The Cybersecurity Mistakes Small Companies Keep Making with Bruno Lecoq

This week Laura and Kevin sit down with Bruno Lecoq, CEO of BEMO, to talk about the reality of cybersecurity for small and mid-sized defense contractors. Bruno shares how he ended up leading a cybersecurity company and why smaller organizations, especially those connected to the defense supply chain, have become some of the most attractive targets for attackers. The conversation challenges the common belief that hackers only focus on big-name companies and instead explains what’s actually happening on the ground for organizations with 50 to 100 employees.  

From there, we dig into the difference between security theater and real protection. Bruno explains why fear-driven compliance advice often leads companies to spend more money without meaningfully reducing risk, who benefits from that cycle, and where organizations tend to invest in tools that look impressive but don’t actually stop breaches. We also get into practical issues leaders overlook, like admin access and identity controls, which are often the simplest path into a company network. We wrap with a candid look at real-world constraints. If a company passes every audit but still gets breached, what does that say about compliance frameworks like CMMC, SOC 2, and NIST SP 800-171? And looking ahead, Bruno weighs in on what’s more likely to cause damage over the next five years: sophisticated AI-powered attacks or companies continuing to ignore the basic security controls that stop most breaches today.

Bruno Lecoq is the CEO of BEMO and a trusted voice in cybersecurity compliance for US-based small and mid-sized defense contractors. He works hands-on with business owners, IT leaders, and executives to turn complex regulatory frameworks into practical, achievable compliance outcomes. With deep expertise across CMMC, SOC 2, ISO 27001, HIPAA, and NIST 800, Bruno is known for his calm, implementation-first approach. Rather than promoting fear or over-engineered solutions, he helps organizations align compliance requirements with the tools, processes, and systems they already use, particularly within Microsoft environments.