Expert Insights Podcast

Diego Zavala discusses how digital credentials can replace physical IDs, limit the data businesses hold, and close the gaps that passkeys leave open.

Last month, scans of more than 153 million U.S. and Canadian driver’s licenses were allegedly leaked and offered for sale on cybercrime forums, leaving cybersecurity professionals globally wondering whether there’s a better way of securing identities.

In this episode of the Expert Insights Podcast, Diego Zavala, Director of Ecosystem Development at the FIDO Alliance, argues that there is.

Zavala explains why FIDO set up its Digital Credentials Working Group and what it’s working on, and discusses the main challenge when it comes to widespread adoption: trust. Users need to trust their wallets, and organizations need to trust the credentials that users present. He also covers what FIDO is doing to build that trust, and why adoption should move faster than passkeys did.

Tune in to learn:

* How selective disclosure lets users share only the data that a verifier needs

* How digital credentials stop issuers tracking where a credential is used

* How digital credentials counter deepfakes in onboarding and account recovery

* Why adoption should take a couple of years, not a decade like passkeys

* What businesses can do now to prepare for that change, from purging stored ID scans to preparing for mobile driver’s licenses

AI has made attacks both more frequent and more convincing. In this episode, Juraj Janosik, VP of AI at ESET, explains how attackers use AI to sharpen phishing and Business Email Compromise (BEC), making their messages hard to tell apart from genuine communication. He covers how automation has lowered the barrier to entry for unskilled attackers and reduced ransomware dwell time to a couple of hours.

Juraj also sets out what defenders can do about it. He argues that AI-powered tools alone won’t protect you, and makes the case for layered defenses built on strong security telemetry, human oversight, and consistent patching of known vulnerabilities, which remain attackers’ favorite way in. He also looks inward at the risks of rapid AI adoption, including shadow AI and employees leaking data through unsanctioned tools, and explains why training and clear governance are the best ways to reduce those risks.

Tune in to learn:

* How AI has raised the quality of phishing and BEC attacks

* How to spot AI-driven social engineering, starting with context and urgency

* Why automation has cut the time from initial access to encryption down to hours

* Why unpatched known vulnerabilities, not zero days, drive most attacks

* How to govern AI use internally and reduce shadow AI risk

Few areas of cybersecurity have been reshaped by AI as fast as phishing. In just three years, generative AI has rewritten the economics of the attack, stripping out the red flags security teams have trained users to spot for decades, and pushing attackers into new channels like Microsoft Teams, voice, and video.

In this episode, Steve Malone, Chief Product and Strategy Officer at IRONSCALES, joins the podcast to unpack how the threat has evolved through what IRONSCALES calls “Phishing 3.0,” and what security leaders should actually be doing about it. Steve has spent two decades in email security, including senior product leadership roles at Mimecast and Egress, giving him a front-row seat to how attacks, and defenses, have changed.

Topics covered:

* Why speed and quality, not new attack methods, are what’s really changed about phishing

* What IRONSCALES’ 2025 Cost of Phishing report reveals about the gap between faster incident handling and rising overall costs

* The evolution from phishing 1.0 (malicious attachments) to 2.0 (BEC and social engineering) to 3.0 (AI-generated, multi-channel attacks)

* Why old advice like “spot the typo” or “call to verify” no longer holds up against deepfakes

* How Ironscales’ native API integration, adaptive AI and Agentic Virtual SOC reduce the volume of incidents reaching human analysts

* IRONSCALES’ red teaming agent, and how it powers hyper-personalized detection and security awareness training

* Real-time deepfake detection for Microsoft Teams meetings, and the emerging threat of deepfakes in recruitment

* Steve’s advice for CISOs on rethinking security metrics, hardening business processes and questioning vendors about their AI capabilities

This is a roundup episode pulling together four conversations we recorded at Black Hat USA 2026, each looking at a different piece of the same story: AI is changing what attackers and defenders can do, and most organizations are behind on both fronts.

Daniel Blackford, VP and Head of Threat Research at Proofpoint, breaks down why ransomware timelines are collapsing from weeks to hours, and walks through “half-click,” a Russian state-sponsored exploit that ran just from an email loading in a preview pane, no click required.

Dhawal Sharma, EVP of AI Security and Strategic Initiatives at Zscaler, explains why securing AI agents is a fundamentally different problem from securing human users, and why standard DLP policies miss an agent that’s doing something it was never intended to do.

Deepen Desai, Zscaler’s Chief Security Officer, shares results from Project Glass Wing, including a frontier model that bypassed its own security patch three times out of five, and makes the case for deception as the highest-value control against AI-driven attacks.

Todd Moore, Global VP and GM of data security products at Thales, explains why 2029 is closer than it sounds for quantum-safe cryptography, and what security leaders should be doing about it right now, not in three years.

Recorded live on the final day of Black Hat 2026, this episode of the Expert Insights Podcast features Todd Moore, global VP and GM of data security products at Thales. In the episode, he discusses why the post-quantum era has stopped being a future problem, and needs to be on your agenda today. Todd explains why 2029 matters: it’s the point at which researchers expect a crypto-relevant quantum computer could break today’s encryption, and why that timeline is already reshaping regulation in the US, France, Singapore, and Australia.

