Cybersecurity Where You Are (audio)

Center for Internet Security

Welcome to audio version of “Cybersecurity Where You Are,” the podcast of the Center for Internet Security® (CIS®). Cybersecurity affects us all, so join us on Wednesdays as Sean Atkinson, CISO at CIS; Tony Sager, SVP & Chief Evangelist at CIS; and Ed Skoudis, President of the SANS Technology Institute discuss trends and threats, explore security best practices, and interview experts in the industry. Together, we’ll clarify these issues, Creating Confidence in the Connected World®. Subscribe to the video version of our podcast here: https://fast.wistia.net/embed/channel/0l9fss300m?wchannelid=0l9fss300m.

Play

Open in

26 episodes
weekly
Avg 37 min
English

Episodes 26

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#208
Wednesday · 34 min
Episode 208: Secure Harness Engineering for Agentic AI
In episode 208 of Cybersecurity Where You Are, Sean Atkinson breaks down secure harness engineering for agentic artificial intelligence (AI). Noting the risks posed by AI agents acting without oversight, he highlights "episodes" as auditable elements that help to provide feedback, and he walks through 15 controls spread across five stages as a way to engineer an AI harness with security in mind. He also differentiates secure harness engineering from prompt engineering, guardrails, frameworks, logs, and universal wrappers for AI agents. Here are some highlights from our episode: 01:23. The need for a control system in light of agent escape incidents 02:19. Analogy of a financial analyst to understand why separation of duties is important 02:57. Revolution and then evolution: How AI models have changed exponentially since 2022 04:54. Where secure harness engineering has a capability 05:42. Making decisions traceable: The need for an evidence chain to build controls effectively 07:15. Smartphones: A parallel for understanding the value of each new AI model 11:20. Engineering controls, not standard policies for all models 12:22. Secure harness engineering vs. prompt engineering 12:51. Models' evolving role: How it invites new security questions to be posed 15:16. AI agents without oversight: The insider persona with which defenders need to contend 16:02. The need for determinism and an effective diagram to build for it 18:22. Definition of secure harness engineering 19:36. Episodes and the importance of log assessment in mediating model capability 20:42. Reality verification: A feedback loop that gets into the concept of forensic assessment 21:27. Questions to ask as you get into an AI agent's evidence chain 22:56. Moving through intent, authority, reasoning, synthesis, decision, and enforcement 25:38. Side effects: What they are and how they actualize risk 27:16. Verification and audit: How they empower you to look at control opportunities 28:49. Five stages and 15 controls for secure harness engineering 29:47. What secure harness engineering is and is not 32:11. Three questions to help you get started 32:52. An important question for the future Resources Artificial Intelligence (AI) Agents Companion Guide The Secure Harness: A Governance Architecture for Agentic AI When Agent Capability Outruns Control: Lessons from the July 2026 OpenAI and Hugging Face Incident Episode 202: Delineating AI Security and Cybersecurity Harness Engineering & Agent Orchestration OWASP Top 10 for Large Language Model Applications If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#207
September 30 · 32 min
Episode 207: AI Risk Management — A Trust Relationship
In episode 207 of Cybersecurity Where You Are, Sean Atkinson makes the case for treating artificial intelligence (AI) not as software but as an ongoing trust relationship. He highlights the value of integrating best practices from regulations like the EU AI Act, walks through the three stages of an AI governance lifecycle, and explains how AI risk management fits into organizational governance, change management, and other business processes. Here are some highlights from our episode: 01:16. The trust component of AI governance 02:02. A need to align to regulatory best practices and bring them into AI risk management 03:47. Advice: Contextualize, don't generalize, your risks associated with AI use 04:40. Common questions that lead to AI governance as a requirement 06:59. Grounding an agile AI governance process on foundational principles 07:46. How the "fortress" approach overlooks the relationship element of AI security 09:51. A direct invitation: Listener feedback on AI governance thinking 11:44. Evaluating trust and relationship in machine learning and generative AI 14:04. The