Cybersecurity Ecosystem Show

Nathan Wenzler has close to 30 years in cybersecurity and serves as a Field CISO at Optiv, advising security leaders across the company's client base. For most of the past year, that work has meant helping organizations separate what is real in AI from what is marketing.

His conclusion is that the organizations succeeding with AI are the ones applying the same discipline they would apply to any investment: a business case, a defined problem, a cost, a benefits analysis, a risk analysis, and governance. The ones that moved fast without a plan produced the layoffs-then-rehiring headlines. And for leaders worried about competitors pulling ahead, his message is that competitors are having the same conversation.

In this conversation, Nathan explains why slow adopters in critical infrastructure, healthcare, and manufacturing are approaching AI correctly, and why the organizations that opened AI to every employee are now pulling back. The reason is trust. Unlike earlier shifts such as cloud, which changed the tool but not the concept, AI produces output that sounds correct and can be wrong in ways most users cannot detect. When employees act on that output, the error rate becomes business risk. His standard for organizations: verify first, then trust.

He then reframes AI as an application, with a front end, algorithms, and data, which means the required fundamentals are data security, identity and access control, and application security. Most organizations deferred data security because it was hard. AI removes that option.

The episode also covers Nathan's argument that security is a risk management function rather than a technology function, what a Field CISO actually does, how the in-house CISO role has shifted toward communication and translation, a short assessment of the expanding regulatory picture, and a candid look at how security buying has changed, including why large buyers are limiting AI security tools to one-year contracts.

Topics covered:

• Sorting AI reality from marketing hype
• Why the organizations succeeding with AI have a plan
• CISOs leading the AI investment conversation with boards
• Slow adopters: risk tolerance in critical infrastructure, healthcare, and manufacturing
• Starting with knowledge bases on trusted internal data
• Early adopters, rogue agent headlines, and familiar misconfigurations
• Why AI compromises trust in a way cloud did not
• Hallucinations, error rates, and the question "how do you know?"
• Business consequences: legal research, marketing claims, employee decisions
• Verify first, then trust
• AI as an application: data security, identity, application security
• Why data security was deferred and why it cannot be now
• Security as a risk management function
• Tooling versus people and process
• What a Field CISO is, and what it is not
• Reviewing marketing messaging before it reaches security buyers
• The modern CISO as organizational translator
• CISO 2.0 and why the role changed
• The regulatory picture: more rules, distributed globally
• How CISO buying has changed under AI uncertainty

Nathan Wenzler is a Field CISO at Optiv with close to 30 years in cybersecurity. He advises security leaders across Optiv's client base from the perspective of someone who has held the CISO seat, bringing peer credibility, cross-client perspective, and candid guidance on strategy and tooling without a sales quota. His work focuses on AI risk and governance, security fundamentals, and the evolution of the CISO role into a risk management and communication function.

• Nathan on LinkedIn: Nathan Wenzler
• Email: [email protected]
• Optiv: optiv.com

David Levine spent ten years as a CISO at Ricoh before joining Forrester as Vice President and Executive Partner for Security and Risk, where he advises security leaders across government and private industry. In this conversation, he shares what that vantage point revealed: the challenges he assumed were specific to his own program are common across the industry.

David explains why patching, prioritization, and asset inventory remain unfinished at most organizations, and why the cause is capacity rather than understanding. Leaders know what needs to be done; they lack the bandwidth and budget to do all of it. AI makes the problem harder by consuming resources, adding new assets to discover, and multiplying vulnerability volume beyond what current processes can absorb.

He describes what the successful programs have in common: informed and supportive leadership, a grounded CISO, and a working relationship between IT and security, which he found to be a more pervasive problem than he expected. He explains why he considers people the biggest security risk, how he turned resented phishing tests into a skill employees asked for by answering "what's in it for me," and the "no, but" rule he set for his teams.

The core of the episode is executive tabletop exercises. David walks through three real cases, including a CEO who rediscovered a lost continuity process during the exercise and an HR and finance team who realized they did not know their roles, and lays out how to run an executive tabletop so that it produces change rather than compliance.

He closes with a buyer's perspective for vendors and founders: why cold outreach to CISOs fails, what works instead, the difference between a partner and a vendor, and where he sees market demand in AI governance and fundamentals execution.

