All Episodes

Take your cybersecurity leadership and operational strategy to the next level with practical insights on AI-driven planning, risk-based zero trust, and framework execution. It’s time to stop chasing unachievable 100% security and start building resilient, business-aligned security programs that maximize risk tolerance and protect core operations. Who better to guide you through this transition than CISO and Director of Cybersecurity at Select Sires, Elie Hachem? You will learn how to leverage AI to accelerate security roadmaps, implement CIS Controls v8.1 for tangible gap analysis, apply sales psychology to navigate executive boardrooms, and scope zero trust practically around high-value assets rather than blanket mandates. Get motivated to engage business partners, build proactive incident containment, and align security investments directly with organizational ROI! Takeaways: Shifting from 100% Security to Resilience: Achieving total security is unrealistic; CISOs must focus on minimizing detection-to-response time and building proactive quarantine controls. Accelerating Security Roadmaps with AI: Read-only tenant integration allows security leaders to rapidly analyze internal processes, identify pain points, and condense traditional multi-year planning horizons. Practical Scoping for Zero Trust: Blanket zero trust across entire enterprises often fails due to executive friction and BYOD demands; focus zero trust controls tightly on privileged accounts and core infrastructure. Structuring Frameworks with CIS Controls: Utilizing structured frameworks like CIS Controls v8.1 gives security teams a measurable, tangible baseline to assess gaps and map directly to NIST standards. Applying Sales Psychology to Security Leadership: Leveraging transactional sales experience and human behavior analytics helps CISOs communicate risk effectively and secure executive buy-in. Quote of the Show: "Security is an enabler to the business, and it is impossible to be a hundred percent secure. What you can do is maximize your risk tolerance and build proactive resilience." - Elie Hachem Links: LinkedIn: https://www.linkedin.com/in/eliehachem/ Website: https://www.selectsires.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your enterprise Microsoft architecture and AI strategy to the next level with practical insights on Copilot deployment, agentic governance, and modern cloud security. It’s time to slow down, eliminate data sprawl, and secure your foundational permission structures before turning loose generative AI across your organization. Who better to guide you through it than 13-time Microsoft MVP, Cloud Architects co-host, and principal technology consultant Chris Goosen? You will learn how to navigate the 70+ Copilot product variations, contain sensitive data leaks using isolated enterprise models, govern unmonitored agent sprawl, and transition away from legacy Active Directory infrastructure. Get motivated to evaluate your M365 licensing efficiency, adopt automated patch management, and implement a "best of platform" security approach that saves budget while maximizing protection! Takeaways: Cutting Through Copilot Branding: With dozens of distinct Copilot products across M365, GitHub, and Power Platform, organizations must distinguish between consumer chat tools and isolated enterprise models that prevent data leakage. Addressing AI-Exposed Data Sprawl: AI tools don't create new security holes; they expose legacy over-permissioned files and old SharePoint archives using natural language queries. The Rise of Agentic Governance: As organizations face "agent sprawl," tools like Agent 365 and conditional access policies are becoming essential to track, identity-tag, and govern autonomous AI agents. Transitioning Off Legacy Active Directory: On-premises Active Directory remains a primary target for attackers; migrating to cloud-native identity architectures eliminates decades of technical debt. Best of Platform vs. Best of Breed: Leveraging built-in M365 Business Premium or E5 security features prevents double-paying for third-party tools and unifies security telemetry in one place. Quote of the Show: "Copilot or any of the AI models aren't discovering stuff that was hidden before - they are just surfacing what was previously over-permissioned and making it easier to find." - Chris Goosen Links: Website: https://gooseco.au LinkedIn: https://www.linkedin.com/in/ctgoosen/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your technology risk and compliance strategies to the next level with powerful insights on independent control validation, third-party risk management, and the evolving audit ecosystem. It’s time to move past rubber-stamp compliance, navigate the alphabet soup of IT frameworks, and understand how AI is transforming sampling into full-population testing. Who better to guide you through it than retired EY partner, Americas Technology Risk practice leader, and senior cybersecurity advisor Bernie Wedge? You will learn how to evaluate auditor credibility through peer reviews, avoid the marketing trap of "instant" SOC 2 tools, and streamline multi-framework testing into a single efficient audit cycle. Get motivated to ask tougher questions of your third-party providers, align controls across the business, and build a trust center that provides real transparency! Takeaways: The Reality of SOC 2: While lower-cost auditors and automated GRC tools have created instances of "security theater," SOC 2 remains a robust, vital assurance mechanism when executed with proper governance and independent testing. Auditing the Auditors: Organizations must exercise due diligence by requesting peer review reports from their auditing firms to verify credentials and ensure proper quality control standards. Navigating Framework Proliferation: Rather than siloing SOC 2, ISO, HITRUST, and PCI efforts, leaders should adopt a "test once, use many" approach to audit overlapping foundational controls simultaneously. Asking the Right TPRM Questions: Vendor risk management requires reading the actual details of a SOC 2 report, challenging sample sizes, testing depth, and even interviewing the signing audit partner, rather than just filing the document away. AI's Impact on the Future of