Chattinn Cyber

In this episode of Chattinn Cyber, Marc Schein is chattin’ with Richard Goldberg, a seasoned cyber attorney with deep experience in data breach response, cybercrime prosecution, and advising organizations through complex incidents. Their chat opens with Goldberg’s background at the U.S. Department of Justice and his path into cyber law, which began when he volunteered to become the office’s computer expert. From there, the conversation quickly moves into the modern threat landscape and the kinds of incidents companies are facing in 2026.

A major theme is how ransomware has evolved. Goldberg explains that many attacks are no longer primarily about locking systems and demanding payment for a decryptor. Instead, attackers increasingly rely on data extortion: they steal sensitive information and threaten to publish it unless the victim pays. He notes that organizations have improved their resilience by strengthening backups and recovery capabilities, which has forced cybercriminals to adapt their tactics.

Their chat also explores the role of artificial intelligence in cybersecurity. Goldberg takes a cautious view, saying it is difficult to know whether AI is helping attackers get into systems more effectively, but he does see potential benefits for defenders. He points out that AI could help close gaps caused by human limitations, such as the delay between discovering a vulnerability and applying a patch. At the same time, he warns that AI is still unreliable and can produce bad outputs, so human oversight remains essential.

Another major topic is cyber insurance and its practical value during a breach. Goldberg makes a strong case that insurance is about more than just financial coverage. He says insurers typically connect clients with highly qualified response teams and can help reduce costs through pre-negotiated rates. He also contrasts insured and uninsured incidents, arguing that having cyber insurance can make a significant difference in both speed and quality of response when an organization is under pressure.

The chat closes with broader best practices and legal risks. Goldberg emphasizes tabletop exercises, pre-breach planning, gap analysis, penetration testing, and using specialists instead of generalists for cyber incidents. He also discusses the rise in class action litigation and warns against companies trying to “attack back” without understanding the legal consequences. Overall, the episode presents a practical, insider’s view of how cyber incidents unfold and why preparation, expertise, and the right advisors matter.

Richard Goldberg is a vice chair of the Constangy Cyber Team based in Philadelphia, Pennsylvania, where he advises clients on all aspects of data privacy and cybersecurity, with particular emphasis on incident response, crisis management, and regulatory investigations. With more than 25 years of experience, he has guided organizations through data breaches ranging from localized business email compromises to major global security events affecting millions of individuals across multiple jurisdictions. Clients also value Richard’s perspective as a former cyber attorney with the U.S. Department of Justice, where he prosecuted cybercrime and intellectual property offenses and led responses to sophisticated threat activity. He is frequently called upon to support regulatory compliance following data incidents, including matters involving multi-agency investigations and international, federal, and state privacy frameworks. Follow Our Guest Website | LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

In this episode of Chattinn Cyber, Marc Schein is chattin’ with AI acceleration expert, Walter Haydock. Their chat opens with Walter explaining how his background in the Marine Corps, the intelligence community, and Congress shaped his approach to cybersecurity and AI governance. He describes founding StackAware after seeing how quickly companies were struggling to manage the risks created by AI tools, especially as adoption accelerated and organizations needed practical, cost-effective controls. The conversation opens with the idea that the corporate world has introduced a new kind of chaos — one centered on cybersecurity and AI governance — that many teams are still trying to understand.

A major theme of their chat is what AI governance actually means. Walter defines it as the practice of measuring and managing risks caused or created by AI systems, especially risks tied to confidentiality, integrity, and availability. He breaks the space into three categories: AI for security, AI for hacking, and security for AI. The final category is his primary focus, and he frames it as protecting organizations from the risks that come from using AI systems themselves, rather than simply using AI as a defensive or offensive tool.

The chat then turns to how traditional risk management applies in an AI-driven world. Walter says the core choices — accept, avoid, mitigate, or transfer — still hold, but the way organizations think about risk must evolve because AI is non-deterministic. Unlike traditional systems, AI may not produce the same output every time, even with the same inputs. That means companies need to move toward a more probabilistic way of assessing risk, where some deviation from expected behavior is acknowledged and managed rather than assumed away.

