Fred Descloux

Many organisations know the feeling. A security review arrives, and with it hundreds of recommendations, a lengthy report and an endless compliance checklist, with no clear sense of what actually matters. Fred Descloux named his company after the antidote. “Security has become unnecessarily complicated,” says the founder of Zero Drama Security.

The name is memorable, but it is also a philosophy, and Descloux can state it in a sentence: reduce noise, focus on risk, communicate clearly, and make security something that enables the business rather than slows it down.

His starting point is the business, not the framework. Before reaching for a checklist, he asks what the organisation is trying to protect, what could go wrong, what the impact would be and which risks genuinely deserve attention. Then come conscious decisions about which risks to address, mitigate, transfer or accept. Frameworks such as NIST and ISO are tools in that work, he argues, not objectives in themselves, a distinction that matters most for smaller and fast-growing companies. He would rather “avoid creating unnecessary work simply because a framework says so.”

Much of the job is translation. Whether the subject is cybersecurity, privacy, AI governance or compliance, “the objective is the same: help leadership make better decisions.” That means turning technical findings into what he calls decision language for executives: the exposure, the business impact, the options, the cost and the risk that remains once a choice is made. “I try to translate technical complexity into business language,” he says.

The same pragmatism shapes his view of compliance. A requirement such as SOC 2 is, in his view, a business problem to be solved, perhaps the thing standing between a company and a deal, rather than the starting point for a security programme. And security, he insists, should not be the department that says no. His aim is to turn it from the department of no into the department of know.

In practice, that means making the secure path the easiest one: approving common patterns, automating authentication, and saving manual security reviews for genuinely high-risk exceptions. It means bringing security in at the start of product development, rather than at the last minute before launch, when late requirements become costly hurdles. Done that way, organisations “can often move faster because they spend less time fixing preventable problems later.”

Nowhere is that balance more pressing than with AI, which has left many leaders excited and unsure at the same time. Descloux sees one error above all. “The biggest misconception is that AI governance is about controlling AI.” It is really about understanding where AI is being used, what data it touches, who owns the risks, and how an organisation can innovate confidently instead of reacting after something goes wrong. His shorthand is guardrails, not gates. Six-month reviews, he warns, simply encourage employees to bypass the process. Governance should also fit the use: rewording an email needs far less oversight than using AI to make material decisions about people or customers.

Ask what he hopes clients walk away with, and compliance is only the beginning. “Beyond compliance, I want clients to leave with confidence.” He means a clear grasp of their risks and priorities, a realistic roadmap, and the ability to make decisions without feeling constantly overwhelmed. Leaders, in his view, should know their biggest risks, what is being addressed, what can wait and what they are consciously choosing to accept. It is, fittingly, a definition of success with no drama in it.