In this episode of Business Technology Perspectives, I speak with Michel Jacobs, Chief Strategy Officer at CSI, about how artificial intelligence and customer intelligence are changing the relationship between financial institutions and the people they serve.

Community banks and regional financial institutions have traditionally competed through personal relationships rather than scale. But digital banking, fintech competition, and changing consumer expectations are putting that advantage under pressure. Michel argues that the future of banking will increasingly be defined by interactions rather than transactions.

That means understanding why a customer is contacting the bank, what may be happening in their life, and which service could provide value at that moment. It also means preparing for interactions initiated through APIs, open banking services, and AI agents, rather than assuming every customer journey begins with a person opening a banking app.

Michel explains how CSI’s Customer Intelligence Suite combines transaction information, card activity, merchant category data, and digital behavior to identify signals and changing patterns. According to Michel, these signals can help a financial institution understand when a customer’s circumstances may have changed instead of relying on the demographic category assigned when the account was opened.

This creates opportunities for relevant financial support, but it also introduces serious questions about privacy, consent, accuracy, and customer trust. Inferring that somebody has changed jobs, bought a home, become a parent, or encountered financial difficulty can be useful when the response genuinely helps. The same capability can feel intrusive when it produces poorly timed sales offers or conclusions the customer cannot question.

We discuss how banks can balance personalization with regulatory responsibilities and why younger consumers are less likely to remain loyal when a provider offers little practical value. As Michel puts it, the era of offering everybody the same account and throwing in a free beach ball has probably run its course.

Customer retention is another major part of our conversation. Michel explains how declining digital activity, money leaving an account, late payments, or changes in income can reveal that a relationship is weakening. Used responsibly, this information could allow a bank to offer assistance before missed payments or financial strain become harder to address.

For community banks, the answer is unlikely to be copying every product offered by the largest global institutions. Michel believes they should decide where they can provide distinctive value, then use technology and data to support that position. CSI’s stated aim is to give smaller financial institutions access to customer analytics capabilities that would otherwise require considerable internal investment.

Can AI help banks become useful partners in their customers’ lives without crossing the line from personalization into intrusion? Listen to the conversation and share your thoughts with me.

In this episode of The Business of Cybersecurity, I speak with Spencer Young, Senior Vice President of International Markets at Delinea, about why authenticating an AI agent is only the beginning of the security challenge.

Spencer has spent 34 years in IT and around half that time in cybersecurity. His experience covers secure software development, vulnerability testing, application protection, data security, and identity security.

Our conversation begins with the changing economics of cybercrime. Spencer says attackers increasingly prefer stealing or compromising legitimate credentials because logging in can be cheaper, faster, and easier than forcing a route through network defenses. He estimates that over three quarters of attacks involve a compromised credential somewhere in the chain.

AI agents add speed and scale to identity risk. They can access applications, databases, financial systems, development tools, and infrastructure while performing dozens of actions during a single session.

The danger is not limited to an agent being denied access. An agent may be fully authenticated and possess valid permissions while taking an action the organization never intended.

Spencer offers the example of a finance agent created to support payment processes. Hidden or manipulated instructions could cause it to change payment profiles and redirect money while appearing to operate as an authorized identity.

This is why Delinea is focusing on runtime authorization. Rather than approving an agent once and allowing every subsequent action, the approach evaluates each proposed tool call, database query, or SSH command before it runs. The action can be allowed, blocked, or referred to a person for approval.

We also discuss how least privilege applies to autonomous systems. Spencer recommends providing credentials only at the moment an agent needs them, limiting access to the specific task, and revoking those privileges immediately afterward. The agent never needs to see or retain the credential.

The research figures Spencer shares reveal a concerning difference between confidence and control. He says 80% to 85% of respondents feel confident in their ability to discover nonhuman identities, while only 30% validate nonhuman identity use and AI activity in real time.

Delinea now works with over 9,000 organizations, including over 60% of the Fortune 100. Spencer says regulated industries frequently demonstrate greater identity security maturity because external requirements encourage continuous controls rather than reactive incident response.

However, technology cannot decide an organization’s risk appetite. People must define what the agent is expected to do, which actions require approval, where it must stop, and who is accountable when something goes wrong.

Could your organization detect a properly authenticated AI agent taking an inappropriate action before that action executes? Listen to the episode and share your thoughts with me.

Suggested URL

In this episode of The Business of Cybersecurity, I speak with Heath Mullins, Chief Evangelist at ExtraHop and former Forrester analyst, about why AI security has become an operational issue for organizations today.

ExtraHop’s 2026 Global Threat Landscape Report states that 85 percent of organizations have experienced an AI-driven attack. These incidents include AI-enhanced external attacks, compromised AI identities, and breaches involving third-party AI providers. The report also found that 55 percent view AI agents, agentic infrastructure, and GenAI applications as their biggest attack-surface risk.

Heath explains that many attacker tactics remain familiar. The difference is speed. An analyst who once had hours or days to compare endpoint alerts, network logs, threat intelligence, and security events may now find that the attack has completed before the investigation begins.

We also discuss how AI models can be influenced without anybody directly altering their code. Attackers can publish false information that enters future training data or introduce misleading content into internal repositories and development environments. An agent may then infer a connection, assign a high confidence score, and act on inaccurate information.

The risks grow when AI agents receive administrator privileges. Heath describes an agent as an entity capable of taking action across the network. His analogy is difficult to forget: AI can resemble a dangerous toddler carrying the keys to the house, car, and gun safe. It may be extremely helpful, but broad permissions combined with loosely defined instructions create the conditions for serious damage.

Third-party AI adds further dependencies. Security leaders need to understand how suppliers use models and reasoning tools, whether customer data is segregated, what remote access exists, and how a compromised supplier could create a path into the network.

Heath also challenges the assumption that endpoint controls and delayed logs provide enough visibility. Machine-speed attacks may exploit unknown vulnerabilities, evade endpoint detection, and move laterally using identities that appear legitimate. Behavioral and live network signals can reveal activity that does not match a published indicator or known signature.

Buying another security product may address an identified gap, but Heath argues that CISOs also need awareness across physical, virtual, cloud, and container environments. Network and security teams must share information when an identity, agent, or workload begins behaving differently.

His immediate advice is direct. Treat every new tool as potentially dangerous. Test AI agents inside properly isolated environments. Connect every agent to a known identity, restrict its permissions, and define a narrow task. Finally, train people to use AI responsibly and retain human authority over consequential actions.

Heath is also the kind of guest I could talk with over a cold beer for hours about technology and its consequences. After we finished the formal interview, our conversation moved naturally into AI data centers, energy costs, water consumption, surveillance, and humanity’s habit of adopting technology even when we understand the price.

If AI agents can act with administrator privileges at machine speed, are your security controls watching what those agents are doing or merely recording what happened afterward? Listen to the episode and share your thoughts with me.

In this episode of The Business of Cybersecurity, I speak with David Sowder, Senior Solutions Architect and OneSite Patch product specialist at Adaptiva, about balancing rapid vulnerability remediation with operational control.

David brings 25 years of IT operations and engineering experience to the conversation. He remembers receiving large spreadsheets of vulnerabilities from security teams and being responsible for turning that information into deployed fixes. That experience gives him a practical view of the gap between identifying a vulnerability and safely resolving it across thousands of endpoints.

Adaptiva’s State of Patch Management report argues that speed cannot be the only measure of success. David illustrates the problem with a library cart full of books. Pushing it down the stairs may be the fastest way to reach the lower floor, but the resulting mess defeats the purpose.

The same principle applies to patch management. Urgent deployment can reduce the period when a vulnerability remains exposed, but an inadequately tested update may break applications, interrupt customer services, or affect revenue. David recommends representative pilot groups, defined testing periods, user feedback, staged deployment, monitoring, and the ability to stop a release before it reaches the full production environment.

We also discuss why greater endpoint visibility does not automatically reduce business risk. Dashboards and vulnerability reports provide knowledge, but IT teams must perform the work required to remediate the problem. David believes closer cooperation between InfoSec and IT can reduce the time between identification and action.

Automation introduces another difficult decision. David argues that layers of manual approval frequently add delay without changing which patches are eventually deployed. His proposed alternative is to begin the process automatically, notify the right people, test through pilot groups, and prevent wider deployment when the feedback indicates a problem.

Accountability remains shared. Security leaders set risk policies, InfoSec prioritizes exposure, IT manages deployment, and application owners understand the possible business consequences. These responsibilities need to be agreed before an urgent incident arrives.

Can autonomous patch management help companies respond at machine speed without turning a security fix into a business outage? Listen to the conversation and share your thoughts with me.

In this episode of The Business of Cybersecurity, I speak with Rami Habal, founder and CEO of Magnitude. We discuss why traditional third party risk management is struggling to keep pace with connected supply chains, autonomous attacks, AI adoption, and constantly changing vendor environments.

Rami explains that third party risk management developed largely as a compliance process. Companies relied on questionnaires, spreadsheets, point-in-time assessments, and annual reviews. Those methods provided documentation, but they offered limited visibility into what changed after the review or which fourth and fifth parties supported the original vendor.

The result can be a false sense of security. A supplier may change its infrastructure, ownership, software, data practices, or terms of service months before the customer performs another formal assessment. Attackers do not wait for the next compliance cycle.