A substantial portion of their chat focuses on ISO 42001, which Walter describes as the first global standard for AI management systems. He explains that the framework helps organizations build policies, procedures, and practices for governing AI responsibly and demonstrating that governance to regulators and customers. He also discusses supply chain exposure, warning that AI is already embedded in vendor ecosystems whether companies want it or not. Rather than trying to ban AI outright, he argues for a measured, quantitative approach that compares the risk of supplier AI usage to the business value those suppliers deliver.

The chat concludes with practical advice for CISOs and security teams. Walter recommends three starting actions: define clear AI policy guidelines, create a full inventory of AI systems in use, and then perform a risk assessment to determine which systems and uses deserve the strictest controls. He also notes that ISO 42001 can support regulatory compliance and, in some cases, provide a form of safe harbor under emerging AI laws such as Colorado’s SB 205. The interview ends with Walter inviting listeners to connect with him on LinkedIn, where he posts AI governance and security content regularly.

Walter Haydock is the Founder of StackAware, where he helps organizations address the biggest cybersecurity and AI governance risks without wasting time or resources on distractions. Before entering the private sector, he served on the U.S. House Homeland Security Committee, at the National Counterterrorism Center, and as a Marine Corps reconnaissance and intelligence officer. He is a graduate of the U.S. Naval Academy, Georgetown University’s School of Foreign Service, and Harvard Business School.

Follow Our Guest

Website | LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

This episode, Marc is chattin’ with Ahmad Alokush, a technology risk, AI governance , and cybersecurity oversight expert. Their chat centers on AI governance and why organizations often approach it too narrowly. Ahmad explains that one of the biggest blind spots is treating governance as a one-time compliance exercise instead of a continuous operating discipline. He frames AI governance as an operating system for trust — something that must evolve as AI systems, business use cases, and risks evolve.

A major theme is the hidden cost of AI governance. Ahmad notes that many CFOs underestimate the true investment required, because governance includes not just technical maintenance but also data quality work, regulatory compliance, and change management. His point is that governance is not overhead; it is what makes AI’s ROI sustainable and defensible over time.

The discussion then shifts to the difference between reactive and proactive organizations. Reactive teams tend to address issues only after deployment, often after a problem has already become a crisis. Proactive organizations, by contrast, build risk assessments, bias testing, documentation, and oversight into the process before systems go live. Ahmad emphasizes the importance of visibility into AI usage, including the dangers of “shadow AI” when employees adopt tools outside approved policy.

They also chat about accountability and ownership. Ahmad points out that AI initiatives often span IT, data, HR, compliance, and business teams, which can make ownership unclear. In his view, mature governance requires a clear owner, often supported by a chief AI officer, risk committee, or audit committee, along with a living inventory of AI systems that identifies risk levels and update cadence.

Finally, the chat moves to global regulation and how organizations can manage conflicting rules across jurisdictions. Ahmad describes the need for jurisdiction-specific risk mapping, compliance by design, and deployment variants that can satisfy stricter disclosure or transparency requirements where needed. He closes by encouraging listeners to stay proactive, continuously improve, and treat AI governance as part of the organization’s long-term operating model rather than a box-checking task.

Ahmad Alokush is a globally recognized expert in AI, cybersecurity, fintech, and technology litigation, and the founder of Ahmadeus Technology Boutique. He advises foreign governments, institutional investors, and C-suite leaders on emerging technologies, M&A strategy, digital asset valuation, and complex regulatory matters, while also serving as a trusted expert witness and keynote speaker for Fortune 500 companies, AmLaw 100 firms, and global policy leaders. Known for bridging technical, legal, and business perspectives, Ahmad brings clarity, discretion, and strategic insight to high-stakes engagements in boardrooms, courtrooms, and advisory settings.

Follow Our Guest

LinkedIn | Website

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Today Marc is chattin’ with Richa Kaul, founder and CEO of an AI-based compliance automation platform. The conversation centered on how AI is reshaping enterprise governance, risk, and compliance (GRC), especially by helping organizations handle growing complexity without simply adding more headcount. The discussion quickly focused on how compliance teams can use automation and AI to streamline vendor risk, regulatory requirements, and other time-consuming workflows. Richa explained that his approach starts by separating what truly requires human judgment from what can be automated.

