When seven different responders and law firms were thrown into the same ransomware negotiation chat by a threat actor, Eder Ribeiro, Director of Global Incident Response at TransUnion, it became his framework for managing global incident response: map the data, map the people, and look as holistically as possible before acting. To do this, executive trust must be built long before the 3AM phone call requiring million-dollar decisions. Eder breaks down complex security issues "Barney style" and with empathy, remembering that instruction works best when adapted to how the audience receives it, not how the teacher wants to give it.

For emerging AI risks, he's tracking prompt injection as the attack vector that creates a more linear path to data, particularly in enterprise bundle add-ons that sit in the gray zone between public tools and properly isolated solutions. When investigations spiral, he returns to "control the controllables," reset without finger-pointing, and compress what should take weeks into days. His military-informed leadership philosophy centers on generating agency and freedom for his team, accepting that incident response inherently lacks balance and compensating through daily autonomy.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Cyderes' CISO in Residence Stephen Fridakis’s vulnerability management framework rejects the "list problem" mindset — scan, report, patch what you can — in favor of contextual risk assessment. His approach asks four critical questions: Is this vulnerability applicable to my environment? Can it actually be exploited? Will exploitation expose sensitive data? This methodology allowed his teams to deprioritize even critical vulnerabilities like Log4J when they existed in inaccessible systems with no valuable data, redirecting resources to genuinely exploitable exposures.

During a suspected ransomware incident at a major media company, Stephen made the call to force overnight MFA and rotate all passwords across the entire ecosystem without email access since it was compromised. Production teams were frustrated, help desk tickets surged, but they didn't miss a single millisecond of production schedules. His decision-making framework centers on three elements: what happened (in human language, not technical jargon), what's at stake (customer data, operations, downtime), and the likelihood plus consequences of inaction. Security, he argues, should reflect the mission like the moon reflects the sun: never the star of the show, but essential to protect what matters.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Matt Johansen, Founder of Vulnerable U, built a following of 133,000 cybersecurity professionals by abandoning corporate messaging for authentic practitioner-to-practitioner communication. His systematic approach combines daily content creation with AI workflows that transform security operations. This proves his "humans to the power of AI" framework, where teams multiply capabilities without losing the human insight that threat actors can't replicate.

Matt's transition from finance industry silence to social media leadership offers a blueprint for cybersecurity professionals who want to share knowledge without corporate constraints. His routine of content creation — recording daily videos for over 2 years — demonstrates how consistency beats perfection when building industry influence.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Alessio Faiella, Sr. Director of Security Engineering at ThoughtSpot, sees security teams making the same mistakes with AI that they've made with every new technology: rushing to implement without understanding the fundamentals. He's learned that the most effective AI security deployments come from teams who first attempt to build solutions internally. His approach of running 30-day AI hackathons reveals whether problems are worth solving and helps teams evaluate vendor claims with real experience. 

He's also developed an RPG-style unlock system for AI tool access, requiring junior analysts to master manual investigation techniques before gaining access to AI-powered capabilities. Alessio warns that traditional 2- to 3-year security roadmaps have become obsolete in an ecosystem evolving so rapidly. The result is a practical framework that cuts through AI marketing noise to focus on measurable outcomes like reduced analyst burnout and improved team velocity.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Brook Schoenfield, Chief Scientist and EVP of Services at Rezliant Inc., brings decades of security architecture experience to explain why SOCs function as the ultimate firewall when all other defenses fail. His mathematical framework for understanding software vulnerabilities reveals why human expertise remains irreplaceable in modern threat detection.

Brook demonstrates how sophisticated attackers exploit the inevitable failure points in software-based security controls. His insights challenge the notion that SOC work is purely reactive, positioning it instead as the critical last defense that can save or destroy entire organizations.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Paul Marco, Co-founder of TALAS Security, challenges the assumption that effective security operations follow a universal playbook. His decades of hands-on SOC experience reveal that the most successful teams customize their approach based on organizational context rather than copying industry templates. Paul's methodology for complex security environments centers on four critical data requirements that enable any investigation to reach definitive conclusions. 

He explains how AI creates unprecedented consistency in security operations while emphasizing why human expertise remains irreplaceable for contextual decision-making. Paul also offers practical strategies for maximizing existing security tool capabilities, building trust in AI-powered solutions, and preparing for the inevitable AI arms race between defenders and attackers.

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

Andy Triedman, Partner at Theory Ventures, argues that AI is reshaping not just security capabilities, but the entire business model of security companies. Unlike traditional "insurance-style" security products that were difficult to evaluate quantitatively, AI-enabled platforms provide clear scoreboards that buyers can use to measure effectiveness, speed, and cost efficiency. This shift from relationship-based to results-based evaluation advantages product-led teams with genuine AI-native expertise over traditional sales-driven organizations.

With a background spanning computational neuroscience and machine learning, Andy brings a unique perspective on how AI transforms both attack and defense capabilities. He explains why security presents particularly compelling investment opportunities due to the perpetual attacker-defender dynamic and the chronic information overload that defines security operations. He also shares frameworks for distinguishing between teams that truly understand AI-native development versus those that added AI features after LLMs emerged. 

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube

In our inaugural episode of Beyond the Alert, we explore how Tyler Martin, Senior Director of Enterprise Security Engineering and Operations at FanDuel, has reimagined what a modern SOC can accomplish when AI becomes the foundation rather than an add-on tool. His team eliminated traditional shift-based operations entirely, replacing 30-40 potential analyst positions with custom agentic AI that delivers 60-70% automation efficiency while maintaining critical human oversight for complex threats.

Tyler's approach challenges conventional security thinking by treating AI implementation as an engineering problem rather than a defensive strategy. His team has built internal LLMs, developed custom agentic AI for multi-tier triage work, and created reasoning-based security controls that go beyond typical identity-focused guardrails.

Our host, Anne Gotay, VP of Growth at Dropzone AI, will dive deep into investigation techniques, leadership strategies, and how emerging technologies are transforming security operations through authentic conversations with practitioners who are redefining modern security. 

Topics Discussed:

Listen to more episodes: 

Apple 

Spotify 

YouTube