Topics covered:

• Why the security fundamentals are still unfinished: patching, prioritization, asset inventory
• Capacity versus understanding: budget pressure, staffing, and doing more with less
• How AI adds discovery burden and multiplies vulnerability volume
• What successful programs share: culture, leadership support, grounded in reality
• The pervasive friction between IT and security, and what good looks like
• People as the biggest security risk, and the limits of training
• Answering "what's in it for me" in security awareness
• Reframing phishing tests as personal skill-building
• Influence, storytelling, reciprocity, and leading by example
• Replacing "no" with "no, but"
• Executive tabletop exercises: three real examples
• How to run an executive tabletop: audience, jargon, injects, escalation
• Making training engaging: five-minute animated episodes
• Selling to CISOs: what works, what does not
• Partner versus vendor
• Market demand: AI governance tooling and fundamentals execution
• Prioritizing on real risk, not theoretical risk

David Levine is Vice President and Executive Partner for Security and Risk at Forrester, where he advises CISOs and security leaders across industries. He previously spent 28 years at Ricoh, including roughly a decade as CISO, before moving into the peer advisory role. His work with clients focuses on security fundamentals, leadership influence and storytelling, executive tabletop exercises, and keeping risk prioritization grounded in reality.

• David on LinkedIn: https://www.linkedin.com/in/david-levine-8907133/
• Forrester: forrester.com

Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, when the field was called information security and security teams could not get a meeting with the CIO. In this conversation, he explains how the industry earned its current board-level standing and what security leaders should do with it.

Jim identifies governance as cybersecurity's biggest area of progress, now formalized in NIST 800-53 revision 5 and CSF 2.0, and explains the principle behind effective executive communication: companies do not exist to be secure, so security has to be framed as enabling the business objective with the least risk possible. He credits ransomware with changing executive awareness, because it made operational disruption a universal exposure regardless of what data an organization holds.

On board communication, his guidance is specific. CEOs and CFOs are experienced risk managers who evaluate risk and reward in every decision. What they need from security is an accurate valuation of the organization's cyber exposure, presented as business impact rather than technical terminology.

The conversation then turns to the labor market. Jim confirms what many candidates experience: the entry level is saturated, while engineer-level positions remain unfilled. He outlines the practical path into the field, including structured internships modeled on medicine and psychology, a four-year degree completed on employer tuition reimbursement, and AI governance as a second skill.

He closes with his position on AI adoption: prohibition fails because employees will use AI regardless, so organizations should provide a sanctioned, secure path, supported by enforced data classification and data loss prevention. A follow-up episode on AI and data governance is planned.

• Governance as cybersecurity's biggest area of progress
• NIST 800-53 rev 5, CSF 2.0, and the formalization of governance
• Security as a business enabler rather than a technology function
• How ransomware changed executive awareness of cyber risk
• Remote work and the expansion of the security perimeter
• Presenting cyber risk to boards in business terms
• Why security awareness and workforce involvement are staffing necessities
• Jim's career path: history degree, campus IT, security leadership
• Professional humility and the role of community in the field
• The labor market: saturated entry level, unfilled engineer tier
• Internships, degree requirements, and career progression
• AI governance as a career skill and an organizational requirement
• AI adoption strategy: sanctioned paths instead of prohibition
• Data classification and DLP as the next area of maturity

Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, spanning the antivirus and Windows NT era through today's governance-driven, board-level discipline. He entered the field through campus IT work with a history degree, which he credits for the assessment, analysis, writing, and communication skills that carried him into leadership. He teaches in boot camps and university programs, advises organizations on security leadership, and expects the CISO role to eventually report into enterprise risk under a chief risk officer.

Jim on LinkedIn: https://www.linkedin.com/in/jimmapes/

Georgeo Xavier Pulikkathara enlisted in the Army at 18 as a private E1. He's a colonel now, with 15 years at Microsoft behind him, a PhD in cybersecurity in progress at 58, and a job title most security leaders never hold: both CIO and CISO at the same company, managing one budget to ROI and the other to risk.

In this conversation, Georgeo and Taylor start with the best bad advice he ever received, that technology is a fad, and why every wave since has proven the deeper point: the technology changes, the need for people who understand the business does not. Georgeo lays out his case for AI with guardrails, from the newborn being asked to do brain surgery to the Workday hiring case that pushed the industry toward open-box AI, and explains why he still trusts a 35-year-old spidey sense over a confident hallucination.

Then it gets practical: the four-tier monitoring model that treats endpoints as the last line instead of the first, the North Korean fake worker fraud his team catches through IP checks and shared bank accounts, the breach that lost four terabytes in 40 minutes through an unwatched pipeline, and the military preparation mindset behind his incident response. Dig the foxhole before the fight. Practice containment. Restore the whole application, not one file, and time it.