A major theme was the mismatch between the speed of modern risk and the pace at which organizations can hire. Richa argued that risk is increasing faster than teams can scale, making it unrealistic to solve GRC challenges by just expanding staff. Instead, she framed the real question as what work should remain with humans and what work can be handled by AI or automation. She emphasized that teams are bogged down by urgent audit prep, repetitive tasks, and reactive “fire drills,” which prevents them from focusing on strategic risk reduction.

The chat then moved into visibility and granularity in risk management, particularly around privacy. Richa noted that many CISOs and GRC leaders lack sufficient visibility into their organization’s risks, especially because privacy is cross-functional and touches employees, users, operations, and regulatory obligations. She said this lack of clarity makes it difficult for leaders to confidently communicate risk to boards or determine where to invest time and resources. In her view, the biggest issue is not just managing risk, but being able to see it clearly enough to act on it.

Another key topic was AI governance. Richa pointed out that many companies are paying attention to AI policy at the top level, but are not doing enough to train employees at the operational level, where mistakes are most likely to happen. She described the “last mile” of AI governance as especially vulnerable, since employees may unknowingly expose proprietary information by entering sensitive data into tools like GPT. According to Richa, human behavior is often the weakest link, and effective governance requires education and training throughout the organization, not just policy statements from leadership.

Their chat also touched on industry-specific risk, with healthcare highlighted as a major area of concern. Richa said healthcare compliance appears underinvested compared with financial services, even though both are highly regulated and handle highly sensitive data. She closed by offering a practical starting point for companies facing generative AI challenges: map your most important data, follow it from input to output, identify the systems it touches, and secure each step of the journey. His overall message was optimistic — that even though the risk landscape feels overwhelming, organizations have tools, platforms, and partners that can help them manage it more effectively.

Richa Kaul is a technology executive and Head of Product Engineering: Strategy, AI Builder, and Cloud & AI Enterprise Transformation, with 20+ years of experience leading cloud, data, and AI initiatives across Fortune 500 organizations. She has managed portfolios as large as $2B in revenue and $300M in operating budgets, while building global teams of 100+ and advising CxOs on enterprise AI and financial strategy. Richa is known for driving GenAI adoption, modernizing data platforms, advancing AI governance, and delivering scalable, cost-effective transformation across banking, capital markets, asset management, and wealth management.

Follow Our Guest

LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

On this episode of Chattinn Cyber, Marc is chattin’ with Mike Maletsky, Vice President and Practice Leader for Tech, Cyber, and Crime at Hiscox. Mike begins by discussing his career journey into the insurance industry, explaining that he “fell into” insurance after studying finance but stayed because he found the work intellectually engaging and people-focused. He emphasizes that cyber insurance is about much more than selling policies—it’s about understanding complex risks and helping businesses mitigate them. He also introduces Hiscox’s long-standing focus on serving small businesses, a segment that is often overlooked despite its critical role in the U.S. economy.

The conversation then shifts to the cyber threats currently facing small businesses in 2026. Maletsky explains that cyberattacks are no longer isolated incidents affecting only large corporations. According to Hiscox’s Cyber Readiness Report, more than half of small businesses experienced some form of cyberattack within the past year. He discusses how ransomware, phishing campaigns, and cyber extortion continue to evolve, with artificial intelligence dramatically increasing both the sophistication and scale of attacks. Traditional warning signs such as poor grammar and obvious spelling mistakes have largely disappeared, making fraudulent communications increasingly difficult to detect.

Looking ahead, Maletsky explores how AI and emerging technologies will reshape cyber risk over the next decade. In the near term, AI is making phishing emails nearly indistinguishable from legitimate communications. In the medium term, increasingly convincing deepfake audio and video could enable highly sophisticated fraud schemes, including executive impersonation. Longer term, developments such as autonomous AI agents and quantum computing could fundamentally alter internet security by challenging today’s encryption standards. At the same time, he notes that cybersecurity professionals are leveraging many of these same technologies to build stronger defenses, creating an ongoing technological arms race between attackers and defenders.

