Defense in Depth

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Brett Conlon, CISO, American Century Investments. Joining us is Carla Sweeney, SVP of InfoSec at Red Ventures.

In this episode:

• Proof versus gatekeeping
• Talent is built one way and judged another
• What a multiple-choice exam can't teach
• The hire that got blocked

A huge thanks to our sponsor, ThreatDown

ThreatDown delivers elite Managed Detection and Response purpose-built for resource-constrained teams with high-efficacy protection without complexity. Combining artificial intelligence and expert analyst judgment, ThreatDown intercepts sophisticated attacks with speed and accuracy, scaling security effortlessly. Recognized by MRG Effitas, AVLab, and G2, ditch fragmented tools for fast, 24/7 protection without overhead. Learn more at threatdown.com

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation for this week's episode co-hosted by David Spark, the producer of CISO Series, and Mike Johnson, CISO, Rivian. Joining them is Heather Hinton, CISO, Sitecore, and lecturer at Harvard Extension School.

In this episode:

• Humans were never deterministic either
• Making the report worth opening
• Coverage still needs both
• The record has to be more certain than the detection

A huge thanks to our sponsor, Horizon3.ai

Is your organization actually secure, or do you just hope it is? Horizon3's NodeZero® autonomously tests your defenses, finds real attack paths, and verifies that your fixes actually work. In an era of AI-powered attacks, don't assume you're secure. Prove it. Learn more at horizon3.ai/cisoseries

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation for this week's episode co-hosted by David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining them is their sponsored guest, Snehal Antani, CEO, Horizon3.ai.

In this episode:

• Metrics that show risk actually declining
• Knowing which altitude you're talking to
• Recoverability over control checklists
• Proof the program outlives any one person

A huge thanks to our sponsor, Horizon3.ai

Is your organization actually secure, or do you just hope it is? Horizon3's NodeZero® autonomously tests your defenses, finds real attack paths, and verifies that your fixes actually work. In an era of AI-powered attacks, don't assume you're secure. Prove it. Learn more at horizon3.ai/cisoseries

All links and images can be found on CISO Series

We've all internalized that humans are the weak link in cybersecurity. Why do we not account for that when we're building our cybersecurity programs?

Check out this post for the discussion that is the basis of our conversation on this week's episode, co-hosted by David Spark, the producer of CISO Series, and Geoff Belknap. Joining them is their sponsored guest, Kieran Human, lead cybersecurity engineer, ThreatLocker.

In this episode:

• Humans and automation checking each other
• Assume the click happens
• Catch it in the moment
• Take the manual step out entirely

A huge thanks to our sponsor, ThreatLocker

An AI-generated attack may be new, but it still needs to execute, access data, and move through your environment. ThreatLocker applies enforceable controls at each of those points, limiting what attackers can do regardless of how their code was created. Book a demo at threatlocker.com/ciso.

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation for this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is their sponsored guest, Mark Stockley, cybersecurity evangelist, ThreatDown.

In this episode:

• The ripple effect
• The economics of ignoring SMB
• Let the defaults do the work
• Accountability doesn't get outsourced

A huge thanks to our sponsor, ThreatDown

ThreatDown MDR is a 24/7/365 security analyst service that explains and resolves suspicious endpoint events. Our team of cybersecurity experts delivers proactive monitoring, investigation, and remediation, catching threats before they escalate. With ThreatDown's always-on protection, organizations gain peace of mind and safeguard their data, reputation, and finances - backed by real analyst expertise, not just automation. Learn more at threatdown.com

All links and images can be found on CISO Series

LinkedIn used to have a decent reputation among cybersecurity professionals. But lately, it feels like our feeds are relitigating the same debates every day, just with different faces. Has the situation changed?

Check out this post by Allan Alford of NTT Global Data Centers for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap. Joining us is Howard Holton, founder, Phronia Counsel.

In this episode:

• The clichés that say nothing
• A discipline without shared answers
• Old topics, new lenses
• A people problem, not a security problem

A huge thanks to our sponsor, Teleskope

Most DSPMs stop at finding the risk. Teleskope fixes this: it automatically finds sensitive data, including IP documents or board decks, and remediates exposure across cloud, SaaS, and AI environments natively, with human-in-the-loop controls, improving your team's efficiency tenfold. Trusted by Ramp, Polymarket, and Chevron Phillips, and more. teleskope.ai

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Abby Kearns, CEO, ActiveState.

In this episode:

• Trust, but nobody verifies
• The economics of trust just changed
• Implicit trust doesn't scale anymore
• Rethinking what "open" even means

A huge thanks to our sponsor, ActiveState

ActiveState gives security and engineering teams a single governed source for open source software. With 79 million components built from source, continuously remediated, and delivered directly into the tools teams already use, ActiveState eliminates the CVE backlog and the developer toil that comes with it. Companies see a 60 to 99% reduction in CVEs and reclaim up to 30% of developer time. Learn more at activestate.com.

All links and images can be found on CISO Series

This is a bonus episode of our brand new podcast, Super Cyber Friday Express — a 20-minute highlight version of our live one-hour show we do every available Friday at 1 p.m. Eastern.

In this episode, David Spark is joined by Karl Mattson, founder and managing director of Squared Circle Ventures, and Howard Holton, founder and principal analyst at Phronia Counsel LLC, to discuss how your existing environment shapes what you buy next — and whether that's a strategy or just inertia.

Watch the full one-hour show at Crowdcast.

Subscribe to Super Cyber Friday Express, or any show on CISO Series, at CISOseries.com/subscribe.

All links and images can be found on CISO Series

Check out this post by Anand Singh, CSO, Symmetry Systems, for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is Ryan Barrett, svp, security, Intermedia Cloud Communications.

In this episode:

• Risk by default, not by decision
• Identity, not just speed
• Building security into the pipeline, not around it
• Letting the machine make the fix

A huge thanks to our sponsor, ThreatLocker

An AI-generated attack may be new, but it still needs to execute, access data, and move through your environment. ThreatLocker applies enforceable controls at each of those points, limiting what attackers can do regardless of how their code was created. Book a demo at threatlocker.com/ciso.

All links and images can be found on CISO Series

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Brett Conlon, CISO, American Century Investments. Joining us is our sponsored guest, Simon Hughes, vp of field security at CoreView.

In this episode:

• Ecosystem, not platform
• Beyond backup, into resilience
• What survives the restore
• Toward a digital twin

A huge thanks to our sponsor, CoreView

Attackers don't break into Microsoft 365. They log in and reconfigure it. When tenant configurations drift or get tampered with, recovery can take weeks and missed settings can reopen the door. The Cyber Resilience Framework for Microsoft 365 covers the five pillars, harden, govern, detect, respond, recover, and shows exactly where today's tools leave gaps. Download the free practical guide