Commanding Cyber

Visit Ridgeback Network Defense to learn more about its approach to cybersecurity and how organizations can move beyond traditional defensive strategies to address today's evolving threats.

In this episode of Commanding Cyber, host Scott Fogarty sits down with Ray Spangler, Senior Vice President and Chief Technology Officer at Barge Design Solutions, to discuss the growing responsibility of business leaders in cybersecurity. Drawing on his experience in the U.S. Air Force, telecommunications, and enterprise technology leadership, Ray shares why cybersecurity must extend beyond IT and become a business-wide priority. The conversation explores the limitations of detection-based security, the growing impact of AI-driven attacks, vulnerabilities in operational technology and critical infrastructure, and the importance of translating technical risks into business consequences. Together, Scott and Ray examine why organizations need to rethink traditional security strategies and empower leadership to make meaningful decisions before a crisis occurs.

Key Topics

• Connection versus resistance: Why systems designed to connect people, organizations, and infrastructure must also be designed to withstand and resist adversarial activity.
• Classification versus control: The limitations of detection-based security and why identifying threats doesn't necessarily prevent attackers from taking their next steps.
• Compliance versus operational effectiveness: Balancing regulatory requirements and certifications with investments that actually improve an organization's security and resilience.
• Human processes versus machine speed: How AI and automation are accelerating attacks, exploiting human workflows, and challenging traditional security response models.
• Authority before crisis: Why leadership must establish the authority and support necessary to implement segmentation, containment, defensive measures, and decisive action before an attack occurs.

Connect with Ray Spangler

• LinkedIn: https://www.linkedin.com/in/ray-spangler-7a3636b/
• Barge Design Solutions LinkedIn: https://www.linkedin.com/company/barge-design-solutions-inc/home/
• Barge Design Solutions Website: https://www.bargedesign.com

About the Guest

Ray Spangler is the Senior Vice President and Chief Technology Officer at Barge Design Solutions, a multidisciplinary architecture and engineering firm. His professional background includes military communications service in the United States Air Force, telecommunications infrastructure, network engineering, and securing mobile and IoT environments. At Barge, Ray oversees IT operations, infrastructure, and security, working to align technology investments and cybersecurity priorities with the organization's broader business objectives.

Connect with Scott Fogarty

• Scott Fogarty, Host of Commanding Cyber: https://www.linkedin.com/in/scott-c-fogarty/
• Ridgeback Network Defense: https://www.ridgebacknet.com

Visit Ridgeback Network Defense to learn more about its approach to cybersecurity and how organizations can rethink their defenses against increasingly automated threats.

https://www.ridgebacknet.com

In this episode of Commanding Cyber, Scott Fogarty speaks with Adam Burke, VP of Sales & Partnerships at Quest Technology Management, about the intersection of military leadership, cybersecurity strategy, and organizational risk. Drawing on his experience as a U.S. Army infantry officer, Adam shares how the military concept of commander's intent can help business leaders align security, IT, and governance teams around clear priorities and acceptable risk. They explore how AI is accelerating vulnerability discovery and cyberattacks, why traditional detection-focused security approaches may not be enough, and why organizations need to establish decision-making authority before an incident occurs. The conversation highlights the importance of proactive planning, business continuity, and leadership accountability in an environment where every organization can become a target.

What We Discussed

• Military leadership principles and how commander's intent can help cybersecurity, IT, and governance teams work toward a shared strategy.
• How AI is accelerating vulnerability discovery and exploitation, giving attackers the ability to identify and exploit weaknesses at machine speed.
• Why cybersecurity must be approached as a business risk management issue rather than a purely technical responsibility.
• The importance of establishing incident response plans, disaster recovery procedures, and decision-making authority before a cyber incident occurs.
• How organizations can evaluate the trade-offs between new technologies, operational convenience, productivity gains, and increased security exposure.
• Why traditional detection-focused security strategies may need to evolve toward more proactive approaches that create friction and impose costs on adversaries.