He closes with the three Cs he hires for and why a growth mindset beats any single technical skill.

Topics Covered:

• "Technology is a fad": surviving mainframes, offshoring, cloud, and now AI
• The light switch and the electrician: why learning to code still matters
• AI as a newborn: training, ethics, guardrails, then agency
• Hallucinations, the Workday case, and black-box vs open-box AI
• Wearing both hats: managing to ROI as CIO, managing to risk as CISO
• What he reports to the board, in two buckets
• The four tiers: identity, production, business applications, endpoints
• Catching North Korean fake remote workers: proxies, locations, bank accounts
• Ransomware's migration between industries, and observability on any budget
• Army lessons: preparation, PICERL, containment, and walking backward from the fight
• Testing backups against real recovery objectives
• The three Cs of hiring: character, competency, commitment

Guest

Georgeo Xavier Pulikkathara is a CIO and CISO with roughly 35 years across technology and security, including 15 years at Microsoft and early days at Cooper Industries. He is a US Army colonel who began as an enlisted private, came up through the infantry, and carries the military's preparation discipline into incident response, business continuity, and board reporting. He is currently pursuing a PhD in cybersecurity, mentors service members toward their CISSPs, and connects job seekers with roles whenever he can.

Georgeo on LinkedIn: Georgeo Xavier Pulikkathara

Pull quotes:

• "They gave birth to a child, and because it's AI, they want their child to do brain surgery tomorrow."
• "What does it do? It does what people do. It makes stuff up."
• "We literally discredit the person with 30 years of experience, because AI says it's possible, so you're wrong."
• "A CIO manages to the ROI. If I'm a CISO, I'm managing to the risk."
• "You're taking on a risk you don't have to."
• "You'll have four or five people with the same bank account."
• "I walk backward from the fight."
• "Many people make the assumption that they got backups. Have you checked it? Can you restore from it? Have you tried?"
• "Competency, character, commitment. Show me that. That's who I hire."

Christopher Hetner has seen the board conversation from every seat: building New York City data centers in the nineties, running global information security at GE Capital, advising two chairs of the SEC as senior policy advisor, and three years inside the insurance industry learning how brokers and carriers actually price cyber exposure. Today he is Chief Cyber Advisor at World Wide Technology, Cyber Risk Advisor to the National Association of Corporate Directors and its roughly 25,000 members, and chair of the AI and Cyber Insights Council for the NASDAQ Center for Board Excellence.

In this conversation, Chris and Taylor dig into the numbers behind the board disconnect: roughly 70 percent of directors are still not in tune with how cyber and AI materially impact the business, many CISOs get 20 minutes with the audit committee once a year, and AI has compressed attack reconnaissance from months to minutes. Chris lays out the fix layer by layer. Build an enterprise risk management structure even when no regulator requires it, with a charter, a risk register, and the heads of the business in the room. Quantify exposure with annual loss expectancy analysis benchmarked to your peer group, in the same categories the insurance markets use. Then go the step further that traditional models skip: tell the board where to deploy capital, and trend the exposure down quarter over quarter.

Also in here: why the CISO should never report to the board alone, the professionalization problem behind slow risk quantification adoption, treating AI agents like employees who commit agent error, and why post-quantum readiness has to start now.

If you present to a board, sit on one, or want to someday, this episode is a masterclass.

• Chris's path: NYC data centers, GE Capital global CISO, senior policy advisor at the SEC
• Why sophisticated boards still struggle: business lens, not bits and bytes
• The 70 percent problem and governing on 20-year-old assumptions
• Reconnaissance compressed from three or four months to minutes
• The isolated CISO: M&A blind spots, inflated budgets, reactive posture
• Building enterprise risk management without a regulatory mandate
• Charters, risk registers, and the COSO framework
• Reporting in tandem with the CFO, chief risk officer, and heads of business
• Annual loss expectancy analysis and the insurance markets as the ultimate arbiter
• Peer group benchmarks: why pharma, hospitals, and trading platforms all look different
• Going beyond FAIR: substantiating loss and directing capital
• "A language that we understand": what changes for the board
• Why cyber risk quantification adoption is still low, and the tactical CISO problem
• Culture and tone from the top
• AI agents as employees, agent error, and agentic-to-agentic monitoring
• Q-day and starting post-quantum readiness now

Christopher (Cristobal) Hetner is the Chief Cyber Advisor at World Wide Technology, Cyber Risk Advisor to the National Association of Corporate Directors, and chair of the AI and Cyber Insights Council for the NASDAQ Center for Board Excellence. His nearly 30 years in cyber and technology include building data centers in New York City, serving as global CISO at GE Capital, four years as senior policy advisor to two chairs of the SEC, and three years working with major insurance brokers and carriers on sizing cyber exposure. He also advises the Cyber Future Foundation and engages roughly a dozen boards a year as an independent expert.

