Adopting Zero Trust

As organizations push return-to-office (RTO) mandates and chase efficiency, many security teams are quietly accumulating debt they don’t know how to unwind.

In this episode, we are joined by Lea Cure Thorpe and Kayne McGladrey to unpack the less-discussed consequences of recent security decisions: RTO exposure, endpoint blind spots, tooling overload, analyst burnout, and the slow erosion of junior talent (thanks AI).

Rather than going too crazy on hot takes and obvious trends, we focus in on operational reality, business risk, and what security leaders need to confront before these issues compound further.

02:00 | Is the perimeter really dead?

06:30 | RTO fallout and the return of local network risk

12:30 | Endpoint sprawl, dirty devices, and SOC fatigue

18:30 | Cloud tooling, visibility gaps, and false assurances

26:00 | AI adoption: risk appetite vs. reality

33:30 | Identity, agentic AI, and trust amplification risk

41:00 | Workforce erosion and the efficiency trap

50:30 | The business math CISOs can’t avoid

58:30 | Career development, communication, and relevance

Hosted on Acast. See acast.com/privacy for more information.

In this episode, we break down Whisper Leak, a newly disclosed side-channel issue affecting encrypted LLM communications. JBO explains how attackers can infer conversation topics using packet size and timing metadata without breaking encryption. The discussion covers how the research team discovered the issue, how vendors (including Microsoft and OpenAI) mitigated it, and what it means for the future of secure AI systems.

01:30 – What Whisper Leak Actually Is
02:30 – Understanding Side-Channel Attacks
04:00 – Why LLMs Are Uniquely Vulnerable
08:00 – Stream Ciphers vs Block Ciphers
13:30 – “Did You Break Encryption?” Clearing Up Misconceptions
16:00 – Fixes & Mitigations Across LLM Vendors
18:30 – Why Some Vendors Were More Vulnerable Than Others
20:00 – Could High-End Adversaries Still Pull This Off?
24:00 – How API Users Can Protect Themselves
25:00 – Designing LLM Systems with Side Channels in Mind

Guests: Jonathan (JBO) Bar Or, Principal Security Researcher, Microsoft Threat Intelligence, who just joined CrowdStrike

Hosts: Elliot Volkman & Neal Dennis

Hosted on Acast. See acast.com/privacy for more information.

In this episode of Adopting Zero Trust, hosts Elliot Volkman and Neal Dennis discuss critical infrastructure security with expert guest Ian Branson, Vice President of Global Industrial Cybersecurity at Black and Veatch.

The discussion centers around the philosophical and strategic approaches to handling incidents and breaches, especially in the operational technology (OT) realm. Branson highlights the importance of understanding what needs protection, the integration of IT and OT security, and the crucial role of threat intelligence. They also explore the evolving need for converging physical and digital security data to manage risks effectively.

01:37 Starting Point for Protecting Critical Infrastructure

04:52 Funding and Resource Allocation for Cybersecurity

10:57 Threat Intelligence and Incident Response

16:25 IT and OT Convergence

23:47 Discussing Employee and Equipment Management

26:19 Integrating Physical and Cyber Security

34:39 Proactive Security Measures in New Constructions

40:46 Balancing Rapid Response and Availability

Hosted on Acast. See acast.com/privacy for more information.

In this episode of Adoption Zero Trust (AZT), host Neal Dennis and producer Elliot Volkman sit down with Bradon Rogers, Chief Customer Officer at Island, to discuss how AI is compounding the already existing problems tied to shadow IT. The conversation explores how modern enterprises handle the growing complexities of unregulated software use, the role of enterprise browsers in mitigating risks, and the dynamic between user experience and cybersecurity.

01:16 Shadows within shadows

04:15 AI in Approved Solutions

09:14 Enterprise Browser and Security

14:25 Transition to Browser-Based Applications

16:23 Enterprise Browser Capabilities

18:45 Data Protection and Shadow IT

24:39 Shepherding Data in the Enterprise Browser

25:17 Policy Perspectives on AI and Data Flow

28:16 Exploring SBOM and AI Integration

35:39 Browser Security and Application Boundaries

41:40 BYOD and Privacy Concerns

44:48 Third-Party Scenarios and Onboarding

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.