Auditing: Generative AI tools allow auditors to move away from small sample sets and analyze entire populations of system logs and access requests in real time. Quote of the Show: "SOC 2 is not a security theater for those who put time and effort into doing reports correctly, but it is sort of what the company puts into it." - Bernie Wedge Links: LinkedIn:https://www.linkedin.com/in/bernie-wedge-jr-59817583/ Website: http://www.openhandatlanta.org arc360.com https://s2guild.org/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your application security strategy to the next level with powerful insights on securing fast-paced agentic development, navigating abstracted SaaS platforms, and bridging the gap between engineers and security teams. It’s time to move past rigid no-saying, embrace "vibe coding" as a shared collaborative workspace, and build resilient security systems that stand the test of time. Who better to guide you through it than DevSecOps podcast host, blockchain application security expert, and Founder & Managing Principal Consultant at Asgard Security, Ken Toler? You will learn how AI-driven tools are accelerating threat modeling and supply chain management, why abstracted "squishy middle" infrastructure presents new attack vectors, and how to foster a curious, error-friendly engineering culture. Get motivated to enable your developers, simplify system abstractions, and build collaborative bridges across your entire organization! Takeaways: The Pace of Agentic Development: AI tools and agentic development aren't changing core security fundamentals; rather, they are accelerating execution and making practices like threat modeling and supply chain fixes faster to implement. Preserving Systems Thinking: While AI lowers barriers to coding, engineers and security teams must still maintain deep reading and architectural comprehension to diagnose complex system vulnerabilities. The Danger of the "Squishy Middle": Modern abstracted platforms (like Replit or Lovable) consolidate credentials and environment variables into shared SaaS infrastructure, creating lucrative targets for attackers. Embracing Citizen Developers & "Vibe Coding": When non-technical departments prototype apps using AI, security and engineering teams should engage collaboratively rather than dismissively to build organizational alignment. Enabling Over Blocking: Security leaders thrive by finding creative, positive ways to enable business goals securely instead of being the transactional "no guy". Quote of the Show: "I've gotten so much further figuring out how to enable people securely rather than trying to tell people why they are insecure. Nobody wants to talk to the angry security guy." - Ken Toler Links: X: Relotnek LinkedIn: https://www.linkedin.com/in/kentoler/ Website: https://www.asgardsec.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your cybersecurity program to the next level with powerful insights on structuring security reporting lines, combating shadow risk, and building an engaged, transparent team culture from scratch. It’s time to move past organizational blind spots, establish top-down AI guardrails, and align vulnerability management directly with business priorities. Who better to guide you through it than Fortune 100 security leader, former CISO at Hyundai Capital America, and former VP & CISO at LIV Golf, Eddie Younker? You will learn how reporting directly to executive leadership eliminates conflicts of interest, why effective vulnerability management relies on business support rather than just IT execution, and how to foster a "family away from family" culture that achieves industry-leading employee engagement. Get motivated to build cross-functional relationships, educate leadership teams, and take a business-first approach to security! Takeaways: The Power of Reporting Structure: Reporting directly to the CEO gives security leaders the visibility and authority needed to embed security into operational processes, whereas reporting under a CTO can create conflict between speed-to-market and risk management. Mitigating Shadow IT and AI Risks: Emerging tools and ad-hoc AI adoption create shadow risk across organizations; mitigating this requires clear corporate guardrails, top-down governance, and strong cross-departmental relationships. Business-Centric Vulnerability Management: Successfully patching high-priority vulnerabilities isn't just an IT task, it requires educating business stakeholders, managing tech debt, and securing executive buy-in to prevent operational downtime. Transparent and Inclusive Leadership: High-performing security teams are built on transparency, mutual respect, and hiring for complementary skill sets rather than redundant backgrounds. Practical Advice for Rising Security Leaders: Gaining broad experience across multiple security domains gives rising professionals the holistic perspective needed to apply security frameworks to real-world business environments. Quote of the Show "Building a security culture starts with the reporting structure... You need a structure that enables you to own security for the entire organization and drive governance that gets support from the business." - Eddie Younker\ Links: LinkedIn: https://www.linkedin.com/in/eddie-younker-19559a96/ Website: https://www.livgolf.com/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your cybersecurity strategy to the next level with powerful insights on securing modern healthcare delivery, bridging the digital divide, and translating complex security tech into executive business language. It’s time to rethink patient care availability, move beyond legacy castle-and-moat models, and adopt platform-based zero trust architectures. Who better to guide you through it than U.S. Marine Corps veteran, published author, and Healthcare CISO at Zscaler, Chris Logan? You will learn how ambient AI is transforming clinical workflows, why health systems must consolidate point solutions into platform security to speed up M&A, and how servant leadership builds resilient, high-performing security teams. Get motivated to speak the language of business executives, protect critical patient care environments, and open career doors for the next generation of cyber leaders! Takeaways: Securing Care