Chris on LinkedIn: Christopher Hetner

Kevin Lewis has a political science degree, a career that started while he was waiting to hear back from the NYPD, and a job today that puts him inside a stack of companies at once. He is the CISO at E78 Partners, a boutique consulting firm serving small and mid-size private equity funds and their portfolio companies, where he also sits in fractional CIO and CTO seats for clients, most of them in med spa and healthcare.

In this conversation, Kevin and Taylor get into why the industry's biggest win is that security stopped being the department of no, how to translate risk for a CFO who has already decided what security should cost, and what private equity's two-day definition of "fast" teaches you about scoping honestly. Kevin walks through the AI reporting pilot that pulled 15 systems into one data lake and replaced a week-long report request with a real-time answer.

Then the harder stuff: why he thinks the talent shortage is partly a spending decision, why he does not tolerate gatekeeping on his team, what he actually screens for when he reads every resume himself, and why the network is the middle layer most career-changers skip. He closes with the culture playbook, including the reframe worth stealing: phishing simulation results measure how well the security team communicated, not how bad the employees are.

Whether you run a program, advise one, or are trying to break into the industry, this one is full of things you can use on Monday.

• What's working in security: the shift from "no, you can't" to "let's make this work"
• Why the seat at the table matters for the information, not the title
• Selling to a CFO: the daily cost of zero work, remediation, and reputation
• Security dashboards with business metrics attached
• What private equity's timeline teaches you about honest scoping
• The AI pilot: 15 systems, one data lake, and an agent that builds the KPI report
• Why mentoring faded, and why Kevin requires it from his leads
• Gatekeeping, the scarcity mindset, and the tools-instead-of-people trap
• Hiring without certification or degree requirements
• The network: the middle layer between "no computer experience" and "security analyst"
• Why "we're not a target" is the sentence that makes you one
• Security awareness without fear, and phishing as a metric on your own team
• Responsiveness as the real control for shadow IT and shadow AI
• Retiring a rogue tool without making an enemy

Kevin Lewis is the CISO at E78 Partners, a boutique consulting firm that works at the intersection of the CEO, CFO, and CIO for private equity funds and their portfolio companies. Alongside running E78's internal security program, he takes fractional technology leadership roles with client companies and handles pre-close technology due diligence for PE deals. His career spans a DOD contractor, fashion and apparel, and now consulting across whatever industry walks in the door, which suits him: to Kevin, it's all bits and bytes. He holds a master's in cybersecurity and a bachelor's in political science, came up through help desk and networking, and mentors relentlessly because that is how he got in.

• Kevin on LinkedIn: Kevin Lewis
• Email: [email protected]
• E78 Partners: e78partners.com

Ward Spangenberg has spent his career finding the gaps: mapping trout DNA with a homemade database in college, dismantling a game economy's black market so thoroughly that players nicknamed him the Dark Knight, and helping build the case for bug bounties at HackerOne. Now he's the founder of Behavry.ai, building in the category Gartner calls guardian agents.

In this conversation, Ward and Taylor dig into why security spends its money explaining last night instead of preventing tomorrow, what purple teaming should have become, how to hire engineers with the play instinct, and why AI won't take over but ungoverned agents absolutely will hurt you. Ward breaks down the four things real AI agent governance requires: no self-attestation, real-time review of every action, human-in-the-loop escalation instead of binary yes/no decisions, and tamper-evident audit trails that regulators are about to start asking for.

Whether you're a practitioner, a founder, an investor, or just AI-curious, this one is full of stories you'll retell.

• What's acutely broken in security: an industry built on hindsight
• Thinking like an attacker: every door, every window, one unlocked
• Purple teaming as a quarterly exercise when you don't have the budget
• Hiring for curiosity: role-play interviews and the "what do you play with at home" question
• Why AI won't take over (and why it doesn't write perfect code)
• The junior analyst who becomes a level two with the right AI tooling
• Ward's origin stories: trout genetics, game fraud, and the Dark Knight
• Why you can't kill the black market: the bug bounty lesson
• Behavry.ai and the guardian agents category: proxy, policy, attestation
• The compliance wave: EU AI rules, Wyoming, and the SEC

Ward Spangenberg is a longtime security practitioner and leader whose career spans companies like Uber, HackerOne, and a Silicon Valley gaming company, plus years presenting to lawyers and law enforcement investigators. He is the founder of Behavry.ai, an AI governance platform that adds policy, human-in-the-loop controls, and independent, tamper-evident attestation to any AI agent, model, or provider. He is also a rugby coach, a gym rat, and the kind of person who stuck a paper clip in an outlet as a kid and grew up to build guardrails for a living.

