And Security For All

If you think cybersecurity is just about tools and technology, think again.

In this episode of And Security For All, host Kim Hakim sits down with Keith McMenamin, VP of IT at Visit Philadelphia, to break down why user awareness is still one of the most critical—and overlooked—components of cybersecurity today.

As cyber threats evolve and AI-driven attacks become more sophisticated, even the most experienced users can be fooled. Keith shares real-world examples of modern phishing scams, explains how attackers exploit human behavior, and discusses why employees are both the biggest target and the greatest opportunity for defense.

You’ll learn:

• Why phishing and social engineering are more convincing than ever
• How to move from security training to building a true security culture
• The importance of creating a no-blame environment where employees feel safe reporting mistakes
• Why multi-factor authentication and awareness together stop most attacks
• How organizations can turn users into a “human firewall”
• The growing risks of AI, deepfakes, and evolving cyber threats

This conversation also explores how security leaders balance protection with productivity, why executive buy-in is critical, and how collaboration across the cybersecurity community is shaping the future of defense.

Whether you’re a security leader, IT professional, or everyday user, this episode will change how you think about the human role in cybersecurity.

🔐 Because in today’s threat landscape, hackers don’t just break in… they log in.

Artificial Intelligence is rapidly transforming the cybersecurity landscape — but is it something security leaders should fear, or a powerful tool they must learn to master?

In this episode of And Security For All, host Kim Hakim sits down with Ron Bevans, CISO at BenefitHub, to explore how AI is reshaping both cyber threats and cyber defense. As attackers increasingly leverage automation and AI-driven tactics, security teams must evolve just as quickly to stay ahead.

Ron shares practical insights on how organizations can embrace AI responsibly, empower employees to use it effectively, and build governance strategies that balance innovation with security. Rather than replacing cybersecurity professionals, AI has the potential to amplify human expertise, accelerate detection, and help teams focus on what matters most.

🎙️ In this episode we discuss:

• How AI is changing the cyber threat landscape

• Why organizations shouldn’t fear AI — but learn to leverage it

• The importance of governance and responsible AI adoption

• How CISOs can empower teams to safely use AI tools • Why human expertise is still essential in the age of AI

This conversation offers valuable perspectives for CISOs, security leaders, IT professionals, and anyone navigating the intersection of AI and cybersecurity.

Listen now to learn how security leaders can stay ahead of emerging threats while using AI as a strategic advantage.

In this episode of And Security For All, host Kim Hakim sits down with Jonathan Kimmitt, CISO at Alias Cybersecurity, to discuss one of the most important shifts happening in cybersecurity today: the move from cyber protection to cyber resilience.

While many organizations focus on deploying security tools and controls, Jonathan explains why perfect security is unrealistic and why modern organizations must instead focus on resilience — the ability to detect, respond to, and recover from cyber incidents quickly.

Drawing on real-world incident response experiences, Jonathan shares practical insights into why many organizations still struggle with security despite major investments in tools. From overlooked vulnerabilities to unused monitoring systems, the conversation highlights how visibility, preparedness, and continuous testing are critical to defending against today’s evolving cyber threats.

The discussion also explores:

• Why cybersecurity perfection is impossible • The difference between cyber protection and cyber resilience • Why many companies have security tools but don’t use them effectively • The importance of visibility, logging, and monitoring in modern security programs • How penetration testing reveals real attack surfaces • Why organizations must practice incident response and tabletop exercises • The role of business continuity and disaster recovery planning • Real-world stories of how attackers exploit small overlooked vulnerabilities

Jonathan also shares actionable advice for security leaders, including how organizations can begin building resilience today by testing assumptions, practicing response scenarios, and strengthening communication during incidents.

In an era where cyber incidents are no longer a matter of if but when, this conversation offers valuable guidance for CISOs, security teams, and business leaders looking to strengthen their cybersecurity strategy.

What really happens during a ransomware attack?

In this powerful episode of And Security For All, host Kim Hakim sits down with Zach Lewis, CIO & CISO at the University of Health Sciences and Pharmacy in St. Louis, to break down the real-world story behind his new book Locked Up — a firsthand account of surviving a major ransomware incident.

