Explore every episode of the podcast Cybersecurity Where You Are (audio)
Dive into the complete episode list for Cybersecurity Where You Are (audio). Each episode is cataloged with detailed descriptions, making it easy to find and explore specific topics. Keep track of all episodes from your favorite podcast and never miss a moment of insightful content.
Rows per page:
50
1–50 of 209
Title
Pub. Date
Duration
Episode 209: Security Chaos Engineering with Game Theory
14 Oct 2026
00:39:23
In episode 209 of Cybersecurity Where You Are, Sean Atkinson argues that most organizations prepare for operational failure like they're bracing for a hurricane while most adversaries are playing chess. Drawing on security chaos engineering and game theory, he walks through a structured approach that blends threat modeling, internal red teaming, and constructive disagreement to empirically test and strengthen a defensive posture.
Here are some highlights from our episode:
00:33. The RSA Conference 2025 presentation behind this episode
00:48. How artificial intelligence (AI) is only accelerating adversaries' evolution
01:23. Hurricanes and chess: Analogies for different types of disaster preparedness
04:03. Overview of chaos engineering and game theory
05:01. Understanding threat vectors in our environment and how MITRE ATT&CK can help
05:50. Why adversaries "need a vote" when planning for failure
07:03. Red teaming and the need for penetration testing as part of an internal process
07:50. Going beyond technology to understand business objectives and strategy
08:51. Continuity as a consideration for continually adapting and updating controls
10:12. Transition from three separate threat silos to multidimensional threats
10:45. Game theory: It's not just a tabletop exercise (TTX)
12:15. Goalkeeper: An analogy for addressing "predictability of weakness"
13:52. Testing where our weaknesses are: An important element of chaos engineering
14:58. Accounting for biases and finite resources when evaluating strengths and weaknesses
17:56. Vulnerability identification: An example of how a strength can become a weakness
22:25. The need to resist getting too sophisticated with internal red teaming too quickly
24:23. Rigor for pushing back against tired adages like "it's never happened to us before"
26:22. An implementation strategy focused on communication
27:00. Dr. Tyler Moore's Return on Security Investment and the consequences of doing nothing
28:03. Debate and commit: A leadership principle for getting the most out of disagreement
30:42. Start small, provide notice to those affected, and consider a "surprise audit"
32:12. Minimize the blast radius, build hypotheses, balance bias, and other best practices
37:38. Parting thoughts of how to break down this approach
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 208: Secure Harness Engineering for Agentic AI
07 Oct 2026
00:34:42
In episode 208 of Cybersecurity Where You Are, Sean Atkinson breaks down secure harness engineering for agentic artificial intelligence (AI). Noting the risks posed by AI agents acting without oversight, he highlights "episodes" as auditable elements that help to provide feedback, and he walks through 15 controls spread across five stages as a way to engineer an AI harness with security in mind. He also differentiates secure harness engineering from prompt engineering, guardrails, frameworks, logs, and universal wrappers for AI agents.
Here are some highlights from our episode:
01:23. The need for a control system in light of agent escape incidents
02:19. Analogy of a financial analyst to understand why separation of duties is important
02:57. Revolution and then evolution: How AI models have changed exponentially since 2022
04:54. Where secure harness engineering has a capability
05:42. Making decisions traceable: The need for an evidence chain to build controls effectively
07:15. Smartphones: A parallel for understanding the value of each new AI model
11:20. Engineering controls, not standard policies for all models
12:22. Secure harness engineering vs. prompt engineering
12:51. Models' evolving role: How it invites new security questions to be posed
15:16. AI agents without oversight: The insider persona with which defenders need to contend
16:02. The need for determinism and an effective diagram to build for it
18:22. Definition of secure harness engineering
19:36. Episodes and the importance of log assessment in mediating model capability
20:42. Reality verification: A feedback loop that gets into the concept of forensic assessment
21:27. Questions to ask as you get into an AI agent's evidence chain
22:56. Moving through intent, authority, reasoning, synthesis, decision, and enforcement
25:38. Side effects: What they are and how they actualize risk
27:16. Verification and audit: How they empower you to look at control opportunities
28:49. Five stages and 15 controls for secure harness engineering
29:47. What secure harness engineering is and is not
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 207: AI Risk Management — A Trust Relationship
30 Sep 2026
00:32:37
In episode 207 of Cybersecurity Where You Are, Sean Atkinson makes the case for treating artificial intelligence (AI) not as software but as an ongoing trust relationship. He highlights the value of integrating best practices from regulations like the EU AI Act, walks through the three stages of an AI governance lifecycle, and explains how AI risk management fits into organizational governance, change management, and other business processes.
Here are some highlights from our episode:
01:16. The trust component of AI governance
02:02. A need to align to regulatory best practices and bring them into AI risk management
03:47. Advice: Contextualize, don't generalize, your risks associated with AI use
04:40. Common questions that lead to AI governance as a requirement
06:59. Grounding an agile AI governance process on foundational principles
07:46. How the "fortress" approach overlooks the relationship element of AI security
09:51. A direct invitation: Listener feedback on AI governance thinking
11:44. Evaluating trust and relationship in machine learning and generative AI
14:04. The role of human oversight in realizing AI as a method that gets to a solution quicker
14:53. AI governance boards: A potential solution to elevating AI literacy internally
16:00. AI governance lifecycle: Three phases from current business processes to value generation
18:55. Overview of the future of AI security
23:16. The need for foundational security controls and AI-specific controls
25:00. AI governance assessment: Why it needs to happen across the organization
26:28. How AI governance ties into organizational governance
29:49. Ethics and responsible AI practice
29:57. Change management considerations with AI deployment
30:35. A concluding call to action to get stronger together
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 206: Trust and Influence as CISO Survival Skills
23 Sep 2026
00:40:25
In episode 206 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager speak with Julie Morris, Founder and Head of Thought Leadership at Persona Media, about why trust and influence have become survival skills for today's CISOs. Julie breaks down three types of organizational power, explains why the "good guys" resist the language of influence, and offers a practical starting point for anyone who's ever felt like PowerShell was the only power they understood.
Here are some highlights from our episode:
02:13. From old to new: A shift in how trust and influence factor into organizational structures
04:24. The three kinds of power in an organization: hard, soft, and network
09:59. Wise advice: Build your personal and professional network first
11:07. How influence multiplies confidence with network power
12:03. Inertia, fear, and status quo: overcoming the emotional reactions that oppose change
18:12. How Sean uses the power of "slow down," not "no," to support AI transformation
20:49. Why good thought leadership starts with empathy and self awareness
24:32. Building organizational processes that "trigger" a change in CISOs' trust and influence
26:30. Hugging Face as an example of how triggering moments become lessons
27:42. What Tony Soprano has to do with measuring trust and influence
30:47. Reality check: Every information gap gets filled one way or another
32:15. The power of community and shared ideas in figuring out thought leadership together
36:09: Advice: Be in the "river" of your network to go where you want to go
37:34. How understanding of shared values helps to overcome imposter's syndrome
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 205: Secure by Design — Now Updated for AI
16 Sep 2026
00:36:38
In episode 205 of Cybersecurity Where You Are, Tony Sager speaks with Phyllis Lee, VP of SBP Content Development at the Center for Internet Security®(CIS®), and Steve Lipner, Executive Director of SAFECode. Together, they discuss how an updated document from CIS and SAFECode gives concrete guidance on what artificial intelligence (AI) means for your Secure by Design process.