Rami argues that AI has broken the traditional mathematics of third party risk. Security teams cannot manually monitor thousands of suppliers and every organization supporting them. Attackers can use advanced models to find weaknesses faster, while businesses are adding AI services and dependencies at speed.

Magnitude provides what Rami describes as an AI workforce for third party and supply chain risk management. Its agents support tasks including supplier intake, evidence gathering, security evaluation, risk analysis, onboarding, continuous assurance, and offboarding.

We discuss how this automation can address three business problems. The first is time compression, allowing security teams to process supplier reviews faster. The second is risk reduction through wider visibility, including fourth and fifth party dependencies. The third is business enablement, reducing delays that might otherwise encourage employees to use unapproved AI tools.

Rami explains how Magnitude maps supplier relationships as a connected graph. Security teams can see where dependencies overlap, identify concentration risk, and assess which parts of the business may be affected when a provider experiences an incident.

Continuous monitoring also includes unstructured information. A vendor may update a lengthy terms of service document and introduce permission to train AI systems using customer data. An employee receiving the notification may ignore it, while an automated agent can compare the document, identify the change, and explain its potential effect.

Rami uses a helpful analogy. Traditional vendor assessments resemble photographs, while continuous monitoring resembles a live video feed. Operational, financial, cybersecurity, and privacy risks continue changing after the original assessment.

Automation does not remove people from the process. Rami sees AI preparing evidence, correlating signals, and recommending action while humans handle exceptions, ask difficult questions, and judge the business consequences.

He closes by urging boards to treat third party risk as part of cyber resilience rather than leaving it within procurement or compliance. Does your organization know which suppliers create its greatest concentration risk and how far a breach could travel through the chain? Listen to the conversation and share your thoughts with me.

In this episode of The Business of Cybersecurity, I speak with Guy Flechter, CEO and co-founder of Sola Security. Guy has worked in cybersecurity for 25 years, progressing from operational security roles to the CISO position before moving into entrepreneurship. He previously founded Cider Security, which was acquired by Palo Alto Networks for $300 million.

Our conversation focuses on why adding AI agents to separate security tools may increase speed without improving the quality of the decisions. Cloud, identity, SaaS, code, devices, and networks frequently operate through different consoles and data models. An agent working within one of those systems may answer confidently while missing a relationship that changes the meaning of the risk.

Sola Security’s research examined 50 tasks across eight enterprise platforms. According to Guy, providing structural and relational context improved answer correctness by approximately 34% across the tested models. Under full context, 78% of responses were considered fully correct, around 18% were incomplete, and fewer than 4% were classified as complete failures.

Those results show both the promise and present limitations of AI security agents. Connected context can improve performance significantly, but 78% accuracy does not support fully autonomous action in situations where an incorrect permission change or security response could have serious consequences. Guy believes human involvement will remain necessary until accuracy reaches a far higher level.

We also discuss how companies should vet and onboard AI agents. Guy recommends treating an agent like a new employee by defining its permissions, monitoring its actions, controlling what it can retain, and limiting its authority until trust has been earned.

The episode concludes with a discussion about independent testing. Guy argues that buyers need transparent benchmarks with visible tasks and repeatable methods, rather than vendor accuracy claims based on private evaluations.

Should an AI security agent be allowed to act autonomously if its reasoning cannot be independently tested? Listen to the conversation and share your thoughts with me.

In this episode of Business of Cybersecurity, I speak with Lewis Henderson, Director of Intelligence Communications at KELA, about the criminal economy operating beyond the corporate network. We discuss how cyber threat intelligence can reveal attacker intent earlier, giving security teams time to respond before stolen access becomes a full breach.

KELA’s State of Cybercrime 2026 research identified 2.86 billion stolen credentials in a single year. Lewis explains why that volume makes exposure a question of probability for many large organizations. He also describes how cybercrime as a service has lowered the technical barrier for attackers. Businesses may now face hundreds of lower-skilled criminals using purchased tools, credentials, and AI assistance instead of a small number of highly experienced groups.

One example begins with an employee downloading a video game containing infostealer malware. A single stolen credential reportedly provided access to 300,000 cash registers. KELA discovered the access being discussed in a criminal market, showing why monitoring attacker activity outside the network can provide warning that internal tools may miss.

We also examine alert fatigue, the limitations of point-in-time risk assessments, how criminals are experimenting with AI, and why boards should ask security leaders about threats forming across suppliers, cloud services, and the wider internet.

Are companies investing enough in understanding attacker intent, or are too many waiting for the threat to arrive at their front door? Listen to the conversation and share your thoughts with me.

Advanced security models such as Mythos can gather and apply techniques published across security research, Black Hat, DEF CON, and other industry sources. Gunter says this makes them particularly effective at reviewing large code bases and trying known attack methods against potential targets.

The result is faster vulnerability discovery, but finding additional weaknesses does not automatically make a company safer. Cobalt’s 2026 State of Pentesting Report found AI and LLM tests produced high risk findings at 2.7 times the rate of its wider data set. According to Cobalt, 32% of AI and LLM findings were rated High Risk, while only 38% were resolved.

Gunter sees two reasons for the gap. Companies are adding AI features to existing applications without fully understanding how the new components affect security. He compares this with the arrival of internet connectivity inside physical equipment, when engineering teams added network stacks without years of experience securing them.

Supplier dependency creates another problem. When a company adds a third party model or AI service to its product, it may lack the ability to correct a weakness directly. Remediation then depends on the supplier’s development priorities and release schedule.

Gunter recommends moving security testing closer to development. The traditional annual penetration test created for compliance is being replaced by a continuous cycle of monthly or quarterly human testing, daily or weekly automated scanning, and remediation connected with development pipelines.

Human participation remains important, but its role is changing. Automation, machine learning, and AI have already removed many Tier 1 positions from security operations centers. The same pattern is appearing in offensive security, where junior pentesters once learned by working alongside experienced practitioners.

Gunter does not see strong evidence that giving a junior analyst an AI tool automatically turns that person into a Tier 2 practitioner. Instead, some organizations are recruiting experienced professionals from IT, product management, or program management and using AI to help them acquire cybersecurity knowledge.

This creates a long term talent problem. Businesses continue competing for senior practitioners while removing the junior roles that historically produced them. The industry therefore needs new ways for inexperienced candidates to learn, practice, receive feedback, and assume responsibility safely.

We also discuss whether faster discovery could overwhelm senior practitioners. Gunter points out that many weaknesses being discovered by AI have existed for years. The technology is improving the industry’s ability to locate and exploit them. Defensive tools are also becoming faster at finding causes, creating fixes, and deploying updates.

The remaining problem is time. If an AI system can find a vulnerability and create an exploit almost simultaneously, companies may have hours rather than weeks to respond. When an immediate code fix is unavailable, detection and blocking technologies may need to provide temporary protection.

His final message is directed at CISOs. AI cannot be treated as a system that receives a problem and operates without supervision. Security leaders need to understand how the technology works, where humans belong in the process, and when human review becomes a delay that attackers can exploit.

Can security teams increase testing and remediation speed while still developing the practitioners they will need in the future? Listen to the episode and share your thoughts with me.

Our conversation begins with the UK Cyber Security and Resilience Bill and the demands it could place on managed service providers, data centers and designated suppliers. Proposed reporting windows could require an initial notification within 24 hours and a fuller incident report within 72 hours. Khush explains why organizations should map their supplier dependencies, define reporting responsibilities and rehearse those deadlines before a real incident tests them.

We then examine what Vanta calls security theater. Khush argues that teams have spent years gathering screenshots, maintaining documents and completing questionnaires because passing an audit became the accepted measure of success. The danger is that an organization can appear compliant while controls remain poorly designed, incorrectly scoped or ineffective in daily operations.

AI can compound that problem. It can generate policies, automate attestations and produce reassuring dashboards, but those outputs mean little when nobody validates the systems or checks whether the underlying controls are working.

Khush also explains why shadow AI creates a larger governance problem than shadow IT. Employees can introduce copilots, models, APIs and autonomous agents that access company data or take actions without the security team knowing they exist. Her advice begins with a live inventory covering cloud assets, SaaS applications, suppliers, machine identities, AI tools and agents.

We also discuss how CISOs can improve their conversations with boards. Instead of presenting compliance status as the main result, Khush recommends explaining business exposure, supplier dependencies, potential outage costs, reporting readiness and the speed at which failed controls can be detected.

Can organizations turn compliance into a continuous operating discipline that protects the business every day, rather than a scramble before the next audit? Please share your thoughts with me.

In this episode of The Business of Cybersecurity, I welcome Almog Apirion, CEO and Co-Founder of Cyolo, to discuss why the rules of defending operational technology are changing. Drawing on his experience leading the Israeli Navy's cyber unit and serving as a CISO before founding Cyolo, Almog shares why the rise of AI-powered attacks demands a renewed focus on the security fundamentals many organizations have overlooked.

One of the strongest messages from our conversation is that AI has dramatically lowered the barrier for attackers. Capabilities that once required highly skilled specialists are now becoming accessible to a much wider range of threat actors. Rather than spending weeks researching vulnerable systems, attackers can now automate reconnaissance, identify weak points, and prepare attacks at unprecedented speed. That leaves defenders with far less time to react.

