Special guest Mike Pinch talks about Zero Trust security. He presents various ways companies are implementing Zero Trust, how it actually affects a company's security posture, and common misconceptions about the concept.

Do Supplier Risk programs actually reduce risk? If done correctly then possibly but most of the time they are just a burden on vendors. Tim and Chris talk about what's wrong with the current process and how Supplier Risk programs should change.

If you could only have 3 security controls in place, what would they be? Tim and Chris present their top three choices.

Companies love to test their employees' security awareness by spear phishing them and tracking whether or not the employee fell for it. But what does this prove? Tim and Chris discuss whether it's effective, and if we are over phishing our employees.

Special guest Anahi Santiago, CISO of Christiana Care Health System discusses her experience using recruitment agencies for hiring security employees. Tim does not agree with using them.

Tim and Chris discuss the differences between Penetration Testing, Red Teams, and Purple Teams. Learn how these security testing exercises have evolved, and why you would perform one over the other.