In episode 192 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss how leaders, including those in cybersecurity, balance their technical expertise with mastery of communication strategies.

Here are some highlights from our episode:

• 00:51. Introductions to Marcus
• 02:04. How Marcus found value in using analogies to communicate complex topics
• 08:40. Coordination with non-technical folks as a sign of leadership maturity
• 14:03. The wisdom in knowing what to say and what not to say when managing up
• 17:31. The need to balance technical skills with team resourcing in a way that's imitable
• 21:07. The challenge of leaders learning by proximity in hybrid and remote environments
• 24:16. "Classic" engineering vs. "new" engineering
• 25:13. Lessons from Boards in applying discipline, rigor, and order to software engineering
• 28:23. The value in leaders continuously learning how businesses work

Resources

• Episode 183: The Role of CISO in Supporting Risk Translation
• Episode 187: The Role of a CISO as a Strategic Storyteller
• Episode 99: How Cyber-Informed Engineering Builds Resilience
• 7 CIS Experts' 2026 Cybersecurity Predictions

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 191 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Elvenaes, Sr. Multidimensional Threat Analyst at the Center for Internet Security® (CIS®), and Rian Davis, Multidimensional Threat Analyst at CIS. Together, they discuss how threat actors are misusing generative artificial intelligence (GenAI) to plan physical threats.

Here are some highlights from our episode:

• 00:40. Introductions to Sasha, Rian, and their research on GenAI misuse
• 01:56. The impact of GenAI on lowering the barrier for operationalizing physical threat activity
• 03:37. Exploitation of GenAI model design to circumvent models' guardrails
• 05:58. The misuse of session persistence to streamline physical threat research
• 07:57. GenAI misuse: A call for critical infrastructure operators to think about security differently
• 11:52. Factors that make large-scale events a target of physical threat activity
• 14:33. The use of GenAI as a strategy for organizations to see what threat actors could see
• 15:37. Ongoing question: How can drones help mitigate risks while protecting public safety?
• 17:13. Extrapolation as a reinforcement of GenAI session persistence
• 20:15. The new reality: Look at what information AI can provide to threat actors
• 25:01. Traditional methods vs. GenAI conversations for threat planning
• 27:58. Continuous vulnerability assessments, communication, and other recommendations

Resources

• An Examination of Generative AI and Physical Threat Planning
• An Examination of AI-Enabled Threats to Event and Stadium Security
• Multidimensional Threats
• Man who exploded Cybertruck in Las Vegas used ChatGPT in planning, police say
• Episode 190: Separating Mythos AI Fact from Fiction
• Episode 185: AI Prompt Injection from a Risk Perspective
• 5 Steps to Help Secure Your City before a Large-Scale Event
• Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings
• 8 Security Essentials for Managing Your Online Presence
• Vulnerability Assessments

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 190 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they separate fact from fiction around artificial intelligence (AI) capabilities like Mythos AI and other AI-driven vulnerability discovery tools.

Here are some highlights from our episode:

• 00:50. Greetings to Brian and setting the stage for questions from a CIS webinar
• 03:05. The lack of a unified formula or standard for vulnerability prioritization
• 03:55. The opportunity for defenders to interrupt vulnerabilities chained together
• 05:47. An invitation to better understand your enterprise amid the "slopdemic"
• 06:33. How AI guardrails tie back into security best practices
• 10:15. How a fundamental practice we can refine is the best counter to chained attacks
• 12:25. The value of the CIS Community Defense Model and a teaser for Version 3
• 14:50. Mythos AI vs. Static Application Security Testing (SAST) in terms of practice and time
• 19:08. Visibility, governance, and prioritization: Three elements of a "prepared" environment
• 24:32. "One to one" cyber defense as a losing battle
• 27:25. The importance of knowing your dependencies with open-source software
• 33:15. Threat actor economics and the ongoing debate around responsibility in cybersecurity

Resources

• Mythos AI: What Actually Matters for Cybersecurity Leaders
• Secure by Design
• CIS Critical Security Controls®
• CIS Community Defense Model 2.0
• Episode 185: AI Prompt Injection from a Risk Perspective
• Living off the Land: Threats Looming From Within
• Turn Intel Into Action: CIS Controls and the 2026 Verizon DBIR
• Implementation Guide for Small- and Medium-Sized Enterprises CIS Controls IG1
• Information Technology and Information Security Governance

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 189 of Cybersecurity Where You Are, Sean Atkinson sits down with Ed Skoudis, President of SANS Technology Institute. Together, they discuss the present and future of pentesting enabled by artificial intelligence (AI).