Here are some highlights from our episode:
02:17. A refresher on making Secure by Design digestible for end organizations
02:57. Distillation and prescriptive guidance: The value provided by CIS
06:53. An overview of Butler Lampson's "Gold Standard of Security"
07:03. How a shift in approach to Secure by Design led to the founding of SAFECode
09:42. The importance of verification requirements for what developers have done
12:54. A product of CIS pragmatism: Prioritization relative to the development environment
20:06. Artifacts as evidence of secure software development at work
30:15. How the updated document provides guidance around AI
30:45. What AI creates instead of new classes of vulnerabilities
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 204: FWC26 and the New Bar for Event Security
09 Sep 2026
00:33:36
In episode 204 of Cybersecurity Where You Are, Sean Atkinson speaks with Ryan Winmill, Chief Security Officer and Vice President of FIFA World Cup Boston, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how FIFA World Cup 2026 (FWC26) — secured through an unprecedented tripartite governance framework, $625 million in U.S. Congressional funding, and real-time intelligence that stopped a swatting attempt at the finals — set a new standard for proactive event security worldwide.
Here are some highlights from our episode:
01:18. The "unprecedented" governance framework created for FWC26
03:53. The role of CIS as a force multiplier for FIFA, host regions, and other partners
11:00. Why you can't trust the person with an ego in large-scale event security planning
13:23. How the threat environment evolved over the previous three World Cup tournaments
17:23. A new bar for proactive event security going forward
18:43. How CIS provided quality control that helped to mitigate swatting calls during FWC26
21:55. Unique approaches used by host regions to better understand the World Cup fanbase
23:15. How counterfeit FIFA volunteer uniforms triggered a cross-city credentialing response
26:46. Recommendations for future large-scale event host cities
30:19. Ryan's recommendation to future host cities: "Call CIS before you get started"
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 203: Cyber Attacks' Human Impact — Beyond the Data
02 Sep 2026
00:33:50
In episode 203 of Cybersecurity Where You Are, Sean Atkinson speaks with Pavlina Pavlova, Founder of Critical Cyber. Together, they discuss how Pavlina started Critical Cyber to go beyond the data and give voice to the human impact of cyber attacks, from ransomware hitting hospitals to cyber tactics targeting civilians in active conflict zones.
Here are some highlights from our episode:
00:44. How Pavlina's work covering the impact of cyber attacks on Ukrainian critical infrastructure led to Critical Cyber
03:13. How Critical Cyber works with cyber attack victims, responders, and other audiences
04:08. Countering the tendency, even among cybersecurity experts, to sanitize cyber attacks' human impact
08:57. The use of storytelling with those impacted by cyber attacks to drive policy changes
15:02. Why cyber attacks in some sectors are underreported
19:01. Critical Cyber's mission of combining testimony, research, and expert collaboration
24:51. Where Critical Cyber is and where it's looking to go
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 202: Delineating AI Security and Cybersecurity
26 Aug 2026
00:38:56
In episode 202 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute. Together, they explore how the implications of multiple 2026 sandbox escapes of artificial intelligence (AI) models are starting to delineate AI security and cybersecurity.
Here are some highlights from our episode:
02:00. The historical context of one AI model's 2026 sandbox escape
03:26. The impact of ethics, guardrails, and misconfigurations in an AI containment breach
06:08. Why context matters when talk of AI models "going rogue" surfaces
11:49. How history helps us to delineate AI security and cybersecurity
13:47. A new skill and mindset to match our refined AI risk understanding
15:43. Rules and cybersecurity implementation as a possible way forward
19:04. The double-edged sword of restricting access to open-weight models
23:25. Recommendations for keeping up with what's changing in the AI security space
25:51. Rob's advice: To learn how to defend a thing, try learning how to build it first
28:23. AI governance and seeing through the "slop" to informed conversation
29:54. The use of AI to learn more about and discuss AI security for years to come
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 201: The Evolution and AI Enablement of Pentesting
19 Aug 2026
00:33:46
In episode 201 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. Together, they reflect on the evolution of penetration testing, including the impact on pentesting from artificial intelligence (AI).
Here are some highlights from our episode:
01:03. How things have changed since William's and Ed's first pentests
09:02. Community: A defining element of Capture The Flag (CTF) events
14:47. Industry concerns over the "death" of CTFs and "cheating" by artificial intelligence (AI)
17:00. Opportunities to take CTFs to the next level in the age of AI
20:18. Pentesting vs. vulnerability scanning: Why terminology matters
25:43. The advent of autonomous AI tools and what they could mean for vulnerability scanning
29:07. Why continuous improvement in cybersecurity doesn't always require AI
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 200: Alan Paller's Vision and Our Next Chapter
12 Aug 2026
00:40:36
In episode 200 of Cybersecurity Where You Are, Sean Atkinson, Tony Sager, and Ed Skoudis sit down with Frank Reeder, Co-Founder and Founding Chair of the Center for Internet Security® (CIS®). Together, they reflect on how Alan Paller's vision continues to drive CIS forward. In the spirit of that vision, this milestone episode also marks a new chapter for the podcast: Ed Skoudis joins as co-host of Cybersecurity Where You Are.
Here are some highlights from our episode:
01:09. The two complementary missions of CIS
02:55. Three defining moments that have shaped CIS into the organization it is today
08:10. The story of naming CIS
10:31. How CIS and SANS advance Alan Paller's vision of bringing people together
13:50. Personal anecdotes of Alan Paller as a connector of people
15:45. "What would Alan do?" A question that continues to guide CIS and SANS
22:00. How CIS security best practices are emblematic of helping others
27:12. CIS's "secret sauce" as a trusted, neutral platform for cybersecurity collaboration
29:53. How CIS can continue to embody Alan Paller's philosophy into the future
37:47. A special announcement: Ed Skoudis as a new co-host on the podcast
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 199: Translating Cyber Risk into Business Decisions
05 Aug 2026
00:40:43
In episode 199 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chris Painter, Chair of the Risk Committee and Board Member at the Center for Internet Security® (CIS®). Together, they discuss how chief information security officers (CISOs) can support the work of translating cyber risk into business decisions by Boards.
Here are some highlights from our episode:
00:50. Introductions to Chris
01:36. The single biggest translation error Chris has seen CISOs make
07:38. Cyber risk quantification: An opportunity to go beyond translation for Boards
09:25. How ransomware changed Boards' understanding of cyber risks' business impact
10:45. The value of tabletop exercises (TTX) and other simulations in creating shared language
13:26. Recommendations on how to make the most of a TTX
18:37. Risk modeling and how artificial intelligence (AI) complicates probability estimations
21:51. "Pressure" (2026) as an illustration of making good, not 100% accurate, estimations
22:58. How growing public awareness of cyber is reshaping CISOs' conversations with Boards
25:55. The importance of walking Boards through risk mitigation steps with AI as an example
29:31. A recommendation for how CISOs can learn what directors care about
30:15. From "wizardry" to familiarity: An ongoing generational shift around cyber
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 198: AI Privacy from a Risk-Based Perspective
29 Jul 2026
00:30:49
In episode 198 of Cybersecurity Where You Are, Sean Atkinson discusses artificial intelligence (AI) and privacy from a risk-based cybersecurity perspective. Together, he explores how organizations and individuals can assess AI risk, apply governance frameworks, evaluate third-party AI services, and balance innovation with due diligence.
