This was another exhausting #RSAC in San Francisco but I think I'm finally getting a handle on it. There will be more to come, but Bruce Schneier gave a keynote on Tuesday that I think bodes well for journalism.

And we had a visit with our friend at Safety National Insurance, Spencer Timmel, about just how far insurance can cover cybersecurity wweaknesses.

This is a short episode previewing what I'll be doing at RSAC 2025 next week, kudos to the California Franchise Tax Board, and a how-to on working with the press.

There comes a moment in many abusive relationships, when observant friends encourage the abused party to leave the abuser.

I consider myself a friend of the cybersecurity industry, aside from its bad marketing practices, I see it as important to the well-being of society worldwide. And that’s why I say now, it’s time to leave the federal government, at least for the next two years.

The actions persecuting Chris Krebs and SentinelOne for merely for doing their jobs without political bias, demonstrate that no amount of money is worth working with the Trump administration.

I spend much of the past week unsuccessfully trying to get members of the US cyber industry to comment publicly on this issue. I was able to get public comment from a few outside the country. Some of that can be found in my piece this week on Cyber Protection Magazine. This podcast is with one of the commenters, James Bore, a British cybersecurity consultant and speaker. He says what everyone is thinking.

It’s time to divorce the orange git.

When it comes to polite discussion, there are two things you should never discuss: Politics and Religion. At the same time, most people would also rather not talk about insurance or data encryption. Well, I can’t say I’m all that polite, because that is exactly what this episode is about.

The need for encryption on or data has never been more important, but msot of us don’t know what is or isn’t encrypted and that knowledge has a direct bearing on how much cybersecurity insurance might cost. So we sat down with Spencer Timmel, head of cybersecurity and technology insurance for Safety National, the primary sponsor for this podcast, and we discussed the unmentionable topics.

Microsoft haw cancelled plans for a massive build out of AI data centers and China is shutting down gigawatts or AI processing due to lack of demand. It seems the AI boom is on the verge of busting as big as the Dotcom collapse. And since cybersecurity companies seem dependent on the AI buzzwords to sell their services, that is going to mean change for the industry.

We chatted with ThreatLocker CEO Danny Jenkins and Reality Defender CEO Ben Colman about what is and isn't real regarding the concepts of AI threats.

The "Signalgate" scandal has raised the issue of encryption to a broader audience in the past week.  On the plus side, many sources say that 95% of digital traffic is encrypted now, compared to 43% in 2014, but most people have no idea that their personal data is being encrypted. It’s one of those invisible technologies that touch many people.

But there is a basic fact, that a lot of stuff that should be secured, isn’t because users don’t know they have to turn it on  For example, WhatsApp, the messenger platform from Meta, advertises that they have end to end encryption, but they don’t tell you that you have to turn it on to get that benefit. 

So that brings us to today.  What is encryption? Why do we need it and where does it come into play.  We talk with Luigi Caramico, CTO and founder of DataKrypto, a company dedicated to encryption. And not just encryption but fully homomorphic encryption, an important step forward in protecting our data

As I've said before, I get a lot of "studies" and "surveys" from cybersecurity firms with breathless and urgent warnings about a coming cyber-pocalypse of one sort or another. Funny thing, it's always about something that they supposedly defend against. As I started writing this note, I got another one.

I did one podcast about a survey from Huntress about phishing in February, which was actually pretty good. Then I did one a couple of weeks ago about a less-than-good survey from iProov. Well, my partner in Germany, Patrick Boch, wanted to get into the fun and we decided to talk about two more of these that were also less-than-good from HiddenLayer and Ontinue. No, we didn't interview representatives from either company on this one. We were just having some fun at, unfortunately, their expense.

Here are some of the highlights of our discussion.

• Many cybersecurity surveys lack scientific rigor, often using small, potentially biased samples (e.g., 250 IT decision-makers)
• Reports frequently make vague assumptions or present data in ways that may exaggerate threats or market demand
• Deep fake attacks, while concerning, are currently not as prevalent or successful in cybercrime as often portrayed
• The Verizon Data Breach Investigation Report (DBIR) is considered a gold standard for its concrete terms and unbiased approach

The DDoS attack on X.com this week provided a certain amount of schadenfreude for people less than enamored by Elon Musk. It also rang alarm bells in the cybersecurity community as that style of attack seems to be making a comeback, and not for financial gain. All indications are corporations, and, in particular, government institutions are not ready to repel attacks motivated by political revenge.

We talked with Inversion6 CISO Ian Thornton-Trump about how the attack was allowed to happen and what it may mean for the very near future.

I get a lot of "studies" about the state of cybersecurity and most of them are poorly done. In Episode 10.8 I talked about one I like, from Huntress and the week it came out I got pitched another report from iProov that was, well, less than well done. And as much as I tried to help them focus on reality, the more they pushed back.

Again, this is not a knock on what the company does, which is to ensure the veracity of biometric identity, but it is a good example of how cybersecurity companies spend too little and on the wrong efforts to get their story out.

Artificial Intelligence is all the rage right now with broad claims about how it is going to change the world as we know it. I have my doubts about the hype and so does Bob Ackerman, the granddaddy of cybersecurity venture capital, founder and managing director of AllegisCyber Capital (for the past 29 years) and cofounder of the cyber incubator, DataTribe in Maryland.

I always enjoy chatting with Bob because he sees the nuts and bolts of tech advancements and isn’t the kind of investor to get swayed by the glitz of questionable marketing. In this session, we discussed how AI is starting to displace high-paying jobs like computer coding and legal work, raising concerns about who will be left to buy the AI subscriptions and services. While there will be short-term disruption, he thinks AI will ultimately enable new industries and use cases that create new jobs and economic opportunities. Surprisingly enough, he believes the transition may require policies like universal basic income to support displaced workers.

We also discussed the demographic challenges facing countries like the US and Europe, with aging populations and declining birth rates straining social welfare systems. dAI and automation may help address labor shortages, but also raise questions about how to fund programs like Social Security and Medicare long-term.

More importantly, Bob thinks that the people who invested in AI early will to lose their shirts.

Check it out.