Everywhere: Healthcare has shifted from hospital-centric care to decentralized delivery across home, mobile, and wearable devices, making system availability vital to preventing negative patient outcomes. Leading with Business Outcomes Over Tech: Security leaders must frame investments in terms of clinical continuity, patient care, and revenue impact rather than technical jargon to win CFO and board support. The Rise of Ambient AI in Clinics: Ambient AI listening tools are relieving clinicians of manual EMR documentation during visits, restoring eye contact and the human relationship between doctor and patient. Platform Consolidation vs. Point Solution Noise: Health systems need platform-based security and the "80/20 rule" to reduce software sprawl, cut costs, and shorten clinic onboarding times from 18 months down to weeks. Servant Leadership & "Good Leaders Eat Last": True cyber leadership requires approachability, conducting skip-level check-ins, allowing teams room to fail forward, and opening doors for others to grow. Quote of the Show: "If you lead with technology when speaking to your board or CFO, you've already failed. They don't care about the technology, they care about the business outcome." - Chris Logan Links: LinkedIn: https://www.linkedin.com/in/logancm/ Website: https://www.zscaler.com Email: clogan@zscaler.com  christopherm.logan@gmail.com  Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your understanding of cybersecurity risk, organizational alignment, and executive career pivots to the next level with powerful insights from a 30-year industry veteran! It’s time to rethink the evolving personal liability of CISOs, how to effectively communicate cyber risk to non-technical business leaders, and what it really takes to walk away and build a successful second-act venture. Who better to guide you through it than former CISO at Finastra and Diebold Nixdorf, and co-founder and Chief Travel Officer at Sunshine Travelers Experiences, Scott Berrington? In this episode, you will learn how the rapid influx of emerging tech like AI creates mounting operational risk, the pros and cons of different CISO reporting structures, and strategies for providing true security assurance to demanding global clients. Get motivated to build empowered, self-sufficient security teams, navigate executive burnout, and turn your lifelong passions into your next big career milestone! Takeaways: The Shifting Risk-Reward Matrix for CISOs: Increasing personal and criminal liability for CISOs, coupled with 24/7/365 operational burnout, is causing many seasoned security leaders to rethink the CISO role. Emerging Tech & AI Disruption: Business leaders often adopt fast-moving technologies like AI for efficiency without fully understanding the rapid, potent risks involved, leaving CISOs to clean up structural mistakes. Optimal Security Reporting Lines: Security functions operate best when reporting to a Chief Risk Officer or Chief Legal Officer due to shared risk frameworks, whereas reporting to a CIO or CFO often introduces budget and operational friction. Proactive Customer Assurance: Rather than waiting for demanding enterprise clients to audit your environment, presenting a comprehensive, tailored security program builds deep customer trust and streamlines compliance. Delegation with Accountability: Effective leadership means giving direct reports full authority to execute while keeping a "quick hook" offline to coach them gently without destroying their internal credibility. Quote of the Show: “I was proud when I got my first CISO role, but there’s no type of pride like being an entrepreneur and taking that role of trying to build something from scratch.” - Scott Barronton Links: LinkedIn: https://www.linkedin.com/in/scottbarronton/   https://www.linkedin.com/company/sunshine-travelers-experiences/home/ Website: https://www.sunshinetravelersexperiences.com/ Podcast Link: https://podcasts.apple.com/us/podcast/sunshine-travelers-podcast/id1683937797 Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Take your cybersecurity operations to the next level with powerful insights on managing high-volume vulnerability patches, securing healthcare IT/OT environments, and applying deep reinforcement learning to autonomous defense. It’s time to move beyond reactive security measures and build resilient, zero-downtime systems in live, life-safety environments. Who better to guide you through it than healthcare CISO, critical infrastructure veteran, and University of Michigan-Dearborn researcher, Keith Lawson? You will learn how the surge in AI coding agents is driving a "tsunami" of software patches, strategies for managing identity as the modern perimeter, and how autonomous AI agents can adapt in real time to protect critical infrastructure. Get motivated to foster a zero-blame, collaborative culture that empowers your technical and non-technical teams to solve complex security challenges together. Takeaways: The Vulnerability Tsunami: The adoption of AI coding agents by software vendors is generating a massive wave of bug fixes and corresponding exploits, requiring organizations to automate testing and speed up patching cycles. Identity as the Modern Perimeter: As healthcare and enterprise data shift to cloud and SaaS environments, human vulnerabilities and weak identity controls, rather than traditional network perimeters, have become the primary target for social engineering and exploitation. Zero-Downtime Patching in Healthcare: Securing complex hospital networks (spanning medical IoT, legacy software, and life-critical devices) requires strict pre-planning, automated testing, and a zero-tolerance approach for service disruptions. Applied Reinforcement Learning: Unlike static large language models (LLMs), reinforcement learning enables real-time, continuous online learning for autonomous cyber defense against zero-day threats. Fostering a Zero-Blame Culture: Effective security leadership relies on open collaboration, empowering staff across all departments, and maintaining a transparent, zero-blame environment so teams can report mistakes and fix root causes fast. Quote of the Show: "In security, I think open honesty and sharing is the best thing that we can do... To me, security is a team