Here are some highlights from our episode:
00:41. Framing the conversation around AI, privacy, and risk-based controls
02:22. Due diligence and ethical considerations around AI products and services
03:14. Data minimization and transparency as foundations for AI privacy
04:46. Privacy impact assessments as a way to understand AI data collection and use
05:42. AI governance and the tension between implementation velocity and risk management
10:08. The use of existing data flows and controls in AI assessments
11:57. Algorithmic transparency and the challenge of understanding AI decision making
13:47. Standards, frameworks, and data sovereignty in AI privacy governance
15:12. Encryption, anonymization, tokenization, and federated learning as privacy safeguards
16:40. The need to shift stakeholder input left in AI development and deployment lifecycles
19:13. Building literacy around security, data management, privacy, and AI risk
23:40. The value of cross-functional and written assessment criteria for AI risk
26:21. A call to action for keeping pace with AI privacy and and innovation risk
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 197: AI-ready OT Data Begins with Understanding
22 Jul 2026
00:33:10
In episode 197 of Cybersecurity Where You Are, Sean Atkinson sits down with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch; and Ed Skoudis, President of SANS Technology Institute. Together, they discuss artificial intelligence (AI), operational technology (OT) data, and how understanding creates the foundation for AI-ready OT data.
Here are some highlights from our episode:
00:54. Introductions to Ben and Ed
02:16. How we understand and integrate AI into OT environments
04:30. How OT diverges from information technology (IT) in data responsibilities
05:23. Opportunities for AI to assist OT
06:33. The importance of meeting OT systems where they are
08:10. A passive and incremental approach that respects the operations machines are doing
12:29. Efficiency gains, public safety improvements, and other benefits of AI-ready OT data
17:47. What lifecycle management, asset hierarchies, and governance look like for OT data
22:14. The promise of AI to help to make OT environments understandable
23:19. A team sport: How IT and OT can work together to understand assets and data
28:38. The need for translation in IT-OT communication
29:01. Recommendations for how to make OT data AI ready
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 196: Securing FIFA World Cup 2026 Collaboratively
15 Jul 2026
00:37:07
In episode 196 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how CIS, FIFA, and FIFA World Cup 2026 host cities started collaborating in 2025 on cybersecurity, public safety, intelligence, and information-sharing efforts supporting the largest sporting event in the world.
Here are some highlights from our episode:
00:40. Introductions to Sasha and John
02:07. Overview of one of the most complex public safety efforts assembled for a sporting event
05:52. Consistency: A standard for preventing and deterring threats at FIFA World Cup 2026
10:30. The impact of relationships in shaping FIFA's security ops and information sharing
11:53. Effective communication: The key to cross-functional collaboration in support of the tournament
18:07. The importance of information that guides operations
20:35. Education as a way to inform stakeholders and deploy resources
26:19. A deliberate effort to look at unanticipated threats and plan for them
29:14. Examples of messaging synchronization in support of FIFA World Cup 2026
32:37. An all-hands-on-deck support campaign from CIS
33:29. Parting thoughts around large-scale event support in the future
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 195: Enigma Machines’ Security Lessons for Today
08 Jul 2026
00:41:57
In episode 195 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute, and Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss Enigma machines, their history, and their security lessons for today.
Here are some highlights from our episode:
00:56. Introductions to Ed and Marc
01:32. What Enigma machines are and why cybersecurity folks still care about them today
06:10. Enigma machines as a symbol for how we can use hacking for noble purposes
07:18. How the human mind and the need for ease of use can undermine security
15:59. The importance of testing when designing and maintaining a security system
20:45. Why "security through obscurity" isn't actually true
22:58. Curiosity, logic, and a wide range of knowledge: Essential traits for getting hired in cybersecurity today
30:57. The impact of culture in shaping security policy and priorities
35:09. Why artificial intelligence (AI) is the Enigma machine of 2026
In episode 194 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute. Together, they conduct a mid-year review of 2026 cybersecurity predictions from seven Center for Internet Security® (CIS®) experts, as shared on the CIS website.
Here are some highlights from our episode:
01:50. Ongoing conversations about improving defense with artificial intelligence (AI)
05:19. A trap to avoid: Automating things with AI because we can regardless of utility
06:54. Ed's prediction about a near-term transition for AI-enabled vulnerability discovery
09:27. How AI agents change the economics around conducting a penetration test
11:26. Adversary emulation: A blurry proposition when threat actors use AI to look like anybody
14:02. Ed's prediction about threat actors shifting APT profiles within a single attack campaign
17:00. The need to systematically rethink cyber defense to support state and local cybersecurity
23:34. How adversaries are pivoting to the "authorization sprawl" in light of zero trust efforts
29:20. Industry-specific threat intelligence as a way to keep organizations informed
32:10. Why a policy isn't the same as security control for operational technology (OT)
33:55. Social expectations and public policy objectives around holistic OT security
39:52. Compliance as a floor, not a ceiling, that results as a byproduct of continuous security
43:43. The need for oversight and confidence in technology as distinct from the "Fog of More"
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 193: AI Security and Responsibility in EO 14409
24 Jun 2026
00:39:00
In episode 193 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute, and Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they discuss AI security and the responsibility of the U.S. government in creating confidence around it, as represented in Executive Order (EO) 14409, "Promoting Advanced Artificial Intelligence Innovation and Security."
Here are some highlights from our episode:
00:50. Introductions to Rob and Brian
02:32. How to conceptualize confidence around something as complex as AI security
04:32. The U.S. government's responsibility to set AI security guardrails as clear expectations
08:12. The use of "voluntary" participation to create confidence in the context of EO 14409
14:38. How Mythos AI and similar developments affect assessment of frontier AI models
17:11. Airport security as an analogy for understanding AI security and privacy concerns
18:41. Why cybersecurity is a hard sell until an incident occurs
20:50. How AI is quickly becoming critical infrastructure
22:53. Furbies as reference for a flexible, iterative benchmarking process for AI security
25:50. The need for technical folks to translate AI risks into something understandable
28:21. Balancing encouragement of AI innovation with mindfulness of risk
31:24. The basics as a foundation for building shared responsibility around AI security
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 192: How Leaders Balance Expertise and Communication
17 Jun 2026
00:31:44
In episode 192 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss how leaders, including those in cybersecurity, balance their technical expertise with mastery of communication strategies.