The discussion also highlights the wide-ranging impact of cyber incidents beyond financial losses. Maletsky explains that a cyberattack can trigger cascading operational disruptions, including business interruption, regulatory notifications, reputational damage, and customer distrust. Perhaps most importantly, he argues that cyber incidents are fundamentally human events rather than purely technical ones. Employees often experience intense stress during an incident, particularly those responsible for responding to attacks or those who inadvertently initiated a breach through a phishing click. Organizations can suffer from burnout, blame, and deteriorating workplace culture long after technical recovery has been completed.

Finally, Maletsky outlines practical steps small businesses can take to improve their cyber resilience. He stresses the importance of ongoing employee awareness training, implementing basic security controls such as multi-factor authentication and reliable backups, and viewing cyber insurance as more than financial protection. Modern cyber insurance increasingly includes preventative services such as phishing simulations, breach coaching, employee education, and risk management resources. He closes by noting that 77% of U.S. small businesses remain underinsured against cyber risk, emphasizing that many companies mistakenly assume cyber insurance is prohibitively expensive when, in reality, coverage is often affordable for even very small organizations.

Mike Maletsky is Vice President of Technology E&O/Cyber at Hiscox USA, with more than 18 years of insurance industry experience. He brings a strong technical foundation in underwriting management and professional liability, including cyber insurance, and has deep expertise across both manual and digital distribution channels. Mike has a proven track record of building full-stack new products through digital distribution, with a focus on technology errors and omissions (E&O), excess coverage, and cyber liability. Known for serving as a key bridge in product development workstreams, he effectively connects business and underwriting priorities with technology implementation to drive aligned, successful outcomes. Throughout his career, Mike has demonstrated a commitment to innovation and to delivering forward-looking insurance solutions informed by emerging technologies and industry best practices.

Follow Our Guest

LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

In this milestone 100th episode of Chattinn Cyber, Marc Schein sits down with one of the most influential figures in cyber insurance, Bob Parisi. Widely regarded as a pioneer in the space, Parisi reflects on the origins of cyber insurance, tracing its roots back to the late 1990s during the dot-com boom and the early recognition that traditional insurance products were not equipped to handle emerging digital risks.

Parisi shares a candid look at how cyber insurance evolved from a niche product designed for tech companies into a critical component of enterprise risk management. From the early days of privacy breach notification laws to the growing realization that business interruption and operational dependency on technology represent the true magnitude of cyber risk, the conversation highlights the key inflection points that shaped today’s market.

The discussion also explores how the insurance industry has responded to ongoing complexity and volatility. From “silent cyber” to the challenges of aligning capacity across a fragmented marketplace, Parisi explains why cyber insurance still exhibits characteristics of an emerging market—even after decades of development. He emphasizes the importance of integrating cyber coverage with broader risk management strategies rather than treating it as a standalone solution.

Looking ahead, Marc and Bob dive into some of the most pressing issues facing the industry today, including geopolitical risk, evolving privacy regulations, and the rapid rise of artificial intelligence. Parisi offers a grounded perspective, arguing that while AI introduces new complexities, it should ultimately be understood as another form of technology—one that must be managed thoughtfully rather than feared outright.

Throughout the conversation, Parisi reinforces a consistent theme: the importance of balance. Whether discussing underwriting practices, organizational governance, or emerging technologies, he highlights the need for measured, informed decision-making. As cyber risk continues to evolve, this episode provides valuable insight into how organizations, insurers, and brokers can navigate uncertainty with clarity and discipline.

Bob Parisi is a widely recognized leader in the cyber insurance industry and one of the pioneers behind the development of modern cyber insurance products. With a career spanning nearly three decades, he has played a key role in shaping how insurers underwrite and manage cyber risk, from the early days of the dot-com era to today’s complex digital landscape. Currently serving in a senior underwriting role at Munich Re, Parisi is known for his deep expertise, practical perspective, and influence across the insurance and risk management community.

