Cybersecurity Ecosystem Show

Hosted by Cybersecurity Ecosystem Show

Business

Website RSS feed

Episodes

Latest episode

Oct 2026

Language

About the show

The Cybersecurity Ecosystem Show connects the full spectrum of the industry: practitioners, investors, vendors, regulators, and everyone in between — because the more we learn from each other, the stronger we become.

Listen to episodes

60 recent

October 22, 202636 min

Why Security Fundamentals Still Fail, From a Former CISO Turned Forrester Advisor

David Levine spent ten years as a CISO at Ricoh before joining Forrester as Vice President and Executive Partner for Security and Risk, where he advises security leaders across government and private industry. In this conversation, he shares what that vantage point revealed: the challenges he assumed were specific to his own program are common across the industry. David explains why patching, prioritization, and asset inventory remain unfinished at most organizations, and why the cause is capacity rather than understanding. Leaders know what needs to be done; they lack the bandwidth and budget to do all of it. AI makes the problem harder by consuming resources, adding new assets to discover, and multiplying vulnerability volume beyond what current processes can absorb. He describes what the successful programs have in common: informed and supportive leadership, a grounded CISO, and a working relationship between IT and security, which he found to be a more pervasive problem than he expected. He explains why he considers people the biggest security risk, how he turned resented phishing tests into a skill employees asked for by answering "what's in it for me," and the "no, but" rule he set for his teams. The core of the episode is executive tabletop exercises. David walks through three real cases, including a CEO who rediscovered a lost continuity process during the exercise and an HR and finance team who realized they did not know their roles, and lays out how to run an executive tabletop so that it produces change rather than compliance. He closes with a buyer's perspective for vendors and founders: why cold outreach to CISOs fails, what works instead, the difference between a partner and a vendor, and where he sees market demand in AI governance and fundamentals execution. Topics covered: Why the security fundamentals are still unfinished: patching, prioritization, asset inventory Capacity versus understanding: budget pressure, staffing, and doing more with less How AI adds discovery burden and multiplies vulnerability volume What successful programs share: culture, leadership support, grounded in reality The pervasive friction between IT and security, and what good looks like People as the biggest security risk, and the limits of training Answering "what's in it for me" in security awareness Reframing phishing tests as personal skill-building Influence, storytelling, reciprocity, and leading by example Replacing "no" with "no, but" Executive tabletop exercises: three real examples How to run an executive tabletop: audience, jargon, injects, escalation Making training engaging: five-minute animated episodes Selling to CISOs: what works, what does not Partner versus vendor Market demand: AI governance tooling and fundamentals execution Prioritizing on real risk, not theoretical risk David Levine is Vice President and Executive Partner for Security and Risk at Forrester, where he advises CISOs and security leaders across industries. He previously spent 28 years at Ricoh, including roughly a decade as CISO, before moving into the peer advisory role. His work with clients focuses on security fundamentals, leadership influence and storytelling, executive tabletop exercises, and keeping risk prioritization grounded in reality. David on LinkedIn: https://www.linkedin.com/in/david-levine-8907133/ Forrester: forrester.com

September 24, 202637 min

Thank Ransomware for Your Seat at the Table

Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, when the field was called information security and security teams could not get a meeting with the CIO. In this conversation, he explains how the industry earned its current board-level standing and what security leaders should do with it. Jim identifies governance as cybersecurity's biggest area of progress, now formalized in NIST 800-53 revision 5 and CSF 2.0, and explains the principle behind effective executive communication: companies do not exist to be secure, so security has to be framed as enabling the business objective with the least risk possible. He credits ransomware with changing executive awareness, because it made operational disruption a universal exposure regardless of what data an organization holds. On board communication, his guidance is specific. CEOs and CFOs are experienced risk managers who evaluate risk and reward in every decision. What they need from security is an accurate valuation of the organization's cyber exposure, presented as business impact rather than technical terminology. The conversation then turns to the labor market. Jim confirms what many candidates experience: the entry level is saturated, while engineer-level positions remain unfilled. He outlines the practical path into the field, including structured internships modeled on medicine and psychology, a four-year degree completed on employer tuition reimbursement, and AI governance as a second skill. He closes with his position on AI adoption: prohibition fails because employees will use AI regardless, so organizations should provide a sanctioned, secure path, supported by enforced data classification and data loss prevention. A follow-up episode on AI and data governance is planned. Governance as cybersecurity's biggest area of progress NIST 800-53 rev 5, CSF 2.0, and the formalization of governance Security as a business enabler rather than a technology function How ransomware changed executive awareness of cyber risk Remote work and the expansion of the security perimeter Presenting cyber risk to boards in business terms Why security awareness and workforce involvement are staffing necessities Jim's career path: history degree, campus IT, security leadership Professional humility and the role of community in the field The labor market: saturated entry level, unfilled engineer tier Internships, degree requirements, and career progression AI governance as a career skill and an organizational requirement AI adoption strategy: sanctioned paths instead of prohibition Data classification and DLP as the next area of maturity Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, spanning the antivirus and Windows NT era through today's governance-driven, board-level discipline. He entered the field through campus IT work with a history degree, which he credits for the assessment, analysis, writing, and communication skills that carried him into leadership. He teaches in boot camps and university programs, advises organizations on security leadership, and expects the CISO role to eventually report into enterprise risk under a chief risk officer. Jim on LinkedIn: https://www.linkedin.com/in/jimmapes/

