In Episode 162 of Cybersecurity Where You Are, Tony Sager sits down with Tina Williams-Koroma, Founder and CEO of TCecure, LLC and CyDeploy, Inc. Together, they discuss why "cyber insecurity is not inevitable" and how organizations can take a managed approach to attack surface management.

Along the way, Tina shares her journey from software development to cybersecurity entrepreneurship and explains why proactive measures like hardening systems and automating patching are critical for reducing risk. Here are some highlights from our episode:

• 00:50. Introductions to Tina, her career pivot, and her entrepreneurial path
• 03:35. The value of the secure configuration guidance provided by the CIS Benchmarks®
• 07:35. Why a well-managed system makes for a hard target
• 11:00. Marketing against “magic” in a hype-driven cybersecurity market
• 13:44. The translative work of moving well-managed infrastructure beyond "mere hygiene"
• 19:14. Tina's faith-based inspiration for helping others get as far as she's gotten
• 27:23. Soccer analogies for a managed attack surface
• 33:54. Tina's pep talk: "Why cyber insecurity is not inevitable"
• 38:38. Free cybersecurity resources for small businesses

Resources

• Mapping and Compliance with the CIS Benchmarks
• Guide to Asset Classes: CIS Critical Security Controls v8.1
• Gartner Says That in the Age of GenAI, Preemptive Capabilities, Not Detection and Response, Are the Future of Cybersecurity
• CIS Community Defense Model 2.0
• OwlThis — Powered By CyDeploy

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In Episode 161 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Mishal Makshood, Azure Partner Alliance Manager at the Center for Internet Security® (CIS®), and David Kalish, Sr. Cybersecurity Solutions Engineer at CIS. Together, they explore how CIS Hardened Images® help to secure cloud environments and strengthen critical national infrastructure (CNI) resilience through collaboration.

Mishal and David explain how these virtual machine images, which are pre-configured to the CIS Benchmarks®, serve as secure, scalable blueprints for cloud deployments. They highlight how CIS Hardened Images reduce human error, accelerate compliance, and foster trust across a global cybersecurity ecosystem that includes hyperscalers, supply chains, and public-private partnerships.

Tony shares the origin story of the CIS Hardened Images and reflects on the evolution of cybersecurity from isolated efforts to a cooperative model built on shared standards and integrated tooling. The group also discusses how CIS Hardened Images align to frameworks and how they help organizations navigate multi-cloud environments while maintaining consistent security postures. Here are some highlights from our episode:

• 00:50. Introductions to Mishal and David
• 01:36. What CIS Hardened Images are and why they matter
• 03:14. Why CIS Hardened Images are uniquely suited to strengthening CNI resilience
• 04:24. The cultural shift toward working as an ecosystem to start from secure baselines
• 06:34. The origin story of the CIS Hardened Images
• 10:32. The value of taking guesswork out of secure configuration management in the cloud
• 13:44. How CIS Hardened Images support compliance directly and through the CIS Critical Security Controls® (CIS Controls®)
• 20:39. Building trust through cloud partnerships and collaboration
• 28:50. The foundational role of configuration management in cybersecurity
• 34:35. Getting started with strengthening your cloud security foundation

Resources

• CIS Hardened Images® List
• Secure by Design: A Guide to Assessing Software Security Practices
• Software Supply Chain Security
• 25 Years of Creating Confidence in the Connected World
• Mapping and Compliance with the CIS Controls
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• Build a Zero Trust Roadmap for FinServ with CIS SecureSuite
• Episode 154: Integration of Incident Response into DevSecOps
• How to Construct a Sustainable GRC Program in 8 Steps

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In Episode 160 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Alan Watkins, CIS Controls Ambassador, to explore how the CIS Critical Security Controls® (CIS Controls®) empower small and medium-sized enterprises (SMEs) to build practical, scalable cybersecurity programs.

Alan shares his journey from law enforcement to IT leadership in the City of San Diego and how his passion for supporting SME security led him to become a champion of the CIS Controls. The episode highlights the importance of translating complex cybersecurity guidance into actionable steps that SMEs can realistically implement even with limited resources.