Follow Our Guest

LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

On this episode of Chattinn Cyber, Marc is chattin’ with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch. Their chat opens by focusing on high-impact, practical ways organizations can reduce cyber risk. Ben highlights identity as the top priority: his team moved to passkeys to remove passwords and lower the attack surface. He stresses that threat actors increasingly use man-in-the-middle techniques and that AI has accelerated the automation of credential-theft, which makes strengthening identity controls essential.

The chat then moves to AI and data governance. Ben describes rolling out visibility tools to monitor internal AI use — what prompts users run and what data is fed into models — and pairing that with data labeling and classification. He warns organizations to restrict where AI tools are allowed and to implement compensating data controls to prevent accidental or intentional leaks of sensitive information.

Ben cautions that AI and cybersecurity must be adopted in parallel, because AI will reveal existing misconfigurations and permission drift. He gives practical examples (like Copilot showing information a user shouldn’t see because of incorrect permissions) to illustrate how AI surfaces weaknesses in access controls. The takeaway is that AI can be a force-multiplier but also a magnifier of existing security gaps.

On leadership and tradeoffs, Ben explains how combining CTO and CSO responsibilities can be an enabler if balanced correctly. He argues for marrying a product/technology lens with a risk lens, leveraging internal expertise, and making business enablement and security complementary so organizations can move quickly while maintaining the right groundwork.

Finally, Ben addresses translating cyber risk into financial terms for CFOs and boards. He recommends business impact analysis—linking key system outages (e.g., Active Directory) to production downtime costs—to quantify risk and justify security investments. He shares real incident cost ranges (low seven figures to tens of millions in some cases), underscores the role of compensating controls, and concludes with a call to monitor industry trends, assess outage and reputational costs, and prioritize risk reduction.

Ben Wilcox is a seasoned technology leader with over 25 years of experience driving innovation and solving complex business challenges. Serving as both Chief Technology Officer and Chief Information Security Officer at ProArch, Ben combines a forward-looking vision with a hands-on approach to cybersecurity. He is passionate about leveraging technology to accelerate business outcomes while embedding security best practices into organizational culture and operations. Ben’s strategic mindset and dedication to excellence have strengthened ProArch’s resilience and helped protect clients’ data and systems. Outside of work, Ben channels his relentless drive into racing as an instructor and competitor with the Northeast Audi Club, and enjoys gardening, cooking, and spending quality time with his family. As he puts it, “Security isn’t just about defending against threats—it’s about enabling trust, protecting growth, and ensuring every decision we make strengthens the foundation of the business.”

Follow Our Guest

LinkedIn | Website

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

In this episode of Chattinn Cyber, Marc Schein is chattin’ with Mike Armistead, a seasoned cybersecurity expert with over 40 years of experience, including more than 20 years as a vendor in the cybersecurity space. The conversation opens with a discussion about the challenges security leaders face in 2026. Mike highlights the complexity of their role, comparing it to that of a CFO managing financial risk, but notes that cybersecurity leaders often lack the comprehensive management tools that CFOs have. He emphasizes the fragmented nature of cybersecurity tools and the difficulty in stitching together disparate signals to form a coherent security posture.

Mike further explains that the human element is the critical glue in cybersecurity programs. The effectiveness of security teams depends heavily on the leadership and the ability of individuals to contextualize technical signals within the business environment. This need for situational awareness is driving interest in AI technologies, particularly on the defender side, to augment human capabilities and expand the scope and depth of security operations.

The chat then shifts to the role of AI in cybersecurity products. Mike observes that while AI is increasingly integrated into detection tools, the industry has largely shifted focus away from prevention. He advocates for a strategic return to prevention, where AI can play a significant role in helping security leaders develop and implement risk mitigation strategies tailored to their organizations. Mike stresses the importance of a holistic approach that goes beyond real-time detection to include employee training, access control, and disaster recovery.

Addressing the challenges faced by middle-market organizations, Mike points out that these companies are often expected to meet the same cybersecurity standards as large enterprises but with far fewer resources. He advises middle-market CISOs to prioritize protecting their most critical assets—their “crown jewels”—and to have candid conversations with leadership about realistic security goals. This pragmatic approach helps ensure that limited resources are focused on the highest risks rather than attempting to cover every possible threat.