Here are some highlights from our episode:
00:51. Introductions to Marcus
02:04. How Marcus found value in using analogies to communicate complex topics
08:40. Coordination with non-technical folks as a sign of leadership maturity
14:03. The wisdom in knowing what to say and what not to say when managing up
17:31. The need to balance technical skills with team resourcing in a way that's imitable
21:07. The challenge of leaders learning by proximity in hybrid and remote environments
24:16. "Classic" engineering vs. "new" engineering
25:13. Lessons from Boards in applying discipline, rigor, and order to software engineering
28:23. The value in leaders continuously learning how businesses work
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 191: GenAI Misuse for Physical Threat Planning
10 Jun 2026
00:31:37
In episode 191 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Elvenaes, Sr. Multidimensional Threat Analyst at the Center for Internet Security® (CIS®), and Rian Davis, Multidimensional Threat Analyst at CIS. Together, they discuss how threat actors are misusing generative artificial intelligence (GenAI) to plan physical threats.
Here are some highlights from our episode:
00:40. Introductions to Sasha, Rian, and their research on GenAI misuse
01:56. The impact of GenAI on lowering the barrier for operationalizing physical threat activity
03:37. Exploitation of GenAI model design to circumvent models' guardrails
05:58. The misuse of session persistence to streamline physical threat research
07:57. GenAI misuse: A call for critical infrastructure operators to think about security differently
11:52. Factors that make large-scale events a target of physical threat activity
14:33. The use of GenAI as a strategy for organizations to see what threat actors could see
15:37. Ongoing question: How can drones help mitigate risks while protecting public safety?
17:13. Extrapolation as a reinforcement of GenAI session persistence
20:15. The new reality: Look at what information AI can provide to threat actors
25:01. Traditional methods vs. GenAI conversations for threat planning
27:58. Continuous vulnerability assessments, communication, and other recommendations
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 190: Separating Mythos AI Fact from Fiction
03 Jun 2026
00:38:33
In episode 190 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they separate fact from fiction around artificial intelligence (AI) capabilities like Mythos AI and other AI-driven vulnerability discovery tools.
Here are some highlights from our episode:
00:50. Greetings to Brian and setting the stage for questions from a CIS webinar
03:05. The lack of a unified formula or standard for vulnerability prioritization
03:55. The opportunity for defenders to interrupt vulnerabilities chained together
05:47. An invitation to better understand your enterprise amid the "slopdemic"
06:33. How AI guardrails tie back into security best practices
10:15. How a fundamental practice we can refine is the best counter to chained attacks
12:25. The value of the CIS Community Defense Model and a teaser for Version 3
14:50. Mythos AI vs. Static Application Security Testing (SAST) in terms of practice and time
19:08. Visibility, governance, and prioritization: Three elements of a "prepared" environment
24:32. "One to one" cyber defense as a losing battle
27:25. The importance of knowing your dependencies with open-source software
33:15. Threat actor economics and the ongoing debate around responsibility in cybersecurity
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 189: The Present and Future of AI-enabled Pentesting
27 May 2026
00:33:33
In episode 189 of Cybersecurity Where You Are, Sean Atkinson sits down with Ed Skoudis, President of SANS Technology Institute. Together, they discuss the present and future of pentesting enabled by artificial intelligence (AI).
Here are some highlights from our episode:
00:39. Introductions to Ed
01:49. The promise of AI-enabled pentesting in creating more secure infrastructure
04:52. AI-enabled and AI-centric workflows in the realm of penetration testing
08:03. Wranglers, matadors, and centaurs, oh my! Metaphors for AI-enabled pentesters
13:00. How AI can assist with reporting, enumeration, and scanning as part of a pentest
14:57. AI-enabled source-assisted pentesting and the types of vulnerabilities it finds
19:50. A learning opportunity for the broader cybersecurity community
23:44. How AI and human analysts could split the workload in a future penetration test
25:54. AI-enabled pentesting vs. AI pentester in a box
29:51. Why "human in the loop" might be too passive a phrase
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 188: DBIR 2026 Insights and Collaboration with CIS
20 May 2026
00:39:03
In episode 188 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Philippe "Phil" Langlois, Data Breach Investigations Report (DBIR) Author at Verizon; and Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®). Together, they discuss some of the top insights of the 2026 DBIR and how CIS contributed to the publication.
Here are some highlights from our episode:
00:50. Introductions to Phil and Charity
02:46. Vulnerability exploitation as the most common attack vector
05:25. The role of artificial intelligence (AI) in threat actors' natural system thinking
07:03. The need for clear governance and responsibility around vulnerability management
08:58. Insight into the types of techniques threat actors research using frontier AI models
13:43. A trending drop in ransomware payouts and organizations willing to pay attackers
14:59. Why a healthy dose of distrust goes a long way in assessing attackers' claims of victims
16:24. How two ransomware groups stand out above the norm
17:49. The ongoing risk surrounding vendor, supplier, and other third party exposure
22:34. The need for governance in managing data issues involving the use of AI
27:14. Three ways in which CIS contributed to the 2026 DBIR
34:02. How the 2026 DBIR informs the CIS Controls and parting actionable steps
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 187: The Role of a CISO as a Strategic Storyteller
13 May 2026
00:39:44
In episode 187 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager discuss how the role of a CISO functions as a strategic storyteller of cyber risk while keeping the bigger picture in mind.
Here are some highlights from our episode:
00:51. Framing the conversation around CISOs' efforts to communicate with the business
02:01. Translation: A nuanced practice of simplifying the story while still telling the truth
02:41. The need for a CISO to bridge their organization's respective "culture gap(s)"
04:13. Collaborative and dictatorial: Two different ways CISOs talk to a business
06:07. The work of translation in motivating and informing action around perceived risk
07:03. Security sampling: A story from Tony that reminds CISOs of the bigger picture
09:55. Fewer wizards and more mechanics: What the cybersecurity industry needs today
12:20. Two factors to consider: Politicking and the need to provide an accessible narrative
15:49. Rapport and tradecraft as two critical tools supporting the role of a CISO
18:09. Technical competence as a prerequisite for confidence in risk conversations
19:20. The false sense of security from relying on comparative data with competitors
22:14. The CISO as a strategic storyteller who helps the business make decisions
27:03. The need for machinery to constantly rediscover and recreate trust
30:15. A call to action for Boards: Build vernacular in cybersecurity risk space
35:03. CISO as a strategic storyteller vs. CISO as an enforcer
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 186: Strong Cyber Defense Starts with IT Operations
06 May 2026
00:38:45
In episode 186 of Cybersecurity Where You Are, Tony Sager sits down with Tony Krzyzewski, a CIS Critical Security Controls® (CIS Controls®) Ambassador for the Center for Internet Security® (CIS®). Together, they discuss how strong cyber defense starts with the fundamentals of IT operations.
Here are some highlights from our episode:
00:45. Introductions to Tony Krzyzewski and his background
02:19. Tony Krzyzewski's first interaction with the CIS Controls
03:47. IT operations: The foundation that makes strong cyber defense possible
06:20. How an increasingly connected world makes the CIS Controls essential to cybersecurity
09:56. The need for operations people to realize they're part of the cybersecurity solution
13:11. The use of Implementation Groups to reduce overload on IT and security teams
16:52. How the CIS Controls differ from "umbrella frameworks" like NIST CSF and ISO 27001
18:25. CIS Controls mappings and how they help to simplify a surplus of good guidance
20:35. How the CIS Controls support improvement programs and Board-level conversations
25:38. Tony Krzyzewski's work in creating the CIS Controls Ambassador program
27:02. Why a deep view of what's happening at CIS supports Tony Krzyzewski's efforts
30:11. Growing international promotion of the CIS Controls and "doing the basics well"
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 185: AI Prompt Injection from a Risk Perspective
29 Apr 2026
00:38:05
In episode 185 of Cybersecurity Where You Are, Sean Atkinson sits down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®); Theodore "TJ" Sayers, Senior Director of Threat Intelligence at CIS; and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS. Together, they use a risk perspective to discuss artificial intelligence (AI) prompt injection and how to defend against it.
