Cleared For Discussion

In this episode, Tabetha Baume explains what it actually takes to operate a cleared company under a Foreign Ownership, Control, or Influence (FOCI) mitigation agreement and how these agreements reshape security, governance, and day-to-day business operations.

She explores government security committees, technology control and communications plans, annual compliance reporting, National Interest Determinations, and the operational restrictions created by foreign ownership to demonstrate how FOCI mitigation affects everything from board governance and affiliate communications to classified contract eligibility.

Her key message is that organizations must treat FOCI mitigation as an ongoing operating structure rather than a one-time compliance exercise by maintaining strong governance, documenting foreign interactions, integrating security into business decisions, and empowering FSOs and outside directors to actively oversee compliance.

In this episode, Tabetha Baume examines how foreign ownership, private equity investments, and beneficial ownership structures are becoming critical national security concerns as new regulations expand Foreign Ownership, Control, or Influence (FOCI) requirements beyond the traditional cleared contractor community.

She explores Section 847, proposed DFARS rules, SF-328 reporting requirements, venture capital and private equity investments, beneficial ownership disclosures, and FOCI mitigation measures to demonstrate how ownership structures, foreign investment, and corporate governance can create national security risks even when no wrongdoing has occurred.

Her key message is that organizations must proactively understand and document their ownership structures, capital sources, foreign relationships, and governance arrangements while preparing for expanded FOCI reporting and mitigation requirements that will increasingly shape eligibility for Department of Defense contracts.

In this episode, Tabetha Baume explains how the greatest security risks facing cleared contractors often exist outside classified systems, highlighting the overlooked vulnerabilities within unclassified networks, physical security systems, and Controlled Unclassified Information (CUI) environments.

She explores NISPOM requirements, CUI assessment provisions, CMMC readiness, insider threat integration, and the cybersecurity risks posed by access control systems, badge readers, surveillance infrastructure, and other unclassified systems that support classified operations to demonstrate how organizational silos create critical security blind spots.

Her key message is that organizations must bridge the gap between security, IT, and compliance by documenting and governing the unclassified systems that support classified operations, strengthening CUI oversight, and ensuring physical security technologies are managed with the same rigor as traditional cybersecurity assets.

Episode 50 Summary – The Off Switch

In this episode, Tabetha Baume examines how AI adoption, shadow AI, and long-standing cybersecurity failures are creating systemic risks that traditional security and compliance models can no longer address.

She explores the Salt Typhoon cyber campaign, shadow AI, AI governance gaps, China's long-term data collection strategy, and the emerging threat of "Harvest Now, Decrypt Later" quantum attacks to demonstrate how ungoverned AI use, outdated security practices, and fragmented organizational responsibilities are exposing sensitive information and critical infrastructure.

Her key message is that organizations must shift from static compliance to continuous security by implementing AI governance, maintaining visibility into AI usage, strengthening collaboration between security and IT, preparing for post-quantum cryptography, and treating security as an ongoing process rather than a one-time certification.

Episode 49 Summary – The Secret's Out Book Launch

In this episode, Tabetha Baume introduces her new book, The Secrets Out: The Death of National Security in the AI Age, explaining how AI, evolving cyber threats, and outdated security frameworks are reshaping the national security landscape.

She explores the impact of the Salt Typhoon cyber campaign, shadow AI, deepfakes, and policy gaps to demonstrate how modern threats are exposing weaknesses in traditional classification systems, insider threat programs, and organizational trust.

Her key message is that organizations must move beyond awareness by implementing comprehensive AI governance, data classification, workforce training, and enforceable AI policies to protect sensitive information and strengthen security in the AI era.

Episode 48 Summary – The Insider You Didn't Hire

In this episode, Tabetha Baume explains how artificial intelligence has transformed the insider threat landscape by introducing AI agents that operate inside trusted environments with legitimate access to sensitive systems, data, and organizational workflows.

She examines emerging risks including agentic AI, prompt injection, shadow AI, deepfake impersonation, and fraudulent remote workers to demonstrate how organizations can unknowingly expose themselves to security breaches without traditional hacking or malicious insiders.

Her key message is that organizations must govern AI with the same rigor as human insiders by enforcing least-privilege access, human oversight, AI usage policies, continuous monitoring, and strong verification practices to securely integrate AI into mission-critical environments.

Episode 47 Summary – The Recruiter Who Wasn't

In this episode, Tabetha Baume explains how artificial intelligence has become a new type of insider threat, with AI assistants and autonomous agents operating inside trusted environments with legitimate access to sensitive systems and data.

She examines the risks posed by agentic AI, prompt injection attacks, shadow AI, deepfakes, and fraudulent remote workers to demonstrate how organizations can unknowingly introduce new vulnerabilities without a traditional cyber breach.

Her key message is that organizations must govern AI tools with the same discipline applied to human insiders by enforcing least-privilege access, human oversight, data protection policies, vendor due diligence, and continuous monitoring to safely integrate AI into security-sensitive environments.

Episode 46 Summary – The Academic Front

In this episode, Tabetha Baume explains how foreign adversaries exploit U.S. universities and academic research environments to acquire sensitive technologies, recruit future intelligence assets, and gain access to defense-related research.

She examines the cases of Charles Lieber, Zheng Xiaoqing, and Ji Chaoqun to demonstrate how foreign talent programs, technology theft, undisclosed foreign affiliations, and long-term recruitment efforts target both researchers and emerging professionals.

Her key message is that organizations must strengthen research security, export control compliance, data protection, and insider threat awareness while ensuring researchers and academic partners understand how to recognize, report, and defend against foreign intelligence collection efforts.

Episode 45 Summary – Elicitation Without Direct Questions

In this episode, Tabetha Baume explains how foreign intelligence services use elicitation techniques to gather sensitive information through seemingly harmless conversations rather than direct questions.

She examines the cases of Glenn Duffie Shriver, James Fondren, and Kevin Mallory to show how social interactions, professional networking, and online engagement can gradually evolve into intelligence collection and espionage.

Her key message is that cleared professionals must recognize elicitation tactics, limit sensitive disclosures, maintain strong operational security, and report suspicious contacts early to prevent foreign intelligence exploitation.

Episode 44 Summary – Don't Sleep on These Two

In this episode, Tabetha Baume explains how Iran and North Korea pose significant but often overlooked threats to cleared contractors through cyber operations, insider access, and unconventional intelligence tactics.

She highlights Iran’s cyber campaigns targeting critical infrastructure and defense contractors, as well as North Korea’s scheme of placing intelligence operatives inside U.S. companies through fraudulent remote IT jobs and laptop farm networks.

Her key message is that security programs must expand their focus beyond China and Russia by strengthening cyber defenses, remote hiring verification, insider threat awareness, and reporting processes to counter emerging threats from Iran and North Korea.