September 3, 202634 min

AI Needs Guardrails, Backups Need Testing, and Your New Hire Might Not Exist

Georgeo Xavier Pulikkathara enlisted in the Army at 18 as a private E1. He's a colonel now, with 15 years at Microsoft behind him, a PhD in cybersecurity in progress at 58, and a job title most security leaders never hold: both CIO and CISO at the same company, managing one budget to ROI and the other to risk. In this conversation, Georgeo and Taylor start with the best bad advice he ever received, that technology is a fad, and why every wave since has proven the deeper point: the technology changes, the need for people who understand the business does not. Georgeo lays out his case for AI with guardrails, from the newborn being asked to do brain surgery to the Workday hiring case that pushed the industry toward open-box AI, and explains why he still trusts a 35-year-old spidey sense over a confident hallucination. Then it gets practical: the four-tier monitoring model that treats endpoints as the last line instead of the first, the North Korean fake worker fraud his team catches through IP checks and shared bank accounts, the breach that lost four terabytes in 40 minutes through an unwatched pipeline, and the military preparation mindset behind his incident response. Dig the foxhole before the fight. Practice containment. Restore the whole application, not one file, and time it. He closes with the three Cs he hires for and why a growth mindset beats any single technical skill. Topics Covered: "Technology is a fad": surviving mainframes, offshoring, cloud, and now AI The light switch and the electrician: why learning to code still matters AI as a newborn: training, ethics, guardrails, then agency Hallucinations, the Workday case, and black-box vs open-box AI Wearing both hats: managing to ROI as CIO, managing to risk as CISO What he reports to the board, in two buckets The four tiers: identity, production, business applications, endpoints Catching North Korean fake remote workers: proxies, locations, bank accounts Ransomware's migration between industries, and observability on any budget Army lessons: preparation, PICERL, containment, and walking backward from the fight Testing backups against real recovery objectives The three Cs of hiring: character, competency, commitment Guest Georgeo Xavier Pulikkathara is a CIO and CISO with roughly 35 years across technology and security, including 15 years at Microsoft and early days at Cooper Industries. He is a US Army colonel who began as an enlisted private, came up through the infantry, and carries the military's preparation discipline into incident response, business continuity, and board reporting. He is currently pursuing a PhD in cybersecurity, mentors service members toward their CISSPs, and connects job seekers with roles whenever he can. Georgeo on LinkedIn: Georgeo Xavier Pulikkathara Pull quotes: "They gave birth to a child, and because it's AI, they want their child to do brain surgery tomorrow." "What does it do? It does what people do. It makes stuff up." "We literally discredit the person with 30 years of experience, because AI says it's possible, so you're wrong." "A CIO manages to the ROI. If I'm a CISO, I'm managing to the risk." "You're taking on a risk you don't have to." "You'll have four or five people with the same bank account." "I walk backward from the fight." "Many people make the assumption that they got backups. Have you checked it? Can you restore from it? Have you tried?" "Competency, character, commitment. Show me that. That's who I hire."