• Behavry.ai
• Ward on LinkedIn: Ward Spangenberg
• Ward on Twitter/X: @wardspan

Most security leaders come up through IT or risk. Chris Bollerud came up through code, and it changes how he sees the entire field.

Chris is the CISO at AppZen, an AI-driven finance platform, and a software engineer of more than twenty years before that. In this episode he explains why AI gives attackers and defenders the same speed boost, why shifting left only works when you automate the catch instead of training developers and hoping, and how a single dinner with two competing vendors reframed his view of application security.

From there the conversation widens out. Chris makes the case that third party risk management is overdue for a reset, that frameworks like ISO 42001 and the NIST AI RMF have not earned enterprise trust, and that nearly every security questionnaire reduces to one question: where does my data go. He also shares the one line from an early career review that reshaped how he communicates, why he thinks AI slop is the next propaganda problem, and what makes a real moat when a buyer can rebuild most of your tool in weeks.

A wide-ranging conversation for anyone in or around cybersecurity, from practitioners and vendors to investors and regulators.

Listen and follow so you don't miss what's next.

Eric Freeman is the CISO at Writer, an AI-native company that has built its own large language model. Before that, he worked across blockchain and emerging technology. Before any of that, he was a line cook pulling 16-hour shifts in a restaurant kitchen six days a week.

That background shows up in everything about how he leads. In this episode, Eric draws a direct line between prepping for dinner service and implementing security controls, between reading a plate and reading a log, between surviving a Friday night rush and surviving a major incident.

We get into how AI is changing both offense and defense in cybersecurity right now, with specific examples of how his team is using LLMs to automate vulnerability validation end-to-end. He explains why context is the only thing that makes AI useful and shares a learning framework where team members use personal analogies to internalize unfamiliar concepts through LLMs.

Eric also doesn't hold back on what's broken. He makes the case that cybersecurity stress is a structural problem, not a personal one, and proposes a mandatory security credit score for businesses. He breaks down prompt injection as social engineering for machines, agents as scripts with more dynamicness, and reduces all of cybersecurity to a single mental model: access control.

We close with his framework for the three camps of cybersecurity buyers, why two of those camps are the reason the industry still sells on fear, and how to build a security culture with engineers by making the secure path the fastest path.

For practitioners, vendors, investors, and anyone trying to understand how the cybersecurity industry actually works underneath the noise.

Connect with Eric Freeman on LinkedIn: https://www.linkedin.com/in/eric-m-freeman/

Janet Heins has led cybersecurity programs in pharma, manufacturing, cruise lines, broadcast media, and healthcare. Every industry felt unique from the inside, and they are. But the patterns she's found underneath are what make this conversation worth listening to.

Every industry has a system that can't be shut off, even when security demands it. Every organization has legacy infrastructure that's too embedded to replace and too old to protect with modern tools. And almost no company has a dedicated leader responsible for governing the data that everything else depends on.

In this episode, Janet walks through what she's learned moving across industries by design. She shares the four-category framework she uses to get board buy-in for cybersecurity investments: operational, financial, reputational, and regulatory. She explains why aligning security to the company's mission is the difference between being seen as the department that says no and being treated as a strategic partner. And she gets into why data governance is the gap that's making every other cybersecurity and AI challenge harder than it needs to be.

We also talk about AI and what it means for practitioners right now, why university cybersecurity curricula are struggling to keep pace, what major security incidents actually feel like from the inside, and what Janet learned writing her book Go Ahead, Ask For It about making your value visible and advancing your career.

This one is for CISOs who want a framework they can use in any industry, practitioners thinking about career growth, vendors who want to understand how security leaders actually make decisions, and investors trying to evaluate security maturity from the outside.

Connect with Janet Heins on LinkedIn: https://www.linkedin.com/in/janetheins/

Get Go Ahead, Ask For It on Amazon: https://www.amazon.com/Go-Ahead-Ask-Value-Undeniable-ebook/dp/B0GLR2W4D5