Connect with Adam Burke

• LinkedIn: https://www.linkedin.com/in/adam-burke-0455bb21/
• Quest Technology Management — LinkedIn: https://www.linkedin.com/company/quest-media-&-supplies-inc-/about/
• Quest Technology Management Website: https://questsys.com

About Adam Burke

Adam Burke is the VP of Sales & Partnerships at Quest Technology Management, a technology services provider offering managed IT and cybersecurity services. Following his service as a U.S. Army infantry officer with the 101st Airborne Division, Adam joined his family's business and helped expand its reach through strategic partnerships. His experience brings a military leadership perspective to cybersecurity risk management, operational resilience, and organizational decision-making.

Connect with Scott Fogarty

• Ridgeback Network Defense: https://www.ridgebacknet.com
• Scott Fogarty — LinkedIn: https://www.linkedin.com/in/scott-c-fogarty/

Visit Ridgeback Network Defense to learn more about a different approach to cybersecurity—one focused on changing the economics of cyberattacks and helping organizations build stronger, more resilient defenses.

On this episode of Commanding Cyber, host Scott Fogarty speaks with Dara Gibson, Chief Information Security Officer at Cyber Ready, about the intersection of cybersecurity, business leadership, and cyber insurance. They explore why traditional security approaches built around detection and compliance may fall short against AI-accelerated attacks, and why organizations need to prioritize operational readiness, resilience, and meaningful risk management. Dara explains how business leaders, security teams, and insurance professionals can work together to establish effective controls, clarify accountability, and protect critical business assets. The conversation highlights why cybersecurity must be treated as a core business responsibility rather than simply an IT expense.

What We Discussed

• Systems built to connect are often expected to defend themselves, creating new security challenges as organizations become increasingly dependent on interconnected technologies and third-party services.
• Alerts do not necessarily change what an attacker can do next, raising questions about the limitations of detection-focused security and the need to make attacks more difficult and costly for adversaries.
• Documented effort is not the same as operational control. Organizations must verify that security measures, including multifactor authentication and other insurance-related controls, are implemented consistently and effectively.
• AI compresses attack time beyond human-centered response, challenging traditional assumptions about detection, incident response, and the time available to defend business systems.
• Leaders must preauthorize constraint, segmentation, deception, and consequence. Cybersecurity decisions should be made before a crisis, with clear authority and an understanding of which risks the organization is willing to accept.
• Cyber insurance requires collaboration between business leaders, security professionals, and insurance specialists. Organizations need to understand their coverage requirements, validate their security controls, and recognize that insurance transfers financial risk but does not replace effective cybersecurity.

Connect with Dara Gibson

• LinkedIn — Dara Gibson
• Cybersecurity Readiness Advisors — LinkedIn
• Cybersecurity Readiness Advisors — Website

About Dara Gibson

Dara Gibson is the Chief Information Security Officer at Cyber Ready and the founder and CEO of Cybersecurity Readiness Advisors. Her work focuses on cybersecurity readiness, incident response, and the intersection of security controls and cyber insurance. She helps organizations understand their cybersecurity risks, strengthen their defenses, and prepare to recover when incidents occur.

Connect with Commanding Cyber

• Scott Fogarty — LinkedIn
• Ridgeback Network Defense — Website

Visit Ridgeback Network Defense to learn more about its approach to cybersecurity and how it thinks about defending organizations in an increasingly automated threat environment: https://www.ridgebacknet.com

On this episode of Commanding Cyber, Scott Fogarty speaks with Kayne McGladrey, cybersecurity author and vCISO, about why cyber risk needs to be treated as a business and governance issue rather than a problem that security teams can solve alone. Drawing from more than two decades in cybersecurity and his book Cyber Risk is a Myth, Kayne discusses the communication failures that repeatedly produce predictable security outcomes. The conversation explores the growing impact of AI and automation, the limitations of compliance-driven security, and the challenge of defending against threats operating at machine speed. Kayne also explains how security leaders can build stronger relationships with business leaders by connecting cybersecurity risks to the priorities and performance indicators those leaders already care about.