August 20, 202633 min

From the SEC to 25,000 Board Members: Pricing Cyber Risk Like an Insurer

Christopher Hetner has seen the board conversation from every seat: building New York City data centers in the nineties, running global information security at GE Capital, advising two chairs of the SEC as senior policy advisor, and three years inside the insurance industry learning how brokers and carriers actually price cyber exposure. Today he is Chief Cyber Advisor at World Wide Technology, Cyber Risk Advisor to the National Association of Corporate Directors and its roughly 25,000 members, and chair of the AI and Cyber Insights Council for the NASDAQ Center for Board Excellence. In this conversation, Chris and Taylor dig into the numbers behind the board disconnect: roughly 70 percent of directors are still not in tune with how cyber and AI materially impact the business, many CISOs get 20 minutes with the audit committee once a year, and AI has compressed attack reconnaissance from months to minutes. Chris lays out the fix layer by layer. Build an enterprise risk management structure even when no regulator requires it, with a charter, a risk register, and the heads of the business in the room. Quantify exposure with annual loss expectancy analysis benchmarked to your peer group, in the same categories the insurance markets use. Then go the step further that traditional models skip: tell the board where to deploy capital, and trend the exposure down quarter over quarter. Also in here: why the CISO should never report to the board alone, the professionalization problem behind slow risk quantification adoption, treating AI agents like employees who commit agent error, and why post-quantum readiness has to start now. If you present to a board, sit on one, or want to someday, this episode is a masterclass. Chris's path: NYC data centers, GE Capital global CISO, senior policy advisor at the SEC Why sophisticated boards still struggle: business lens, not bits and bytes The 70 percent problem and governing on 20-year-old assumptions Reconnaissance compressed from three or four months to minutes The isolated CISO: M&A blind spots, inflated budgets, reactive posture Building enterprise risk management without a regulatory mandate Charters, risk registers, and the COSO framework Reporting in tandem with the CFO, chief risk officer, and heads of business Annual loss expectancy analysis and the insurance markets as the ultimate arbiter Peer group benchmarks: why pharma, hospitals, and trading platforms all look different Going beyond FAIR: substantiating loss and directing capital "A language that we understand": what changes for the board Why cyber risk quantification adoption is still low, and the tactical CISO problem Culture and tone from the top AI agents as employees, agent error, and agentic-to-agentic monitoring Q-day and starting post-quantum readiness now Christopher (Cristobal) Hetner is the Chief Cyber Advisor at World Wide Technology, Cyber Risk Advisor to the National Association of Corporate Directors, and chair of the AI and Cyber Insights Council for the NASDAQ Center for Board Excellence. His nearly 30 years in cyber and technology include building data centers in New York City, serving as global CISO at GE Capital, four years as senior policy advisor to two chairs of the SEC, and three years working with major insurance brokers and carriers on sizing cyber exposure. He also advises the Cyber Future Foundation and engages roughly a dozen boards a year as an independent expert. Chris on LinkedIn: Christopher Hetner

August 6, 202635 min

Private Equity Speed, Shadow AI, and the Middle Layer Everyone Skips

Kevin Lewis has a political science degree, a career that started while he was waiting to hear back from the NYPD, and a job today that puts him inside a stack of companies at once. He is the CISO at E78 Partners, a boutique consulting firm serving small and mid-size private equity funds and their portfolio companies, where he also sits in fractional CIO and CTO seats for clients, most of them in med spa and healthcare. In this conversation, Kevin and Taylor get into why the industry's biggest win is that security stopped being the department of no, how to translate risk for a CFO who has already decided what security should cost, and what private equity's two-day definition of "fast" teaches you about scoping honestly. Kevin walks through the AI reporting pilot that pulled 15 systems into one data lake and replaced a week-long report request with a real-time answer. Then the harder stuff: why he thinks the talent shortage is partly a spending decision, why he does not tolerate gatekeeping on his team, what he actually screens for when he reads every resume himself, and why the network is the middle layer most career-changers skip. He closes with the culture playbook, including the reframe worth stealing: phishing simulation results measure how well the security team communicated, not how bad the employees are. Whether you run a program, advise one, or are trying to break into the industry, this one is full of things you can use on Monday. What's working in security: the shift from "no, you can't" to "let's make this work" Why the seat at the table matters for the information, not the title Selling to a CFO: the daily cost of zero work, remediation, and reputation Security dashboards with business metrics attached What private equity's timeline teaches you about honest scoping The AI pilot: 15 systems, one data lake, and an agent that builds the KPI report Why mentoring faded, and why Kevin requires it from his leads Gatekeeping, the scarcity mindset, and the tools-instead-of-people trap Hiring without certification or degree requirements The network: the middle layer between "no computer experience" and "security analyst" Why "we're not a target" is the sentence that makes you one Security awareness without fear, and phishing as a metric on your own team Responsiveness as the real control for shadow IT and shadow AI Retiring a rogue tool without making an enemy Kevin Lewis is the CISO at E78 Partners, a boutique consulting firm that works at the intersection of the CEO, CFO, and CIO for private equity funds and their portfolio companies. Alongside running E78's internal security program, he takes fractional technology leadership roles with client companies and handles pre-close technology due diligence for PE deals. His career spans a DOD contractor, fashion and apparel, and now consulting across whatever industry walks in the door, which suits him: to Kevin, it's all bits and bytes. He holds a master's in cybersecurity and a bachelor's in political science, came up through help desk and networking, and mentors relentlessly because that is how he got in. Kevin on LinkedIn: Kevin Lewis Email: klewis@e78partners.com E78 Partners: e78partners.com

