memories give the software story a welcome human scale. Wrenn’s interests included flying, surfing, filmmaking and music. He served as a Civil Air Patrol pilot and first lieutenant. The working life contained teaching, companies and standards; the rest of the life had plenty of motion.
The customer visit in 2015 remains a useful place to remember him. He had a technical concern, a business decision approaching and people who needed to understand the connection. So he arranged an experience they could carry into the meeting. Much of his career involved giving an abstract problem that sort of practical shape, with somebody else’s understanding as part of the job.