role of human oversight in realizing AI as a method that gets to a solution quicker 14:53. AI governance boards: A potential solution to elevating AI literacy internally 16:00. AI governance lifecycle: Three phases from current business processes to value generation 18:55. Overview of the future of AI security 23:16. The need for foundational security controls and AI-specific controls 25:00. AI governance assessment: Why it needs to happen across the organization 26:28. How AI governance ties into organizational governance 29:49. Ethics and responsible AI practice 29:57. Change management considerations with AI deployment 30:35. A concluding call to action to get stronger together Resources CIS Critical Security Controls® Episode 198: AI Privacy from a Risk-Based Perspective Episode 122: DeepSeek AI Security and Utility Considerations Episode 120: How Contextual Awareness Drives AI Governance AI Playbooks for SLTT Cybersecurity Leaders CIS Controls v8.1.2 AI Security Guidance Workbook Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1 Mapping and Compliance with the CIS Controls If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#206
September 23 · 40 min
Episode 206: Trust and Influence as CISO Survival Skills
In episode 206 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager speak with Julie Morris, Founder and Head of Thought Leadership at Persona Media, about why trust and influence have become survival skills for today's CISOs. Julie breaks down three types of organizational power, explains why the "good guys" resist the language of influence, and offers a practical starting point for anyone who's ever felt like PowerShell was the only power they understood. Here are some highlights from our episode: 02:13. From old to new: A shift in how trust and influence factor into organizational structures 04:24. The three kinds of power in an organization: hard, soft, and network 09:59. Wise advice: Build your personal and professional network first 11:07. How influence multiplies confidence with network power 12:03. Inertia, fear, and status quo: overcoming the emotional reactions that oppose change 18:12. How Sean uses the power of "slow down," not "no," to support AI transformation 20:49. Why good thought leadership starts with empathy and self awareness 24:32. Building organizational processes that "trigger" a change in CISOs' trust and influence 26:30. Hugging Face as an example of how triggering moments become lessons 27:42. What Tony Soprano has to do with measuring trust and influence 30:47. Reality check: Every information gap gets filled one way or another 32:15. The power of community and shared ideas in figuring out thought leadership together 36:09: Advice: Be in the "river" of your network to go where you want to go 37:34. How understanding of shared values helps to overcome imposter's syndrome Resources CIS Critical Security Controls® Episode 183: The Role of CISO in Supporting Risk Translation Episode 187: The Role of a CISO as a Strategic Storyteller Episode 192: How Leaders Balance Expertise and Communication Episode 199: Translating Cyber Risk into Business Decisions The Myth of Mythos: What It Means For Information Security Episode 202: Delineating AI Security and Cybersecurity If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#205
September 16 · 36 min
Episode 205: Secure by Design — Now Updated for AI
In episode 205 of Cybersecurity Where You Are, Tony Sager speaks with Phyllis Lee, VP of SBP Content Development at the Center for Internet Security®(CIS®), and Steve Lipner, Executive Director of SAFECode. Together, they discuss how an updated document from CIS and SAFECode gives concrete guidance on what artificial intelligence (AI) means for your Secure by Design process. Here are some highlights from our episode: 02:17. A refresher on making Secure by Design digestible for end organizations 02:57. Distillation and prescriptive guidance: The value provided by CIS 06:53. An overview of Butler Lampson's "Gold Standard of Security" 07:03. How a shift in approach to Secure by Design led to the founding of SAFECode 09:42. The importance of verification requirements for what developers have done 12:54. A product of CIS pragmatism: Prioritization relative to the development environment 20:06. Artifacts as evidence of secure software development at work 30:15. How the updated document provides guidance around AI 30:45. What AI creates instead of new classes of vulnerabilities Resources CIS Critical Security Controls® (CIS Controls®) Secure by Design Secure by Design v1.1 A Guide to Assessing Software Security Practices Turning Secure Software Development into a Measurable Practice CIS and SAFECode Release Secure by Design v1.1: A Guide to Assessing Software Security Practices Episode 164: Secure by Design in Software Development CIS Critical Security Control 16: Application Software Security Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1 Episode 200: Alan Paller's Vision and Our Next Chapter From Prompts to Protocols: The Security Blueprint for Enterprise AI Mythos AI: What Actually Matters for Cybersecurity Leaders If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#204
September 9 · 33 min
Episode 204: FWC26 and the New Bar for Event Security
In episode 204 of Cybersecurity Where You Are, Sean Atkinson speaks with Ryan Winmill, Chief Security Officer and Vice President of FIFA World Cup Boston, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how FIFA World Cup 2026 (FWC26) — secured through an unprecedented tripartite governance framework, $625 million in U.S. Congressional funding, and real-time intelligence that stopped a swatting attempt at the finals — set a new standard for proactive event security worldwide. Here are some highlights from our episode: 01:18. The "unprecedented" governance framework created for FWC26 03:53. The role of CIS as a force multiplier for FIFA, host regions, and other partners 11:00. Why you can't trust the person with an ego in large-scale event security planning 13:23. How the threat environment evolved over the previous three World Cup tournaments 17:23. A new bar for proactive event security going forward 18:43. How CIS provided quality control that helped to mitigate swatting calls during FWC26 21:55. Unique approaches used by host regions to better understand the World Cup fanbase 23:15. How counterfeit FIFA volunteer uniforms triggered a cross-city credentialing response 26:46. Recommendations for future large-scale event host cities 30:19. Ryan's recommendation to future host cities: "Call CIS before you get started" Resources Special Event Risk Analysis & Advisory Services Episode 196: Securing FIFA World Cup 2026 Collaboratively Inside the Security Operation Behind the 2026 FIFA World Cup 3 Lessons for Securing Large-Scale Events: Inside FIFA World Cup 2026 Securing FIFA World Cup 2026 With a Collective Defense Approach If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#203
September 2 · 33 min
Episode 203: Cyber Attacks' Human Impact — Beyond the Data
In episode 203 of Cybersecurity Where You Are, Sean Atkinson speaks with Pavlina Pavlova, Founder of Critical Cyber. Together, they discuss how Pavlina started Critical Cyber to go beyond the data and give voice to the human impact of cyber attacks, from ransomware hitting hospitals to cyber tactics targeting civilians in active conflict zones. Here are some highlights from our episode: 00:44. How Pavlina's work covering the impact of cyber attacks on Ukrainian critical infrastructure led to Critical Cyber 03:13. How Critical Cyber works with cyber attack victims, responders, and other audiences 04:08. Countering the tendency, even among cybersecurity experts, to sanitize cyber attacks' human impact 08:57. The use of storytelling with those impacted by cyber attacks to drive policy changes 15:02. Why cyber attacks in some sectors are underreported 19:01. Critical Cyber's mission of combining testimony, research, and expert collaboration 24:51. Where Critical Cyber is and where it's looking to go Resources Critical Cyber Cybersecurity for Critical Infrastructure Episode 202: Delineating AI Security and Cybersecurity Recent Water Utility Attacks Offer a Blueprint for Resilience If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#202
August 26 · 38 min
Episode 202: Delineating AI Security and Cybersecurity
In episode 202 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute. Together, they explore how the implications of multiple 2026 sandbox escapes of artificial intelligence (AI) models are starting to delineate AI security and cybersecurity. Here are some highlights from our episode: 02:00. The historical context of one AI model's 2026 sandbox escape 03:26. The impact of ethics, guardrails, and misconfigurations in an AI containment breach 06:08. Why context matters when talk of AI models "going rogue" surfaces 11:49. How history helps us to delineate AI security and cybersecurity 13:47. A new skill and mindset to match our refined AI risk understanding 15:43. Rules and cybersecurity implementation as a possible way forward 19:04. The double-edged sword of restricting access to open-weight models 23:25. Recommendations for keeping up with what's changing in the AI security space 25:51. Rob's advice: To learn how to defend a thing, try learning how to build it first 28:23. AI governance and seeing through the "slop" to informed conversation 29:54. The use of AI to learn more about and discuss AI security for years to come Resources OpenAI says its AI technology acted on its own in an ‘unprecedented’ hack of another company Pacing model development in an era of cyber-critical capabilities Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident Episode 193: AI Security and Responsibility in EO 14409 The AI Daily Brief — Daily AI News & Analysis AI Playbooks for SLTT Cybersecurity Leaders SANS Cybersecurity Summits SANS NewsBites If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#201
August 19 · 33 min
Episode 201: The Evolution and AI Enablement of Pentesting
In episode 201 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. Together, they reflect on the evolution of penetration testing, including the impact on pentesting from artificial intelligence (AI). Here are some highlights from our episode: 01:03. How things have changed since William's and Ed's first pentests 09:02. Community: A defining element of Capture The Flag (CTF) events 14:47. Industry concerns over the "death" of CTFs and "cheating" by artificial intelligence (AI) 17:00. Opportunities to take CTFs to the next level in the age of AI 20:18. Pentesting vs. vulnerability scanning: Why terminology matters 25:43. The advent of autonomous AI tools and what they could mean for vulnerability scanning 29:07. Why continuous improvement in cybersecurity doesn't always require AI Resources Closed Door Security Episode 189: The Present and Future of AI-enabled Pentesting SANS Cyber Ranges Top External Network Risks And How to Fix Them Penetration Testing Vulnerability Assessments If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#200
August 12 · 40 min
Episode 200: Alan Paller's Vision and Our Next Chapter
In episode 200 of Cybersecurity Where You Are, Sean Atkinson, Tony Sager, and Ed Skoudis sit down with Frank Reeder, Co-Founder and Founding Chair of the Center for Internet Security® (CIS®). Together, they reflect on how Alan Paller's vision continues to drive CIS forward. In the spirit of that vision, this milestone episode also marks a new chapter for the podcast: Ed Skoudis joins as co-host of Cybersecurity Where You Are. Here are some highlights from our episode: 01:09. The two complementary missions of CIS 02:55. Three defining moments that have shaped CIS into the organization it is today 08:10. The story of naming CIS 10:31. How CIS and SANS advance Alan Paller's vision of bringing people together 13:50. Personal anecdotes of Alan Paller as a connector of people 15:45. "What would Alan do?" A question that continues to guide CIS and SANS 22:00. How CIS security best practices are emblematic of helping others 27:12. CIS's "secret sauce" as a trusted, neutral platform for cybersecurity collaboration 29:53. How CIS can continue to embody Alan Paller's philosophy into the future 37:47. A special announcement: Ed Skoudis as a new co-host on the podcast Resources CIS Benchmarks® List CIS Critical Security Controls® Multi-State Information Sharing and Analysis Center® Episode 114: 3 Board Chairs Reflect on 25 Years of Community Alan Paller Laureate Program SANS Difference Makers Awards If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#199
August 5 · 40 min
Episode 199: Translating Cyber Risk into Business Decisions
In episode 199 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chris Painter, Chair of the Risk Committee and Board Member at the Center for Internet Security® (CIS®). Together, they discuss how chief information security officers (CISOs) can support the work of translating cyber risk into business decisions by Boards. Here are some highlights from our episode: 00:50. Introductions to Chris 01:36. The single biggest translation error Chris has seen CISOs make 07:38. Cyber risk quantification: An opportunity to go beyond translation for Boards 09:25. How ransomware changed Boards' understanding of cyber risks' business impact 10:45. The value of tabletop exercises (TTX) and other simulations in creating shared language 13:26. Recommendations on how to make the most of a TTX 18:37. Risk modeling and how artificial intelligence (AI) complicates probability estimations 21:51. "Pressure" (2026) as an illustration of making good, not 100% accurate, estimations 22:58. How growing public awareness of cyber is reshaping CISOs' conversations with Boards 25:55. The importance of walking Boards through risk mitigation steps with AI as an example 29:31. A recommendation for how CISOs can learn what directors care about 30:15. From "wizardry" to familiarity: An ongoing generational shift around cyber Resources Episode 183: The Role of CISO in Supporting Risk Translation Episode 187: The Role of a CISO as a Strategic Storyteller Episode 192: How Leaders Balance Expertise and Communication How Risk Quantification Tests Your Reasonable Cyber Defense CIS RAM (Risk Assessment Method) Leveraging Generative Artificial Intelligence for Tabletop Exercise Development CIS Controls v8.1 Incident Response Policy Template You Have a Cybersecurity Incident. Now What? Prompt Injections: The Inherent Threat to Generative AI "Pressure" | Official Website | 29 May 2026 If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#198
July 29 · 30 min
Episode 198: AI Privacy from a Risk-Based Perspective
In episode 198 of Cybersecurity Where You Are, Sean Atkinson discusses artificial intelligence (AI) and privacy from a risk-based cybersecurity perspective. Together, he explores how organizations and individuals can assess AI risk, apply governance frameworks, evaluate third-party AI services, and balance innovation with due diligence. Here are some highlights from our episode: 00:41. Framing the conversation around AI, privacy, and risk-based controls 02:22. Due diligence and ethical considerations around AI products and services 03:14. Data minimization and transparency as foundations for AI privacy 04:46. Privacy impact assessments as a way to understand AI data collection and use 05:42. AI governance and the tension between implementation velocity and risk management 10:08. The use of existing data flows and controls in AI assessments 11:57. Algorithmic transparency and the challenge of understanding AI decision making 13:47. Standards, frameworks, and data sovereignty in AI privacy governance 15:12. Encryption, anonymization, tokenization, and federated learning as privacy safeguards 16:40. The need to shift stakeholder input left in AI development and deployment lifecycles 19:13. Building literacy around security, data management, privacy, and AI risk 23:40. The value of cross-functional and written assessment criteria for AI risk 26:21. A call to action for keeping pace with AI privacy and and innovation risk Resources CIS Controls v8.1.2 AI Security Guidance Workbook Episode 105: Context in Cyber Risk Quantification Service Provider Management Policy Template for CIS Control 15 EU AI Act: first regulation on artificial intelligence AI Risk Management Framework IAPP AI Governance Center Episode 120: How Contextual Awareness Drives AI Governance Secure by Design v1.1 A Guide to Assessing Software Security Practices Reasonable Cybersecurity If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#197
July 22 · 33 min
Episode 197: AI-ready OT Data Begins with Understanding
In episode 197 of Cybersecurity Where You Are, Sean Atkinson sits down with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch; and Ed Skoudis, President of SANS Technology Institute. Together, they discuss artificial intelligence (AI), operational technology (OT) data, and how understanding creates the foundation for AI-ready OT data. Here are some highlights from our episode: 00:54. Introductions to Ben and Ed 02:16. How we understand and integrate AI into OT environments 04:30. How OT diverges from information technology (IT) in data responsibilities 05:23. Opportunities for AI to assist OT 06:33. The importance of meeting OT systems where they are 08:10. A passive and incremental approach that respects the operations machines are doing 12:29. Efficiency gains, public safety improvements, and other benefits of AI-ready OT data 17:47. What lifecycle management, asset hierarchies, and governance look like for OT data 22:14. The promise of AI to help to make OT environments understandable 23:19. A team sport: How IT and OT can work together to understand assets and data 28:38. The need for translation in IT-OT communication 29:01. Recommendations for how to make OT data AI ready Resources CIS Critical Security Controls® CIS Controls version 8.1 ICS Workbook Artificial Intelligence and Large Language Models Companion Guide CIS Controls v8.1 Enterprise Asset Management Policy Template CIS Controls v8.1 Software Asset Management Policy Template CIS Controls v8.1 Data Management Policy Template CIS Controls v8.1 Account & Credential Management Policy Template Establishing Essential Cyber Hygiene ProArch Cybersecurity for Critical Infrastructure Episode 77: Data's Value to Decision-Making in Cybersecurity Episode 183: The Role of CISO in Supporting Risk Translation If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#196
July 15 · 37 min
Episode 196: Securing FIFA World Cup 2026 Collaboratively
In episode 196 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how CIS, FIFA, and FIFA World Cup 2026 host cities started collaborating in 2025 on cybersecurity, public safety, intelligence, and information-sharing efforts supporting the largest sporting event in the world. Here are some highlights from our episode: 00:40. Introductions to Sasha and John 02:07. Overview of one of the most complex public safety efforts assembled for a sporting event 05:52. Consistency: A standard for preventing and deterring threats at FIFA World Cup 2026 10:30. The impact of relationships in shaping FIFA's security ops and information sharing 11:53. Effective communication: The key to cross-functional collaboration in support of the tournament 18:07. The importance of information that guides operations 20:35. Education as a way to inform stakeholders and deploy resources 26:19. A deliberate effort to look at unanticipated threats and plan for them 29:14. Examples of messaging synchronization in support of FIFA World Cup 2026 32:37. An all-hands-on-deck support campaign from CIS 33:29. Parting thoughts around large-scale event support in the future Resources An Examination of Generative AI and Physical Threat Planning An Examination of AI-Enabled Threats to Event and Stadium Security Multidimensional Threats 5 Major Emerging Risks to Large-Scale Events Illicit Sports Betting and Match Integrity Risks to Large-Scale Events Deepfakes and Synthetic Media: The Emerging Threat to Large-Scale Public Gatherings Growing Risks to Digital Ticketing Platforms for Large-Scale Events Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings Cyber Risks Companion Guide 5 Steps to Help Secure Your City before a Large-Scale Event If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#195
July 8 · 41 min
Episode 195: Enigma Machines’ Security Lessons for Today
In episode 195 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute, and Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss Enigma machines, their history, and their security lessons for today. Here are some highlights from our episode: 00:56. Introductions to Ed and Marc 01:32. What Enigma machines are and why cybersecurity folks still care about them today 06:10. Enigma machines as a symbol for how we can use hacking for noble purposes 07:18. How the human mind and the need for ease of use can undermine security 15:59. The importance of testing when designing and maintaining a security system 20:45. Why "security through obscurity" isn't actually true 22:58. Curiosity, logic, and a wide range of knowledge: Essential traits for getting hired in cybersecurity today 30:57. The impact of culture in shaping security policy and priorities 35:09. Why artificial intelligence (AI) is the Enigma machine of 2026 36:11. How to learn more about Enigma machines Resources Episode 189: The Present and Future of AI-enabled Pentesting A Short Guide for Spotting Phishing Attempts Penetration Testing Vulnerability Assessments Episode 192: How Leaders Balance Expertise and Communication Episode 193: AI Security and Responsibility in EO 14409 The Myth of Mythos: What It Means For Information Security National Cryptologic Museum Enigma Replica: The Enigma touch If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#194
July 1 · 51 min
Episode 194: 2026 Cybersecurity Predictions Mid-Year Review
In episode 194 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute. Together, they conduct a mid-year review of 2026 cybersecurity predictions from seven Center for Internet Security® (CIS®) experts, as shared on the CIS website. Here are some highlights from our episode: 01:50. Ongoing conversations about improving defense with artificial intelligence (AI) 05:19. A trap to avoid: Automating things with AI because we can regardless of utility 06:54. Ed's prediction about a near-term transition for AI-enabled vulnerability discovery 09:27. How AI agents change the economics around conducting a penetration test 11:26. Adversary emulation: A blurry proposition when threat actors use AI to look like anybody 14:02. Ed's prediction about threat actors shifting APT profiles within a single attack campaign 17:00. The need to systematically rethink cyber defense to support state and local cybersecurity 23:34. How adversaries are pivoting to the "authorization sprawl" in light of zero trust efforts 29:20. Industry-specific threat intelligence as a way to keep organizations informed 32:10. Why a policy isn't the same as security control for operational technology (OT) 33:55. Social expectations and public policy objectives around holistic OT security 39:52. Compliance as a floor, not a ceiling, that results as a byproduct of continuous security 43:43. The need for oversight and confidence in technology as distinct from the "Fog of More" Resources Episode 169: 2026 Cybersecurity Predictions from CIS — Pt 1 Episode 174: 2026 Cybersecurity Predictions from CIS — Pt 2 Episode 179: 2026 Cybersecurity Predictions from CIS — Pt 3 The Myth of Mythos: What It Means For Information Security Episode 189: The Present and Future of AI-enabled Pentesting Authorization Sprawl: The Vulnerability Reshaping Modern Attacks Episode 188: DBIR 2026 Insights and Collaboration with CIS Mapping and Compliance with the CIS Controls Mapping and Compliance with the CIS Benchmarks If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#193
June 24 · 39 min
Episode 193: AI Security and Responsibility in EO 14409
In episode 193 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute, and Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they discuss AI security and the responsibility of the U.S. government in creating confidence around it, as represented in Executive Order (EO) 14409, "Promoting Advanced Artificial Intelligence Innovation and Security." Here are some highlights from our episode: 00:50. Introductions to Rob and Brian 02:32. How to conceptualize confidence around something as complex as AI security 04:32. The U.S. government's responsibility to set AI security guardrails as clear expectations 08:12. The use of "voluntary" participation to create confidence in the context of EO 14409 14:38. How Mythos AI and similar developments affect assessment of frontier AI models 17:11. Airport security as an analogy for understanding AI security and privacy concerns 18:41. Why cybersecurity is a hard sell until an incident occurs 20:50. How AI is quickly becoming critical infrastructure 22:53. Furbies as reference for a flexible, iterative benchmarking process for AI security 25:50. The need for technical folks to translate AI risks into something understandable 28:21. Balancing encouragement of AI innovation with mindfulness of risk 31:24. The basics as a foundation for building shared responsibility around AI security Resources Promoting Advanced Artificial Intelligence Innovation and Security The Myth of Mythos: What It Means For Information Security Episode 190: Separating Mythos AI Fact from Fiction The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program Anthropic says it has taken its latest AI models offline to comply with new export controls Establishing Essential Cyber Hygiene Episode 187: The Role of a CISO as a Strategic Storyteller If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#192
June 17 · 31 min
Episode 192: How Leaders Balance Expertise and Communication
In episode 192 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss how leaders, including those in cybersecurity, balance their technical expertise with mastery of communication strategies. Here are some highlights from our episode: 00:51. Introductions to Marcus 02:04. How Marcus found value in using analogies to communicate complex topics 08:40. Coordination with non-technical folks as a sign of leadership maturity 14:03. The wisdom in knowing what to say and what not to say when managing up 17:31. The need to balance technical skills with team resourcing in a way that's imitable 21:07. The challenge of leaders learning by proximity in hybrid and remote environments 24:16. "Classic" engineering vs. "new" engineering 25:13. Lessons from Boards in applying discipline, rigor, and order to software engineering 28:23. The value in leaders continuously learning how businesses work Resources Episode 183: The Role of CISO in Supporting Risk Translation Episode 187: The Role of a CISO as a Strategic Storyteller Episode 99: How Cyber-Informed Engineering Builds Resilience 7 CIS Experts' 2026 Cybersecurity Predictions If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#191
June 10 · 31 min
Episode 191: GenAI Misuse for Physical Threat Planning
In episode 191 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Elvenaes, Sr. Multidimensional Threat Analyst at the Center for Internet Security® (CIS®), and Rian Davis, Multidimensional Threat Analyst at CIS. Together, they discuss how threat actors are misusing generative artificial intelligence (GenAI) to plan physical threats. Here are some highlights from our episode: 00:40. Introductions to Sasha, Rian, and their research on GenAI misuse 01:56. The impact of GenAI on lowering the barrier for operationalizing physical threat activity 03:37. Exploitation of GenAI model design to circumvent models' guardrails 05:58. The misuse of session persistence to streamline physical threat research 07:57. GenAI misuse: A call for critical infrastructure operators to think about security differently 11:52. Factors that make large-scale events a target of physical threat activity 14:33. The use of GenAI as a strategy for organizations to see what threat actors could see 15:37. Ongoing question: How can drones help mitigate risks while protecting public safety? 17:13. Extrapolation as a reinforcement of GenAI session persistence 20:15. The new reality: Look at what information AI can provide to threat actors 25:01. Traditional methods vs. GenAI conversations for threat planning 27:58. Continuous vulnerability assessments, communication, and other recommendations Resources An Examination of Generative AI and Physical Threat Planning An Examination of AI-Enabled Threats to Event and Stadium Security Multidimensional Threats Man who exploded Cybertruck in Las Vegas used ChatGPT in planning, police say Episode 190: Separating Mythos AI Fact from Fiction Episode 185: AI Prompt Injection from a Risk Perspective 5 Steps to Help Secure Your City before a Large-Scale Event Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings 8 Security Essentials for Managing Your Online Presence Vulnerability Assessments If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#190
June 3 · 38 min
Episode 190: Separating Mythos AI Fact from Fiction
In episode 190 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they separate fact from fiction around artificial intelligence (AI) capabilities like Mythos AI and other AI-driven vulnerability discovery tools. Here are some highlights from our episode: 00:50. Greetings to Brian and setting the stage for questions from a CIS webinar 03:05. The lack of a unified formula or standard for vulnerability prioritization 03:55. The opportunity for defenders to interrupt vulnerabilities chained together 05:47. An invitation to better understand your enterprise amid the "slopdemic" 06:33. How AI guardrails tie back into security best practices 10:15. How a fundamental practice we can refine is the best counter to chained attacks 12:25. The value of the CIS Community Defense Model and a teaser for Version 3 14:50. Mythos AI vs. Static Application Security Testing (SAST) in terms of practice and time 19:08. Visibility, governance, and prioritization: Three elements of a "prepared" environment 24:32. "One to one" cyber defense as a losing battle 27:25. The importance of knowing your dependencies with open-source software 33:15. Threat actor economics and the ongoing debate around responsibility in cybersecurity Resources Mythos AI: What Actually Matters for Cybersecurity Leaders Secure by Design CIS Critical Security Controls® CIS Community Defense Model 2.0 Episode 185: AI Prompt Injection from a Risk Perspective Living off the Land: Threats Looming From Within Turn Intel Into Action: CIS Controls and the 2026 Verizon DBIR Implementation Guide for Small- and Medium-Sized Enterprises CIS Controls IG1 Information Technology and Information Security Governance If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.
#189
May 27 · 33 min
Episode 189: The Present and Future of AI-enabled Pentesting
In episode 189 of Cybersecurity Where You Are, Sean Atkinson sits down with Ed Skoudis, President of SANS Technology Institute. Together, they discuss the present and future of pentesting enabled by artificial intelligence (AI). Here are some highlights from our episode: 00:39. Introductions to Ed 01:49. The promise of AI-enabled pentesting in creating more secure infrastructure 04:52. AI-enabled and AI-centric workflows in the realm of penetration testing 08:03. Wranglers, matadors, and centaurs, oh my! Metaphors for AI-enabled pentesters 13:00. How AI can assist with reporting, enumeration, and scanning as part of a pentest 14:57. AI-enabled source-assisted pentesting and the types of vulnerabilities it finds 19:50. A learning opportunity for the broader cybersecurity community 23:44. How AI and human analysts could split the workload in a future penetration test 25:54. AI-enabled pentesting vs. AI pentester in a box 29:51. Why "human in the loop" might be too passive a phrase 30:37. The use of AI for source code development Resources Mythos AI: What Actually Matters for Cybersecurity Leaders Secure by Design SEC543: AI-Assisted Source Code Analysis and Exploitation for Penetration Testers Episode 108: Gaming and Competition in Cybersecurity Episode 59: Probing the Modern Role of the Pentest If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Showing 1–20 of 26 episodes