July 17, 202643 min

The Dark Knight of Game Economies on AI, Curiosity, and Guardrails

Ward Spangenberg has spent his career finding the gaps: mapping trout DNA with a homemade database in college, dismantling a game economy's black market so thoroughly that players nicknamed him the Dark Knight, and helping build the case for bug bounties at HackerOne. Now he's the founder of Behavry.ai, building in the category Gartner calls guardian agents. In this conversation, Ward and Taylor dig into why security spends its money explaining last night instead of preventing tomorrow, what purple teaming should have become, how to hire engineers with the play instinct, and why AI won't take over but ungoverned agents absolutely will hurt you. Ward breaks down the four things real AI agent governance requires: no self-attestation, real-time review of every action, human-in-the-loop escalation instead of binary yes/no decisions, and tamper-evident audit trails that regulators are about to start asking for. Whether you're a practitioner, a founder, an investor, or just AI-curious, this one is full of stories you'll retell. What's acutely broken in security: an industry built on hindsight Thinking like an attacker: every door, every window, one unlocked Purple teaming as a quarterly exercise when you don't have the budget Hiring for curiosity: role-play interviews and the "what do you play with at home" question Why AI won't take over (and why it doesn't write perfect code) The junior analyst who becomes a level two with the right AI tooling Ward's origin stories: trout genetics, game fraud, and the Dark Knight Why you can't kill the black market: the bug bounty lesson Behavry.ai and the guardian agents category: proxy, policy, attestation The compliance wave: EU AI rules, Wyoming, and the SEC Ward Spangenberg is a longtime security practitioner and leader whose career spans companies like Uber, HackerOne, and a Silicon Valley gaming company, plus years presenting to lawyers and law enforcement investigators. He is the founder of Behavry.ai, an AI governance platform that adds policy, human-in-the-loop controls, and independent, tamper-evident attestation to any AI agent, model, or provider. He is also a rugby coach, a gym rat, and the kind of person who stuck a paper clip in an outlet as a kid and grew up to build guardrails for a living. Behavry.ai Ward on LinkedIn: Ward Spangenberg Ward on Twitter/X: @wardspan

June 11, 202633 min

Shift Left, Real Moats, and Where Your Data Actually Goes, with Chris Bollerud

Most security leaders come up through IT or risk. Chris Bollerud came up through code, and it changes how he sees the entire field. Chris is the CISO at AppZen, an AI-driven finance platform, and a software engineer of more than twenty years before that. In this episode he explains why AI gives attackers and defenders the same speed boost, why shifting left only works when you automate the catch instead of training developers and hoping, and how a single dinner with two competing vendors reframed his view of application security. From there the conversation widens out. Chris makes the case that third party risk management is overdue for a reset, that frameworks like ISO 42001 and the NIST AI RMF have not earned enterprise trust, and that nearly every security questionnaire reduces to one question: where does my data go. He also shares the one line from an early career review that reshaped how he communicates, why he thinks AI slop is the next propaganda problem, and what makes a real moat when a buyer can rebuild most of your tool in weeks. A wide-ranging conversation for anyone in or around cybersecurity, from practitioners and vendors to investors and regulators. Listen and follow so you don't miss what's next.