Here are some highlights from our episode:

• 00:39. Introductions to Ed
• 01:49. The promise of AI-enabled pentesting in creating more secure infrastructure
• 04:52. AI-enabled and AI-centric workflows in the realm of penetration testing
• 08:03. Wranglers, matadors, and centaurs, oh my! Metaphors for AI-enabled pentesters
• 13:00. How AI can assist with reporting, enumeration, and scanning as part of a pentest
• 14:57. AI-enabled source-assisted pentesting and the types of vulnerabilities it finds
• 19:50. A learning opportunity for the broader cybersecurity community
• 23:44. How AI and human analysts could split the workload in a future penetration test
• 25:54. AI-enabled pentesting vs. AI pentester in a box
• 29:51. Why "human in the loop" might be too passive a phrase
• 30:37. The use of AI for source code development

Resources

• Mythos AI: What Actually Matters for Cybersecurity Leaders
• Secure by Design
• SEC543: AI-Assisted Source Code Analysis and Exploitation for Penetration Testers
• Episode 108: Gaming and Competition in Cybersecurity
• Episode 59: Probing the Modern Role of the Pentest

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 188 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Philippe "Phil" Langlois, Data Breach Investigations Report (DBIR) Author at Verizon; and Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®). Together, they discuss some of the top insights of the 2026 DBIR and how CIS contributed to the publication.

Here are some highlights from our episode:

• 00:50. Introductions to Phil and Charity
• 02:46. Vulnerability exploitation as the most common attack vector
• 05:25. The role of artificial intelligence (AI) in threat actors' natural system thinking
• 07:03. The need for clear governance and responsibility around vulnerability management
• 08:58. Insight into the types of techniques threat actors research using frontier AI models
• 13:43. A trending drop in ransomware payouts and organizations willing to pay attackers
• 14:59. Why a healthy dose of distrust goes a long way in assessing attackers' claims of victims
• 16:24. How two ransomware groups stand out above the norm
• 17:49. The ongoing risk surrounding vendor, supplier, and other third party exposure
• 22:34. The need for governance in managing data issues involving the use of AI
• 27:14. Three ways in which CIS contributed to the 2026 DBIR
• 34:02. How the 2026 DBIR informs the CIS Controls and parting actionable steps

Resources

• 2026 Data Breach Investigations Report
• CIS Critical Security Controls®
• Episode 87: Marking 11 Years as a Verizon DBIR Contributor
• Mythos AI: What Actually Matters for Cybersecurity Leaders
• Applying the CIS Controls to Real‑World AI Environments
• CIS Community Defense Model 2.0
• The Conti Leaks: A Case of Cybercrime’s Commercialization

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 187 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager discuss how the role of a CISO functions as a strategic storyteller of cyber risk while keeping the bigger picture in mind.

Here are some highlights from our episode:

• 00:51. Framing the conversation around CISOs' efforts to communicate with the business
• 02:01. Translation: A nuanced practice of simplifying the story while still telling the truth
• 02:41. The need for a CISO to bridge their organization's respective "culture gap(s)"
• 04:13. Collaborative and dictatorial: Two different ways CISOs talk to a business
• 06:07. The work of translation in motivating and informing action around perceived risk
• 07:03. Security sampling: A story from Tony that reminds CISOs of the bigger picture
• 09:55. Fewer wizards and more mechanics: What the cybersecurity industry needs today
• 12:20. Two factors to consider: Politicking and the need to provide an accessible narrative
• 15:49. Rapport and tradecraft as two critical tools supporting the role of a CISO
• 18:09. Technical competence as a prerequisite for confidence in risk conversations
• 19:20. The false sense of security from relying on comparative data with competitors
• 22:14. The CISO as a strategic storyteller who helps the business make decisions
• 27:03. The need for machinery to constantly rediscover and recreate trust
• 30:15. A call to action for Boards: Build vernacular in cybersecurity risk space
• 35:03. CISO as a strategic storyteller vs. CISO as an enforcer

Resources

• CIS Critical Security Controls®
• CIS Community Defense Model 2.0
• Episode 183: The Role of CISO in Supporting Risk Translation
• Episode 166: Foundations of Actuarial Science in Cyber Risk
• Episode 121: The Economics of Cybersecurity Decision-Making
• NICE Workforce Framework for Cybersecurity (NICE Framework)

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 186 of Cybersecurity Where You Are, Tony Sager sits down with Tony Krzyzewski, a CIS Critical Security Controls® (CIS Controls®) Ambassador for the Center for Internet Security® (CIS®). Together, they discuss how strong cyber defense starts with the fundamentals of IT operations.

Here are some highlights from our episode:

• 00:45. Introductions to Tony Krzyzewski and his background
• 02:19. Tony Krzyzewski's first interaction with the CIS Controls
• 03:47. IT operations: The foundation that makes strong cyber defense possible
• 06:20. How an increasingly connected world makes the CIS Controls essential to cybersecurity
• 09:56. The need for operations people to realize they're part of the cybersecurity solution
• 13:11. The use of Implementation Groups to reduce overload on IT and security teams
• 16:52. How the CIS Controls differ from "umbrella frameworks" like NIST CSF and ISO 27001
• 18:25. CIS Controls mappings and how they help to simplify a surplus of good guidance
• 20:35. How the CIS Controls support improvement programs and Board-level conversations
• 25:38. Tony Krzyzewski's work in creating the CIS Controls Ambassador program
• 27:02. Why a deep view of what's happening at CIS supports Tony Krzyzewski's efforts
• 30:11. Growing international promotion of the CIS Controls and "doing the basics well"