Instead of relying solely on detection and response, Almog argues that businesses must build security into their environments from the beginning. We discuss why identity controls, multi-factor authentication, segmentation, and tightly governed access remain some of the most effective ways to reduce cyber risk, even as AI continues to reshape the threat landscape. Sometimes the simplest security controls still prevent the biggest attacks.

Our conversation also examines why traditional VPN-based remote access has become increasingly difficult to justify inside critical infrastructure. Almog explains why giving users access to an entire network creates unnecessary exposure when modern approaches can limit access to only the specific systems people need to perform their work. That principle sits at the heart of mature zero trust strategies, where every connection is verified and every action is tightly controlled.

Another area we explore is microsegmentation and why it is becoming an increasingly important part of protecting operational technology. Rather than assuming attacks can always be prevented, organizations should prepare for the possibility of compromise and focus on limiting how far an attacker can move through a network. Reducing the blast radius can often make the difference between a contained security incident and a major operational disruption.

We also discuss the practical challenges security leaders face every day. Replacing legacy remote access tools, introducing zero trust without disrupting production, supporting third-party vendors, and maintaining always-on access for mission-critical operations all require careful planning. Almog explains why cybersecurity cannot come at the expense of uptime, particularly in industries where every minute of disruption carries real-world consequences.

This conversation serves as a timely reminder that while AI is changing both sides of cybersecurity, the strongest defenses are still built on solid foundations. As attackers become faster and more automated, organizations must ensure that identity, access, segmentation, and resilience are designed into their environments from the start rather than added after an incident occurs.

If AI is making attacks faster, should security teams spend less time chasing alerts and more time reducing opportunities for attackers altogether? And are the foundations of your security strategy strong enough for the threats that already exist today? I'd love to hear your thoughts after listening.

As businesses race to deploy generative AI, AI agents, and Model Context Protocol integrations, Leslie explains why AI models themselves are becoming valuable targets. When organizations pool large volumes of sensitive data into centralized AI systems, they create what he describes as a corporate brain, one that can quickly become attractive to attackers if the right controls are not in place.

We explore the rise of shadow AI, where employees use unsanctioned AI tools to meet deadlines and improve productivity, often without understanding the long-term consequences. Leslie shares why a simple upload of financial data, customer information, or proprietary documents into a public AI platform can create risks that traditional security teams struggle to contain once the information has entered a large language model.

The conversation also examines the changing nature of insider threats. From negligent behavior to deliberate misuse of credentials, attackers are increasingly targeting employees directly. Leslie discusses how AI is making it easier for threat actors to identify vulnerable individuals, while growing concerns around job displacement may create new pressures inside organizations.

We also discuss why visibility remains one of the biggest cybersecurity challenges facing modern enterprises. As AI changes data flows, communication channels, and user behavior, many organizations are discovering that traditional security controls were never designed for the speed and complexity of today's AI-powered environments. Leslie explains why cybersecurity leaders need to become AI champions rather than blockers, helping businesses adopt AI safely while maintaining visibility, governance, and trust.

Looking ahead, Leslie remains optimistic about using AI to strengthen cyber defenses. As attackers embrace AI, defenders are doing the same, creating a new chapter in cybersecurity where automation, intelligence, and human expertise will work together to protect organizations from emerging threats. How is your organization balancing AI innovation with security, and are you confident you can see where your data is really going? Share your thoughts with me.

The conversation begins with a striking statistic. More than 40% of cyber incidents reported to the FCA involved at least one third party, highlighting how interconnected digital ecosystems have created new points of vulnerability across financial services. Ben explains why attackers are increasingly targeting suppliers, service providers, and technology partners to gain access to larger organizations, and why regulators are becoming increasingly concerned about concentration risk across critical infrastructure.

We also tackle one of the biggest misconceptions surrounding the new FCA requirements. Many organizations assume that compliance with the EU's Digital Operational Resilience Act (DORA) automatically prepares them for the UK's reporting obligations. Ben explains why that assumption could leave firms exposed, outlining the differences between the two frameworks and the additional work many organizations still need to complete.

Our discussion explores operational resilience, supply chain visibility, incident reporting, and the practical realities of responding to cyber incidents while simultaneously meeting regulatory expectations. Ben shares insights on why organizations need a far better understanding of third-, fourth-, and even fifth-party dependencies, and why traditional approaches to supplier risk management are struggling to keep pace with today's interconnected business environment.

We also examine how collaboration between regulators, cybersecurity providers, threat intelligence specialists, and financial institutions could help strengthen collective defenses against increasingly sophisticated threats. From cyber extortion campaigns to supply chain attacks affecting hundreds of organizations simultaneously, the discussion highlights why resilience has become as important as prevention.

If your organization assumes compliance is already covered, this conversation may prompt a second look. Are businesses truly prepared for the next phase of cyber resilience reporting, or are many still underestimating the risks hidden within their supply chains? Share your thoughts with me.

In this episode of Business of Cybersecurity, I sit down with Mary Ann Miller from Prove to discuss how AI is reshaping fraud, identity, and cybersecurity in ways many organizations are still struggling to understand fully. With decades of experience across banking, fintech, and fraud prevention, Mary Ann brings a unique perspective on the growing collision between customer experience, digital identity, and AI-driven attacks.

We explore how cybercriminals are using contextual AI-powered phishing campaigns that feel increasingly believable, why account takeover attacks are evolving into AI-assisted operations, and what happens when human intuition is no longer enough to identify deepfakes and manipulated content online. Mary Ann explains why the traditional idea of identity verification at login is beginning to break down, especially as one-time passwords and legacy authentication methods become easier to exploit.

The conversation also examines the rise of “continuous identity,” in which organizations must continually evaluate trust signals across the customer journey rather than relying on a single authentication event. Mary Ann shares why many organizations are investing heavily in AI innovation while simultaneously lacking the controls needed to defend themselves against AI-driven fraud. We also discuss how non-human identities, AI agents, and automated interactions are introducing new risks that many businesses are still unprepared for.

There is also a fascinating discussion around how AI has quietly powered fraud detection systems for decades, from early neural networks monitoring payment anomalies to today’s far more advanced machine learning systems. But as organizations race to introduce AI-powered customer experiences, Mary Ann warns that customer trust and adoption cannot be taken for granted. She shares the example of Walmart reportedly seeing a major drop in conversions during an AI-driven commerce experiment, highlighting how businesses are still learning where AI genuinely improves experiences and where it creates friction.

Mary Ann also offers practical advice for boards and security leaders on how to proactively test their defenses through fraud red-team exercises, why organizations need to recognize AI-generated attack patterns earlier, and how businesses can rethink identity in a world where both humans and machines participate in digital interactions.

If you care about the future of trust, authentication, fraud prevention, and cybersecurity in the AI era, this conversation offers a valuable look at the challenges already unfolding behind the scenes.

In this episode of Business of Cybersecurity, I speak with David Cottingham, president of rf IDEAS, about why identity has become one of the most targeted attack surfaces in modern business. From phishing attacks powered by AI to the growing risks tied to compromised credentials, David explains why traditional password habits continue to expose organizations across healthcare, manufacturing, finance, and enterprise environments.

Our conversation looks at the uncomfortable reality that while businesses have spent years hardening infrastructure, attackers have shifted their attention toward human behavior. David shares why fully passwordless environments may still be out of reach for many organizations, but why the move toward stronger authentication methods, secure second factors, mobile credentials, passkeys, and biometric workflows is already reshaping how businesses think about trust and access.

We also discuss the growing tension between stronger security and employee productivity. From clinicians accessing patient records in hospitals to workers authenticating on factory floors, David explains why security tools only succeed when they fit naturally into real-world workflows. The episode also explores the convergence of physical and logical security, the dangers of outdated proximity cards, and how layered security strategies still matter in an age shaped by AI-driven threats.

Along the way, David shares what he’s hearing from organizations at industry events, why many leaders feel overwhelmed by identity decisions, and how companies can future-proof their authentication strategies without disrupting existing systems overnight.

If identity is now the new perimeter, how should organizations rethink trust before the next breach forces the conversation?

Jim shared how ransomware gangs are evolving into highly organized operations powered by AI, automation, and ransomware-as-a-service models that dramatically lower the barrier to entry for attackers. From healthcare systems and transportation networks to retailers and city infrastructure, no sector appears off limits anymore. We explored why traditional disaster recovery strategies built for floods or hardware failures are no longer enough when attackers actively corrupt backups, manipulate databases, and target recovery systems themselves.

A major focus of our conversation centered on the idea of “Return on Risk” or ROR, a shift away from viewing cybersecurity purely through an ROI lens. Jim explained why boards and executives need to stop treating ransomware as an isolated IT issue and instead recognize it as a business continuity crisis capable of damaging reputation, customer trust, revenue, and regulatory standing in a matter of hours. He shared real-world stories of organizations discovering their backups had been deleted, deepfake scams impersonating executives, and attackers infiltrating recovery planning meetings themselves.

We also discussed how Index Engines’ CyberSense platform approaches cyber resilience differently by validating the integrity of recovery data and helping organizations identify clean copies of data with a 99.99% detection SLA for ransomware corruption. Jim explained why assuming compromise has become essential and why organizations must rehearse recovery strategies long before disaster strikes.