sport." - Keith Lawson Links: LinkedIn: https://www.linkedin.com/in/j-keith-lawson/ Website: blog.9600baud.net http://www.lhsc.on.ca Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Get ready to challenge everything you assume about AI's role in cybersecurity. Shannon Garcia, founder of Strategic Defense and a veteran red team leader with stops at Trustwave, SecureWorks, IBM, and Kudelski Security, joins the Cyber Smokehouse to break down why manual, human-led penetration testing still outperforms automated AI tools, and why that might not last forever. You'll learn how shadow IT quietly drains company budgets, why remote work has changed both testing methodology and phishing success rates, and how translating technical findings into business language can protect million-dollar contracts. Plus, Shannon shares her unlikely path from 11 years as an AMD engineer to building two cybersecurity companies from scratch. Takeaways: AI is reshaping conversations across cybersecurity, but Shannon's teams still rely on manual, human-led penetration testing. She notes that automated AI pen testing platforms can't yet handle certain test types, like wireless assessments, and that clients often value the real-time communication a human tester provides over an automated tool. Shadow IT remains a persistent and growing risk, not just from a security standpoint but from a business one. Shannon points out that when business units are given autonomy to buy and deploy their own tools, companies can end up bleeding money on redundant or unnecessary licensing without realizing it. Remote work has changed both how testing gets done and how social engineering performs. Without a traditional office network to test, engagements now lean heavily on VPN and SaaS-based access reviews, and Shannon has found that phishing and vishing success rates drop significantly when employees work from home and simply don't answer the phone. Shannon describes her leadership style as people-first and curiosity-driven. She asks her team detailed questions not to micromanage, but to genuinely understand their thought process and challenges, which she says helps her advocate for them with clients. Translating technical findings for non-technical executives has been one of Shannon's most valuable skills. She frames security findings in terms of business risk and cost avoidance rather than pure ROI, which has directly helped clients unblock stalled contracts tied to security requirements. Shannon transitioned into cybersecurity after being laid off from an 11-year engineering career at AMD in 2012. Her advice to newcomers is to recognize the transferable soft skills they already have, since communication and reliability matter as much as technical ability when building a career in the field. Looking ahead, Shannon is considering a potential acquisition to expand her pen testing company's capabilities, while continuing to grow her AppSec-focused company's response to AI-driven risk in the software development lifecycle. She also has a long-planned mentorship program for aspiring cybersecurity practice leads still in development. Quote of the Show: “The thing that I love the most about running my own business is I don't have to ask for permission.” - Shannon Garcia Links: LinkedIn: https://www.linkedin.com/in/shannongarcia/ Website: strategicdefense.co Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Strong cybersecurity programs aren't built through quick fixes, they're built through thoughtful leadership, patient execution, and investing in people. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Ward Balcerzak, Field CISO at Sentra, to discuss what effective security leadership looks like in today's rapidly evolving landscape. Ward shares lessons from building security programs, mentoring future leaders, adopting AI responsibly, and helping organizations avoid reactive decision-making. From creating realistic AI roadmaps to developing cybersecurity talent and leading through change, this conversation offers practical guidance for security leaders focused on building resilient organizations for the long term. Takeaways: Successful AI adoption requires thoughtful planning rather than rushed implementation. Ward explains that many organizations are reacting to AI with unrealistic timelines and expectations. Leaders should slow down, identify their objectives, understand their gaps, and build a roadmap instead of treating AI as an overnight transformation. Effective security leaders know when to slow momentum without stopping progress. Rather than simply saying "no" to new initiatives, Ward advocates helping the business move forward responsibly by balancing innovation with practical execution and demonstrating measurable progress along the way. AI should eliminate repetitive work, not cybersecurity careers. Ward predicts entry-level analyst responsibilities will become increasingly automated, allowing security professionals to develop higher-value technical and strategic skills instead of spending time on repetitive manual tasks. Cybersecurity professionals should proactively develop new skills as technology evolves. Rather than fearing AI, Ward encourages practitioners to seek additional projects, expand their expertise, and have ongoing career conversations with leadership to remain valuable contributors. Networking has become one of the most valuable career investments in cybersecurity. Technical knowledge alone is no longer enough. Building relationships, participating in industry events, and maintaining an active professional network create opportunities that certifications alone often cannot provide. Leadership requires making difficult decisions with empathy. Ward reflects on both hiring and performance management, acknowledging that leaders often want to help people personally while still making decisions that are best for the organization. Quote of the Show: “Take a breath, zoom out, figure out what you're actually trying to accomplish.” -  Ward Balcerzak Links: LinkedIn: https://www.linkedin.com/in/ward-balcerzak/ Website: https://www.sentra.io/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Most security programs are built around understanding what has already happened, but what if organizations could begin anticipating cyber threats before they materialize? In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Tim and Suzanne O'Neil, founders of AigisPoint Predictive Intelligence. Drawing on decades of experience spanning enterprise security architecture, military leadership, entrepreneurship, and business strategy, they discuss their approach to predictive cyber risk, how AI and machine learning are reshaping threat modeling, and the realities of building an innovative cybersecurity startup. From balancing innovation with security to understanding AI's limitations, this conversation explores how organizations can begin thinking beyond reactive cybersecurity while remaining grounded in practical risk management.  