In this episode, Tabetha Baume examines how foreign adversaries are exploiting hiring processes, personnel, business partnerships, and AI to gain access to sensitive organizations and government systems.

She explores North Korean remote IT workers, insider recruitment near military installations, foreign-linked partnerships, and AI-assisted cyberattacks to demonstrate how seemingly routine interactions can become intelligence collection and security threats.

Her key message is that organizations must strengthen identity verification, insider threat awareness, foreign contact reporting, and security procedures while creating a culture where employees recognize and report suspicious activity before it becomes a larger threat.

In this episode, Tabetha Baume examines how mergers and acquisitions involving cleared companies can create significant national security and business risks because a facility clearance does not automatically transfer when ownership changes.

She explores DCSA reporting requirements, facility clearance eligibility, key management personnel changes, contract novation, FOCI considerations, and CFIUS review to demonstrate how failing to address security requirements early can delay transactions, freeze new classified business, or even force a deal to be unwound.

Her key message is that security must be integrated into the transaction from the beginning by involving the FSO early, notifying DCSA, understanding the buyer’s ownership structure, protecting critical cleared positions, and building regulatory timelines directly into the deal.

In this episode, Tabetha Baume explains what it actually takes to operate a cleared company under a Foreign Ownership, Control, or Influence (FOCI) mitigation agreement and how these agreements reshape security, governance, and day-to-day business operations.

She explores government security committees, technology control and communications plans, annual compliance reporting, National Interest Determinations, and the operational restrictions created by foreign ownership to demonstrate how FOCI mitigation affects everything from board governance and affiliate communications to classified contract eligibility.

Her key message is that organizations must treat FOCI mitigation as an ongoing operating structure rather than a one-time compliance exercise by maintaining strong governance, documenting foreign interactions, integrating security into business decisions, and empowering FSOs and outside directors to actively oversee compliance.

In this episode, Tabetha Baume examines how foreign ownership, private equity investments, and beneficial ownership structures are becoming critical national security concerns as new regulations expand Foreign Ownership, Control, or Influence (FOCI) requirements beyond the traditional cleared contractor community.

She explores Section 847, proposed DFARS rules, SF-328 reporting requirements, venture capital and private equity investments, beneficial ownership disclosures, and FOCI mitigation measures to demonstrate how ownership structures, foreign investment, and corporate governance can create national security risks even when no wrongdoing has occurred.

Her key message is that organizations must proactively understand and document their ownership structures, capital sources, foreign relationships, and governance arrangements while preparing for expanded FOCI reporting and mitigation requirements that will increasingly shape eligibility for Department of Defense contracts.

In this episode, Tabetha Baume explains how the greatest security risks facing cleared contractors often exist outside classified systems, highlighting the overlooked vulnerabilities within unclassified networks, physical security systems, and Controlled Unclassified Information (CUI) environments.

She explores NISPOM requirements, CUI assessment provisions, CMMC readiness, insider threat integration, and the cybersecurity risks posed by access control systems, badge readers, surveillance infrastructure, and other unclassified systems that support classified operations to demonstrate how organizational silos create critical security blind spots.

Her key message is that organizations must bridge the gap between security, IT, and compliance by documenting and governing the unclassified systems that support classified operations, strengthening CUI oversight, and ensuring physical security technologies are managed with the same rigor as traditional cybersecurity assets.

Episode 50 Summary – The Off Switch

In this episode, Tabetha Baume examines how AI adoption, shadow AI, and long-standing cybersecurity failures are creating systemic risks that traditional security and compliance models can no longer address.

She explores the Salt Typhoon cyber campaign, shadow AI, AI governance gaps, China's long-term data collection strategy, and the emerging threat of "Harvest Now, Decrypt Later" quantum attacks to demonstrate how ungoverned AI use, outdated security practices, and fragmented organizational responsibilities are exposing sensitive information and critical infrastructure.

Her key message is that organizations must shift from static compliance to continuous security by implementing AI governance, maintaining visibility into AI usage, strengthening collaboration between security and IT, preparing for post-quantum cryptography, and treating security as an ongoing process rather than a one-time certification.

Episode 49 Summary – The Secret's Out Book Launch

In this episode, Tabetha Baume introduces her new book, The Secrets Out: The Death of National Security in the AI Age, explaining how AI, evolving cyber threats, and outdated security frameworks are reshaping the national security landscape.

She explores the impact of the Salt Typhoon cyber campaign, shadow AI, deepfakes, and policy gaps to demonstrate how modern threats are exposing weaknesses in traditional classification systems, insider threat programs, and organizational trust.

Her key message is that organizations must move beyond awareness by implementing comprehensive AI governance, data classification, workforce training, and enforceable AI policies to protect sensitive information and strengthen security in the AI era.

Episode 48 Summary – The Insider You Didn't Hire

In this episode, Tabetha Baume explains how artificial intelligence has transformed the insider threat landscape by introducing AI agents that operate inside trusted environments with legitimate access to sensitive systems, data, and organizational workflows.

She examines emerging risks including agentic AI, prompt injection, shadow AI, deepfake impersonation, and fraudulent remote workers to demonstrate how organizations can unknowingly expose themselves to security breaches without traditional hacking or malicious insiders.

Her key message is that organizations must govern AI with the same rigor as human insiders by enforcing least-privilege access, human oversight, AI usage policies, continuous monitoring, and strong verification practices to securely integrate AI into mission-critical environments.

Episode 47 Summary – The Recruiter Who Wasn't

In this episode, Tabetha Baume explains how artificial intelligence has become a new type of insider threat, with AI assistants and autonomous agents operating inside trusted environments with legitimate access to sensitive systems and data.

She examines the risks posed by agentic AI, prompt injection attacks, shadow AI, deepfakes, and fraudulent remote workers to demonstrate how organizations can unknowingly introduce new vulnerabilities without a traditional cyber breach.

Her key message is that organizations must govern AI tools with the same discipline applied to human insiders by enforcing least-privilege access, human oversight, data protection policies, vendor due diligence, and continuous monitoring to safely integrate AI into security-sensitive environments.

Episode 46 Summary – The Academic Front

In this episode, Tabetha Baume explains how foreign adversaries exploit U.S. universities and academic research environments to acquire sensitive technologies, recruit future intelligence assets, and gain access to defense-related research.

She examines the cases of Charles Lieber, Zheng Xiaoqing, and Ji Chaoqun to demonstrate how foreign talent programs, technology theft, undisclosed foreign affiliations, and long-term recruitment efforts target both researchers and emerging professionals.

Her key message is that organizations must strengthen research security, export control compliance, data protection, and insider threat awareness while ensuring researchers and academic partners understand how to recognize, report, and defend against foreign intelligence collection efforts.