May 28, 202634 min

Line Cook to CISO: Eric Freeman on AI, Access Control, and Why Security Is Just Dinner Prep

Eric Freeman is the CISO at Writer, an AI-native company that has built its own large language model. Before that, he worked across blockchain and emerging technology. Before any of that, he was a line cook pulling 16-hour shifts in a restaurant kitchen six days a week. That background shows up in everything about how he leads. In this episode, Eric draws a direct line between prepping for dinner service and implementing security controls, between reading a plate and reading a log, between surviving a Friday night rush and surviving a major incident. We get into how AI is changing both offense and defense in cybersecurity right now, with specific examples of how his team is using LLMs to automate vulnerability validation end-to-end. He explains why context is the only thing that makes AI useful and shares a learning framework where team members use personal analogies to internalize unfamiliar concepts through LLMs. Eric also doesn't hold back on what's broken. He makes the case that cybersecurity stress is a structural problem, not a personal one, and proposes a mandatory security credit score for businesses. He breaks down prompt injection as social engineering for machines, agents as scripts with more dynamicness, and reduces all of cybersecurity to a single mental model: access control. We close with his framework for the three camps of cybersecurity buyers, why two of those camps are the reason the industry still sells on fear, and how to build a security culture with engineers by making the secure path the fastest path. For practitioners, vendors, investors, and anyone trying to understand how the cybersecurity industry actually works underneath the noise. Connect with Eric Freeman on LinkedIn: https://www.linkedin.com/in/eric-m-freeman/

May 14, 202628 min

Data Governance, Board Buy-In, and the Thing You Can't Shut Off: A CISO's Cross-Industry Playbook

Janet Heins has led cybersecurity programs in pharma, manufacturing, cruise lines, broadcast media, and healthcare. Every industry felt unique from the inside, and they are. But the patterns she's found underneath are what make this conversation worth listening to. Every industry has a system that can't be shut off, even when security demands it. Every organization has legacy infrastructure that's too embedded to replace and too old to protect with modern tools. And almost no company has a dedicated leader responsible for governing the data that everything else depends on. In this episode, Janet walks through what she's learned moving across industries by design. She shares the four-category framework she uses to get board buy-in for cybersecurity investments: operational, financial, reputational, and regulatory. She explains why aligning security to the company's mission is the difference between being seen as the department that says no and being treated as a strategic partner. And she gets into why data governance is the gap that's making every other cybersecurity and AI challenge harder than it needs to be. We also talk about AI and what it means for practitioners right now, why university cybersecurity curricula are struggling to keep pace, what major security incidents actually feel like from the inside, and what Janet learned writing her book Go Ahead, Ask For It about making your value visible and advancing your career. This one is for CISOs who want a framework they can use in any industry, practitioners thinking about career growth, vendors who want to understand how security leaders actually make decisions, and investors trying to evaluate security maturity from the outside. Connect with Janet Heins on LinkedIn: https://www.linkedin.com/in/janetheins/ Get Go Ahead, Ask For It on Amazon: https://www.amazon.com/Go-Ahead-Ask-Value-Undeniable-ebook/dp/B0GLR2W4D5

April 30, 202632 min

OEM Partnerships: What Every Practitioner, Vendor, and Investor Needs to Understand

The threat intel in your SIEM, the scanning engine in your endpoint tool, the analysis powering your detection platform. There's a good chance those capabilities come from a company you've never directly evaluated. That's OEM. And it touches every corner of cybersecurity. Chad Loeven has spent 20 years building OEM partnerships on both sides of the table, licensing technology inbound as a buyer and outbound as a seller. In this episode, he breaks open one of the most misunderstood parts of the cybersecurity market and explains how it actually works. We get into what qualifies as OEM versus resale or MSSP, why OEM can be the smartest go-to-market path for startups, and the real stories behind deals that worked and deals that didn't. Chad shares the seven-figure Yahoo contract that nearly drained his company, the DLP product that proved some solutions just don't OEM well, and the time he walked into a company where 25% of revenue disappeared overnight because of a single OEM dependency. But this isn't just a conversation for partnership teams. If you're a practitioner, this episode explains why some capabilities in your stack feel native and others feel bolted on. It's about your vendors' partner ecosystems and why they matter to your security posture. If you're an investor, Chad breaks down why OEM revenue gets discounted, when that discount is justified, and the concentration risk questions you should be asking during due diligence. If you're a vendor, you'll walk away with a framework for which products OEM well, how to structure deals that don't erode your margins, and why technology integrations are the front door to your best OEM relationships. OEM is the invisible infrastructure underneath most of the cybersecurity products the industry depends on. This conversation makes it visible.

Is this your show?

Claim this listing to keep it up to date, reach guests who want to pitch you, and manage bookings with Guestify.

Claim this listing

More Business podcasts

The Bottom Line

Alexander Spencer

BusinessInterviews guests