Takeaways: Traditional threat modeling remains largely static, creating an opportunity to apply AI and machine learning to forecast potential cyber threats before they emerge rather than relying solely on historical attack data. Publicly available sources, including industry reports, breach investigations, and threat intelligence, contain valuable information that can be combined with modern analytical techniques to identify emerging trends instead of simply documenting the past. Building innovative cybersecurity products requires leaders to constantly balance investment decisions, innovation, and acceptable business risk, recognizing that organizations cannot fund every initiative simultaneously. Early-stage cybersecurity companies face the challenge of proving value through customer adoption while simultaneously developing secure, production-ready platforms and meeting investor expectations. AI should be viewed as an enabling technology, not an infallible decision-maker. Human oversight remains essential because AI systems can still produce flawed outcomes and require validation before being trusted in security-critical environments. As AI automates more routine security analysis, cybersecurity roles will continue to evolve rather than disappear, creating demand for new specialties as adversaries increasingly leverage AI-driven techniques. Entrepreneurship in cybersecurity requires technical expertise alongside resilience, adaptability, and a willingness to navigate uncertainty while transforming innovative ideas into commercially viable products. Quote of the Show: “Currently everybody's looking backwards.” - Suzanne O’Neil Links: LinkedIn: https://www.linkedin.com/in/suzanne-oneil-7490643b8/  linkedin.com/in/tim-o-22774918/?skipRedirect=true  Website: https://www.aigispoint.net/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Cybersecurity leaders today face a challenge that extends far beyond technology: keeping pace with constant change. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with John Rogers, Chief Information Security Officer and Head of Technology Risk at MSCI. Drawing on experience spanning consulting, financial services, and executive security leadership, John shares his perspective on AI governance, third-party risk management, board communication, and the growing complexity facing security teams. Listeners will gain practical insights into how organizations can approach AI governance, communicate cyber risk effectively to executives and boards, rethink traditional third-party risk practices, and prepare for a future where security leaders must balance innovation with increasingly complex threats.   Takeaways: The speed of change remains one of the biggest challenges facing security leaders today, with AI accelerating both innovation and the barrier to entry for attackers. AI governance starts with visibility. Before organizations can govern AI effectively, they need an inventory of where AI systems and agents actually exist across the business. Citizen development creates opportunities for innovation but also introduces new security responsibilities that many non-technical users may not fully understand. Effective board communication requires focusing on risk, change, and business impact rather than diving into highly technical details that executives may not find actionable. Traditional third-party risk management approaches often rely heavily on questionnaires that may not provide meaningful security insight, highlighting the need for more risk-focused evaluation methods. Security teams are continually playing catch-up as new technologies emerge, while foundational controls such as encryption and access management remain consistently important. Cybersecurity professionals entering the field should embrace AI tools rather than fear them, as familiarity with AI is rapidly becoming a critical skill regardless of technical background. Quote of the Show: “It's impossible to be an expert at everything.” - John Rogers Links: LinkedIn: https://www.linkedin.com/in/johnsrogers/ Website: http://www.msci.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Most cybersecurity conversations start with technology. Michael Myint starts with the foundation. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Michael Myint, a cybersecurity executive whose thirty year career spans Big Four consulting, global enterprises, and high growth healthcare startups. He has built programs from scratch, led organizations through public incidents, and mentored security leaders who have gone on to surpass him. You will walk away with a sharper view of where AI is genuinely changing the threat landscape, why vendor consolidation is coming, whether organizations are ready or not, and what separates the security professionals who rise from the ones who stall.   