Finally, Mike shares information about a community he helped start called the Security Impact Circle, which focuses on cybersecurity leadership issues such as board engagement. This community facilitates workshops that bring together CSOs and board directors to bridge the communication gap and align security priorities with business needs. Mike encourages listeners to visit securityimpactcircle.org to learn more and get involved.

Mike Armistead brings nearly 40 years of business experience marked by a proven track record of building companies, navigating strategic acquisitions, and leading growth at every stage. As co-founder and CEO of Respond Software, acquired by Mandiant for $200 million, and co-founder of Fortify Software, acquired by HP for $285 million, Mike has played pivotal roles in multiple successful startups, including serving as SVP on the turnaround team at WhoWhere (acquired by Lycos for $133 million) and contributing to Pure Software’s IPO. His post-acquisition leadership includes key roles as VP of Products & UX at Mandiant, Director at Google Cloud, and VP & GM for Fortify and ArcSight business groups at HPE, where he drove significant expansion and over $400 million in revenue impact. Alongside these successes, Mike gained valuable insights from two brief ventures, including leading InLeague through post-9/11 financial challenges and emphasizing product-market fit in another startup. Beginning his career as a Product Manager at HP in the late 1980s, Mike’s multifaceted experience spans diverse industries and company sizes. Today, he remains passionate about building high-performing teams and tackling complex, noble challenges.

Follow Our Guest

LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Today Marc is chattin’ with Alex Niejelow, a respected figure in cybersecurity. The episode opens with Marc highlighting Alex’s unique background growing up in Philly and his diverse career path. Alex shares how his early career as a Durham police officer and later as a lawyer shaped his mindset around public service and supporting people and businesses. He then transitioned into federal and state government roles, including significant positions in the Obama administration and Homeland Security, focusing on trade, customs, and national security issues such as counterfeit semiconductors in supply chains.

They then chat about Alex’s role on the National Security Council, where he worked on the intersection of trade and cybersecurity, a concept that was not widely recognized in the early 2010s but has since become central to government policy. Alex explains his involvement in developing the first-ever cyber sanctions regime, a tool designed to economically disincentivize cybercriminals and nation-states from monetizing stolen intellectual property and trade secrets. This approach was innovative in addressing the asymmetry in cyber threats, where traditional law enforcement and diplomatic tools were insufficient.

The chat then shifts to the challenges Alex faced working across multiple government agencies with differing priorities, which, while complex, ultimately led to better outcomes through collaboration and creative problem-solving. Alex emphasizes the importance of reducing asymmetry in cybersecurity, noting that companies remain vulnerable at their weakest points. He highlights the evolution of the cyber insurance industry, which has become more sophisticated with risk engineers engaging deeply with clients to improve cybersecurity postures and insurance terms.

Alex explains his motivation for founding Hilco Global Cyber Advisors, driven by the need to support middle-market companies that often lack adequate cybersecurity resources despite their sophistication and capital. He critiques the cybersecurity industry’s tendency to self-silo and stresses the importance of aligning cybersecurity solutions with the nature of the products and services businesses provide to increase adoption and effectiveness.

Finally, the chat turns to artificial intelligence (AI) as a major cybersecurity topic in 2025. Alex acknowledges both the threats and opportunities AI presents, noting that threat actors are leveraging AI to scale traditional cyberattacks like phishing. He expresses optimism about the cybersecurity community’s commitment to addressing these challenges and highlights regulatory efforts, such as guidance issued to the insurance industry on AI use in underwriting, to mitigate risks including bias. The episode closes with Alex sharing a personal anecdote from his time at the White House and providing contact information for Hilco Global Cyber Advisors.

Alexander Niejelow is Executive Director of Global Cyber Advisors at Hilco Global, bringing deep expertise in cybersecurity, fintech, and digital policy from leadership roles in both the private sector and government. He previously served as Deputy Superintendent for Innovation Policy at the New York Department of Financial Services, leading initiatives on AI and emerging fintech. At Mastercard, he was Senior Vice President for Cybersecurity Coordination and Advocacy, overseeing global cybersecurity and technology policy efforts. Alex also held key government positions, including Director of Cybersecurity Policy at the White House National Security Council and Chief of Staff to the U.S. Intellectual Property Enforcement Coordinator. He began his career as a litigator and holds a JD from the University of Pennsylvania and a BA from Duke University. Alex actively contributes to cybersecurity policy through board roles with the Center for Cybersecurity Policy and Blue Star Families, and has led global coalitions focused on cyber risk reduction and digital protection.