From negotiating with the notorious LockBit ransomware group to navigating board-level decisions about paying (or not paying) a ransom, Zach shares what most organizations never talk about publicly.

🔐 In this episode, we cover:

• What actually happens during a ransomware attack (pre, during & post-breach)
• How ransomware groups like LockBit operate as “ransomware-as-a-service”
• Why some organizations pay — and what happens after they do
• Double extortion & the evolving tactics of cybercriminals
• AI-powered phishing, deepfakes, and the new threat landscape
• How boards are responding to growing cyber risk
• Practical advice for small and mid-sized organizations with limited security budgets
• Lessons learned from real breach recovery

With ransomware, AI-driven attacks, and data extortion on the rise in 2026, this conversation is essential listening for CISOs, IT leaders, board members, business owners, and anyone responsible for protecting sensitive data.

🎧 Whether you're in healthcare, education, finance, or enterprise security — this episode delivers actionable insight from someone who’s lived through it.

Cybersecurity isn’t slowing down — it’s accelerating. In this episode of And Security For All, host Kim Hakim is joined by Arun DeSouza, Managing Director at ProFortis Solutions and President of the ISSA Detroit Chapter, for a powerful conversation on emerging cyber trends, AI disruption, and the evolution of the modern CISO

From supply chain risk and ransomware evolution to OT security, cloud vulnerabilities, regulatory accountability, and AI-powered threats, this episode explores the real-world challenges security leaders are navigating right now.

Topics include:

• The rise of cyber resilience over pure prevention
• Why supply chain risk is now bigger than ransomware
• OT and critical infrastructure targeting
• The API economy and expanding attack surfaces
• AI as both attacker and defender
• Deepfakes, autonomous attacks, and data poisoning
• Observability vs visibility in modern security operations
• The revolutionary evolution of the CISO role

Arun also shares practical strategies for embedding security into innovation lifecycles, building AI governance frameworks, and preparing organizations for the next wave of disruption.

If you’re a CISO, security practitioner, board member, or technology leader, this episode delivers actionable insight on how to stay ahead in an era where innovation and risk move at warp speed.

In this episode of And Security For All, host Kim Hakim sits down with Jeff Williams, Founder and CTO of Contrast Security, for a deep dive into why application security is undergoing its most dramatic shift in decades.

Jeff shares his journey from helping create the OWASP Top Ten to building one of the leading runtime application security platforms, and explains why traditional AppSec approaches are no longer keeping up with modern software development.

🎙️ In this episode, we cover:

• Why 2026 is shaping up to be the year of runtime security
• How traditional AppSec tools create noise instead of clarity
• What runtime security reveals that static and perimeter tools cannot
• Where AI truly helps in AppSec—and where the hype falls short
• How European regulatory changes are redefining software liability
• Why security teams must prioritize context over volume
• What developers, CISOs, and security leaders should focus on next

This conversation breaks down complex topics like runtime protection, AI-driven remediation, regulatory pressure, and developer enablement into clear, practical insights for today’s security practitioners.

Whether you’re a CISO, AppSec leader, developer, or security architect, this episode offers a forward-looking perspective on how application security is evolving—and what it takes to stay ahead.

In this episode of And Security For All, host Kim Hakim is joined by Jessica Couto, VP of Channels & Alliances at Harmonic Security, for an in-depth conversation on Securing Intelligence: AI’s Impact on Cyber Risk. Together, they explore how generative AI has rapidly shifted from a productivity tool to a new source of organizational risk—and why blocking AI outright is no longer a viable strategy.

Jessica shares real-world insights on how employees are using AI both inside and outside corporate environments, the growing risks of data exposure, phishing, deepfakes, and shadow AI usage, and what security leaders must do to regain visibility and control. The discussion also covers how organizations can safely enable AI without sacrificing productivity, the evolving role of the CISO, the rise of fractional CISOs, and how security teams can communicate AI risk in business terms that resonate with leadership.

Topics include:

• How AI is changing the cyber threat landscape
• Why blocking generative AI puts organizations at risk of falling behind
• Data leakage, shadow AI, and employee behavior
• Deepfakes, phishing, and AI-driven social engineering
• AI governance, visibility, and policy challenges
• The future of the CISO role and cybersecurity careers

This episode is a must-listen for CISOs, security leaders, IT professionals, and anyone navigating the fast-changing intersection of AI, cyber risk, governance, and workforce impact.