This conversation goes far beyond technical defenses. It examines trust, operational resilience, leadership accountability, and what happens when businesses fail to answer one simple but uncomfortable question: “How quickly can we recover if everything goes down tomorrow?”

Are organizations finally starting to accept that prevention alone is no longer enough, or are too many still hoping they will somehow avoid becoming the next headline?

Useful Links

• Connect with Jim McGann
• Learn more about Index Engines

Please check the partners of the Tech Tech Talks Network

• Learn more about the NordLayer Browser
• Visit Denodo.com

Kevin brought a fascinating perspective to the discussion, shaped by nearly three decades teaching computer science and cybersecurity at Ulster University, alongside years working with industry leaders, legal cases, and global media. Together, we explored how cybersecurity evolved from an afterthought into one of the most in-demand career paths in the world. Kevin explained why the rise of online commerce, social media, cloud services, and cryptocurrency completely transformed the threat landscape, creating an environment where cybercrime became financially rewarding and increasingly sophisticated.

The conversation also tackled the growing cybersecurity talent gap and why AI is simultaneously creating new risks and new career opportunities. Kevin shared why he believes certifications still matter in cybersecurity, why platforms like TryHackMe are helping democratize access to cyber training, and why younger professionals have an advantage if they become truly AI-native. He also offered a candid look at how AI agents, autonomous workflows, and rapidly evolving models are reshaping both education and enterprise security practices in real time.

One of the most thought-provoking moments came when Kevin discussed the emotional side of working in technology during a period of relentless acceleration. From AI burnout to fears around agentic systems and nation-state threats, he spoke openly about the pressure many professionals are feeling as they try to keep pace with constant disruption. Rather than resisting change, Kevin argues that the future belongs to people with strong judgment, domain expertise, and the ability to work alongside AI systems responsibly.

We also discussed the balancing act facing business leaders today. Organizations want innovation and productivity gains from AI, but they also need governance, compliance, and protection against entirely new attack vectors like prompt injection, malicious plugins, and compromised AI agents. Kevin shared practical advice for anyone looking to future-proof their career in cybersecurity, particularly around understanding agent architectures, AI workflows, and how trust models are changing inside modern organizations.

If you work in cybersecurity, technology leadership, education, or simply want a clearer understanding of where AI and cyber risk are heading next, this episode offers a thoughtful and surprisingly human conversation about a rapidly changing industry. After listening, do you share Kevin’s concerns that today may eventually feel like the safest period of the internet we will ever experience?

Please check the partners of the Tech Tech Talks Network

• Learn more about the NordLayer Browser
• Visit Denodo.com

In this episode of The Business of Cybersecurity, I sit down with Mark Molyneux, Field CTO for Northern Europe at Commvault, to break down the UK’s Cyber Security and Resilience Bill and what it really means for organizations trying to stay ahead of increasingly complex threats.

At first glance, legislation like this can feel distant, something for compliance teams to worry about later. But as Mark explains, the reality is far more immediate. This bill has been years in the making, shaped by a growing pattern of incidents that have moved beyond isolated IT problems and into events with real economic and societal impact. The conversation quickly shifts from what the bill says to why it matters right now, especially as cyber threats continue to evolve faster than regulation can keep up.

One of the most valuable takeaways from our discussion is the distinction between disaster recovery and true cyber recovery. Many organizations believe they are prepared because they have invested heavily in backup systems and failover environments. But as Mark highlights, those assumptions can break down quickly when core systems, identities, or trusted environments are compromised. In those moments, traditional recovery metrics no longer apply, and the focus turns to how quickly a business can return to a clean, operational state.

We also explore the risk of treating new regulation as a simple compliance exercise. There is always a temptation to do the minimum required and move on. However, recent real-world incidents have changed the tone of the conversation. Leadership teams are starting to recognize that resilience is about survival, not certification. That shift in mindset is where meaningful progress begins.

Mark shares practical guidance for organizations at different stages of their journey. Whether it is selecting a single cybersecurity framework, running realistic tabletop exercises with executive teams, or defining what a minimum viable company actually looks like during a crisis, the emphasis is on taking action now rather than waiting for legislation to dictate the pace.

There is also an honest discussion about the limits of regulation. Laws and frameworks will always lag behind the speed of technological change, especially as AI begins to reshape how attacks are launched and executed. That puts the responsibility back on organizations to go further than compliance and build resilience that reflects their real-world risk.

This episode is a reminder that cyber resilience is no longer about preventing every possible attack. It is about ensuring the business can continue when something goes wrong.

So as new legislation begins to take shape and expectations rise, are you confident your organization could recover quickly from a serious cyber event, or are you still relying on assumptions that have yet to be tested?

Please check the partners of the Tech Tech Talks Network

• Learn more about the NordLayer Browser
• Visit Denodo.com

In this episode of the Business of Cybersecurity podcast, I sat down with Gonzalo Alonso, CEO of Ditto, to explore why digital identity has quietly become one of the most important and misunderstood challenges in our digital economy. Drawing on his experience at Microsoft, Google, and now Ditto, Gonzalo shares a perspective that challenges long-held assumptions about how identity works, who owns it, and why the current model is starting to break under pressure from AI, regulation, and evolving user expectations.

We unpack what is changing across Europe with initiatives like the European Digital Identity Wallet and what that really means in practice for both consumers and businesses. Gonzalo explains how the shift toward user-controlled identity could reshape everything from onboarding and compliance to fraud prevention and cross-border trust. At the same time, he does not shy away from the complexity this creates for organizations that have historically treated identity data as an asset they control.

Our conversation also looks at the deeper technical shift from trusting systems to relying on cryptographic proof. Gonzalo brings this to life with real-world examples, including how identity could travel with you across borders, unlock access to services, and even influence financial opportunities. But alongside the opportunity, we also discuss the risks, from device security to identity recovery, and why getting the model right matters just as much as the technology behind it.

This episode offers a clear-eyed view of where digital identity is heading, why it matters now, and what leaders need to start thinking about before the rules change around them. So as identity moves from passwords and tokens to something far more personal and portable, are we ready to give control back to the individual, and what does that mean for the businesses built on the old model?

In this episode of Business of Cybersecurity, I sit down with Uri Haramati, CEO and co-founder of Torii, to unpack a shift that is happening faster than most organizations can keep up with. AI is no longer sitting on the sidelines as a productivity tool. It is now deeply embedded across platforms like Slack, Google Workspace, and CRM systems, often operating with levels of access that rival or even exceed human users. As Uri explains, that changes the entire security conversation, especially when many of these agents are effectively invisible to traditional identity and governance models.

What stood out to me in this conversation is how quickly AI adoption has moved from experimentation to something far more operational. Uri shares insights from Torii’s 2026 SaaS Benchmark Report, which reveals that enterprises added nearly 700 new AI applications in just one year, with 61 percent of all apps operating outside of IT oversight. That creates a growing blind spot, where non-human identities, API tokens, and automated workflows are interacting with sensitive data without clear ownership or lifecycle management. It is a shift that feels familiar, echoing past waves like BYOD, but this time the scale and speed are on another level.

We also explore why this is not simply a story about risk. There is a clear business driver behind this surge in AI adoption. Organizations are under pressure to control costs, reduce manual work, and get more value from their software stack. AI is stepping into that role, but it introduces new challenges around usage-based pricing, unexpected spend, and governance models that were designed for a much slower era of IT. Uri makes the case that the real issue is not adopting AI too quickly, but failing to evolve governance at the same pace.

By the end of the conversation, one idea really stayed with me. Within the next couple of years, non-human identities could outnumber human ones inside most enterprises. That raises a simple but uncomfortable question. If every actor in your system needs to be treated as an identity, how many do you actually have, and how many are you truly managing?

If this is a topic you are grappling with, I highly recommend checking out Torii’s 2026 SaaS Benchmark Report and connecting with Uri to continue the conversation. But for now, I would love to hear your perspective. Are we building the right guardrails for this new era of AI-driven access, or are we already further behind than we think?

In this episode of Business of Cybersecurity, I sit down with Shan Kulkarni, CEO of Nullify, to discuss a growing tension that many security leaders are already feeling. AI is helping developers ship code faster than ever. Still, for product security teams, that speed often creates even more alerts, more vulnerabilities to review, and more pressure on already stretched teams.

Shan argues that the real issue is not productivity alone. It is accountability. When copilots increase output while ownership remains with the same engineers, the workload does not disappear. It multiplies.

We explore why Shan believes the next phase of enterprise AI will be shaped by autonomous AI employees rather than assistant-style tools.

He explains how Nullify is designed to onboard, reason, and act like a human security engineer, with access to code bases, ticketing systems, cloud environments, and internal documentation.

From validating whether a vulnerability is truly exploitable to assigning fixes and following up with developers, Shan shows how AI workers could replace several disconnected security tools and the extensive manual coordination required.

Our conversation also gets into trust, which remains one of the biggest barriers to adoption in high-risk environments. Shan talks openly about the safeguards needed before companies will feel comfortable allowing AI to take action instead of simply making suggestions.

We discuss merge-ready patches, exploit confidence scores, the rising threat surface created by AI-generated code, and why authorization, authentication, and business logic flaws may become some of the biggest risks in modern software.