Resources

• CIS Critical Security Controls®
• CIS Controls Ambassador Spotlight: Tony Krzyzewski
• Episode 160: Championing SME Security with the CIS Controls
• Episode 168: Institutionalizing Good Cybersecurity Ideas
• Episode 172: Helping CISOs as a CIS Controls Ambassador
• Episode 181: Supply and Demand of Cybersecurity Ecosystems
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• Reasonable Cybersecurity
• Mappings to Security Frameworks
• Translations
• Policy Templates
• Securing the AI Ecosystem Begins at the Model Layer

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 185 of Cybersecurity Where You Are, Sean Atkinson sits down with Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®); Theodore "TJ" Sayers, Senior Director of Threat Intelligence at CIS; and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS. Together, they use a risk perspective to discuss artificial intelligence (AI) prompt injection and how to defend against it.

Here are some highlights from our episode:

• 00:49. A definition of AI prompt injection for businesses and executives
• 02:16. Brian on his role of guiding AI implementation at CIS
• 03:12. Understanding the urgency surrounding AI prompt injection as a security risk
• 05:32. Signals and trends indicative of threat actors attempting to weaponize prompt injection
• 07:10. How AI prompt injection differs from traditional input validation vulnerabilities
• 11:13. Early indicators that cyber threat intelligence (CTI) teams can monitor
• 15:00. The need to treat AI as a new identity in any enterprise implementation strategy
• 17:10. Understanding the difference: AI safety vs. AI security
• 20:36. Foundational, practical AI security that extends across all sectors
• 24:55. How CIS manages risk and supports the opportunity around the use of AI
• 28:25. The long-term promise of AI-driven vulnerability discovery grounded in fundamentals
• 34:48. Recommendations for piercing through the marketing hype surrounding AI

Resources

• Prompt Injections: The Inherent Threat to Generative AI
• New CIS Report Warns Prompt Injection Attacks Pose Growing Risk to Generative AI
• Episode 182: Striking a Balance on an AI Adoption Journey
• Episode 120: How Contextual Awareness Drives AI Governance
• Mythos AI: What Actually Matters for Cybersecurity Leaders
• Applying the CIS Controls to Real‑World AI Environments
• An Examination of Generative AI and Physical Threat Planning
• AI Playbooks for SLTT Cybersecurity Leaders

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 184 of Cybersecurity Where You Are, Sean Atkinson sits down with Brock Boggs, Director of Technology at Cityscape Schools and Multi-State Information Sharing and Analysis Center® (MS-ISAC®) member. Together, they discuss how Brock approaches cybersecurity policy development as a journey at his school.

Here are some highlights from our episode:

• 01:21. Brock's first attempt at drafting an IT security policy manual
• 04:17. Fact or fiction? How the best "written" security program doesn't always translate
• 06:35. A starting policy landscape of creating baselines for cybersecurity, ticketing, and more
• 08:40. How Brock learned about a roadmap for his school at ISAC Annual Meeting 2023
• 11:07. Lean and to the point: The second draft of Brock's IT security policy manual
• 12:37. The use of Center for Internet Security® (CIS®) policy templates to write procedures
• 19:34. How Brock used regular updates about his policy manual to secure stakeholder buy-in
• 28:42. Openness, willingness to fail, and adaptability as strengths of the community
• 31:49. Approaching cybersecurity policy development as an ever-changing journey

Resources

• CIS Critical Security Controls®
• Policy Templates
• Formalizing K-12 Cybersecurity Policies in Less Time
• Episode 163: K-12 Cybersecurity Made Practical
• Episode 176: A Cybersecurity Journey of Incremental Wins
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• CIS SecureSuite® Membership

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 183 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager discuss how the role of CISO supports risk translation across all levels of an organization.

Here are some highlights from our episode:

• 01:52. Describing the role of CISO in a single sentence
• 03:43. The importance of storytelling in risk translation for an organization
• 07:56. The need for CISOs to meet members of an organization where they are
• 10:47. Why the function of translating risk matters more than sharing it
• 14:41. The misnomer of "soft skills" and why they're a crucial part of professional life
• 15:50. Tony's experience with cultivating "soft skills" and working with trusted truth tellers
• 21:01. The importance of contextualization when framing risk to a Board of Directors
• 24:20. How teaching and communicating differ
• 25:05. Humility and empathy: Crucial skills in understanding another person's world
• 26:34. How communication and public speaking can help to advance a mission
• 29:08. The use of teaching to build mastery and writing to understand what we teach
• 32:35. Public speaking tip: Don't let the first time you hear your words aloud be onstage
• 36:10. Tony's "superpower" of geeky sincerity

Resources

• Episode 88: The Evolution of the Role of a CISO
• Episode 121: The Economics of Cybersecurity Decision-Making
• Episode 166: Foundations of Actuarial Science in Cyber Risk
• CIS Community Defense Model 2.0

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].