Takeaways: Board communication lives or dies on business relevance. Phishing rates and patch counts belong in the appendix. Metrics tied to revenue, speed to delivery, and product outcomes are what earn executive attention and budget support. AI is disrupting the entry level pipeline in ways the industry has not fully reckoned with. New practitioners who rely on prompt engineering without foundational knowledge will struggle when things break and nobody knows why. Vendor consolidation is coming. The era of niche tools for every sliver of the security stack is giving way to platforms that cover more ground at lower cost, and leaders who get ahead of that shift will be better positioned. Quantum computing combined with AI capabilities is a legitimate long term concern. Nation state actors are already better resourced than most enterprises, and that gap only widens as quantum matures. The CISO is not the department of no. Security leaders who lean on restriction and compliance theater lose credibility quickly. The ones who earn trust show up with solutions and speak the language of the business. Building future leaders requires giving real ownership, not just tasks. Cross training across security functions and evaluating people on program outcomes rather than activity is what develops professionals who can eventually lead on their own. A foundational background still matters before moving into a cybersecurity role. Understanding networking, identity, and how systems actually work provides context that no certification shortcut can replace. Quote of the Show: “"Be curious, dig a lot, be a go-getter, be a problem solver, take ownership."- Michael Myint Links: LinkedIn: https://www.linkedin.com/in/michaelmyint/ Website: https://adapthealth.com/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Cybersecurity careers are rarely linear, and building effective security leadership requires more than technical expertise alone. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mea Clift, CISO at Cengage, for a conversation about cybersecurity career growth, leadership, curiosity, and risk management. Mea shares insights on how professionals can find their place within the cybersecurity industry, why curiosity is essential for long-term success, and how passion drives deeper expertise. The discussion also explores misconceptions about the CISO role, business impact assessments, security risk, and the realities of operating modern security programs. Outside of cybersecurity, the conversation shifts into Mea’s approach to smoking and grilling, including charcoal setups, smoking techniques, and favorite recipes.  Takeaways: Cybersecurity professionals should find a specialty they’re passionate about. Mea explains that broad interest alone is not enough to build a successful cybersecurity career and encourages people to identify the specific area that excites them most. Curiosity is critical for long-term success in security. The conversation highlights the importance of continuous learning because cybersecurity constantly evolves. Passion helps professionals stand out in competitive hiring environments. Mea discusses how enthusiasm, projects, networking, and deep subject knowledge differentiate candidates during interviews. Business impact assessments are an underrated security control. During the lightning round, Mea identifies business impact assessments as a security control that deserves more attention. Risk remains a major challenge within the security industry. Mea gives a concise answer of “Risk” when asked what the industry is getting completely wrong. There are misconceptions about what CISOs actually do. The discussion touches on common assumptions around the day-to-day work of CISOs and the operational realities behind security leadership roles. Smoking and grilling are part of Mea’s creative outlet outside work. Mea shares details about her charcoal and wood smoking setup, favorite smoking techniques, and favorite  recipes. Quote of the Show: “Life’s too short. You gotta follow your passion.” - Mea Clift Links: LinkedIn: https://www.linkedin.com/in/mea-clift/ Website: https://www.cengagegroup.com/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

What happens when organizations scale rapidly through acquisition while simultaneously navigating AI adoption and evolving cyber risk? In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Matthew Mudry, CISO at Alera Group, to discuss the operational realities of securing large-scale acquisitions, integrating fragmented environments, and managing cybersecurity risk during periods of aggressive growth. Matthew shares firsthand experiences standardizing security across acquired organizations, balancing business pressure with security due diligence, and navigating the growing complexity introduced by AI technologies. The conversation explores M&A integration challenges, data loss prevention, access control, AI governance, leadership communication, security roadmaps, and the future of the CISO role.  Takeaways: M&A creates significant operational security complexity. Matthew discusses the challenge of integrating acquired businesses into standardized security platforms and processes. Security teams need earlier involvement in acquisitions. The conversation explores how organizations sometimes prioritize business growth before fully understanding integration and security risks. AI introduces both opportunity and risk. Matthew shares concerns around AI misuse, access control, data loss prevention, and adversarial use cases while also discussing opportunities to improve security operations using AI. Access control and DLP remain foundational. The episode repeatedly emphasizes the importance of strong access controls and data protection strategies when adopting AI technologies. Security leaders must communicate effectively with executives. Matthew discusses translating technical risk into measurable business reporting through roadmaps, metrics, and leadership engagement. Strong technical foundations matter for future leaders. Matthew advises aspiring cybersecurity leaders not to rush into management too early and stresses the importance of technical and risk management experience. Quantum computing is becoming a long-term concern. The conversation explores future risks around encryption, legacy data exposure, and long-term data retention. Quote of the Show: “What’s better than fighting AI with AI?” - Matthew Mudry Links: LinkedIn: https://www.linkedin.com/in/matthewmudry/ Website: http://www.aleragroup.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Cybersecurity is evolving faster than ever, and leaders are being forced to rethink how they approach risk, resilience, and modern defense strategies. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mike Salem to discuss today’s rapidly changing cyber landscape and the growing influence of AI on both attackers and defenders. Throughout the conversation, Mike shares insights on emerging cyber threats, operational challenges facing security teams, and the importance of adaptability in modern cybersecurity leadership. The discussion also explores how organizations can better prepare for evolving risks while balancing innovation, visibility, and practical security execution. This episode offers valuable perspective for cybersecurity leaders, IT professionals, and organizations navigating constant technological change and increasing security complexity.  Takeaways: • AI is rapidly changing the cybersecurity landscape. The conversation explores how AI is accelerating both offensive and defensive cybersecurity capabilities and increasing the speed of change across the industry. • Security teams must continuously adapt. Mike discusses the operational challenges organizations face as threats evolve faster than traditional security processes. • Visibility and awareness remain critical.The episode highlights the importance of understanding environments, risks, and potential gaps before incidents occur. • Cybersecurity leadership requires flexibility. The discussion emphasizes the need for leaders to remain adaptable while balancing business priorities and security objectives. • Threat actors are evolving quickly. Mike shares perspectives on how modern attackers are becoming more sophisticated and accessible through emerging technologies. • Organizations must focus on practical execution. The conversation reinforces the importance of operationalizing security strategies rather than relying solely on theoretical frameworks. Quote of the Show: “Threat actors are evolving faster than most organizations can react.” -  Mike Salem Links: LinkedIn: https://www.linkedin.com/in/mikesalem2112/ Website: http://www.ihstowers.com Mike’s Email: mss972@yahoo.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Tired of the buzzword bingo flooding the cybersecurity industry? So is Zlatko Unger. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Zlatko Unger, CISO Expert at Wiz, for a no-nonsense conversation that cuts straight through the AI noise and gets back to what actually matters in security. With over 18 years of experience spanning security, risk, privacy, and compliance, Zlatko brings the kind of hard-earned perspective that only comes from building and scaling security programs in the real world. From the growing complexity of identity and access management to the supply chain gaps that keep him up at night, Zlatko lays it all out plainly. You will walk away with a clearer picture of where AI is genuinely useful in security programs, where technical debt is quietly piling up while everyone chases the next shiny thing, and what it takes to lead remote security teams and communicate risk to a board that may not want to hear it. This one is packed with substance, humor, and the kind of candid insight you rarely get on a stage at RSA.  Takeaways: AI hype is creating real operational risk. Organizations are rushing to adopt AI tools without the due diligence needed to understand what they are allowing or what risks are being introduced. Foundational security is being deprioritized. Technical debt keeps accumulating and legacy threats are still getting through because teams are too distracted by what is new to fix what is old. The AI agent space is where the near-term security value lives. Agentic tools that surface information faster and offer action suggestions are more meaningful than the AI-powered SOC marketing dominating the RSA floor. Identity and access management is growing more complex, not less. There is no standard across SaaS platforms for how permissions and scoping work, leaving serious gaps in logs, accountability, and access control. Supply chain and third-party risk still has massive gaps. Security teams often cannot trace where their data goes beyond the first layer of vendors, and AI black boxes embedded in vendor tools are making this harder. Cloud security has matured, but smaller organizations are still the weak point. Larger organizations have developed stronger muscle memory for secure cloud configuration, while smaller businesses are still stumbling into basic misconfigurations. Communicating risk to the board requires speaking their language. Translating technical risk into financial impact and tailoring the message to each stakeholder's function is what gets attention and drives action. Building strong teams means distributing hiring judgment. A committee-based interview process that includes different perspectives and gives staff a real voice in the final decision helps catch what any one interviewer might miss. Remote team culture requires intentional effort. In-person offsites, consistent communication, and encouraging team members to get outside and interact with people are all essential to keeping a remote team healthy. A course correction is coming on AI. Zlatko predicts organizations will hit a wall trying to replace too many functions with AI and will ultimately swing back toward valuing people who know how to use it rather than replacing people with it. Quote of the Show: “Using AI in every way, shape, or form creates a tremendous amount of risk across the organization.” - Zlakto Unger Links: LinkedIn: https://www.linkedin.com/in/zlatkounger/ Website: https://www.wiz.io Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