It is a timely conversation about what security teams actually need right now: fewer dashboards, fewer false positives, and better ways to manage growing responsibility in a world of machine-speed software delivery. If you are trying to understand where AI fits inside security operations, and whether autonomous systems can truly ease the burden rather than increase it, this episode should give you plenty to think about.

What do you think, are we heading toward a future of AI teammates in cybersecurity, and how much responsibility are you willing to hand over?

In this episode of the Business of Cybersecurity podcast, I sat down with Adam Bateman, co-founder and CEO of Push Security, to explore a growing shift in how modern attacks are carried out and why traditional defenses are increasingly struggling to keep up. Adam brings a rare perspective to the conversation, having spent years in offensive security and red team operations simulating real-world attacks against major enterprises before founding Push Security.

One of the central ideas we unpacked is the claim that the browser has quietly become the new endpoint. As organizations move more work into cloud applications and SaaS platforms, the connection between users and company systems increasingly runs through the browser rather than traditional networks or local applications. The problem is that most security tools still focus on endpoints, networks, and email. That leaves what Adam describes as a “missing middle,” the space between a user logging in and the moment a breach is discovered.

We also discuss how phishing attacks have evolved beyond the inbox. Push has observed that as much as thirty-four percent of the malicious phishing attempts they detect now originate outside email, appearing instead through platforms like LinkedIn messages, Google search results, or other online channels. These platform-native attacks bypass traditional email gateways entirely, often targeting senior executives and employees with privileged access to business systems.

Adam also shares insights from a recent campaign his team uncovered called ConsentFix, an attack technique that combines browser manipulation with OAuth consent abuse. Instead of exploiting software vulnerabilities or deploying malware, these attacks manipulate trusted workflows inside cloud platforms and identity systems. The result is a compromise that can occur entirely within a browser session, often without triggering traditional security alerts.

Throughout our conversation we explore why these browser-native threats are growing, how attackers are using AI to scale social engineering campaigns, and why visibility into browser activity may become one of the most important capabilities for modern security teams. Adam also explains how Push Security approaches this challenge by bringing real-time detection and response directly into the browser environment where work and attacks increasingly collide.

If cybersecurity teams are still focused only on networks, endpoints, and email, they may be missing the layer where attackers now spend most of their time. As work moves deeper into cloud platforms and SaaS tools, could the browser become the next frontline in enterprise defense?

In this episode of Business of Cybersecurity, I sat down with Andrew Carr, Managing Director at Booz Allen Hamilton and leader of the firm’s Commercial Threat Detection and Response practice. Andrew has spent nearly two decades working in digital forensics, ransomware response, and incident investigations across both government and enterprise environments. During our conversation, he shared lessons drawn from hundreds of cyber incidents and explained why preparation, clarity, and coordination often matter far more than the tools organizations deploy.

One of the most striking themes in this conversation was the importance of the first seventy-two hours during a cyber crisis. Andrew explained that organizations that stabilize quickly tend to have one thing in common. They understand their environments with precision. They know where critical data lives, how systems connect, and which assets attackers are most likely to target. When that visibility is missing, those early hours are often spent trying to answer basic questions rather than containing the incident.

We also explored why traditional incident response exercises sometimes fail to prepare organizations for real attacks. Many companies still run tabletop exercises within individual departments, yet real cyber incidents rarely stay confined to a single team. Andrew described why effective rehearsals must involve the entire business, from technical responders to executive leadership, and why organizations need to define what he calls the “minimum viable company,” the core functions required to keep operations running during a major disruption.

Another key takeaway from our discussion was the role of leadership. Cybersecurity can no longer be treated as a purely technical function handled by the IT or security team. Andrew argues that cyber risk is a business risk, and executives across the organization must understand how decisions, priorities, and communication shape the response when a crisis unfolds.

We also discussed emerging risks around supply chains and AI systems, and how organizations are beginning to think more seriously about resilience rather than prevention alone. In a world where no company can block every attack, the ability to respond quickly and recover effectively is becoming the true measure of cybersecurity maturity.

If you lead a technology team, oversee risk, or simply want to understand how organizations prepare for high-stakes cyber incidents, this conversation offers a clear look inside the realities of modern incident response. When the next breach happens, will your organization be scrambling to understand its environment, or ready to act within those critical first seventy-two hours?

In this episode of Business of Cybersecurity, I sit down with Anthony Cusimano from Object First to unpack one of the most misunderstood words in cyber resilience right now: immutability. It is a term that appears in countless vendor pitches and product pages, but as Anthony explains, the reality behind those claims can vary wildly. In a world where attackers are actively targeting backups as part of modern ransomware campaigns, that gap between promise and reality can have serious consequences.

Anthony helps me separate marketing language from real architectural protection. We explore why a simple checkbox or software setting is not enough to make backup data truly safe, and why organizations need to think much more carefully about how backup storage is designed, isolated, and protected. He also explains why backup strategy can no longer sit quietly in the background as a routine IT function. It now sits right at the heart of cyber resilience.

One of the biggest takeaways from this conversation is how ransomware operators have changed their tactics. Backups used to be the fallback plan, the thing that gave businesses a path back after an attack. Now, attackers know that too, which is why backup systems themselves have become a priority target. Anthony explains how this shift has changed the role of backup admins, raised the stakes for recovery planning, and forced security leaders to rethink what “safe” really means.

We also get into the role of Zero Trust in backup storage, the risks of false confidence when immutability is poorly implemented, and the practical questions CIOs, CISOs, and infrastructure teams should be asking vendors before they trust them with business-critical recovery data. This is where the conversation gets especially useful, because Anthony does not stay at the theory level. He brings it back to what teams should be checking, testing, and validating right now.

Another part of the discussion looks at how AI is changing the threat picture. As attacks become more automated and more adaptive, organizations will need recovery strategies that are built for pressure, not just written for compliance. Anthony shares his perspective on why long-standing best practices still matter, and why businesses should be far more intentional about where their most important data lives and how quickly it can be recovered.

I also appreciated Anthony’s strong defense of backup professionals, the people who often carry enormous responsibility without much recognition until something goes wrong. This episode is a reminder that resilience is never just about technology. It is also about the people trusted to keep the business standing when everything else is under pressure.

So if your organization believes its backups are immutable, the real question is simple. Are they truly protected at the architecture level, or are you trusting a label that might not hold up when it matters most?

• Connect with Anthony Cusimano
• Learn more about Object First
• Absolute Immutability: The Ultimate Ransomware Defense
• YouTube

In this episode of Business of Cybersecurity, I sit down with Steven Brodie, Chief Revenue Officer at Goldilock Secure, a NATO-backed cybersecurity firm challenging the industry’s long-standing assumptions. Steven argues that in 2026 we are finally confronting the downside of overconnectivity, where sprawling networks and forgotten links create enormous blast radiuses when breaches occur. Instead of defaulting to constant connection, he introduces the idea of “right-sized connectivity,” where systems are connected only when required, no more and no less.

We explore why so many modern breaches spread so quickly, and how architectural decisions made in the name of speed and convenience have left organizations exposed. Steven explains how most attacks are software-driven, moving laterally at machine speed, often faster than teams can patch. In that arms race, patching alone is no longer enough. Goldilock Secure approaches the problem differently by adding a physical layer of segmentation that can remotely connect or disconnect assets without sending commands over the public internet. The goal is simple: buy time, contain incidents, and prevent a localized breach from becoming a company-wide crisis.

We also discuss the tension between security and operational continuity. How do you introduce deliberate firebreaks into a network without slowing down the business? Steven is clear that this is not about returning to air-gapped islands everywhere. It is about controlled connection and controlled disconnection. Boards, he argues, should rethink cybersecurity metrics away from checklist compliance and toward containment, resilience, and clear audit trails that demonstrate who accessed what, and when.

As AI accelerates attack automation and zero-day vulnerabilities shrink response windows, the question facing every CISO and board is whether their architecture has grown beyond what is defensible. Are you relying purely on logical controls that can be subverted in software, or are you prepared to add physical boundaries that act as real firebreaks?

I would love to hear your take. Has hyper-connectivity become a strategic liability in your organization, or is it still viewed as a competitive advantage?

I sit down with Tim Freestone, Chief Strategy Officer at Kiteworks, to unpack the findings from the Kiteworks 2026 Data Security & Compliance Risk Forecast and what it reveals about the true state of data resilience today. As AI accelerates business processes and agentic systems gain more autonomy, Tim argues that the real challenge is no longer about adding another security tool. It is about gaining repeatable control over how sensitive data moves across organizations, partners, and automated systems.

We explore why third-party involvement in breaches has surged to nearly one in three incidents and what that means for board-level accountability. Tim explains how traditional third-party risk assessments struggle to scale in an AI-enabled world, and why data-layer controls and modern digital rights management approaches are being revisited in a more practical form. We also examine the shift from ransomware headlines to the rising dominance of social engineering, and why micro-learning and human error prevention may offer a more realistic path forward than annual compliance training.

Our conversation also tackles the regulatory pressure building across regions, from evolving GDPR requirements to the EU AI Act. Tim makes the case for unified, data-centric compliance models that provide file-level visibility and auditability, rather than fragmented controls across siloed systems. We discuss the growing relevance of data security posture management, the shrinking timeline for quantum risk, and the “harvest now, decrypt later” threat that leaders can no longer afford to dismiss as a distant concern.

