ICT Compliance Pod

Description:
This episode explores how artificial intelligence, changing regulatory requirements, and emerging technologies are reshaping cybersecurity assurance and product certification.

Cybersecurity expert Seth James Nielson, founder and CEO of Crimson Vista, joins Joshua to examine the growing security risks posed by autonomous AI agents, including prompt injection, the limitations of AI guardrails and proposed “kill switches,” and the larger question of how organizations can establish meaningful assurance for increasingly powerful AI systems. They also unpack the Department of Defense’s pause in CMMC implementation, what it does—and does not—mean for defense contractors, and why organizations handling Controlled Unclassified Information still need to take their cybersecurity obligations seriously.

Matt Fussa adds another industry perspective on the rapidly changing certification and compliance landscape and what these developments mean for technology companies navigating new security requirements.

Plus, we go on location at ICCC 2026 in Rome to talk with members of the international Common Criteria community about AI in security evaluation, evolving Protection Profiles and certification requirements, international mutual recognition, and why face-to-face collaboration remains critical to the future of global product security assurance.

Sponsors:
Securus Consulting Group (www.securus-cg.com)
OpenSSL Foundation (openssl.foundation)
Common Criteria Users Forum (www.ccusersforum.org)
Biometric Update (biometricupdate.com)

Host:
Joshua Brickman

Guests:
Seth Nielson, CEO, Crimson Vista
Ashit Vora, CEO/Founder, Autonomi
Shawn Geddis, Chief Technology Officer, Katalyst LLC
Matt Fussa, Vice President, Trust & Cyber Security Compliance, Cisco

Links:
Full Interview with Ashit Vore and Shawn Geddis:
https://youtu.be/-DAlouapXPY

Trust and Turbulence Podcast:
https://www.joshuabrickmanpmp.com/listen

International Common Criteria Conference
https://iccconference.org

AI Security Concerns:
https://www.nytimes.com/2026/09/03/technology/openai-hugging-face-hack.html?unlocked_article_code=1.-lA.qYM5.44Xs1S85ocA4&smid=nytcore-android-share
https://www.nytimes.com/2026/09/16/technology/openai-model-safety-guardrails.html?unlocked_article_code=1.B1E.EAGT.gayWVP0N_crV&smid=nytcore-android-share
https://www.newyorker.com/culture/open-questions/the-long-doomsday-of-ai?_sp=f30c1001-5ea0-4bd2-a082-83e7b8003131.1789648868786

Use of AES-128 for Bluetooth will be the exception to this policy until the Bluetooth standard is updated.
https://www.techtarget.com/cybersecurity/news/366650198/EU-cyber-rule-exposes-gaps-in-product-security-operations

Cyber compliance has long been defined by documents, manual reviews, and one-off assessments—but that model is buckling under the speed and complexity of modern technology. In “From Paperwork to Proof,” host Josh Brickman explores how automation, machine-readable standards, and AI could transform compliance into a continuous, evidence-driven practice.

Pirooz Javan, CTO and co-founder of Easy Dynamics, explains the promise of OSCAL, intelligent automation, and a common language for communicating cybersecurity posture—while emphasizing why organizations cannot permanently outsource ownership of compliance. Members of the Common Criteria Users Forum Management Group preview their upcoming work in Rome and discuss how vendors, laboratories, and governments can improve international product assurance. Eric Crusius, Partner at Hunton Andrews Kurth brings us up to date on CMMC. Former NSA NIAP director Jonathan Rolf reflects on four decades of cybersecurity change and examines the tensions surrounding EUCC, mutual recognition, protection profiles, software supply chains, and post-quantum cryptography.

Plus, Josh and producer Bill Rutledge unpack recent developments involving AI-assisted cryptanalysis, the CMVP backlog, AI and PQ, ENISA’s PQ plans, and critical-infrastructure threats.

