ISF Podcast

By Information Security Forum PodcastBusiness Technology Tech News Careers Management

ISF Podcast episodes

October 27360: Will Vogt - Beyond the Chip Race: How China Really Thinks About Technology
Today, Steve speaks with Will Vogt, expert on Chinese tech policy. The two discuss China’s approach to technology, how it can impact western businesses, and the country’s investments in tech infrastructure in emerging markets in Africa and Latin America. Will also gives his thoughts on how business leaders best can understand tech developments in China in the coming years.
Key Takeaways:
China is moving toward a more centralized, collectivist internet.
Understanding Chinese cultural norms is helpful when looking to do business with Chinese corporations.
If you are looking to expand into emerging markets, expect various nation states and private actors to be operating there.
Tune in to hear more about:
The Chinese state’s relationship between technology, security, control, and culture (7:58)
China and AI (9:47)
How Chinese tech and infrastructure is spreading to emerging markets (18:39)
Standout Quotes:
“There's a real risk there that comes from any sort of social, economic, or political revolution, and that is something that has global impacts now because a China that melts down has a lot of externalities involved, and I think that's just something that those stakeholders who are engaged with China, it's important to keep that in mind, not only for global stability, but also to understand the counterpart's point of view.” - Will Vogt
“In certain contexts, what we might call a bug or hallucination in an AI platform can also be viewed as a potential mechanism for propaganda or for establishing a national narrative.” - Will Vogt
“China is changing rapidly. I really want to reiterate to de-emphasize the conversations about chips and even about regional issues in East Asia. So I would say you need to look outward. And it's worth having a better understanding of what markets are being emphasized by China, because that will tell you a lot.” - Will Vogt
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
28 min
October 20359: Dr. Ashley Sweetman – Communicating Cyber Risk: Why Soft Skills Are Now Security Skills
Today, Steve is in conversation with Dr. Ashley Sweetman, co-author with Nina Paine of the recently released book, Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, including how to translate complex cyber risk into business and financial terms. Ash highlights the importance of empathy and honesty, and notes that more and more C-suite executives now consider these “soft” skills as important as technical skills. Ash and Steve also dive into how to communicate cyber risk to the board, what a security-focused culture is, and challenges created by AI.
Key Takeaways:
Lead with honesty and transparency, but make sure you understand who you are communicating to and tailor your message accordingly.
A leader that takes cybersecurity seriously goes a long way to build a security-focused culture.
Cultivating relationships between the cybersecurity team and other teams is important for cyber resilience.
Tune in to hear more about:
Why more cybersecurity employees should receive communications training (4:48)
What a security-focused culture looks like (9:24)
Ash’s advice for communicating cyber risk that leaders can implement right now (20:37)
Standout Quotes:
“Communicating things in business and financial terms is a pretty key skill. If you can put numbers on things and give talk in kind of estimative intelligence language, that can be helpful. It's about explaining things in terms of real world impact and the impact on the customer or your clients.” - Ash Sweetman
“It's having those relationships with the board that preexist, the trust and credibility that you build up over time so that when the inevitable happens or if you're in a bit of a crisis period, everybody knows their roles. The board is able to challenge effectively. They're equipped with the right skills and questions to provide constructive challenge, and that is built over time rather than just when your back is against a wall.” - Ash Sweetman
“I don't think anytime soon AI’s going to be relied upon as the kind of producer of communications, but I think it could do some good peer comparison, for example, or ask some really good constructive challenge questions and things like that.” - Ash Sweetman
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
24 min
October 13358: Steve Durbin - No Symptoms, No Family History: Why Every Man Should Get Tested
This week’s episode is unique and personal. Earlier this year, Steve announced that he had been diagnosed with stage 3 prostate cancer. Today, Steve and and Producer Tavia Gilbert sit down to talk about what his life has been like over the past year. He shares how he reacted when he first got his diagnosis and explains why it’s so important to choose the right medical team. We also discuss resilience and mindset, how people in his personal and professional life have responded to his news and his decision to be publicly transparent, and, now that Steve’s nearly done with radiotherapy, what comes next.
Also, let’s cut to the chase. The whole point of today’s episode is this message: men, get your PSA levels checked!
Key Takeaways:
Get tested! Early detection significantly improves survival rates.
Taking control over your treatment is important, and that can include choosing your medical team, being brave and asking all the questions, and doing your research.
It’s okay for people around you to be uncomfortable or not know what to say.
Tune in to hear more about:
How Steve responded to his diagnosis ()
Adopting an athlete-mindset ()
Steve’s use of meditation ()
Standout Quotes:
“I think most leaders like to think that they are pretty invincible, and when something like cancer comes along, it doesn't have to be prostate, it could be anything, you suddenly realize that actually you're not. Lo and behold, you are actually human. And you do have to rely on some of your softer side to be able to cope with not just the physical pressures, but much more importantly, I think the emotional and the psychological impact.” - Steve Durbin
“From the security standpoint, of course you have the ability to be objective because you're talking about a business, or somebody else's business. When you're talking about yourself and balancing risk at an individual level, at a personal level it takes on a whole new dimension because it is for real. If you probably get one shot at it, maybe two if you're lucky, but you've got to get it right in terms of how you balance that out and how you talk about it.” - Steve Durbin
“There was one other decision that I did take, and that decision was that I did not see my cancer as making me a sick person. So in my mind I do not have an illness. I am not sick. I happen to have a cancer. There's a little part of me that has got something that's not working the way that it ought to, and that's fine. I'm fine with that because we can fix that. But I'm not ill. ” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
53 min
October 06357: Legal Owl Podcast: Steve Durbin on AI, Geopolitics and Legal Cyber Resilience
We’re back with the second part of Steve’s appearance on John “Jock" Brocas’ podcast “Legal Owl”. Today, Steve and Jock discuss artificial intelligence, the global powers shaping the cyber landscape, and how to get lawyers, board members, and other non-technical business people to care about cyber resilience. Steve also gives some tips for law firms looking to beef up their cyber practices.
Key Takeaways:
Bad state actors operate all over the world, and national cyber resilience efforts must reflect that reality.
With AI’s rapid growth, good compliance training is more important than ever.
Many law firms still don’t grasp the need for good cyber hygiene and resilience.
Tune in to hear more about:
AI and cyber (4:53)
Steve’s tips for law firms looking to commit to a more robust cyber effort (18:10)
Steve's advice for a law firm that's suffered a breach (21:33)
Standout Quotes:
“I think the best outcome for AI is humans working collaboratively with the tool. No doubt you can get things done a lot quicker. You can get to certain points, but that doesn't mean that you stop validating and switch off the brain. You need to be looking at these things and saying, "Okay, does that actually make sense?" And questioning. And I think the assumption that because it's AI, somehow it must be absolutely right. No, it's not at that point yet. My personal hope is that it never gets to that point.” - Steve Durbin
“I always say that good security will result in good compliance. Compliance will not necessarily result in good security.” - Steve Durbin
“If a law firm is breached, I would hope that they have run through their resilience testing beforehand. I would hope that they have run some cyber simulation exercises where they are ready to respond to that kind of thing. If they haven't, I would say they're being negligent.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
26 min
September 22357: Legal Owl Podcast: Steve Durbin on Cyber Risk in the Legal Industry
The tables turn in this episode, as Steve becomes the guest on “Legal Owl,” a podcast by John “Jock" Brocas, the executive coach whom you might remember from one of our shows earlier this year. In this first part of two, Steve tells Jock about how he got into cyber in the first place, and the two discuss the evolution of the cyber landscape. They also dive into why law firms must begin to think more about cyber risk and resilience.
Key Takeaways:
Cyber has moved from an IT issue to a business issue.
Senior staff must be aware of the risks of deepfake impersonations.
Your information is probably out there already, so focus on what to do when that information is used the wrong way.