Finally, we turn to identity as the new perimeter in a world where AI agents act with increasing autonomy. Tim shares why identity alone is insufficient and why combining identity with data location defines the modern security boundary. For leaders facing limited budgets and skill constraints, his advice is pragmatic: start with visibility, align with established frameworks like NIST, and use AI-enabled copilots to accelerate cyber maturity rather than fall behind.

If you are responsible for security, compliance, or risk outcomes, this episode offers a clear-eyed look at what is changing, accelerating, and must be addressed now. Are you truly in control of every send, share, receive, and save of sensitive data across your ecosystem?

In this episode of Business of Cybersecurity, I reconnect with Taylor Hersom, Founder and CEO of Eden Data, for a wide-ranging and honest conversation about what security really looks like in an AI-first world. Taylor has built his career inside compliance, risk, and cybersecurity, from Deloitte to launching Eden Data during COVID, and now helping venture-backed startups and global enterprises rethink how security fits into the business itself. Rather than framing cybersecurity as fear-driven insurance, he explains why it works best when treated as a signal of maturity, discipline, and credibility.

We spend time unpacking how generative AI and agentic systems are changing the risk landscape, often faster than regulation and enforcement can keep up. Taylor shares why data, not models, remains the real asset worth protecting, and why so many organizations are still operating in a kind of AI Wild West. Without slipping into alarmism, he explains where companies are most exposed today, from training data to shadow AI tools quietly entering workflows, and why governance, transparency, and basic controls matter more than flashy security spending.

What really stands out is Taylor’s practical take on turning compliance into a growth lever. We talk about SOC 2 and ISO standards, not as box-checking exercises, but as tools that can actually improve operations, customer confidence, and sales conversations when done properly. He explains why oversharing security posture can be a competitive advantage, how founders should think differently than large enterprises, and why bad audits and rubber-stamp certifications may create more risk than they remove.

We also explore the human side of cybersecurity, including why most breaches still come down to everyday mistakes, not elite hackers, and how automation, monitoring, and better system design can reduce risk without burning out teams. Taylor shares a grounded view of how AI could finally help solve staffing shortages and alert fatigue inside security teams, and why emerging AI security standards may soon become the next credibility badge companies want to display.

We close on a lighter note with book and music recommendations, but the core message is clear. Cybersecurity no longer lives in a silo, and the organizations that understand this are already using trust as a business advantage rather than a defensive posture. As AI becomes woven into every workflow, the companies that communicate clearly about how they protect data and customers may be the ones that stand out most.

So as security, compliance, and AI continue to collide over the next few years, will your organization treat cybersecurity as a burden to manage, or as a story worth telling?

Useful Links

• Connect with Taylor Hersom on LinkedIn
• Learn more about Eden Data
• Follow on LinkedIn

Thanks to our sponsors, Alcor, for supporting the show.

In this episode of Business of Cybersecurity, I sit down with Jason Revill, Global Security Practice Technology Lead at Avanade, to unpack why this legislation represents a genuine shift in how cyber risk will be judged, enforced, and felt across the UK mid-market. While much of the public debate has focused on critical national infrastructure, Jason explains why managed service providers and mid-sized firms are now firmly in scope, particularly those that underpin larger enterprises. Mandatory incident reporting, tougher expectations, and turnover-based penalties are changing cyber resilience from a technical concern into a board-level business issue.

We explore why outsourcing cybersecurity no longer reduces accountability, even though nearly half of UK mid-market firms rely on third parties to manage their defenses. Jason shares real-world insight into how supply chain vulnerabilities are driving a growing share of breaches, why identity and access management has become a weak link, and how attackers increasingly exploit trust between organizations rather than technical flaws alone. The conversation also looks at the rising threat of legal action following breaches, with group claims against well-known UK brands signaling a wider shift in public and regulatory expectations.

Crucially, this is not a fear-driven discussion. Jason offers a grounded perspective on how mid-sized organizations can move beyond checkbox compliance and embed security into everyday operations without grinding the business to a halt. We talk openly about cost, trade-offs, and why resilience planning only works when it is owned by the whole organization, not just the security team. For leaders heading into a new year facing tighter scrutiny and higher stakes, this episode offers clarity on what good looks like in practice and how to start building it.

If cyber resilience is quickly becoming a license to operate rather than an optional safeguard, how prepared is your organization for the expectations that customers, regulators, and even the public are about to place on it, and what would it take to get ahead of that curve rather than react after the fact?

Useful Links

• Connect With Jason Revill
• Learn More About Avanade
• Cyber Security and Resilience Bill

Tech Talks Network is sponsored by Denodo

Back in March in Miami, John and I talked about zero trust as an ecosystem rather than a product, a way to bring unified management and strong policy enforcement to the endpoint. This time, we take that thinking to the operational technology world, where the stakes feel very different. When a cyberattack hits a factory, it is not only data at risk. It can stop production lines, damage equipment, and cost millions in downtime. John explains how a prevention first mindset, backed by IGEL’s immutable OS, Universal Management Suite, and OEM ready integrations, is helping manufacturers and OEMs move security out to the edge where attacks actually begin.

Across the episode, John lifts the lid on IGEL’s work with partners such as Intel, Honeywell, Zscaler, and others who see OT as a growth frontier. We talk about US Department of Defense zero trust 2.0 requirements, European regulation, and what it really takes to extend zero trust thinking from the office to the plant. From dark industrial networks to containerized workloads at the edge, from sensor attestation to the kill chain, this is a grounded look at how endpoint security, confidential compute, and sovereign architectures are reshaping industrial resilience.

This one is for anyone who cares about the future of secure infrastructure, whether you work in manufacturing, utilities, or simply want a clearer view of where zero trust is heading as AI powered threats accelerate. Do you believe prevention first security can truly keep pace with autonomous attacks, or are we still leaning too heavily on detection and response thinking from an older era of cyber? I would love to hear your thoughts.

Jason explains why hospitals and healthcare providers have zero tolerance for downtime, and how the same principle applies across every industry where endpoint failure halts operations. He breaks down how IGEL’s prevention-first approach and its Business Continuity and Disaster Recovery solution can restore access within minutes, even during a ransomware event that would otherwise take weeks or months to recover from.

For cybersecurity analysts evaluating endpoint protection, Jason offers valuable insight into what a prevention-first model looks like in practice. He describes how secure-by-design, read-only operating systems, dual boot capabilities, and layered recovery options create an architecture that is both lightweight and resilient. Analysts looking to compare endpoint strategies will find this discussion useful for understanding how organizations can combine operational uptime, rapid recovery, and measurable ROI without adding complexity or cost.

We also discuss how prevention-first design changes the economics of IT. Jason shares examples of how organizations are cutting costs, improving patient safety, and aligning endpoint strategy with Zero Trust frameworks to strengthen both security and productivity.

It is a fascinating look at how the business of cybersecurity is changing, and why protecting the endpoint is no longer optional. Are enterprises finally ready to treat endpoint continuity as part of their core business strategy? I would love to hear your thoughts after the episode.

Useful Links

• Connect with Klaus Oestermann on LinkedIn
  • Learn more about IGEL
  • Follow on LinkedIn, Twitter and YouTube

Tech Talks Daily is Sponsored by NordLayer:

Get the exclusive Black Friday offer: 28% off NordLayer yearly plans with the coupon code: techdaily-28. Valid until December 10th, 2025. Try it risk-free with a 14-day money-back guarantee.

Brian brings an extraordinary track record from senior roles at Symantec, McAfee, and Citrix, giving him a rare perspective on how cyber strategy has evolved from antivirus software to AI-driven network intelligence. As he explains, “The days of when things were nice and loud and easy to find have come and gone.” Attackers now live off the land, using legitimate IT tools like PowerShell to hide in plain sight, while generative AI accelerates the weaponization of new exploits in hours instead of weeks.

We discuss why Corelight’s open-source heritage gives it a unique edge in the GenAI era, how automation is reshaping response workflows, and what it really takes to achieve sub-15-second threat response. Brian also opens up about leadership lessons learned from his years in the industry, Corelight’s growth from startup to global scale, and the cultural principles that keep innovation alive through rapid expansion.

This conversation goes far beyond cybersecurity buzzwords. It is a candid look at the reality facing modern defenders, where data is readiness, visibility is power, and resilience is built one decision at a time. Whether you are a CISO, developer, or business leader, this episode offers a grounded, human perspective on the future of cyber defense and what it means to truly understand what went “bump in the night.”

Paul explains what works on the defensive side right now. Think adaptive, multilayered authentication that reacts to real risk signals, mobile network checks to identify recent SIM changes, behavioral biometrics, enhanced document and liveness detection, and AI that accelerates investigations while reducing false positives and compliance costs. We also look at more innovative data use, graph analytics to expose fraud rings, cross-industry intelligence sharing, and the FCA’s supersized sandbox that helps teams test models at high volume.

If you care about stopping account takeovers without breaking customer experience, this conversation is a practical blueprint for 2026 and beyond.