Follow Our Guest

Website | LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

In this episode of Chattinn Cyber, Marc Schein is chattin’ with Courtney Hans, a seasoned cyber professional with a unique background. Courtney shares that her path into cybersecurity was nontraditional, having started as a literature major and then spending about a decade as an adventure travel guide. She reflects on how the skills she developed during that time—understanding people’s motivations and goals—have been invaluable in her cybersecurity career, particularly in tailoring security strategies to individual organizational contexts.

Courtney emphasizes that cybersecurity is not a one-size-fits-all problem. She explains how, during her time at a SaaS startup, she prioritized cybersecurity investments based on the company’s specific risks and environment, such as focusing on application security over endpoint detection due to budget constraints and business needs. She stresses the importance of context in determining where organizations should focus their people, processes, and technology investments to have the greatest impact.

The chat then shifts to practical advice on how organizations can begin improving their cybersecurity posture, particularly through tabletop exercises. Courtney encourages organizations to leverage resources from their cyber insurance providers, many of which offer free or low-cost training and virtual tabletop exercises. She advises starting simple—having conversations about incident response plans and ensuring everyone knows their role if a cyber incident occurs.

Courtney also discusses the importance of engaging leadership in cybersecurity exercises. She suggests setting clear expectations, respecting executives’ time, and framing tabletop exercises as safe spaces to practice responses without pressure. She highlights that cyber incidents affect the entire organization, not just IT, and that practice builds muscle memory and helps identify gaps before a real crisis occurs.

Finally, Courtney outlines best practices for following up after tabletop exercises, including documenting observations, assigning responsibilities, and setting deadlines to ensure improvements are made. She acknowledges the discomfort some may feel participating in these exercises but stresses that creating a supportive environment where it’s okay to say “I don’t know” is crucial for identifying and addressing security gaps effectively.

1. Nontraditional Path to Cybersecurity: Courtney’s background in literature and adventure travel shaped her people skills, which are critical in cybersecurity for understanding motivations and tailoring solutions.

2. Context is King: Cybersecurity solutions must be customized to an organization’s specific risks, environment, and priorities rather than applying generic controls.

3. Value of Tabletop Exercises: These exercises are essential for preparing organizations to respond to cyber incidents, helping build muscle memory and identify gaps in a safe environment.

4. Leveraging Cyber Insurance Resources: Many cyber insurance providers offer free or low-cost resources, including virtual tabletop exercises, which organizations should utilize.

5. Leadership Engagement and Follow-Up:Successful cybersecurity preparedness requires executive buy-in, clear expectations, and diligent follow-up with assigned responsibilities to ensure continuous improvement.

1. “Context is king… each of our clients, in the insurance space, are different. What their risks are, what their environment looks like, dictates where their investments will have outsized impact.”

2. “Practice builds muscle memory, practice builds an awareness of where the gaps are, and always better to identify the gaps in a safe environment versus a real environment.”

3. “Plans are useless, but planning is indispensable.” — Dwight Eisenhower, quoted by Courtney.

4. “If you see something, say something… make sure people feel comfortable bringing those concerns to light.”

5. “It’s absolutely okay, maybe desirable, to say ‘I don’t know that yet’ because that’s what we’re here to figure out—where our gaps are.”

Currently the Vice President of Cyber Services for AmTrustCyber, Courtney Hans brings a variety of experience into her work. In her early career, Courtney was an adventure travel guide with a short window to make a strong impression. Curiosity became her superpower as she learned how to uncover the inner motivations of diverse groups of guests. Guiding, just like cybersecurity, requires agility and a cool head during a crisis. Formerly the Head of Security and IT for a growing SaaS startup, Courtney joined AmTrust to help to reduce risk and deepen the relationship between carrier and insured.

Follow Our Guest

Website | LinkedIn

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn