CISO Tradecraft®

What happens when hackers no longer need to know how to hack?

In this episode of CISO Tradecraft, host G. Mark Hardy interviews Jake Bernardes, CISO at Gambit, about how autonomous AI agents are transforming cyberattacks. From exploiting decades-old vulnerabilities to launching attacks against hundreds of companies simultaneously, AI is changing the cybersecurity game.

For aspiring CISOs, the message is clear: You can't prevent every attack. You must build an organization that can survive them.

In this episode, you'll learn: How AI agents are making sophisticated hacking accessible to almost anyone. Why technical debt and AI-generated code are creating new security risks. Why CISOs need to think more like attackers. How to prioritize the systems and processes that keep your business running. Why cyber resilience and recovery are becoming just as important as prevention. How to test and prove your organization's ability to recover from an attack.

The CISO Takeaway: Stop assuming your security tools will save you. Understand what matters to the business, make smarter risk decisions, and prove you can recover when things go wrong.

Subscribe to CISO Tradecraft for the information, knowledge, and wisdom to become a more effective cybersecurity leader. 🌐 https://www.cisotradecraft.com

What Does It REALLY Take to Become a Successful CISO? Todd Fitzgerald reveals the 7 essential elements of cybersecurity leadership that can make or break your security program.

In this episode of CISO Tradecraft, recorded at the COSAC security conference in Ireland, Todd Fitzgerald, author of The CISO Compass, breaks down his CISO Operating System—a practical framework for running cybersecurity like a business.

You'll discover the 7 S's every CISO needs to master:

• Strategy: Align cybersecurity with business goals.
• Structure: Find the right organizational design and reporting relationships.
• Systems: Build effective risk management, control frameworks, and lessons learned.
• Staff: Build stronger teams by understanding people and their strengths.
• Skills: Decide whether your future is in technical mastery or executive leadership.
• Style: Communicate with executives and boards to win trust and support.
• Shared Values: Build a security culture that people actually embrace.

🔥 PLUS: Learn why technical mastery can become a career liability, why a $15 million security transformation can fail even with full funding, and how to avoid overwhelming your organization with too much change.

CISO Compass - https://www.amazon.com/CISO-COMPASS-Navigating-Cybersecurity-Leadership/dp/0367486024/

What if the reason your cybersecurity budget keeps getting cut isn't your security strategy, but how you negotiate? Every CISO negotiates. Whether you're fighting for a bigger cybersecurity budget, negotiating with vendors, retaining top talent, or navigating a ransomware crisis, your ability to negotiate can determine your success as a security leader.

In this episode of CISO Tradecraft, G. Mark Hardy sits down with cybersecurity attorney and negotiation expert Mark Rasch to reveal the strategies that separate effective negotiators from everyone else. You'll discover why winning a negotiation doesn't mean the other side has to lose, how to shift conversations from cost to business value, and why understanding what someone actually wants can unlock deals that initially seem impossible.

What You'll Learn: 💰 Win Bigger Cybersecurity Budgets: Why precise financial requests can outperform inflated budget proposals. 🧠 Master Negotiation Psychology: How anchoring, perceived value, and understanding motivations influence outcomes. 🔐 Navigate Ransomware Negotiations: How attackers think about money, credibility, risk, and leverage. 📈 Sell Security as a Business Enabler: Stop positioning cybersecurity as a cost center and start connecting security investments to revenue. 🤝 Negotiate Better Vendor Contracts: Resolve intellectual property disputes by understanding what each party actually needs. 👥 Retain Your Best Cybersecurity Talent: Negotiate salaries, benefits, flexibility, and career opportunities beyond compensation. 🚨 Know When to Walk Away: Recognize when legal, ethical, or financial risks make a deal unacceptable.

The Biggest Lesson? The best negotiators don't simply ask for more money. They understand what the other side values, build credibility, and find solutions that benefit both parties. Whether you're preparing for your next board meeting, asking for additional resources, or negotiating a multimillion-dollar security contract, these lessons can help you become a more effective cybersecurity executive.

Question for CISOs: What's the toughest negotiation you've faced as a cybersecurity leader? Share your experience in the comments! 👍 Like this episode if you found it valuable. 🔔 Subscribe to CISO Tradecraft for weekly insights on cybersecurity leadership, risk management, business strategy, and becoming a more effective CISO. 🌐

wwVisit us: https://cisotradecraft.com/

Should you get a PhD in Cybersecurity?

In this episode of CISO Tradecraft, G. Mark Hardy sits down with Dr. Char Sample at the COSAC security conference in Ireland to unpack what it REALLY takes to earn a doctorate in cybersecurity.

From her early work on the Gauntlet firewall to cybersecurity research at the Army Research Lab, INL, and Marshall University, Dr. Sample shares hard-earned lessons on research, funding, doctoral programs, and surviving the PhD journey.

They also explore:

• Why a PhD can matter for cybersecurity research funding
• What makes a strong cybersecurity research problem
• How long a doctorate can take
• Research methods, proposals, and defending your work
• Remote vs. residency programs
• AI, hallucinated citations, and research reproducibility
• Why cybersecurity needs more focus on building securely, not just breaking things

If you're considering an advanced degree or want to understand where cybersecurity research is headed, this episode is for you.

🎧 Subscribe to CISO Tradecraft for more cybersecurity leadership insights.