In this follow-up episode, guest host Jonathan Kimmitt sits down again with Matthew Maynard, Security Operations Specialist at BJC HealthCare and Dark Web Researcher, to take an even deeper dive into the inner workings of ransomware crews and the people behind them.

Matthew takes listeners deeper into the “lion’s den,” revealing what he has learned from directly engaging with threat actors on the dark web—how they think, how they operate, and why the human element inside these criminal ecosystems matters more than most organizations realize.

In this episode, they break down:

• What motivated Matthew to enter ransomware intelligence and begin infiltrating criminal groups
• How ransomware crews recruit, organize, and operate like legitimate businesses
• Key differences between the clear web and dark web, and common misconceptions
• Essential OPSEC practices and how both researchers and criminals protect their identities
• How personas are created and maintained when engaging directly with threat actors
• Human drivers of cybercrime—from financial incentive to desperation and coercion
• Insider risks, layoffs, and how human vulnerability contributes to modern breaches
• Major intelligence wins and insights that help organizations make stronger security decisions

This episode offers rare, firsthand insight into the techniques, mindset, and operational flow of active cybercriminals—paired with practical guidance for defenders. Whether you’re in security leadership, incident response, threat intel, or simply curious about the dark web, this conversation will challenge your assumptions and expand your understanding of today’s most dangerous threats.

Listen now and hear why knowing your adversary is one of the most powerful defenses in cybersecurity.

In this eye-opening episode of And Security For All, host Kim Hakim sits down with Matthew Maynard, Information Security Operations Specialist at BJC HealthCare and dark web researcher who has spent the last year doing the unthinkable—infiltrating active ransomware groups from the inside.

Matthew shares how he entered closed cybercriminal communities, built trust, gathered intelligence, and passed critical findings to government agencies—all while maintaining a full-time role protecting one of the largest healthcare systems in the Midwest. His research provides a rare, real-time window into ransomware crews, their structure, their onboarding process, their business platforms, and the tactics they use to select, study, and strike their victims.

What You’ll Learn in This Episode

• How ransomware groups actually operate behind closed doors
• What “initial access brokers” are and why they’re the real first step in most attacks
• How threat actors select targets, test stolen credentials, and prepare for exploitation
• Why holidays and long weekends remain prime attack windows
• What defenders consistently overlook—and the fixes that matter most
• How Matthew manages OPSEC, safety, and reporting while undercover
• Why MFA gaps, vendor access, phishing, and unpatched systems remain the top entry points
• The surprising internal rules, ethics, and boundaries some threat groups enforce
• How organizations should rethink backups, insurance, and negotiating ransom demands

Matthew also discusses the psychological side of this work—the fear, the risk, and the personal motivation that keeps him in the fight. His insights provide actionable takeaways for CISOs, SOC teams, and anyone responsible for protecting an enterprise today.

This is a rare interview with someone who has seen ransomware operations from the inside. It’s a conversation every cybersecurity leader should hear.

In this episode of And Security For All, guest host Steve Winterfeld, Advisory CISO at Akamai Technologies, teams up with Tricia Howard, Security Evangelist and “Scrybe of Cybersecurity Magicks,” to unpack Akamai’s State of the Internet: Fraud & Abuse Report 2025.

They explore how AI-driven bots are reshaping the landscape of digital fraud—surging over 300% in the past year—and what that means for businesses, defenders, and everyday users. From ad fraud and data scraping to compliance challenges and the ethics of AI, this conversation dives deep into the tension between innovation and exploitation in cybersecurity.

Listen as Steve and Tricia discuss:

• The explosive growth of AI bots and their impact on digital operations
• Ad fraud, zero-click searches, and the dark economy of stolen data
• Why healthcare and commerce are prime targets for automated attacks
• The evolving balance between compliance, risk, and real security
• How organizations can defend against this new wave of AI-powered fraud

With insights from Akamai’s global research team, this episode offers a grounded look at how to navigate the rise of generative AI, protect brand integrity, and build trust in a rapidly changing threat environment.