What We Discussed

• Connection versus resistance — Why security leaders need to build relationships and coalitions throughout the business instead of relying on fear-based messaging or trying to justify security controls from the security department alone.
• Classification versus control — The conversation examines how organizations can move beyond simply categorizing cyber risk and instead connect identified risks to the business systems, owners, and decisions that actually determine how that risk is handled.
• Compliance versus effect — Kayne explains why compliance should not be confused with security and why organizations need to focus on measurable business outcomes, including disruption, financial impact, customer attrition, and other consequences.
• Human process versus machine tempo — AI-enabled automation is changing the pace, scope, and scale of cyber activity, creating a mismatch between rapidly evolving threats and traditional organizational planning and budgeting cycles.
• Authority before crisis — Effective cyber governance requires clear ownership and risk acceptance before an incident occurs. Security leaders can advise and quantify exposure, but business leaders ultimately need to understand and accept the risks associated with the systems they own.

Connect with Kayne McGladrey

• LinkedIn: https://www.linkedin.com/in/kaynemcgladrey/?isSelfProfile=false
• Website: https://kaynemcgladrey.com

About Kayne McGladrey

Kayne McGladrey is a cybersecurity professional, author, and vCISO with more than 20 years of experience in cybersecurity. He is the author of Cyber Risk is a Myth, a book focused on the relationship between cybersecurity, business risk, communication, financial incentives, and governance. His work emphasizes connecting security decisions to the priorities and outcomes that matter to the broader organization.

Ridgeback Network Defense

• Website: https://www.ridgebacknet.com
• Scott Fogarty, CEO: https://www.linkedin.com/in/scott-c-fogarty/

Play the Ridgeback Network Defense cyber resilience games and put your skills to the test. See how you measure up and learn more about building a stronger defense at https://www.ridgebacknet.com.

In contested cyberspace, leaders rarely get the certainty they want before they have to make decisions that could determine whether the business keeps operating.

On this episode of Commanding Cyber, Scott Fogarty is joined by Bryce Austin, CSP, CISM, CEO of TCE Strategy, for a leadership conversation shaped by real incidents and real business consequences.

Bryce has worked through ransomware attacks, multimillion-dollar wire fraud, website and domain takeovers, and the organizational fallout that follows when critical systems become unavailable.

Drawing from a ransomware incident that left one company without its ERP system for three weeks, Scott and Bryce will examine what effective incident leadership looks like when normal operations stop.

They will discuss how executives can preserve operational resilience, make decisions under intense uncertainty, and translate technical information into an honest picture of business risk.

Commanding Cyber brings you Leadership Conversations for Contested Cyberspace, focused on the decisions leaders must make before, during, and after disruption.

Connect with Bryce Austin

• Bryce's LinkedIn: https://www.linkedin.com/in/bryceaustin/
• TCE Strategy on LinkedIn: https://www.linkedin.com/company/tcestrategy/
• TCE Strategy Website: https://bryceaustin.com

Connect with Ridgeback Network Defense

• Scott Fogarty on LinkedIn: https://www.linkedin.com/in/scott-c-fogarty/
• Ridgeback Network Defense on LinkedIn: https://www.linkedin.com/company/ridgeback-network-defense/
• Website: https://www.ridgebacknet.com

About Commanding Cyber

Cybersecurity isn't just an IT problem—it's a leadership problem. Hosted by Scott Fogarty, Commanding Cyber examines the decisions, strategies, and responsibilities that shape how organizations manage cyber risk. Scott brings technical experts, business leaders, military professionals, regulators, and cybersecurity practitioners together to explore what happens when technology, leadership, compliance, and real-world threats collide. From emerging threats like AI to questions of accountability, governance, and preparedness, the show tackles the issues leaders need to understand before a crisis occurs. Because a cyberattack doesn't target a department—it targets an organization.