Here are some highlights from our episode:

• 00:49. Introductions to Alan, his career path, and his connection to the CIS Controls
• 11:43. How Alan supports SMEs to mature their cybersecurity postures
• 18:04. The work of CIS Controls Ambassadors to "memorialize" security best practices
• 22:23. The need to translate how cyber hygiene supports business success
• 25:31. CIS WorkBench and in-person communities as avenues to get involved

Resources

• Implementation Guide for Small- and Medium-Sized Enterprises CIS Controls IG1
• Establishing Essential Cyber Hygiene
• Episode 132: Day One, Step One, Dollar One for Cybersecurity
• Episode 97: How Far We've Come preceding CIS's 25th Birthday
• PCI & CIS: Partners in Data Security
• 2024 DBIR Findings & How the CIS Critical Security Controls Can Help to Mitigate Risk to Your Organization
• Policy Templates

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 159 of Cybersecurity Where You Are, Sean Atkinson is joined by Joshua Palsgraf, Sr. Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Randy Rose, Vice President of Security Operations & Intelligence at CIS. Together, they dive into the scariest malware of 2025 in this special Halloween edition.

The conversation explores what makes today’s malware truly terrifying, from stealthy threats that hide in plain sight to modular malware that evolves faster than defenses can adapt. The trio also discusses the corporatization of cybercrime, the rise of Malware as a Service, and how generative artificial intelligence (GenAI) is lowering the barrier to entry for cybercriminals.

Here are some highlights from our episode:

• 00:42. Introductions to Josh and Randy
• 02:21. What makes the scariest malware of 2025 truly "scary"
• 05:42. Evolution of malware: people, process, and technology
• 09:33. How the corporatization of malware helps to democratize cybercrime
• 11:25. The most "terrifying" malware strains of 2025
• 15:49. Malware reincarnation: Old threats with new masks
• 17:20. GenAI as the great equalizer for cybercriminals, especially social engineers
• 23:32. Defense-in-depth and threat-informed strategies
• 24:45. Why incident response playbooks must evolve and become living documents
• 27:02. What incident response looks like for cloud assets in the Fourth Industrial Revolution
• 29:27. Naming malware after horror movie icons

Resources

• Multi-State Information Sharing and Analysis Center®
• Episode 144: Carrying on the MS-ISAC's Character and Culture
• Episode 126: A Day in the Life of a CTI Analyst
• A Short Guide for Spotting Phishing Attempts
• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 157: How a Modern, Mission-Driven CIRT Operates
• Living Off the Land: Scheduled Tasks
• Cyber defenders sound the alarm as F5 hack exposes broad risks
• Episode 134: How GenAI Lowers Bar for Cyber Threat Actors
• Active Lumma Stealer Campaign Impacting U.S. SLTTs
• MS-ISAC Member-Reported Phishing Likely from Tycoon2FA PhaaS
• ClickFix: An Adaptive Social Engineering Technique
• Top 10 Malware Q1 2025
• CTAs Leveraging Fake Browser Updates in Malware Campaigns
• Italian police freeze cash from AI-voice scam that targeted business leaders
• CornCon Cybersecurity Conference

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 158 of Cybersecurity Where You Are, Sean Atkinson is joined by Andy Weidner, Product Manager at Nerdio, and Jason Ingalls, Chief Cybersecurity Officer at C3 Integrated Solutions. Together, they explore how organizations can navigate the complexities of Cybersecurity Maturity Model Certification (CMMC) compliance using automation, scalable infrastructure, and hardened cloud environments.

The conversation dives into the challenges faced by managed service providers (MSPs) and defense contractors, the importance of baking in security from the start, and how Nerdio’s platform acts as a force multiplier for compliance and operational efficiency. Jason shares a compelling anecdote from his time in a security operations center (SOC), illustrating the real-world stakes of cybersecurity and the origins of CMMC.