Here are some highlights from our episode:
00:49. A definition of AI prompt injection for businesses and executives
02:16. Brian on his role of guiding AI implementation at CIS
03:12. Understanding the urgency surrounding AI prompt injection as a security risk
05:32. Signals and trends indicative of threat actors attempting to weaponize prompt injection
07:10. How AI prompt injection differs from traditional input validation vulnerabilities
11:13. Early indicators that cyber threat intelligence (CTI) teams can monitor
15:00. The need to treat AI as a new identity in any enterprise implementation strategy
17:10. Understanding the difference: AI safety vs. AI security
20:36. Foundational, practical AI security that extends across all sectors
24:55. How CIS manages risk and supports the opportunity around the use of AI
28:25. The long-term promise of AI-driven vulnerability discovery grounded in fundamentals
34:48. Recommendations for piercing through the marketing hype surrounding AI
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 184: Cybersecurity Policy Development as a Journey
22 Apr 2026
00:38:27
In episode 184 of Cybersecurity Where You Are, Sean Atkinson sits down with Brock Boggs, Director of Technology at Cityscape Schools and Multi-State Information Sharing and Analysis Center® (MS-ISAC®) member. Together, they discuss how Brock approaches cybersecurity policy development as a journey at his school.
Here are some highlights from our episode:
01:21. Brock's first attempt at drafting an IT security policy manual
04:17. Fact or fiction? How the best "written" security program doesn't always translate
06:35. A starting policy landscape of creating baselines for cybersecurity, ticketing, and more
08:40. How Brock learned about a roadmap for his school at ISAC Annual Meeting 2023
11:07. Lean and to the point: The second draft of Brock's IT security policy manual
12:37. The use of Center for Internet Security® (CIS®) policy templates to write procedures
19:34. How Brock used regular updates about his policy manual to secure stakeholder buy-in
28:42. Openness, willingness to fail, and adaptability as strengths of the community
31:49. Approaching cybersecurity policy development as an ever-changing journey
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 183: The Role of CISO in Supporting Risk Translation
15 Apr 2026
00:39:35
In episode 183 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager discuss how the role of CISO supports risk translation across all levels of an organization.
Here are some highlights from our episode:
01:52. Describing the role of CISO in a single sentence
03:43. The importance of storytelling in risk translation for an organization
07:56. The need for CISOs to meet members of an organization where they are
10:47. Why the function of translating risk matters more than sharing it
14:41. The misnomer of "soft skills" and why they're a crucial part of professional life
15:50. Tony's experience with cultivating "soft skills" and working with trusted truth tellers
21:01. The importance of contextualization when framing risk to a Board of Directors
24:20. How teaching and communicating differ
25:05. Humility and empathy: Crucial skills in understanding another person's world
26:34. How communication and public speaking can help to advance a mission
29:08. The use of teaching to build mastery and writing to understand what we teach
32:35. Public speaking tip: Don't let the first time you hear your words aloud be onstage
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 182: Striking a Balance on an AI Adoption Journey
08 Apr 2026
00:32:34
In episode 182 of Cybersecurity Where You Are, Sean Atkinson sits down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they discuss how organizations can strike a balance on their journeys of artificial intelligence (AI) adoption.
Here are some highlights from our episode:
00:39. Introductions to Brian
01:06. The risk of overbuilding governance when introducing an AI strategy
02:36. Unknowns, data concerns, and other commonalities between AI and cloud adoption
04:27. The utility of AI frameworks: General purpose recommendations as a starting point
06:58. The importance of leading employees in getting the tools they need to be successful
10:42. Listening as a key method for strategic leaders to remove roadblocks to AI adoption
13:47. Final say as a means to make a strategic business decision and adapt as necessary
17:35. AI as artificial intelligence and the role of humans as sources of actual intelligence
19:56. Being a good Googler: An analogy for asking the right questions with AI prompting
23:46. The increasing volume and velocity of cyber attacks leveraging AI
24:00. The need to enhance defenders' skillsets using AI
27:08. An invitation to play with AI capability and see what it can do for you
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 181: Supply and Demand of Cybersecurity Ecosystems
01 Apr 2026
00:46:08
In episode 181 of Cybersecurity Where You Are, Tony Sager sits down with Vilius Benetis, Director of NRD Cyber Security. Together, they discuss how Vilius applies his expertise as a CIS Critical Security Controls® (CIS Controls®) Ambassador to help to cultivate supply and demand for growing cybersecurity ecosystems around the world.
Here are some highlights from our episode:
01:11. Introductions to Vilius and recollections of how he met Tony for the first time
02:06. The CIS Controls as a reasonable, logical approach that avoids generic language
04:11. How the CIS Controls shaped Vilius' cybersecurity conversations with the World Bank
05:26. A clear connection between knowing what you have and recovering from an incident
07:55. A strategic look at how to build cybersecurity programs that will grow and evolve
12:18. How the CIS Controls help to clarify reasonable cybersecurity and avoid victim blaming
18:07. An encouraging sign: Governments enabling businesses, not competing with them
21:13. Transportation: A lens for understanding how security culture and expectations change
28:11. A brief look at how to make progress on operationalizing security
31:54. The supply and demand forces that help to create cybersecurity ecosystems
38:13. An opportunity for helping organizations to simplify governance
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 180: Secure by Design Fused to Operational Practices
25 Mar 2026
00:40:21
In episode 180 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Stephen Thomas, SVP of Sales and Business Services at the Center for Internet Security® (CIS®), and Nick Rust, Director of Distribution at CIS. Together, they discuss how CIS supports secure by design by integrating it into operational practices.
Here are some highlights from our episode:
00:48. Introductions to Stephen and Nick
02:20. The need to connect development and operational environments
07:31. How CIS security best practices make cybersecurity standard and repeatable
09:19. Navigating the complexity the cloud adds to secure by design
11:44. The importance of removing guesswork for operating partners and development teams
14:21. How CIS provides the professional infrastructure for collective action in cybersecurity
16:00. Good configuration management: The bedrock of every successful security program
17:29. The use of a common language to communicate security across an organization
23:59. Shared responsibility, not shared accountability, in the cloud
27:21. A look back at how CIS did secure by design using a projectized approach
32:21. Conveying confidence around cybersecurity and compliance in the connected world
36:16. Parting pieces of advice for organizations just getting started
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 179: 2026 Cybersecurity Predictions from CIS — Pt 3
18 Mar 2026
00:54:08
In episode 179 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager conclude their discussion of 2026 cybersecurity predictions from seven CIS experts, as shared on the CIS website.
