Why Compliance Alone Isn't Security: Lessons from Vetcor's CSO Andrew Wilder

Guest Introduction

Andrew Wilder serves as Chief Security Officer at Vetcor, a veterinary consolidator that owns and operates nearly 1,000 veterinary hospitals across North America. Backed by private equity, Vetcor relieves veterinary practices of back-office responsibilities such as IT, HR, and finance, enabling veterinarians to focus on patient care. Andrew, the company's first CSO, has built the security team from the ground up, growing it from zero to eight in just a year. His leadership emphasizes balancing innovation with risk management, building partnerships with early-stage vendors, and aligning cybersecurity strategy with real-world threats rather than chasing compliance checkboxes.

---

 

Here's a Glimpse of What You'll Learn

• How private equity shapes security priorities for veterinary consolidators

• Why Andrew frames security decisions around risk appetite instead of directives

• The difference between compliance and true security readiness

• How peer networks shape vendor selection more than Gartner or Magic Quadrants

• Why innovation partnerships with startups accelerate defense capabilities

• Lessons from Andrew's teaching role at Washington University on data-driven defense

• Andrew's unconventional career path from customer service rep to regional CISO at Nestlé

• Why major incidents can serve as the best training opportunities for CISOs

---

 

In This Episode

Andrew explains how Vetcor's private equity backing influences the way security strategy is executed. Rather than being driven solely by compliance, the company emphasizes real security outcomes. He stresses that different private equity firms have different levels of involvement, and the right balance allows leaders to focus on building strong defenses without excessive overhead.

He discusses his philosophy of security leadership: not dictating solutions but presenting risks, controls, and letting executives set their risk appetite. This approach ensures that security decisions are aligned with the organization's business priorities, while his team remains empowered to execute effectively.

Andrew highlights the power of peer networks in vendor selection. Instead of relying on market leaders, he prefers referrals from other CISOs, leading to innovation partnerships with startups. One example is Savvy, a company building tools that proactively guide users in real time, like a modern "Clippy" that prevents credential misuse or unsafe browsing. Another design partnership focuses on agentic AI to automate repetitive security reviews. These collaborations bring innovation into Vetcor while cutting costs and expanding capability.

The episode also covers Andrew's career journey, which started at a small paper company where he was assigned to manage IT upgrades simply because he was the youngest employee. From there, he pursued Microsoft certifications, worked on security projects at HP, DHL, and Nestlé, and eventually rose to become regional CISO overseeing multiple continents. Today, he shares his knowledge as a teacher in Washington University's executive cyber program, where he emphasizes data-driven defense and learning from incidents as key to building resilience.