ISF Podcast

By Information Security Forum Podcast

The ISF Podcast brings you cutting-edge conversation, tailored to CISOs, CTOs, CROs, and other global security pros. In every episode of the ISF Podcast, Chief Executive, Steve Durbin speaks with rule... more

4.6

1515 ratings

FAQs about ISF Podcast:

How many episodes does ISF Podcast have?

The podcast currently has 335 episodes available.

ISF Podcast episodes:

February 24, 2026S36 Ep20: Jaya Baloo
Today, Steve is in conversation with Jaya Baloo, COO at Aisle. One of the world’s leading experts on quantum technology and cybersecurity, Jaya shares what the future of quantum computing looks like and what businesses can do to prepare for a quantum-prevalent world. She also offers her view of how cyber and quantum technology will co-evolve in the next 10 to 20 years.
Key Takeaways:
You should have started preparing for quantum yesterday.
Cybersecurity stands out among areas of quantum as a space where quantum may first be used by governments to attack adversaries.
More diversity is needed in quantum development.
Tune in to hear more about:
How to begin your journey to quantum-ready today (8:17)
How diversity can shape responsible development of quantum (13:48)
Jaya Baloo’s view on quantum in 10-20 years (15:58)
Standout Quotes:
“ Cybersecurity is something really special here because unfortunately we do not have only from quantum, the same ability to protect as we have to attack. And I worry that the first application of these technologies beyond the sensors, the first real application from governments will be that offensive use to attack our current cryptographic stack.” - Jaya Baloo
“I think in general, especially now with the whole onslaught against everything DEI, I actually think it's such a shame to waste time on excluding anyone from anything. We really need the best skillset we can possibly get. And what you see is that, especially in areas like quantum, there's not enough diversity.” - Jaya Baloo
“So what I really think that we need to think about is how do we democratize, as much as possible, access to our defense against a potential quantum threat, and how do we democratize the availability of quantum computing in order to benefit all of humanity?” - Jaya Baloo
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
19min
February 10, 2026S36 Ep19: Steve Durbin - How Quantum and Geopolitics Are Redefining Resilience
Today, Steve returns to Business Matters with Juliette Foster. In this conversation, Steve recaps 2025 in cyber and shares what he sees as the biggest risks heading into 2026. The two also discuss resilience and compliance, as well as the growing importance of togetherness among businesses…
Key Takeaways:
Companies would be wise to conduct frequent cyber audits.
Supply-chain disruptions can have long-lasting, reputational effects.
How we protect the integrity of our data is at the core of cybersecurity.
Tune in to hear more about:
The relationship between government business in cyber (12:56)
How boards should plan for a cyber attack (15:40)
Collaborating within and across industries (22:24)
Standout Quotes:
“I've said many times that good compliance doesn't equal good security, but good security does equal, nine times out of 10, very good compliance. So where do we go with all of that? I do think that we're probably getting to a point, sadly, where we need to be viewing some of the security processes that we need to undergo in the same way as we consider financial audits.” - Steve Durbin
“I think that the day is gone when you can rely on your defenses. So boards have to be planning for the day when the defenses fail. When an attack really starts to make an impact on your business. The starting point is to figure out how long you can be without your systems. It may sound like a strange thing to say, but that's the important starting point for me.” - Steve Durbin
“Security is not, in my opinion anyway, a competitive advantage. And because it's not a competitive advantage, there shouldn't be this massive barrier to sharing some of the ideas, some of the attacks that are out there for the good of the industry.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
28min
February 03, 2026S36 Ep18: Sir Jeremy Fleming - Why Government–Business Unity Is Critical to Global Cyber Defence
In today’s episode, Steve sits down with Tom Hardin, aka Tipperx — best known for helping expose a massive Wall Street insider trading ring. Steve and Tom discuss early warning signs that an organization might be crossing ethical or legal lines, how to build an organizational culture that promotes openness and protects from insider threats, and how to get employees to buy into things like good cyber hygiene.
Key Takeaways:
Governments must work with the private sector to achieve a cyber-secure environment.
Boards are increasingly aware of cyber risks, but more work is needed.
Global trust is dissipating.
Tune in to hear more about:
The changing landscape of critical national infrastructure (5:46)
Security vs. privacy in the UK (9:27)
An ongoing, structural geopolitical shift (15:18)
Standout Quotes:
“We need to make sure that we are thinking right across government when we are thinking about the approach to critical national infrastructure and how we can make it most safe for our users and for our populations.” - Sir Jeremy Fleming
“I still encounter plenty who haven't done one for 18 months, who haven't updated to the latest threat environment, who haven't thought about geopolitics coming into play. Haven't checked that they've still contracted with a company who's gonna help them wind back in the event that they are breached. Hasn't thought seriously about whether it's gonna pay a ransom. The implications of paying a ransom.” - Sir Jeremy Fleming
“The first thing is that what we're seeing now around changes in geopolitics is definitely a structural change. It's not a cyclical change. So the post 1948 Bretton Woods approach to the global order, with a whole load of United Nations agencies, World Health Organization, World Trade Organization, our approach to international aid, World Bank, these are all institutions that have changed fundamentally and won't change back.” - Sir Jeremy Fleming
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
21min
January 27, 2026S36 Ep17: Tom Hardin - The Insider Threat Playbook: Reducing Risky Behaviour Before It Starts
In today’s episode, Steve sits down with Tom Hardin, aka Tipperx — best known for helping expose a massive Wall Street insider trading ring. Steve and Tom discuss early warning signs that an organization might be crossing ethical or legal lines, how to build an organizational culture that promotes openness and protects from insider threats, and how to get employees to buy into things like good cyber hygiene.
Key Takeaways:
The most underappreciated leadership skill is listening.
Compliance must never be an afterthought or just a check-box exercise.
Anybody has the potential to become an insider threat.
Tune in to hear more about:
The fraud triangle (4:10)
How cybersecurity leaders can build a culture that discourages insider risk (7:12)
Striking a balance between trust and control (15:12)
Standout Quotes:
“But you don't get people to speak up by telling them to speak up. You actually have to, if you're gonna tell them to do that, you have to listen up. So I always encourage leadership to work on their listening skills.” - Tom Hardin
“If you have a rule that a few people break, you have a people problem. If you have a rule that a lot of people are breaking, you have a rule problem.” - Tom Hardin
“You could be one decision away. Never feel like it couldn't be you. Just have a healthy paranoia when you're in situations and not to feel like that could never be me crossing a line, because that's when we're most susceptible to that.” - Tom Hardin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
19min
January 20, 2026S36 Ep16: Emerging Threats: Threat Horizons Q&A 2026
Today, we bring you the second half of Emerging Threats 2026, the first episode of which we aired last year. In the previous episode, Steve outlined the threats and challenges that enterprises and business leaders will face in 2026 and beyond. Today, he answers questions from the audience. We’ll get into artificial intelligence, supply chain and geopolitical challenges, corporate governance, risk and resilience, and more.
Key Takeaways:
Cyber resilience today is about data, data, and data.
Enterprises must help their suppliers to meet adequate security standards.
AI will be a big challenge for the board in 2026.
Tune in to hear more about:
Managing supply-chain risk (5:07)
How leaders can deal with risks outside of their control (12:16)
An evolving cyber threat landscape (15:37)
Standout Quotes:
“Assuming you've got your policies and your processes in place, I would suggest you have an AI committee that actually approves or otherwise the way in which these tools are then implemented across the business. Why have a committee? Because that way you can pull in representatives from different parts. You can have security, you can have IT, you can have legal and people from the mainline businesses. Everybody makes a decision based on very well-defined criteria, no comeback on any individual, and either it's approved or it isn't.” - Steve Durbin
“How do you avoid getting caught out? For me that's not what's happening. If you happen to be on a list. If you happen to be an organization that has something that is exceptionally interesting or useful, then somebody will want that information. Somebody will want that data. What you have to do is make yourself look pretty unattractive. So it is about all of the tedious things that we don't like. It's about patching, it's about making sure that you're making it difficult for people to access your systems. It means that your monitoring is top of its game.” - Steve Durbin
“What measures can we put in place to ensure our suppliers and third party partners meet our security standards? Good question that I think that requires a lot more communication. It is about being really clear as to what it is you're expecting from a security standard perspective. It's about not just setting the bar, it's about helping people to achieve what it is you're expecting them to do. And the really important piece that I would emphasize there is tell them the why. Why do you have to do it? Why is it important? This isn't about people doing tick boxes. It is about people understanding why it's important and how they can help to maintain integrity and security across the whole supply chain.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
21min
January 13, 2026S36 Ep15: Celebrating the ISF Podcast: Ten Years in Review
The ISF Podcast celebrates 10 years this year. Over the decade that we’ve been in your ears every week, Steve has interviewed a lot of fascinating people: visionary business leaders, neuroscientists and physicists, world leaders, and formerly notorious cyber criminals, just to name a few. We have touched on topics like AI, the human mind, cyber resilience, leadership, and the future of technology and society.
So, to kick off 2026, we wanted to give you a look back, highlighting the very best of this first decade of the ISF Podcast. And don’t worry – we’ll link all the episodes in the show notes.
Check out our favorite episodes from the last 10 years:
Mo Gawdat - Rethinking the Paradigm of Artificial and Human Intelligence
Brian Cox — Intellectual Honesty & Learning to be a Leader
Hannah Fry - What Data Can & Can’t Tell Us About Ourselves
Peter Hinssen - The Never Normal
Inside the Mind of Today's Cybercriminals (Brett Johnson, Part 1)
Steve Wozniak In Conversation with Steve Durbin
Captain Tammie Jo Shults - Habits, Hope and Heroes in a Time of Crisis
Sadie Creese — Minimising Your Attack Surface
Sir Bob Geldof — Challenging Orthodox Thinking
Bonus Episode: Reggie Butler — Bringing Your Home to Work
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
22min
December 16, 2025S36 Ep14: Steve Durbin - Emerging Threats 2026
Today, Steve looks toward the horizon, at the threats and challenges that enterprises and business leaders will face in 2026 and beyond. He also gives advice on how everyone, from the board to the practitioner, can meet these challenges, and answers some of the questions he’s received this year.

Key Takeaways:
Steve’s four key drivers of cyber risk heading into 2026 are AI, supply chain, quantum, and geopolitical instability.
Crucial to cyber resilience are strong governance and a security-conscious culture.
Adaptive governance and adaptive security are keys to managing the challenges of 2026 and beyond.
Tune in to hear more about:
Steve’s four key drivers of cyber risk heading into 2026 (2:23)
Questions to ask, whether you’re a board member, an executive, or practitioner (16:14)
The changing role of the board (18:54)
Standout Quotes:
“ Resilience really needs an organizational wide holistic approach that takes technology, it takes governance, it takes operational readiness, and really importantly, it takes people into account.” - Steve Durbin
“I think boards need to really take it upon themselves to absolutely recognize that cyber risk is a national risk. It is a business ending risk, and they need to ensure that they don't just have incident response and resilience in place, but that they also have a tried and tested plan, so this is good old fashioned BCP — business continuity planning — with a cyber flavor.” - Steve Durbin
“Cyber risk reporting has to be business outcome oriented. Boards, business executives understand revenue, operations, customer impact, legal exposure. That's the way we have to be reporting cyber risk. It's not about how many attacks we repelled, it's not about how good our systems might be. You need to translate it into business language. If you can do that, not only will you get buy-in, but you'll also have a much richer conversation about the role that cyber and therefore cybersecurity and cyber resilience play in the business.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
29min
December 02, 2025S36 Ep13: Steve Durbin - Preparing for AI-Generated Cyber Intrusions
In the second part of his interview with journalist Nick Witchell, Steve and Nick delve into the world of AI and cyber. Steve shares his thoughts on autonomous cyber defense and argues that major actors like the ISF, large private enterprises, and the UK’s National Cyber Security Centre, must lead the way and support small and medium-sized businesses in keeping pace with technological advancements. The two also discuss the future of AI, cautioning that we aren’t as prepared as we need to be…

Key Takeaways:
Small and medium-sized businesses must receive support to stay up-to-date with new technologies.
As more automation is introduced into business operations, understanding of one’s crown jewels and how to protect them is increasingly important.
AI is advancing rapidly with evermore funding, and globally society is not preparing as well as it needs to for what’s to come.
Tune in to hear more about:
Steve’s view on autonomous cyber defense (00:55)
The National Cyber Security Centre and its role in the cyber resilience of UK businesses (3:36)
How AI will impact jobs in cyber (7:55)
Standout Quotes:
“You'll never get me going into an autonomous car. I just won't do it. And people will say, ‘Yes, they're being looked after by some bloke in a tower somewhere who's watching it.” I'm not buying it. I've been working in technology for far too long to know that it is fallible. And so I think we have to really move toward much more transparency in our understanding of where the AI tool is active, the data that it's using, the decisions it's making.” - Steve Durbin
“We are looking for large private enterprise to be working collaboratively with people like the NCSC, with people like the ISF, to really help some of these smaller organizations that don't have the luxury or resources available to them to keep a pace with [technology].” - Steve Durbin
“If you go back to the internet, we didn't do a good enough job of trying to forecast the way in which the internet was going to be used. We put it out there and we said, ‘Let everybody use it and let's see where it goes.” We are doing, I fear, a similar kind of thing with AI.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
14min
November 25, 2025S36 Ep12: Steve Durbin - Cyber Governance in Transition: What Boards Should Do Next
In today's episode, Steve sits down with journalist Nick Witchell for a conversation focused on what business leaders can learn from this year's major cyber attacks and the recent AWS outage. The two also discuss cyber regulations and the challenge of operating global enterprise during significant geopolitical turmoil.

Key Takeaways:
Boards and senior executives understand there is a threat, but many still lack knowledge of how to deal with it.
We are too reliant on technology; for the sake of business continuity, a backup plan must be in place.
High-quality simulation exercises are a crucial step toward more cyber resilience.
Tune in to hear more about:
The role of policy and regulation (3:17)
Why cyber simulation exercises are so important (5:45)
Steve’s thoughts on the recent AWS outage (7:54)
Standout Quotes:
“Now, in the boardroom itself, in companies themselves, we have seen over the past few years an increasing awareness of the threat that these kinds of things can bring to really the future of an organization. But the challenge I think we now face is really helping boards, senior executives to transition from, yes, I get there's a threat, but what should I actually be doing about it?” - Steve Durbin
“I think that in the main, cloud service providers are still probably far better equipped to provide the level of service that most companies need than you'd be able to do yourself. However, we do need to take into account that things will go wrong. And we have to plan for that. So if you are an organization that can quite happily exist without access to data in a cloud provider, it doesn't have to be Amazon, it could be anybody else, then fine. I would question why you're using them in that case. If on the other hand, you are dependent on them, you have to have some backup in place.” - Steve Durbin
“All too often I'm seeing people particularly in the area of, say, cyber simulation exercises, because they're viewing it as a compliance exercise, going for least cost. That to me is a bit like saying I've just moved into an area where I know the burglary rate is quite high. What's the cheapest lock and door that I can get on my front door? It's madness. Not many of us would do it. We would try to work within our budget. We'd try to really figure out how important things were in our house. That's the mentality we have to adopt. So yes, you can get some of these things done very cheaply and you can tick a box, but it's not going to help you when things go wrong.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
15min
November 11, 2025S36 Ep11: Steve Durbin - Why Cybersecurity Should Be a Boardroom Conversation
Today’s special episode features Steve’s recent Business Matters broadcast interview with Juliette Foster, featuring conversation about critical cybersecurity challenges facing organizations today. Steve and Juliette discuss targeted phishing, the growing threat of Crime-as-a-Service, the increase in AI-driven cybercrime, and more.

Key Takeaways:
Cyber attacks will continue to increase, and businesses must adjust.
Regulators must strike a balance to have clear guidelines without stifling businesses.
To take advantage of new technologies like AI, businesses must invest in upskilling their employees.
Tune in to hear more about:
Why cyber crime is on the rise (2:17)
How cyber criminals target their victims (4:00)
Solving the cyber skills shortage (29:02)
Standout Quotes:
“The bad guys only need to get lucky once and they can cause havoc. And so the sorts of numbers you are seeing are them plugging away at it, trying to break down defenses, trying to find a way through. And on the defensive side, of course, we have to be at the top of our game 24/7, and that's just impossible.” - Steve Durbin
“We also have very complex supply chains now that obviously are made up of small to mid-size companies. [...] So an easier way of accessing some of this high value information is often via the third party. So you don't necessarily need to be attacking the larger enterprise. You can target a smaller to mid-size, which probably doesn't have the same level of defense, maybe not the same level of awareness. And because it's in the supply chain and sharing information, you can then access through to the larger enterprise.” Steve Durbin
“You have to invest in actually looking at the skill sets that you need within your organization and making some hard calls, I think, as to whether or not you do have the right capabilities within your organization. That doesn't necessarily mean that you have to get rid of a lot of people. It means you probably do need to invest significantly in upskilling and training and thinking very hard about how you're going to use some of that new technology.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
...more
33min

FAQs about ISF Podcast:

How many episodes does ISF Podcast have?

The podcast currently has 335 episodes available.

More shows like ISF Podcast

All Ears English Podcast

2,257 Listeners

The Happiness Lab with Dr. Laurie Santos

14,399 Listeners

Think Fast Talk Smart: Communication Techniques

830 Listeners

Confident Business English

153 Listeners

Share ISF Podcast

Sign up to save your podcasts

ISF Podcast

FAQs about ISF Podcast:

How many episodes does ISF Podcast have?

ISF Podcast episodes:

FAQs about ISF Podcast:

How many episodes does ISF Podcast have?

More shows like ISF Podcast

All Ears English Podcast

The Happiness Lab with Dr. Laurie Santos

Think Fast Talk Smart: Communication Techniques

Confident Business English