Visit Ridgeback Network Defense to learn more about how its approach to cybersecurity helps organizations think differently about resilience, risk, and defense in a rapidly changing threat environment: https://www.ridgebacknet.com

On this episode of Commanding Cyber, Scott Fogarty talks with Trevor Horwitz, CISO and Founder of TrustNet, about what it really means to build a resilient organization in an increasingly automated threat environment. They explore the gap between cybersecurity compliance and actual security, why traditional assurance frameworks may struggle to account for AI-enabled attacks, and how organizations can better connect business risk with technical security decisions. Trevor also shares his perspective on risk assessment, security testing, cyber insurance, and the importance of helping business leaders understand cybersecurity well enough to make informed decisions.

What We Discussed

• Why compliance does not equal security, and why meeting an assurance framework should be viewed as a baseline rather than the end goal.
• The growing challenge of AI-enabled attacks, including how automation can reduce the cost of attacks while increasing their speed, scale, and scope.
• Why cybersecurity decisions should begin with a business-focused risk assessment that identifies potential threat vectors and their consequences.
• The communication gap between technical security teams and the C-suite, and why organizations benefit from a top-down approach that translates business risk into technical requirements.
• How cyber insurance is evolving as insurers become more sophisticated in evaluating security practices, controls, people, processes, and technology.
• Why organizations need to think about cybersecurity as part of a broader interconnected ecosystem, where the compromise of one service provider can create consequences for customers and other organizations.

Connect with Trevor Horwitz

• LinkedIn: https://www.linkedin.com/in/trevorhorwitz/

• TrustNet on LinkedIn: https://www.linkedin.com/company/trustnet-inc/

• TrustNet: https://trustnetinc.com

About Trevor Horwitz

Trevor Horwitz is the CISO and Founder of TrustNet, a cybersecurity company focused on assurance services, security testing, risk assessments, and helping organizations understand and manage their security requirements. Trevor has spent roughly three decades working across cybersecurity, consulting, and entrepreneurial ventures, serving organizations ranging from early-stage companies to large enterprises.

Connect with Ridgeback Network Defense

• Scott Fogarty on LinkedIn: https://www.linkedin.com/in/scott-c-fogarty/
• Ridgeback Network Defense on LinkedIn: https://www.linkedin.com/company/ridgeback-network-defense/
• Website: https://www.ridgebacknet.com

About Commanding Cyber

Cybersecurity isn't just an IT problem—it's a leadership problem. Hosted by Scott Fogarty, Commanding Cyber examines the decisions, strategies, and responsibilities that shape how organizations manage cyber risk. Scott brings technical experts, business leaders, military professionals, regulators, and cybersecurity practitioners together to explore what happens when technology, leadership, compliance, and real-world threats collide. From emerging threats like AI to questions of accountability, governance, and preparedness, the show tackles the issues leaders need to understand before a crisis occurs. Because a cyberattack doesn't target a department—it targets an organization.

Cyber risk is a business risk, and understanding the difference can change how organizations prepare for the threats they face. Visit Ridgeback Network Defense to learn more about the company’s approach to cybersecurity and protecting organizations in contested cyberspace. https://www.ridgebacknet.com

Episode Summary

In this episode of Commanding Cyber, we speak with Terrence McGraw, CEO of Cape Endeavors, about what it takes for business leaders to understand and manage cyber risk when the consequences are real. Drawing on nearly three decades in the U.S. Army, experience in cyber operations and incident response, and his work in the private sector, Terrence offers a perspective that connects cybersecurity to business risk, mission impact, and organizational decision-making. We explore the challenges facing the defense industrial base, the role of compliance and CMMC, and how AI is changing the speed and complexity of cyber threats. The conversation also examines how boards and executives can use tabletop exercises and better risk metrics to make more informed cybersecurity decisions.

What We Discussed

• Why cybersecurity leaders need to translate technical issues into business risk that CEOs and boards can understand and act upon.
• How Terrence’s military experience shaped his view of cyberspace as a contested environment and influenced his approach to cybersecurity in the private sector.
• The challenges facing the defense industrial base, particularly smaller organizations dealing with cybersecurity requirements, NIST standards, and CMMC.
• Why compliance should be viewed as a foundation of cybersecurity best practices rather than simply an administrative burden.
• How AI is lowering the barriers to cybercrime and espionage while also introducing new challenges around data provenance, data exfiltration, and vulnerabilities.
• How executive teams and boards can use business-focused tabletop exercises to identify critical systems, understand pain thresholds, and prepare for existential cyber risks.

Connect with Terrence McGraw

• LinkedIn: https://www.linkedin.com/in/terry-mcgraw-/ 
• Company Website: https://www.capeendeavors.com

Connect with Ridgeback Network Defense

• Scott Fogarty on LinkedIn: ⁠https://www.linkedin.com/in/scott-c-fogarty/⁠
• Ridgeback Network Defense on LinkedIn: ⁠https://www.linkedin.com/company/ridgeback-network-defense/⁠
• Website: ⁠https://www.ridgebacknet.com⁠

About Commanding Cyber

Cybersecurity isn't just an IT problem, it's a leadership problem. Hosted by Scott Fogarty, Commanding Cyber examines the decisions, strategies, and responsibilities that shape how organizations manage cyber risk. Scott brings technical experts, business leaders, military professionals, regulators, and cybersecurity practitioners together to explore what happens when technology, leadership, compliance, and real-world threats collide. From emerging threats like AI to questions of accountability, governance, and preparedness, the show tackles the issues leaders need to understand before a crisis occurs. Because a cyberattack doesn't target a department, it targets an organization.

Learn more about Ridgeback Network Defense and their approach to cybersecurity, resilience, and protecting organizations from evolving threats at https://www.ridgebacknet.com

In the inaugural episode of Commanding Cyber, host Scott Fogarty sits down with Otuweze Baiye, CEO of Black Knight Risk Management, to explore why cybersecurity needs to be treated as an organizational and leadership responsibility rather than simply an IT function. Otuweze shares how his experience as a West Point graduate, U.S. Army missile defense officer, and cybersecurity bank examiner shaped his approach to digital risk and compliance. Scott and Otuweze discuss the limitations of compliance, the growing role of AI as both a defensive tool and an attack multiplier, and why organizations need to connect technology decisions to actual business use cases. They also examine the divide between IT and cybersecurity and the importance of getting leadership, security, finance, HR, legal, and other stakeholders working toward a shared goal. Ultimately, the conversation makes the case that effective cybersecurity requires communication, accountability, and leadership across the entire organization.

In This Episode

• Why a cyberattack should be viewed as an attack on the entire organization, not just an IT department
• How compliance can establish accountability and processes, but cannot by itself prevent a cyberattack
• Why AI is a force multiplier for both cybersecurity teams and adversaries
• The importance of connecting technology and AI adoption to real business use cases instead of chasing the latest tools
• Why IT, cybersecurity, and business leaders need to work together around a shared organizational mission

Connect with Otuoze Baiye

• LinkedIn: https://www.linkedin.com/in/otuozebaiye/
• Black Knight Risk Management on LinkedIn: https://www.linkedin.com/company/black-knight-risk-management-llc/
• Website: https://blackknightrm.com

Connect with Ridgeback Network Defense

• Scott Fogarty on LinkedIn: https://www.linkedin.com/in/scott-c-fogarty/
• Ridgeback Network Defense on LinkedIn: https://www.linkedin.com/company/ridgeback-network-defense/
• Website: https://www.ridgebacknet.com

About Commanding Cyber

Cybersecurity isn't just an IT problem, it's a leadership problem. Hosted by Scott Fogarty, Commanding Cyber examines the decisions, strategies, and responsibilities that shape how organizations manage cyber risk. Scott brings technical experts, business leaders, military professionals, regulators, and cybersecurity practitioners together to explore what happens when technology, leadership, compliance, and real-world threats collide. From emerging threats like AI to questions of accountability, governance, and preparedness, the show tackles the issues leaders need to understand before a crisis occurs. Because a cyberattack doesn't target a department, it targets an organization.