Here are some highlights from our episode:
01:09. How threat actors' adoption of Agentic AI is reshaping the defender's dilemma
06:28. Public confidence: The primary focus for attackers seeking to undermine U.S. elections
10:43. The surge in threat actors targeting operational technology and critical infrastructure
12:29. Responsibility and the cost of fixing flawed things instead of secure by design
16:29. Secure by design: An invitation to rethink architecture and plan for future adaptability
17:24. Meeting cloud service prioritization with a foundation of defense for all things
25:44. Supporting state and local cybersecurity maturity with both competence and character
41:00. Feedback: The key to adapting security controls to evolving threats and technology use
50:23. Embedding security into the heart of a business
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 178: Appropriate Defense to Iranian Threat Activity
11 Mar 2026
00:34:04
In episode 178 of Cybersecurity Where You Are, Sean Atkinson sits down with Theodore "TJ" Sayers, Senior Director of Threat Intelligence at the Center for Internet Security® (CIS®). Together, they discuss how to mount an appropriate defense to Iranian threat activity observed in February and March 2026.
Here are some highlights from our episode:
00:58. Iran's historical tit-for-tat style of cyber operations
02:50. Regional targets: A primary focus of Iran's state-sponsored threat actors
04:05. What the CIS Cyber Threat Intelligence (CTI) team is watching for
05:19. Contextualizing a drop in precursor-related threat activity from Iran
06:59. Sectors directly and indirectly affected by observed Iranian threat activity
09:12. Password spraying, data wipers, and more: Common TTPs of Iranian threat groups
11:50. The importance of cybersecurity awareness training in countering TTPs that still work
16:07. Advice to SOC managers: How to detect what CIS CTI is expecting the most
21:25. NASCIO's Top 10 Priorities as a guide for framing strategic risk of Iran's threat activity
26:39. What an effective threat intel team does and does not do
29:29. Community defense for U.S. State, Local, Tribal, and Territorial (SLTT) organizations
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 177: Power of Community-Developed Security Content
04 Mar 2026
00:37:59
In episode 177 of Cybersecurity Where You Are, Tony Sager sits down with Bob Gendler, IT Specialist at the National Institute of Standards and Technology (NIST), and Edward Byrd, Senior Cybersecurity Engineer of the CIS Benchmarks® at the Center for Internet Security® (CIS®). Together, they use the open-source macOS Security Compliance Project to discuss the power of community-developed security content.
Here are some highlights from our episode:
01:15. Introductions to Bob and Edward along with their first Mac devices
03:24. Why CIS Benchmarks are needed for macOS
05:49. The need to make security guidance a collaborative, ongoing exercise
11:06. Inside the expanding community supporting the macOS Security Compliance Project
16:59. A practical win: making daily security operations easier to manage
21:40. An operational feedback loop of improving the CIS Benchmarks
25:25. The implications of compliance pointing to assurance, not security
30:53. Advice on how to prepare for an audit using the CIS Benchmarks
34:18. The importance of rationale in defining reasonable cybersecurity behavior
35:30. A teaser of upcoming changes and how to get involved
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 176: A Cybersecurity Journey of Incremental Wins
25 Feb 2026
00:36:03
In episode 176 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brock Boggs, Director of Technology at Cityscape Schools and Multi-State Information Sharing and Analysis Center® (MS-ISAC®) member, and Maureen Kunac, Senior Product Manager at the Center for Internet Security® (CIS®). Together, they discuss Brock's story of using incremental wins to advance his organization on its cybersecurity journey.
Here are some highlights from our episode:
02:10. Getting started making the largest measurable impact with CIS-CAT® Pro Assessor
03:52. Implementation Group 1: A filter for prioritizing secure configuration management efforts
09:16. The use of essential cyber hygiene to build an on-ramp to a security controls program
11:18. Navigating breakage, dependency, and other principles of change management
13:37. Lessons learned from beta testing and enterprise rollout of security changes
22:24. Advice: How to start on a journey of system hardening with measurable impact
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 175: Practically Solving Cyber Problems at Scale
18 Feb 2026
00:33:54
In episode 175 of Cybersecurity Where You Are, Tony Sager sits down with Phil Reitinger, Chair and Senior Advisor of Global Cyber Alliance. Together, they look back on Phil's career and his dedication to exploring how to practically solve cyber problems at scale.
Here are some highlights from our episode:
00:57. How Phil got started in cybersecurity during the "infosec" era
04:51. Old wine in new bottles: trust exploitation, authentication failures, and update challenges
06:14. The lack of political will, not technology, in solving fundamental cyber problems
07:33. How industry and government share similar challenges in cybersecurity
10:09. The importance of metrics in incentivizing the right actions
12:33. Scale: the biggest obstacle to collective cyber defense there ever was or will be
22:50. The Global Cyber Alliance and a focus on practically solving cyber problems at scale
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 174: 2026 Cybersecurity Predictions from CIS — Pt 2
11 Feb 2026
00:38:45
In episode 174 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Kyle Leonard, Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Randy Rose, VP of Security Operations & Intelligence at CIS. Together, they continue their discussion of 2026 cybersecurity predictions from seven CIS experts, as shared on the CIS website.
Here are some highlights from our episode:
02:00. How cross-platform campaigns are becoming the norm
03:09. Threat actors' use of generative artificial intelligence (GenAI) to expand their attacks and gain efficiencies
05:08. The blurring line of what separates today's script kiddies from nation-state threat actors
07:47. Fully autonomous malware: in the realm of possibility but not here yet
13:19. How specialization in the criminal ecosystem requires us to rethink analysis itself
16:07. Shrinking dwell time: a product of the democratization of complex tools' availability
18:02. The effective use of social engineering to lower threat actors' operational costs
19:20. Malware's increasing use of trusted infrastructure to thwart cyber defenses
20:25. The use of behavioral analysis to apply bottleneck security mechanisms
22:40. Evolving threat actors' tradecraft: pseudo-random subdomains, GenAI models, and SEO poisoning
26:39. What trust looks like today: something that's dynamic and negotiated at a moment's notice
31:25. Supply chain attackers' pivot to edge device vendors and security appliance makers
33:43. The ongoing work of CIS to support state and local governments' cybersecurity efforts
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 173: Scammer Jousting as Human Risk Management
04 Feb 2026
00:34:01
In episode 173 of Cybersecurity Where You Are, Sean Atkinson is joined by Roger Grimes, CISO Advisor at KnowBe4. Together, they discuss "scammer jousting," a term coined by Tony Sager which describes empowering organizations to manage human risk using simulated phishing.
Here are some highlights from our episode:
01:05. How simulated phishing and scammer jousting manage human risk
03:48. The shift in perception of security awareness training over the past 20 years
06:19. The need for testing to build capability and resiliency amongst employees
09:27. The many faces of phishing attacks and the impact of generative artificial intelligence
15:00. How gamification is proven to help users learn more in their cybersecurity training
16:57. How data empowers organizations to communicate the potential impact of a phish
19:57. The use of behavior engineering to foster a stronger security culture
23:56. The value of customer feedback in continuously enhancing phishing training
29:52. Continuous and hyper-personalized training as the future of spammer jousting
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 172: Helping CISOs as a CIS Controls Ambassador
28 Jan 2026
00:34:27
In episode 172 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chirag Arora, Cyber Security Executive Advisor and CISO at Dorf Nelson & Zauderer LLP. Together, they discuss how Chirag draws upon his experience as a CISO and his community work as a CIS Critical Security Controls® (CIS Controls®) Ambassador to help other CISOs with their cybersecurity programs.
Here are some highlights from our episode:
00:51. Introduction to Chirag and the early years of his work as a CIS Controls Ambassador
06:03. The value of measurement and psychology when discussing assessments with CISOs
09:00. Chirag's work on a CISO certification and vision for aligning it to the CIS Controls
12:31. How open sharing of wisdom between CISOs makes the world more secure
20:57. The importance of storytelling for CISOs, CIS Controls Ambassadors, and other leaders
24:29. Chirag's use of law school to take his understanding of reasonableness up a level
28:13. Regular opportunities for CIS Controls Ambassadors to discuss universal issues
31:08. The heightened importance of nonprofit organizations bringing people together
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 171: Securing CNI in U.S. SLTTs through AI Adoption
21 Jan 2026
00:37:15
In episode 171 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Soledad Antelada Toledano, Security Advisor, Office of the CISO, Google Cloud at Google. Together, they discuss securing critical national infrastructure (CNI) in U.S. State, Local, Tribal, and Territorial (SLTT) government organizations through artificial intelligence (AI) adoption.
Here are some highlights from our episode:
00:50. Introduction to Soledad
02:48. How the convergence of informational technology (IT) and operational technology (OT) has created bigger attack surfaces
04:10. The proliferation of threat actors targeting critical infrastructure sectors
07:24. The challenge of legacy systems for U.S. SLTT owners of CNI
08:13. Alert fatigue, limited visibility, and other challenges facing OT networks
13:22. The value of automated cyber threat intelligence (CTI)
24:46. Building strategic AI implementation around human in the loop (HITL)
33:17. U.S. SLTTs' use of the cloud to test and build trust for securing CNI
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 170: Visibility for SLTTs in Blocking Typhoon APTs
14 Jan 2026
00:34:30
In Episode 170 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Douglas Holland, Senior Solutions Engineer at Akamai Technologies. Together, they discuss how U.S. State, Local, Tribal, and Territorial (SLTT) government organizations can increase their visibility to obstruct the attack attempts of Typhoon advanced persistent threat (APT) groups.
Here are some highlights from our episode:
00:49. Introduction to Douglas
02:16. How Typhoon APTs are using trusted tools to target critical infrastructure
08:30. Professionalism as a tell of sophisticated nation-state threat actors
09:15. How U.S. SLTTs come up with creative solutions despite budgeting and staffing limits
14:14. The "big credential playground" that is U.S. SLTTs' expanded attack surface
16:46. Visibility into network activity as a way to continuously build defensive capability
19:11. The use of context to connect technical visibility to defensive action
23:20. Identity as the new perimeter, cloud and SaaS posture, and micro-segmentation
29:18. One piece of advice: assume an attacker is already in the network or will be
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 169: 2026 Cybersecurity Predictions from CIS — Pt 1
07 Jan 2026
00:39:54
In Episode 169 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager begin their discussion of 2026 cybersecurity predictions from seven experts at the Center for Internet Security® (CIS®), as shared on the CIS website.
Here are some highlights from our episode:
01:05. The impact and promise of artificial intelligence on cyber defense
05:37. Collective action as an answer to the constraints facing the "cyber-underserved"
12:52. Zero trust and security best practices as functions of managing cycles of time
21:22. How tailored threat intelligence can help to frame cybersecurity around mission
31:18. The convergence of cybersecurity and privacy as a necessity for governance
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 168: Institutionalizing Good Cybersecurity Ideas
31 Dec 2025
00:37:56
In Episode 168 of Cybersecurity Where You Are, Tony Sager sits down with Tony Rutkowski, one of the CIS Critical Security Controls® (CIS Controls®) Ambassadors of the Center for Internet Security® (CIS®). Together, they discuss what Tony Rutkowski has learned in his efforts to institutionalize good cybersecurity ideas like the CIS Controls.
Here are some highlights from our episode:
01:48. Introductions to Tony Rutkowski and his career in technology
06:06. The evolution of the CIS Controls and how Tony Rutkowski came to advocate for them
12:50. The "Fog of More" as a metaphor to focus attention, not create new solutions
17:50. How institutionalizing good cybersecurity ideas is like conducting an orchestra
21:44. The use of timing and the right security content to help people clarify their intentions
24:25. The value of industry mappings in reducing duplicate implementation efforts
26:41. Secure by design: a 2025 example of creating a new formal global technical standard
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 167: Volunteers as a Critical Cybersecurity Resource
24 Dec 2025
00:41:44
In Episode 167 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Kelley Misata, Ph.D., Chief Trailblazer and Founder at Sightline Security. Together, they discuss how volunteers constitute a critical cybersecurity resource for the Center for Internet Security® (CIS®). Along the way, they explore the nature of volunteerism, the role of volunteers at CIS, and how CIS is looking to mature its engagement with volunteers going forward.
Here are some highlights from our episode:
01:37. Introductions to Kelley and her experience with cybersecurity volunteers
03:09. Kelley's use of research, expertise, and an open mind to check in with CIS volunteers
04:50. How volunteers have deepened their passion and dedication with CIS for 25 years
06:55. Volunteers as a critical cybersecurity resource for "One CIS" going forward
10:51. Commitment, conflict resolution, and openness to formal process in CIS Communities
14:39. The use of directionality and accolades to encourage different types of contributors
19:43. The importance of flexibility in management to meet volunteers where they are
20:30. Leadership, storytelling, and recruitment as opportunities for volunteerism at CIS
24:37. The risk of volunteer burnout and how to protect against it
26:00. Collaboration with employers to treat volunteerism as a growth experience
30:09. A balancing act of making volunteers useful without depleting the mission
34:51. Sean's take: volunteer management as the original Large Language Model (LLM)
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 166: Foundations of Actuarial Science in Cyber Risk
17 Dec 2025
00:40:46
In Episode 166 of Cybersecurity Where You Are, Sean Atkinson sits down with Tyler Moore, Ph.D., Chair of Cyber Studies at the University of Tulsa, and Daniel Woods, Lecturer at the University of Edinburgh. Together, they review the foundations of actuarial science in cyber risk. Here are some highlights from our episode:
00:48. Introductions to Tyler and Daniel
01:22. How actuarial science fits into a traditional approach of risk modeling
02:20. Why cyber risk has historically been difficult to quantify
04:01. How data sources available to insurers and individual organizations have evolved
07:21. Adaptability as a key principle to model risk for an evolving cyber threat landscape
08:58. Loss distribution modeling for different types of cyber threats
11:38. Similarities and differences between how actuaries and frameworks view risks
13:10. Quantifying severity, frequency, and resilience to different cyber risks
14:31. How insurers differ from underwriters in their view of risk
17:43. Ransomware as a case study where actuarial modeling improved risk management
22:30. The value of translating cyber risk to business risk for CISOs like Sean
26:20. Why data on which security controls matter most remains elusive
32:33. The biggest misconceptions of using actuarial models in cybersecurity
36:09. How cyber actuarial science can help to determine what works in cybersecurity
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 165: An In-Depth Look at CIS Controls Implementation
10 Dec 2025
00:51:31
In Episode 165 of Cybersecurity Where You Are, Tony Sager sits down with Valecia Stocchetti, Senior Cybersecurity Engineer at the Center for Internet Security® (CIS®), and Charity Otwell, Director of Critical Security Controls at CIS. Together, they take an in-depth look at implementing the CIS Critical Security Controls® (CIS Controls®), including what you need to know to begin your own CIS Controls implementation efforts.
Here are some highlights from our episode:
00:53. Introductions to Valecia and Charity
02:48. How the CIS Controls ecosystem answers the deeper question of how to implement
06:42. The importance of clear strategy, business priorities, and a realistic timeline
09:56. How the CIS Community Defense Model (CDM) clarifies cyber defense priorities
13:01. The use of calculations around costing to make a security program achievable
15:31. Bringing IT and the Board of Directors together through governance
20:36. "Herding cats" as a metaphor for navigating different compliance frameworks
23:17. Why one prescriptive ask per CIS Safeguard starts cybersecurity workflows
25:30. "Why" vs. "how" communication, accountability, staffing, budget, and continuous improvement as keys to success for CIS Controls implementation
42:03. CIS Controls Assessment Specification as an answer to implementation subjectivity
47:21. Parting thoughts around team effort, change, and CIS Controls Accreditation
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 164: Secure by Design in Software Development
03 Dec 2025
00:44:48
In Episode 164 of Cybersecurity Where You Are, Tony Sager sits down with Curt Dukes, EVP and General Manager of Security Best Practices at the Center for Internet Security® (CIS®), and Steve Lipner, Executive Director of SAFECode.org. Together, they explore the evolution of secure software development and why secure by design is critical for reducing risk in today’s complex environments.
Here are some highlights from our episode:
01:08. Introductions to Curt and Steve
04.01. The historical challenge of implementation errors in software security
08:41. The emergence of secure by design and the need to measure against specified criteria
14:39. The value of artifacts as evidence of secure software development
28:52: How the CIS Critical Security Controls® (CIS Controls®) support secure software
39:59. The use of community projects to address challenges like secure by design
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 163: K-12 Cybersecurity Made Practical
26 Nov 2025
00:40:47
In Episode 163 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brock Boggs, Director of Technology at Cityscape Schools, and Maureen Kunac, Senior Product Manager at the Center for Internet Security® (CIS®). They dive into the realities and challenges of K-12 cybersecurity, including limited budgets, small teams, and growing threats.
Brock shares how a ransomware incident at a neighboring school district and new state requirements pushed his district to take K-12 cybersecurity more seriously. He explains how CIS SecureSuite® tools gave him a clear starting point and helped him transform panic into progress. Maureen highlights how CIS continues to adapt its cybersecurity solutions for K-12 schools and why simplicity matters when resources are tight.
Here are some highlights from our episode:
00:47. Introductions to Brock and Maureen
02:50. What prompted Cityscape Schools to prioritize cybersecurity and how Brock found CIS
11:50. The importance of simplicity in making K-12 cybersecurity practical
12:39. A collaborative journey of helping Brock get comfortable learning about cybersecurity
22:52. A look back at Cityscape Schools pivoted to remote education during COVID-19
34:20. Brock's advice for other school districts to get started with a cybersecurity program
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 162: A Managed Approach to a Managed Attack Surface
19 Nov 2025
00:41:24
In Episode 162 of Cybersecurity Where You Are, Tony Sager sits down with Tina Williams-Koroma, Founder and CEO of TCecure, LLC and CyDeploy, Inc. Together, they discuss why "cyber insecurity is not inevitable" and how organizations can take a managed approach to attack surface management.
Along the way, Tina shares her journey from software development to cybersecurity entrepreneurship and explains why proactive measures like hardening systems and automating patching are critical for reducing risk. Here are some highlights from our episode:
00:50. Introductions to Tina, her career pivot, and her entrepreneurial path
03:35. The value of the secure configuration guidance provided by the CIS Benchmarks®
07:35. Why a well-managed system makes for a hard target
11:00. Marketing against “magic” in a hype-driven cybersecurity market
13:44. The translative work of moving well-managed infrastructure beyond "mere hygiene"
19:14. Tina's faith-based inspiration for helping others get as far as she's gotten
27:23. Soccer analogies for a managed attack surface
33:54. Tina's pep talk: "Why cyber insecurity is not inevitable"
38:38. Free cybersecurity resources for small businesses
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 161: An Ecosystem-Wide Approach to CNI Resilience
12 Nov 2025
00:37:42
In Episode 161 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Mishal Makshood, Azure Partner Alliance Manager at the Center for Internet Security® (CIS®), and David Kalish, Sr. Cybersecurity Solutions Engineer at CIS. Together, they explore how CIS Hardened Images® help to secure cloud environments and strengthen critical national infrastructure (CNI) resilience through collaboration.
Mishal and David explain how these virtual machine images, which are pre-configured to the CIS Benchmarks®, serve as secure, scalable blueprints for cloud deployments. They highlight how CIS Hardened Images reduce human error, accelerate compliance, and foster trust across a global cybersecurity ecosystem that includes hyperscalers, supply chains, and public-private partnerships.
Tony shares the origin story of the CIS Hardened Images and reflects on the evolution of cybersecurity from isolated efforts to a cooperative model built on shared standards and integrated tooling. The group also discusses how CIS Hardened Images align to frameworks and how they help organizations navigate multi-cloud environments while maintaining consistent security postures. Here are some highlights from our episode:
00:50. Introductions to Mishal and David
01:36. What CIS Hardened Images are and why they matter
03:14. Why CIS Hardened Images are uniquely suited to strengthening CNI resilience
04:24. The cultural shift toward working as an ecosystem to start from secure baselines
06:34. The origin story of the CIS Hardened Images
10:32. The value of taking guesswork out of secure configuration management in the cloud
13:44. How CIS Hardened Images support compliance directly and through the CIS Critical Security Controls® (CIS Controls®)
20:39. Building trust through cloud partnerships and collaboration
28:50. The foundational role of configuration management in cybersecurity
34:35. Getting started with strengthening your cloud security foundation
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
Episode 160: Championing SME Security with the CIS Controls
05 Nov 2025
00:33:55
In Episode 160 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Alan Watkins, CIS Controls Ambassador, to explore how the CIS Critical Security Controls® (CIS Controls®) empower small and medium-sized enterprises (SMEs) to build practical, scalable cybersecurity programs.
Alan shares his journey from law enforcement to IT leadership in the City of San Diego and how his passion for supporting SME security led him to become a champion of the CIS Controls. The episode highlights the importance of translating complex cybersecurity guidance into actionable steps that SMEs can realistically implement even with limited resources.
Here are some highlights from our episode:
00:49. Introductions to Alan, his career path, and his connection to the CIS Controls
11:43. How Alan supports SMEs to mature their cybersecurity postures
18:04. The work of CIS Controls Ambassadors to "memorialize" security best practices
22:23. The need to translate how cyber hygiene supports business success
25:31. CIS WorkBench and in-person communities as avenues to get involved