Here are some highlights from our episode:

• 00:44. Introductions to Andy and Jason
• 01:17. How to address common challenges of CMMC compliance
• 03:40. A real-world story of data exfiltration and its national security impact
• 08:34. How Nerdio and CIS Hardened Images® help organizations in their CMMC journey
• 12:15. Understanding the vision to scale configuration management
• 18:14. Strategy and automation as key elements to approaching CMMC Level 2
• 25:19. The value of baking scalability in vs. bolting it on
• 26:38. Segregation of duties as a means of pursuing dual-scope CMMC certification
• 29:22. Where to learn more about Nerdio and C3 Integrated Solutions

Resources

• Nerdio
• C3 Integrated Solutions
• CIS Hardened Images®
• How to Plan a Cybersecurity Roadmap in 4 Steps
• CIS Controls v8.1 Mapping to CMMC 2.0
• CIS Controls v8.1 Mapping to NIST SP 800-53 Rev 5
• CIS Controls v8.1 Mapping to NIST SP 800-171 Rev 3

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 157 of Cybersecurity Where You Are, Sean Atkinson sits down with Matthew Grieco, Cyber Incident Response Team (CIRT) Principal Analyst at the Center for Internet Security® (CIS®), and Dustin Cox, CIRT Analyst at CIS. Together, they explore the unpredictable world of cyber incident response. From ransomware investigations to digital forensics, the team shares how they adapt to evolving threats, leverage open-source tools, and collaborate to support state and local governments. The conversation highlights the mission-driven mindset that fuels their work and the importance of continuous learning, effective communication, and teamwork in cybersecurity. Here are some highlights from our episode:

• 00:44. Introductions to Matt and Dustin
• 01:20. Inside the typically untypical day of a CIRT analyst
• 05:33. Continuous learning and teamwork as ways to keep up with evolving threats
• 07:38. Inside the cybersecurity tooling used by CIRT to support state and local governments
• 14:51. How different skillsets on the team produce a unified incident response methodology
• 19:26. The work of a mission-driven team to uncover root causes for security incidents
• 25:52. An example of a case handled by Matt and Dustin
• 30:16. How CIRT assesses potential talent and looks for problem solvers

Resources

• Multi-State Information Sharing and Analysis Center®
• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 152: Driving Response Time While Enriching Telemetry
• Episode 126: A Day in the Life of a CTI Analyst
• Combatting Ransomware

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 156 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Stephanie Gass, Sr. Director of Information Security at Center for Internet Security® (CIS®), and Angelo Marcotullio, Chief Information Officer at CIS. Together, they explore how CIS practices what it preaches by using CIS products and services internally, which includes implementation of the CIS Critical Security Controls® (CIS Controls®) and CIS Benchmarks®, automation, and alignment to compliance frameworks. Their discussion highlights how CIS builds a strong cybersecurity foundation while adapting to evolving threats and regulatory requirements.

The conversation dives into practical applications, cultural alignment, and the importance of repeatable processes for scaling security across new products and services. It also touches on the role of privacy regulations, cyber risk quantification, and the community-driven approach that underpins CIS best practices. Here are some highlights from our episode:

• 01:12. Why CIS “drinks its own champagne” when it comes to cybersecurity
• 02:56. Three ways the CIS Controls help modern enterprises defend against threat actors
• 04:02. The importance of pulling together security lessons learned in a way that's translatable
• 10:03. Our use of the CIS Controls to align to SOC 2, ISO 27001, and other frameworks
• 12:01. How governance, risk, and compliance (GRC) engineering works with automation to help build repeatable processes
• 22:43. The role of collaboration and communication in building a cybersecurity program
• 27:17. Privacy regulations as a catalyst for security innovation
• 30:24. The CIS Community Defense Model and evidence-based practices
• 32:40. How CIS leverages lessons learned to improve our security best practices

Resources

• Episode 146: What Security Looks Like for a Security Company
• Implementation Guide for Small and Medium-Sized Enterprises CIS Controls IG1
• How to Construct a Sustainable GRC Program in 8 Steps
• Mapping and Compliance with the CIS Controls
• CIS Completes SOC 2 Type II Audit Using CIS Best Practices
• Episode 74: The Nexus of Cybersecurity & Privacy Legislation
• CIS Community Defense Model 2.0
• Episode 121: The Economics of Cybersecurity Decision-Making
• Episode 77: Data's Value to Decision-Making in Cybersecurity
• CIS Communities

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 155 of Cybersecurity Where You Are, Tony Sager is joined by John Gilligan, President and Chief Executive Officer (CEO) of the Center for Internet Security® (CIS®). Together, they reflect on 25 years of progress for CIS and look ahead to the future. They explore the driving forces behind "CIS 2.0," including the shift toward addressing multidimensional threats, expanding CIS’s audience, and leveraging tools driven by generative artificial intelligence (GenAI). Their discussion highlights how CIS is adapting to a new era while staying true to its mission-driven roots and foundational principles. Here are some highlights from our episode:

• 01:11. The need for a mission-driven nonprofit to support the role of government
• 04:28. Understanding the primary catalyst behind CIS 2.0
• 05:53. Multidimensional threats, expanded audiences, and revamped tools as adaptive opportunities
• 12:57. The challenge of linking technology risk to operational risk
• 13:45. How attackers tend to be more systems-level thinkers than defenders
• 15:50. Culture as a support system for navigating the evolving skills and processes of CIS 2.0
• 22:24. Collaboration, partnerships, mission focus, and culture as foundational CIS elements
• 31:11. How our engagement with state and local governments, thought leadership, and products and services will change going forward
• 40:47. Parting thoughts and an important reminder

Resources

• 25 Years of Creating Confidence in the Connected World
• Episode 119: Multidimensional Threat Defense at Large Events
• Strengthening Critical Infrastructure: SLTT Progress & Priorities
• Enhanced Cyber Resilience as a Secure Cyber City
• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 115: Continuous Feedback as CIS Employee Culture
• Episode 125: How Leadership Principles Influence CIS Culture
• CIS Culture
• CIS Communities
• Episode 97: How Far We've Come preceding CIS's 25th Birthday
• Why Whole-of-State Cybersecurity Is the Way Forward
• An Introduction to Artificial Intelligence
• Reasonable Cybersecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 154 of Cybersecurity Where You Are, Sean Atkinson discusses incident response in DevSecOps, exploring challenges and solutions in modern software development. He emphasizes the importance of integrating security into development processes and speaks about common issues like alert fatigue and software supply chain vulnerabilities. Here are some highlights from our episode:

• 01:32. Common challenges with modern software development
• 03:54. High-speed and continuous deployment
• 07:08. Incident correlation with cloud deployment strategies
• 10:00. Software supply chain vulnerabilities
• 12:45. Alert fatigue and false positives
• 14:30. Testing and automation as enablers of real-time anomaly detection
• 17:40. The responsibility of incident responders to understand what they see
• 18:58. Automated control and a projectized approach to implementing zero trust
• 21:26. Oversight and governance with artificial intelligence and machine learning
• 23:24. Continuous improvement and early detection
• 28:08. Continuous monitoring and logging, automation, and incident response drills
• 30:03. Moving down a path of helping incident responders become culturally aware

Resources

• Cloud Security and the Shared Responsibility Model
• CIS Software Supply Chain Security Guide
• An Introduction to Artificial Intelligence
• Defense-in-Depth: A Necessary Approach to Cloud Security
• Episode 63: Building Capability and Integration with SBOMs
• Episode 44: A Zero Trust Framework Knows No End
• Leveraging Generative Artificial Intelligence for Tabletop Exercise Development

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 153 of Cybersecurity Where You Are, Sean Atkinson is joined by Jason Ashong, IT Support Specialist at the Center for Internet Security® (CIS®). Jason shares his journey from tinkering with tech as a kid to working in IT and pursuing cybersecurity research. The conversation covers education, mentorship, hands-on experience, and advice for newcomers entering the field. Here are some highlights from our episode:

• 01:10. Jason’s early days in IT of fixing devices and breaking things to learn
• 02:14. First professional IT/helpdesk experience at Dutchess Community College
• 03:48. The importance of mentors pushing you to grow
• 06:02. Jason’s advice to students of understanding foundational computing knowledge
• 08:45. The value of technical skills in networking, cryptography, and coding
• 11:00. Hands-on experience through labs, competitions, and research projects
• 16:08. Self-confidence, practice, and dedicated time as tips for navigating the job market
• 19:29. The role of attitude in opening up new opportunities
• 24:40. Jason flips the script and interviews Sean
• Mistakes to avoid when entering the field: imposter syndrome and perfectionism
• Cybersecurity as a path of continuous learning
• Opportunities for newcomers with experience in artificial intelligence and data science

Resources

• Episode 129: Embedding Cybersecurity in Project Management
• Episode 95: AI Augmentation and Its Impact on Cyber Defense
• Episode 44: A Zero Trust Framework Knows No End
• TryHackMe
• Hack The Box

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].