In this episode, we reveal the biggest security awareness mistakes and the creative ways to make cybersecurity training actually fun in 2026.

From AI-powered phishing and token theft to stronger MFA and gamified training, There are ideas every security leader should steal.

Watch now and level up your security awareness game!

Most CISOs spend years learning cybersecurity.

Almost nobody teaches them how to build a culture people actually want to be part of.

In this episode of CISO Tradecraft, G. Mark Hardy and Ross Young break down the leadership lessons that separate average security organizations from world-class ones.

You’ll learn how to:

• Build a security team people WANT to join
• Develop your employees into future CISOs
• Reward behavior that actually changes culture
• Communicate like an executive
• Spot when your company may NEVER promote you to CISO
• Prevent burnout before your best people leave
• Build trust across the business
• Create a culture of excellence, accountability, and curiosity

Ross also shares how he turned phishing awareness into a company competition, complete with trophies, CEO recognition, and brisket parties.

Because great cybersecurity leadership isn't just about stopping hackers.

It's about building an organization where great people can do their best work.

• What’s the ONE leadership rule every CISO should follow?

Subscribe to CISO Tradecraft for practical lessons on cybersecurity leadership, strategy, risk, and becoming a more effective CISO.

Template for Command Philosophy: https://www.gmarkhardy.com/Navy_Articles/NRA-0306%20Template%20for%20a%20Command%20Philosophy.pdf

The biggest threat to a CISO might not be ransomware, it might be burnout. In this episode, G. Mark Hardy brings on We Hack Health to reveal why brilliant security leaders are sacrificing their health, how accountability can reverse the damage, and the one rule every CISO should follow: Never miss twice. Watch this before your career costs you everything.

Link to CruiseCon

https://cruisecon.com/events/cruisecon-privacy-ai-2026/

Use code: CISOTRADECRAFT10 for a 10% discount

Claude Code Is INSANE… But Is It Safe?

AI coding just went from “autocomplete my code” to “give me the entire repository and let me run the company.”

In this episode of CISO Tradecraft, G Mark Hardy and Ross Young break down what Claude Code can actually do, and the security implications that come with it.

Claude Code can read entire codebases, create and edit multiple files, run commands, execute tests, and operate like an AI developer sitting directly inside your environment.

But there’s a catch…

Every token costs money. And every permission creates risk.

We break down:

• 🔥 Tokenomics — How to get dramatically more AI coding for your dollar
• 🔥 PRDs — Why you should use powerful models to THINK before cheaper models BUILD
• 🔥 Security Risks — What happens when an AI agent can execute commands and modify your environment?
• 🔥 AI Licenses — Individual vs. enterprise and what CISOs need to worry about
• 🔥 Privacy & Regulated Data — When you may need offline or open-weight models
• 🔥 Harnesses — The policy-driven guardrails that can move security WAY earlier in the development process
• 🔥 MCP — How AI agents can connect to tools, systems, and data… and why permissions become a massive security issue
• 🔥 Agents & Skills — Serial vs. parallel agents, prompts, context, commands, hooks, and Markdown-based skills
• 🔥 Threat Modeling AI — Why you need to start threat modeling the prompts AND the tools

The big question isn't:

“Can AI write code?”

It absolutely can.

The question is:

“What happens when we give AI the keys to the kingdom?”

If you're a CISO, security leader, developer, or anyone trying to understand where agentic AI coding is heading, this episode is for you.

🎙️ Subscribe to CISO Tradecraft for more unfiltered conversations about cybersecurity, AI, leadership, and the future of the CISO.

Check out the Harness that Ross is building:

https://github.com/Clear-Capabilities/agentic-security

Most cybersecurity advice is built for massive enterprises.

But what happens when you're a small or medium-sized business and you don't have a 200-person security team… or a massive budget?

In this episode, Mark Hardy sits down with vCISO Carlota Sage to break down what actually works.

Carlota shares lessons from her time at FireEye during its explosive growth and the Mandiant acquisition—and why being a great security leader isn't just about knowing cybersecurity.

It's about IT fundamentals. Influence. Emotional intelligence. And knowing how to lead people.

We also dive into:

Why simply saying "thank you" can transform your security culture 💰 How cybersecurity can become sales enablement and revenue protection 📈 Why security teams should work directly with sales and finance 🔒 Why compliance isn't security—but ISO 27001 and PCI DSS can still be incredibly valuable for smaller companies 🤖 How AI is creating a massive new attack surface 🕵️ The growing risk of sensitive data leaking into AI tools 💸 Why the real cost of AI isn't just the subscription price 🎯 Who should be accountable when AI goes wrong

The BIG takeaway?

You don't need to be a Fortune 500 company to build a strong security program.

But you do need to understand the business, influence people, protect revenue, and help your organization use technology without creating a disaster in the process.

Watch now and let us know in the comments:

What's the biggest cybersecurity challenge facing small and medium-sized businesses right now? 👇

AI can change your network in seconds… but your security approvals still take DAYS. In this episode, Tufin CISO Jeffrey Spear reveals how CISOs can use automation and AI without accidentally scaling security mistakes at machine speed. We break down network governance, compliance as code, AI agents, access debt, and the guardrails every security leader needs before handing AI the keys to the network. Automate the right way or build a faster way to be wrong.

Get Your Network Exposure Assessment https://explore.tufin.com/assessment

Big thanks to our sponsor Tufin.