Live from ThreatLocker’s Zero Trust World (ZTW), cybersecurity heavyweights Dave Bittner, host of CyberWire Daily and Dr. Chase Cunningham AKA Dr. Zero Trust shared their unfiltered thoughts on the state of cybersecurity, AI, and government regulations. From the shifting landscape of compliance enforcement to the role of hitting critical mass of AI in both defense and cybercrime, we can expect an extraordinary level of change in the years ahead.

01:37 Cybersecurity Landscape Overview

01:58 Government and Cybersecurity

02:39 Leadership and Appointments in Cybersecurity

03:47 Future of CISA and Compliance

06:41 Managing Cybersecurity News

14:54 The Role of LLMs in Cybersecurity

16:22 Global Perspective on AI and LLMs

18:47 Reflecting on Past Technological Predictions

20:18 The Double-Edged Sword of AI and Surveillance

24:21 The Dark Side of Technological Advancements

26:17 Debating the Term 'AI' and Its Implications

28:43 Historical Anecdotes and Unanswered Questions

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

It’s mid-February, but somehow, we’ve already been through what feels like a year's worth of change in the cybersecurity and regulation world. Beyond the standard incidents, outages, and attacks… there have been obvious impacts that have downstream effects. Regardless of regulatory changes, which we’ll cover as those impact our space, AZT brought together a few minds who have thoughts on the year ahead.

To properly kick off season four, we have the privilege of chatting with two wonderful guests:

Lawrence Pingree, VP of Technical Marketing at Dispersive, but you are more likely to know his name from his time at Gartner. However, he has a varied background ranging from CTO to security engineer, so don’t let that marketing line in his title fool you.

Oliver Plante, VP of Support at ThreatLocker, has around 15-20 years of IT under his belt. He also has seen a thing or two when it comes to implementing new cybersecurity strategies

03:21 Predictions for the Year Ahead

04:06 Zero Trust and Least Privilege

05:40 The Future of Cyber Defense

07:21 AI and Cybersecurity

08:41 Threat Intelligence and Preemptive Defense

09:50 Challenges and Innovations in Cybersecurity

14:23 The Role of AI in Cyber Attacks

26:18 Quantum Computing: Threat or Savior?

29:31 Passwordless Security: The Future

30:57 Challenges of Deepfake Technology and Passwordless Security

33:03 Blockchain and Its Applications in Security

35:33 Debate on Password Management Practices

38:03 User Responsibility and Security Automation

47:50 Government's Role in Cybersecurity

57:14 Future of Cybersecurity and Zero Trust

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.

Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow our focus a bit.

Hosted on Acast. See acast.com/privacy for more information.

In this episode of 'Adopting Zero Trust (AZT)', host Neal Dennis and producer Elliot Volkman delve into the often-overlooked realm of soft or 'non-tech' skills in cybersecurity.

This week, we chat with Courtney Hans, VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam, author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vital in shaping the careers of cybersecurity professionals.

Our guests share the importance of effective communication, emotional intelligence, and adaptability. The hosts and guests share personal anecdotes, training tips, and the necessity of bridging technical prowess with essential soft skills to improve stakeholder engagement and career advancement. The episode emphasizes the value of being comfortable with discomfort and soliciting feedback to enhance one’s professional journey in cybersecurity.

Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 15: We gather a panel of journalists, communications, and a researcher to discuss how cybersecurity news and incidents are reported.

You can read the show notes here.

In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they all have very different priorities and goals.

• Journalists have a duty to inform the public about security-related events.
• Communication teams have a duty to inform the public about related incidents and research, but in a controlled setting.
• Researchers help provide answers to communication teams and journalists.
• Readers want to be informed of information that impact them, and their habits shape what kind of reporting is invested in the most.

This week we explore some of these dynamics by bringing together a panel representing comms, journalism, and research to discuss the game of tug-of-war during incident response and incident reporting.

Danny Palmer was a long-standing cybersecurity reporter at ZDNet prior to recently joining DarkTrace, Josh Swarz is the Senior Communications Manager at Microsoft focusing on threat intelligence, our host Neal Dennis is former NSA and has lived many lives around either keeping secrets or uncovering them, and producer Elliot Volkman has been a reporter for two decades and works with Josh on elevating research at Microsoft Threat Intelligence.

Hosted on Acast. See acast.com/privacy for more information.