SIM swapping increased by over 1,000%

How to protect yourself from SIM swapping

*********

Visit the Sponsor of Tech Talks Network:

Land your first job in tech in 6 months as a Software QA Engineering Bootcamp with Careerist

https://crst.co/OGCLA

We dig into why compliance keeps tripping companies up, why the impact of digital crime now dwarfs many physical crimes, and how leaders can talk about cyber in a language boards actually understand. Sumedh explains the shift from counting exposures to quantifying business risk, and why the Security Operations Center is giving way to a Risk Operations Center that prioritizes what truly matters, accepts what must be accepted, and transfers the rest through insurance.

We also explore the cloud security market’s next phase as AI workloads pour into public and private clouds, why “attack surface” is not the same as “risk surface,” and how to weigh AI opportunity against model and data uncertainty. Sumedh closes with hard-won leadership lessons on time, teams, and defining success, and recommends Marshall Rosenberg’s Nonviolent Communication for anyone who wants to communicate beyond the words and lead with clarity.

Visit the Sponsor of Tech Talks Network:

Land your first job in tech in 6 months as a Software QA Engineering Bootcamp with Careerist

https://crst.co/OGCLA

In this episode of Business of Cybersecurity, I speak with David Higgins, Senior Director at CyberArk, about how AI agents, autonomous systems, and the sheer scale of machine credentials in the enterprise are reshaping identity security. We discuss why password reuse, unsecured personal devices, and skipped updates remain stubbornly common even though awareness training has been around for decades. David explains that the issue is rarely laziness. Instead, it is often a lack of secure and practical alternatives that still fit the way people work.

We dig into how phishing and social engineering tactics have evolved, with AI enabling deepfake audio and video that can pass casual inspection, and how attackers are increasingly bypassing tech-savvy users entirely by targeting helpdesks and third-party support teams. We also look at the commoditisation of stolen credentials and why buying access on the dark web can now be easier than running a phishing campaign.

A major theme in our conversation is the role of culture in security. David challenges the outdated idea that humans are always the weakest link, arguing instead for a more collaborative approach that blends security objectives with user experience. We explore strategies like adaptive authentication, behavioural context analysis, and just-in-time privilege models that reduce risk without slowing down legitimate work.

The discussion then turns to the identity challenges created by agentic AI. These are AI-driven systems that can interpret goals, adapt, and communicate directly with other AI agents and human colleagues. Unlike traditional machine identities, their behaviour changes over time, creating an entirely new category of security risk. David outlines how organisations can begin to secure these identities now, rather than deferring the problem until it becomes unmanageable.

By the end of this episode, you will have a clear view of why identity-first security is essential in a machine-dominated environment, what practical steps can be taken to close gaps without adding unnecessary friction, and why aligning identity strategy with your organisation’s digital roadmap is no longer optional.

We dig into the realities of regulating AI in a fragmented world, drawing comparisons between Europe’s application-based approach and the US’s patchwork of state-level initiatives. Mike shares why he believes regulation should focus on context and application, not just model size, and why human oversight must stay part of the loop.

We also cover:

• How Abnormal uses behavioral AI to catch phishing and email attacks before they hit inboxes
• Why sandboxes and risk-based regulation can protect innovation without losing control
• The threat of over-regulation pushing innovation toward regimes with fewer ethical safeguards
• The challenge of navigating AI vendors at security events, where almost everyone claims AI capabilities
• The real-world risks of AI bias, misuse, and geopolitical influence in open-source models

Mike also shares practical guidance for CIOs and CISOs on model validation, audit trails, kill switches, and how to distinguish genuine AI value from marketing spin.

🧠 One key takeaway: Attackers are already using AI. If security teams don’t fight fire with fire, they’re at risk of falling behind.

🔗 For more, check out abnormal.ai or connect with Mike on LinkedIn.

John unpacks how cybersecurity leaders from Okta to Fortinet are rethinking the entire revenue engine to fund innovation, reduce friction, and stay ahead of attackers. We discuss the growing gap between AI ambition and data reality, and why 67% of revenue leaders are not trusting their data should be a wake-up call for anyone betting big on automation.

From real-time prospecting and clean data infrastructure to unified cross-departmental collaboration, this is a masterclass in how operational strategy, not just security tooling, is shaping the future of cyber resilience.

John also shares what it really takes to unify go-to-market teams, how RevOps is shifting from reactive reporting to proactive insight, and why the most powerful transformation starts with the "unsexy" work of cleaning up your data stack.

If you’ve ever underestimated the role of RevOps in a tech-driven industry or dismissed data hygiene as someone else’s problem, this conversation will change your mind.

🎧 Listen in to learn:

• Why AI can’t fix broken data
• How cybersecurity firms are aligning ops, sales, and customer success in real time
• What separates high-growth companies from those stuck debating dashboards

Visit Clari.com to learn more about the work John and his team are doing, or connect with him directly on LinkedIn.

Ask ChatGPT

We explore the power of simplicity in cybersecurity strategy, the shift toward zero trust, and the cultural importance of treating employee training as a relentless, personal mission rather than a compliance checkbox. Christian also shares sharp insights on the growing risks posed by AI and quantum computing, the need for post-quantum cryptography, and how data protection is fast becoming the cornerstone of competitive advantage.

If your boardroom still treats security as an IT issue or your workforce sees it as a blocker, this conversation will change how you think about cyber preparedness. We discuss Cloudflare’s latest research findings, the future of AI-powered SecOps, and how organisations can move from passive defence to proactive, strategic resilience.

Listen now to learn how forward-thinking businesses are simplifying their stacks, mobilising end-user education, and building security into the core of their operations rather than bolting it on after the fact.

We explore why more than half of global companies still have to halt operations when ransomware strikes and why so many UK businesses remain reluctant to report incidents. Trevor shares candid insights into what is working, what is not, and why shifting focus from prevention to containment could be the real key to resilience.

He explains how modern containment tactics like advanced obfuscation and one-click ringfencing can limit damage and keep critical operations running, even when attackers break through. We also discuss why only 13 percent of companies believe their cyber resilience is strong enough and what it will take to close that gap as regulations tighten worldwide.

If you want a grounded take on how to prepare for the attacks that will inevitably come, rather than just hoping they never do, this conversation is for you.

Search Tech Talks Network for more episodes that connect cybersecurity and real-world business strategy.

Mark has spent years helping organizations rethink security from the ground up. Instead of chasing alerts or layering new tools onto outdated systems, he advocates for a proactive, systems-first approach. One that prioritizes architecture and continuity over quick fixes.

Zero Trust Isn't Just for Remote Work

Zero Trust started as a security fix for remote access, but that's just one piece of the puzzle. Mark made a sharp observation: many companies still trust users more when they're sitting in the office. That's a dangerous assumption.

Modern Zero Trust means treating all traffic with the same level of scrutiny, regardless of its origin. Every access request should be evaluated based on its context: who is making the request, what device they're using, what they're trying to do, and whether that behavior fits a known pattern.

The Problem with the Patch-and-Pray Model

Security teams often react to new threats by throwing more tools into the mix. Over time, this patchwork creates more problems than it solves. Complexity grows, visibility shrinks, and attackers exploit the gaps.

Mark pointed to research showing that many teams are overwhelmed by the tools they already have in place. Others are held back by outdated systems or a lack of staff with the right skills. That creates a situation where attackers need to succeed once, while defenders must stop everything every time.

A Better Way Forward: Resilient by Design

So, what does a stronger strategy look like? Mark recommends starting with architecture. Build systems that expect disruption. Apply continuous risk assessment. Incorporate business continuity from the start rather than as an afterthought. And don't limit Zero Trust to a single use case. Make it your foundation.

For leaders looking to take action, Mark laid out some clear first steps:

Start by reviewing where Trust is currently assumed. Challenge those defaults. Apply the same standards inside your network as you do for external traffic. Think about context every time you evaluate access.

Ensure that your legacy systems are also included in this effort. But remember, you don't need to replace everything overnight.

Resilience is about ensuring your organization remains standing, regardless of what challenges it faces. That means planning, testing your response, and building security into your infrastructure not bolting it on later.

Listen to the full episode to hear why this shift is a leadership decision that defines how your organization faces tomorrow's threats.

In this episode of The Business of Cybersecurity, Neil C. Hughes sits down with Max Vetter, Vice President of Cyber at Immersive Labs, to examine a surprising trend: less experienced team members are consistently completing more difficult training content than veterans with eight or more years in the field. It’s a data point that challenges assumptions and raises urgent questions about how organizations approach skills development in cybersecurity.

Max shares findings from recent research that expose worrying gaps in readiness, especially at the senior level, and outlines a practical checklist for building resilient, threat-ready teams. He makes a compelling case for continuous, challenge-based learning across all levels of expertise, not just for new hires, but for seasoned professionals who may risk falling behind.

Together, Neil and Max explore:

• Why traditional training approaches might be failing senior professionals
• How complacency and lack of tailored development can erode cyber resilience
• The cultural shifts needed to make continuous learning a team-wide priority
• What boards and business leaders should know about workforce readiness gaps

Whether you're leading a SOC, managing risk at the executive level, or shaping your organization's cyber strategy, this episode offers real-world insight into the human dynamics behind technical defenses.

Are we doing enough to upskill cybersecurity veterans before the next threat hits? Tune in and join the conversation.