Sponsors

Common Criteria Users Forum (www.ccusersforum.org)
Biometric Update (biometricupdate.com)
OpenSSL Foundation (openssl.foundation)
The Cybersecurity Certification and Assessment Tools (CCAT) Project (ccat.fi.muni.cz)

Guests

Pirooz Javan, Chief Technology Officer, Easy Dynamics Corp
The CCUF Management Group
Jonathan Rolf, Cybersecurity Consultant, Independent, Retired NSA NIAP Director, United States
Eric Crusius, Partner, Hunton Andrews Kurth LLP

Links

AI-Assisted Cryptanalysis Leads to withdrawal of HAWK from NIST's ongoing additional signature scheme standardisation process.
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/2r2u6SbHun4/m/TdylDSNgCQAJ?utm_medium=email&utm_source=footer
CMVP Reaches “Zero” Queue
https://crypto-v.org/cmvp-reaches-zero-queue-a-milestone-worth-celebrating/
ENISA opens a call to participate in the public review of “Agreed Cryptographic Mechanisms” until end of July
https://certification.enisa.europa.eu/news/participate-public-review-new-draft-agreed-cryptographic-mechanisms-2026-06-02_en
Cyber Attacks of Water Systems
https://www.nytimes.com/2026/08/01/us/politics/iran-cyberattack-water-systems.html?smid=nytcore-android-share

Trust and Turbulence Podcast
https://www.joshuabrickmanpmp.com/listen

Cybersecurity compliance is moving from policy discussions to urgent implementation. In the premiere episode of the ICT Compliance Pod, host Joshua Brickman speaks with four leading experts about the regulatory and cryptographic changes reshaping the ICT industry.

Roland Atoui, founder of Red Alert Labs, explains how manufacturers can prepare for the EU Cyber Resilience Act and turn compliance into a competitive advantage. ABI Research’s Michela Menting shares key lessons from the International Cryptographic Module Conference, including the challenges of deploying post-quantum cryptography in embedded systems. AWS cryptographer Matthew Campagna explains the “harvest now, decrypt later” threat and the practical steps organizations should take to begin migration. NIST Fellow Lily Chen discusses the post-quantum transition, cryptographic inventories, and why crypto agility must become a long-term organizational capability.

Guests focus on a common theme: Deadlines are approaching and technical challenges are significant.

Sponsors:

• Common Criteria Users Forum (www.ccusersforum.org)
• Biometric Update (biometricupdate.com)
• OpenSSL Foundation (openssl.foundation)
• The Cybersecurity Certification and Assessment Tools (CCAT) Project (ccat.fi.muni.cz)

Guests:

• Roland Atoui, Managing Director and Founder, Red Alert Labs
• Michela Menting, Vice President, ABI Research
• Matt Campagna, Chairman of ETSI Quantum-safe Cryptography Technical Committee, Sr Principal Engineer, Amazon Web Services (AWS)
• Lily Chen, Mathematician and NIST Fellow, National Institute of Standards and Technology (NIST)

Links:

Panel Discussion: PQC Readiness by 2030? – Trust but Verify in a Diverse Technology Ecosystem (Q03a) Leader: Blair Canavan, Director Alliances, PKI and PQC Portfolio, Thales Group, Canada

Panelists: Jaime Gomez, Global Head of the Santander Quantum Threat Program, Santander Digital Services, Spain; Bill Newhouse, Cybersecurity Engineer, National Cybersecurity Center of Excellence, National Institute of Standards and Technology (NIST), United States; Michele Mosca, Co-founder and CEO, evolutionQ, and Co-founder, Institute for Quantum Computing, Canada; Ted Shorter, Chief Technology Officer, Keyfactor, United States

https://youtu.be/8N_6uZtiKX0 

Recognizing Excellence: The CMUF Community Awards & ICMC Closing Plenary (P32a) Including Lifetime Achievement Award: Lily Chen, Mathematician and NIST Fellow, National Institute of Standards and Technology (NIST)

https://www.youtube.com/watch?v=GMj62M0nyB8 

CRA Standards Unlocked – EU Tour 2 (Lisboa)

https://www.etsi.org/events/cra-standards-unlocked-eu-tour-2-170926/

Trust and Turbulence Podcast:
https://www.joshuabrickmanpmp.com/podcast