How is AI changing both the threat landscape and the way security teams operate? Today’s guest is a seasoned cybersecurity leader navigating these changes at scale. Introducing David Cross, CISO at Atlassian. David joins Ernie Anderson and Graeme Payne to share how AI is reshaping cybersecurity, from attacker capabilities to internal defense strategies. He discusses how AI is lowering the barrier for attackers, why security teams must adapt to an increasingly fast-moving environment, and how organizations should think about managing risk as new technologies emerge. David also touches on the importance of understanding evolving threats, maintaining strong fundamentals, and ensuring teams are prepared to respond to continuous change.  Takeaways: AI is lowering the barrier for attackers: David explains that AI makes it easier for more individuals to carry out attacks, increasing both the volume and accessibility of threats. The pace of change is accelerating risk: He highlights that the speed at which AI is evolving is creating challenges for security teams trying to keep up. Security teams must continuously adapt: David emphasizes that organizations cannot rely on static defenses and must evolve alongside the threat landscape. Understanding threats is critical to defense:He discusses the importance of knowing how attackers operate in order to build effective security strategies. Fundamentals still matter: Despite new technologies, core security practices remain essential in protecting organizations. AI impacts both offense and defense: He notes that AI is not just a risk, but also a tool that can be used to strengthen security operations. Quote of the Show: “The pace of change is only increasing.” - David Cross Links: LinkedIn: https://www.linkedin.com/in/david-b-cross-b856657/ Website: https://atlassian.com/ Personal Website: davidcrosstravels.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

How do you secure an environment when the technology is evolving faster than teams can keep up? Today’s guest is a cybersecurity leader operating at the intersection of AI, product security, and enterprise scale. Introducing Jason Loomis, CISO at Freshworks. Jason joins Ernie Anderson and Graeme Payne to share why the speed of AI innovation is becoming one of the biggest challenges in cybersecurity today. He dives into how AI is accelerating both development and risk, the growing difficulty of maintaining guardrails in AI-generated code, and why organizations are still struggling to implement governance at scale. Jason also shares a candid perspective on how AI may impact the future of cybersecurity talent, particularly at the entry level, and why continuous learning is becoming non-negotiable for security professionals.  Takeaways: The biggest challenge is simply keeping up. Jason states directly that the pace of change, especially driven by AI, is the hardest problem organizations face today. AI is accelerating both productivity and risk. From a development perspective, AI is increasing output and speed, but from a security perspective, it introduces new challenges around control and governance. Guardrails for AI-generated code are not mature yet. He highlights that while AI can write code, implementing consistent security controls and governance across tools is still difficult and not easily standardized. Entry-level cybersecurity roles are at risk. Jason explains that AI is already replacing lower-level roles like SOC analysts and GRC positions, which may impact long-term talent development. AI could reduce the future talent pipeline. He raises concern that removing entry-level learning opportunities may lead to fewer experienced professionals advancing into senior roles over time. Software supply chain risk is a growing concern. Beyond AI itself, Jason points to supply chain security as a major emerging challenge that organizations must address. AI literacy is becoming mandatory. He makes it clear that security professionals who are not actively learning and using AI risk becoming obsolete in the near future.  Quote of the Show: “Keeping up… it’s just fast, and AI is exponentially making it faster.” - Jason Loomis Links: LinkedIn: https://www.linkedin.com/in/jasonloomis1/recent-activity/images/ Website: https://www.freshworks.com/?tactic_id=6909181&utm_source=social&utm_medium=linkedin&utm_campaign=aboutpage&utm_ter Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

Why do organizations still struggle with cybersecurity despite more tools and innovation than ever before? Today’s guest is a seasoned cybersecurity executive with deep experience across enterprise and public sector environments. Introducing Merlin Namuth, CISO for the City and County of Denver. Merlin joins hosts Ernie Anderson and Graeme Payne to share why foundational security practices continue to be the biggest challenge for organizations today. He dives into why core disciplines like asset management and vulnerability management are often overlooked despite being critical, how AI is both a force multiplier and a growing threat, and why leadership, communication, and continuous learning are essential in cybersecurity. Merlin also shares practical insights on building high-performing teams, developing talent, and staying relevant in an industry that is constantly evolving.   Takeaways: Foundational security practices remain the biggest gap. Merlin emphasizes that organizations still struggle with core areas like hardware asset management, software tracking, and vulnerability management, despite their importance to reducing risk. “Basic” security is not actually easy. He reframes “basic” controls as “foundational” because they are difficult to implement consistently at any scale, regardless of organization size. AI is both a force multiplier and a threat. AI improves detection and response capabilities, but adversaries are also using it to rapidly develop exploits, increasing the pace of threats. Cybersecurity requires constant learning. The field changes rapidly, and professionals must continuously invest time in learning new technologies, compliance changes, and evolving threats. Leadership requires trust, feedback, and self-reflection. Merlin highlights the importance of having a trusted inner circle that can provide honest feedback and help leaders improve over time. Attracting talent requires a strong team culture. In public sector environments where compensation may be lower, promoting the quality of the team and mission helps attract strong candidates. Security programs must align across the business. He discusses working closely with functions like legal and communicating risk in ways that resonate with broader organizational goals. Quote of the Show: “I still see organizations just struggle with what I call the foundational elements of security.” - Merlin Namuth Links: LinkedIn: https://www.linkedin.com/in/merlin-namuth/ Website: SeeYourselfHere.org Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0  Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297  Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47  iHeart Radio: https://iheart.com/podcast/319629841/  Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550