We talk candidly about the security implications of 44 percent of enterprise technology being “out of life” and unsupported. Paul shares how that vulnerability becomes even more exposed as IoT devices proliferate and AI-powered attacks grow more sophisticated. It’s no longer a question of whether legacy tech is a problem, but how long organizations can afford to ignore it.

This conversation moves beyond the buzzwords and straight into the operational reality. Paul explains how Kyndryl’s post-IBM spin-off transformation included shifting to a cloud-first, zero trust model—and why that decision was just as much about improving agility and cost control as it was about reducing risk.

We also explore the human side of cybersecurity. Paul outlines how Kyndryl’s internal phishing simulations and scenario-based training have led to a measurable increase in employee-reported incidents. It’s a compelling argument for why building a cybersecurity culture beats any off-the-shelf solution.

From AI-enhanced social engineering threats to the disconnect between IT and OT teams, this episode highlights the practical steps business leaders can take to modernize without compromising day-to-day operations. If your cybersecurity strategy still depends on outdated tools and last year’s training modules, it might be time to rethink the foundation.

For more insight, check out the Kyndryl Readiness Report at kyndryl.com,

Lynn explains why the shift in bot activity is no longer about brute force or exploiting technical vulnerabilities. Today’s attackers are targeting business logic itself. From automated purchasing of high-demand items to manipulating pricing and availability data in the travel sector, bots are now bypassing traditional security tools by taking advantage of how platforms are designed to function.

APIs are particularly vulnerable. Nearly 50 percent of account takeover attacks now target APIs directly, largely because they are abundant, consistently structured, and often poorly monitored. Shadow APIs and lack of cross-functional visibility create significant blind spots for security teams.

Some industries are facing an outsized share of these attacks. Gaming platforms are targeted for their in-game currencies and experience systems, while travel providers contend with constant scraping of flight data and availability. In both cases, attackers are capitalizing on high user demand and competitive pressure to exploit weaknesses in systems that were never built with these threats in mind.

Lynn also discusses the rise of residential proxies and mobile user agents, which make it increasingly difficult to distinguish real users from bad actors. And with a surge in global AI regulation expected in 2025, she outlines what organizations can do to prepare. From understanding internal AI use to implementing layered protection across APIs and mobile applications, Lynn provides practical advice for teams looking to get ahead of the threat curve.

In a digital world where nearly half of all traffic is now synthetic, how confident are you in your ability to spot the difference?

John shares how zero trust is moving from theory into applied strategy and why endpoint protection is still ground zero in the modern threat landscape. From hybrid work challenges to AI-powered threats, this episode breaks down how IGEL’s immutable OS and collaborative approach are helping secure some of the most sensitive sectors in the world. Are your endpoints ready for what’s next?

Ricardo offers a sharp, comparative analysis between the UK's proposed bill and the EU's more prescriptive NIS2 directive. He explains why the UK's current approach lacks the specificity needed to tackle critical issues like supply chain security, board-level accountability, and sector-specific risk frameworks. While the UK’s legislative draft includes promising buzzwords and broad commitments, Ricardo notes that it falls short on actionable guidance and enforcement mechanisms—areas where NIS2 has already set a clearer precedent.

But amid these gaps lies a strategic opportunity. Ricardo discusses how the UK can leverage its regulatory independence to selectively adopt the most effective elements from NIS2, crafting a more agile and industry-friendly cybersecurity framework. He highlights the importance of involving diverse stakeholders—from industry bodies to international partners—in shaping regulation that’s both resilient and responsive to evolving threats.

The conversation also explores:

• The importance of making board members directly accountable for cybersecurity risk
• Why workforce training must be mandated alongside technical requirements
• Lessons from NIS2 on post-breach response and business continuity planning
• The need for advisory committees and continuous legislative updates to keep regulation relevant in an AI-driven threat environment

Ricardo closes the episode with a personal story about how visionary leadership early in his career helped shape his trajectory—reminding us that real resilience is built not just through technology or regulation, but through people who see potential and invest in it.

If you're navigating cybersecurity compliance, policy development, or executive accountability, this episode is a timely and thought-provoking listen.

Richard shares a decade's worth of threat intelligence backed by trillions of daily DNS requests and billions of cyberattack observations, offering a data-rich perspective on why financial organizations are squarely in the crosshairs. From a 24-hour DDoS attack on Israel peaking at 800 Gbps to the rise of politically motivated hacktivism, Richard outlines why the Middle East and North Africa (MENA) region has become a hotspot for these digital assaults—and what financial firms can do about it.

The conversation also covers the emerging risk of shadow APIs—forgotten, unmanaged, or defunct APIs that can unintentionally expose sensitive personal or financial data. Richard explains how many businesses still underestimate their API footprint and shares practical steps for regaining visibility and control.

Zero Trust is another central theme. Instead of positioning it as an overwhelming overhaul, Richard suggests organizations reframe it as a modern VPN replacement, focusing first on core business systems and micro-segmentation to restrict lateral movement. With a strategic approach, implementing Zero Trust becomes feasible and a key step in limiting breach impact.

Richard also offers a candid look at balancing proactive and reactive DDoS defense, emphasizing the importance of both automatic mitigation and human-led response to more sophisticated, multi-vector attacks. He highlights how Akamai supports both fronts, including working with global authorities to help take down threat actors like Anonymous Sudan.

Finally, the conversation turns to the future. With EU regulations like the Digital Operational Resilience Act (DORA) on the horizon, financial institutions must invest in real-time visibility, intuitive data access, and actionable threat insights to stay compliant and resilient.

Whether you're in the C-suite, on the frontlines of your SOC, or guiding your enterprise's security roadmap, this episode delivers an honest and data-driven view of what it takes to defend the financial sector in a time of growing complexity and geopolitical tension.

With over two decades in national security and resilience, Tony brings sharp insight into the pressing risks that critical infrastructure faces—from rising ransomware attacks and insider threats to human error and the expanded digital attack surface introduced by cloud adoption and smart technologies. He explains why over 42% of critical infrastructure organizations have already reported data breaches and why 93% are seeing an uptick in cyberattacks. The conversation doesn’t stop at the threats—it goes deep into the real-world consequences, such as cascading failures across sectors, widespread outages, and compromised public safety.

We also explore how organizations can take action now. Tony outlines the importance of adopting zero trust architecture, designing systems with human behavior in mind, and implementing detection and response capabilities that reflect the physical realities of operational technology. He also shares powerful insights from Thales’ Cyber Resilience Lab in Ebbw Vale, a cutting-edge environment where real smart grid systems are tested under simulated attacks to strengthen resilience.

From preparing for quantum computing to managing complex hybrid cloud environments, Tony offers a playbook for leaders who are serious about protecting national infrastructure in a high-stakes environment. Whether you’re a CISO, infrastructure leader, or tech strategist, this episode will provide a roadmap for mitigating risk, increasing awareness, and planning ahead.

What role should technology—and leadership—play in protecting the systems that power society? Join the conversation and share your thoughts on building resilience in a connected world.

John shares the untold story behind the creation of Zero Trust, from challenging traditional perimeter-based models to watching the concept grow into a global movement now embedded in national cybersecurity mandates. Far from being a buzzword, Zero Trust is presented here as a strategic framework that begins with a single protect surface and scales without disruption.

Together, Neil and John explore how Zero Trust is misunderstood, often mistaken for a product, and too often reduced to identity management. They break down the core five-step process for implementation, the importance of context over blind trust, and how cloud environments and AI are reshaping cybersecurity expectations.

But this conversation also carries a personal weight, as both Neil and John reflect on deeply moving experiences with childhood cancer—and how those journeys informed a new way to think about managing risk, or as John reframes it, managing danger.

This isn’t just a technical talk. It’s a story about questioning the status quo, staying adaptable in a rapidly evolving threat environment, and using strategy not assumptions to secure the systems businesses depend on.

Is your organization still relying on outdated models of trust? And what would it look like to build something truly resilient?

In this episode of The Business of Cybersecurity, I sit down with Darren Anstee, CTO for Security at NETSCOUT, to discuss the findings from the company's latest Threat Intelligence Report and why the cybersecurity landscape is changing faster than many organizations can respond.

We explore how conversational AI is lowering the barrier to entry for cybercriminals, making it possible for attackers with little technical expertise to orchestrate increasingly sophisticated DDoS campaigns. Darren explains why this shift isn't simply creating more attacks. It's changing who can launch them and how quickly they can adapt.

Our conversation also looks at the growing collaboration between threat actors, the continued rise of politically motivated hacktivist groups, and why attacks are increasingly targeting entire digital supply chains rather than individual organizations. As businesses become more interconnected, defending your own infrastructure is no longer enough.

We also discuss why compromised customer devices are creating new operational and reputational challenges for internet service providers, how AI is reshaping both offensive and defensive cyber capabilities, and why preparation, visibility, and threat intelligence matter far more than reacting after an attack has already begun.

Darren also shares practical advice for security leaders looking to move from reactive incident response to proactive cyber resilience. From understanding your true attack surface to building adaptive defenses that continuously learn and respond, this episode offers clear guidance for organizations preparing for the next generation of cyber threats.

If AI is making cyberattacks easier to launch, how should businesses rethink the way they defend themselves? After listening, I'd love to hear your thoughts. Is your organization ready for this new reality, or is there still work to do?