The conversation covers why financial services, healthcare, and government are moving faster than retail and manufacturing, the emerging link between AI adoption and quantum risk, and the practical first step every security leader should take now: building a cryptographic inventory. Todd also introduces the concept of crypto agility. This is the ability to adapt as post-quantum algorithms and protocols continue to change, and unpacks Luna 8, Thales’ newly launched quantum-safe hardware security module, including why the company chose Black Hat to announce it.

Read more on Expert Insights: https://expertinsights.com/wp-admin/post.php?post=59547&action=edit

Ahead of Black Hat 2026, Joel Witts, Content Director at Expert Insights, talks with Dr. Chris Pierson, Founder and CEO of BlackCloak, about the growing risk facing corporate executives outside the four walls of the company, in their homes, personal accounts and family lives.

Pierson is a former CISO, chief privacy officer, and longtime Department of Homeland Security advisor who founded BlackCloak and created the digital executive protection category. He explains why the millions companies spend on cybersecurity rarely extend to the personal lives of their executives, and why that gap has become a material business risk, from data broker exposure and personal account breaches to home networks that can be compromised despite passing 41 straight weeks of penetration testing.

In this episode, they discuss:

* Why executives and their family members are targeted through data brokers, breached passwords and public profiles, and how that access can lead back into the company

* Real incidents BlackCloak has responded to, including a compromised home alarm and camera system and a virtual kidnapping scam built from social media activity

* How live, real-time deepfake voice and video attacks have outpaced Zoom and Teams-based verification, and why attackers simply call an executive’s personal device instead

* BlackCloak’s new circle of trust expansion, announced at Black Hat 2026, which extends out-of-band impersonation protection to trusted third parties like wealth advisors, attorneys and family staff

* Why digital executive protection has to operate outside the company, structured more like a health benefit than a corporate security function, to protect both executive privacy and the business

Ahead of Black Hat 2026, Joel Witts, Content Director at Expert Insights, talks with Marc Olesen, CEO of Cofense, about how AI is reshaping the phishing threat landscape and what it takes to defend against it.

Olesen joined Cofense in January 2025, bringing over 30 years of technology leadership from roles including CEO at TokenEx, President and CEO at Sift, and senior leadership positions at Splunk and McAfee. He explains why polymorphic phishing, where AI generates a unique variation of an attack with every email, has become the default delivery model for attackers, and why AI has cut the time to build a phishing attack from 16 hours to five minutes.

In this episode, they discuss:

* Why 88% of AI-generated phishing attacks are now unique, and what that means for signature and rules-based defenses

* How business email compromise and OAuth/identity-based attacks still start with the inbox, even as phishing spreads to WhatsApp, Teams and other channels

* Cofense’s post-perimeter approach: combining AI-driven detection with human-verified intelligence to neutralize reported threats in under 10 minutes

* The “automation gap” between attacker and defender AI, and why a trained human layer will always be needed to close it

* What the next 12 months of phishing could look like, from deepfakes and voice cloning to new email confirmation workflows

* Olesen’s advice for security leaders building a defense-in-depth strategy against phishing

In the second part of our Zscaler’s Zenith Live coverage, we’re speaking with two more industry experts.

Up first is Deepen Desai, EVP and Chief Security Officer at Zscaler, who walks us through the ThreatLabz 2026 Phishing and Initial Access Report, highlighting the key trends that you need to be aware of.

That’s followed by Martyn Ditchburn, CTO in residence at Zscaler. He addresses the threat landscape from a European market perspective, looking at how phishing and AI-driven attacks are evolving and where organizations sit on the security maturity curve.

This is a public episode, if you’d like to discuss this with other subscribers or gain access to bonus episodes, visit podcasts.expertinsights.com

In this episode of the Expert Insights Podcast, recorded at Zscaler’s Zenith Live conference in Vienna, we’re joined by two experts for conversations on AI security and post-quantum cryptography.

First, Swamy Kocherlakota, Executive Vice President, Agentic AI Startup at Zscaler, breaks down the AI security incidents enterprises are dealing with right now. He explains why zero trust is the right architectural response, and how AI coding tools are creating new attack vectors that security teams need to understand.

Then, Yaroslav Rosomakho, Chief Scientist at Zscaler, shares his perspective on agentic AI before moving into post-quantum cryptography: what the threat landscape looks like, and the practical steps organizations can start taking today.

Phishing attacks are more convincing, more frequent, and harder to detect than ever. AI has lowered the barrier to entry for attackers, while raising the stakes for every organization.

In this episode, Expert Insights speaks with David Badanes, Human Risk Leader at Hoxhunt, about the findings from Hoxhunt’s 2026 Phishing Trends Report and what they mean for security teams trying to keep pace with AI-powered threats.In this episode:

* Why AI has made high-quality phishing attacks accessible to any threat actor

* How phishing has expanded beyond email into calendars, SMS, and social platforms

* Why human-centric security training is now a business-critical investment

* How to spot AI-generated phishing emails before your users click

Recommended for CISOs, security awareness leads, and HR and risk leaders building a human-centered approach to cyber defense.

Sponsored by Hoxhunt.