Tune in to hear more about:
How law firms are impacted by today’s cyber risks (8:24)
Deepfakes and reputational damage (12:42)
Why you might want to make your business look unattractive (15:19)
Standout Quotes:
“COVID was a real turning point, I think, for the industry, because suddenly, pretty much overnight, we had to move to an environment where we're protecting data that's not within the strict confines of the organization. So it'll be in people's homes, it was gonna be used by people where you had no control over it at all. And so we had to adapt as an industry to that, and I think that was actually very good for us.” - Steve Durbin
“We're in an environment where you really do need to be exceptionally careful about how you manage your personal profile, how you manage personal data, how you really behave, I would say, online. And that, for some people, is quite a difficult one to get your head around.” - Steve Durbin
“I think that the days of "I'm too small to get noticed" have pretty much gone now. If you're working in any way, shape, or form with data online, you're a potential target, and you have to adopt that mindset.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
24 min
September 15 356: From the archive – Communication, Listening and Being Heard
In this episode, ISF Chief Executive Steve Durbin talks with Dame Inga Beale, the former CEO of Lloyd’s of London, about the role that listening played when she became the first (and only) female CEO in Lloyd’s more than 300-year history. They also discuss the courage and effectiveness of simplicity in communication, a new style of leadership built on trust, and career advice for both board members and security professionals who are relatively new to the industry.
More about Lloyd’s of London.
Mentioned in this episode:
• Dive In Festival
• Read the transcript of this episode.
• Subscribe to the ISF Podcast wherever you listen to podcasts.
• Connect with us on LinkedIn and Twitter.
• From the Information Security Forum, the leading authority on cyber, information security, and risk management.
28 min
September 01355: Eric O'Neill – Hackers Don't Break In, They Log In: Trust as the New Perimeter
Today, Steve is joined by former FBI agent Eric O’Neill. Eric is a cyber security expert and author, but he’s probably most well-known as the man who brought down Peter Hanssen, a Russian spy who became one of the most notorious double agents in the history of US intelligence. Steve and Eric discuss cyber preparedness in today’s business world, insider threats, and cyber resilience in a rapidly changing world.
Key Takeaways:
Cybercrime is a trillion-dollar business and businesses would be wise to make defending against it a top priority.
A business’ information should be segmented, with no one person having access to everything.
Deepfakes will increasingly be used to influence employees, businesses, and voters.
Tune in to hear more about:
Building a culture of cyber vigilance (5:46)
The insider threat (8:44)
Eric’s PAID strategy (20:47)
Standout Quotes:
“What most corporations and companies must worry about critically, it should be at the top of their risk portfolio, is cybercrime, which is the fastest-growing business on Earth.” - Eric O’Neill
“Every single person in IT that is a systems administrator, who can elevate privileges, who can create accounts, who can reset passwords, those tend to be the most targeted individuals in an organization, and the accounts, the individuals, the roles that attackers most want to compromise.” - Eric O’Neill
"Attackers don't care who you are, they don't care what you do, they don't care whether you're big or small. They only care whether you're vulnerable. And if you are vulnerable, you will be attacked by a cyber criminal group, and if you don't prepare ahead of the attack, then you'll be a victim.” Eric O’Neill
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
32 min
August 25354: SUMMER LISTENING: Emerging Threats for 2026
Today, Steve looks toward the horizon, at the threats and challenges that enterprises and business leaders will face in 2026 and beyond. He also gives advice on how everyone, from the board to the practitioner, can meet these challenges, and answers some of the questions he’s received this year.
Key Takeaways:
Steve’s four key drivers of cyber risk heading into 2026 are AI, supply chain, quantum, and geopolitical instability.
Crucial to cyber resilience are strong governance and a security-conscious culture.
Adaptive governance and adaptive security are keys to managing the challenges of 2026 and beyond.
Tune in to hear more about:
Steve’s four key drivers of cyber risk heading into 2026 (2:23)
Questions to ask, whether you’re a board member, an executive, or practitioner (16:14)
The changing role of the board (18:54)
Standout Quotes:
“ Resilience really needs an organizational wide holistic approach that takes technology, it takes governance, it takes operational readiness, and really importantly, it takes people into account.” - Steve Durbin
“I think boards need to really take it upon themselves to absolutely recognize that cyber risk is a national risk. It is a business ending risk, and they need to ensure that they don't just have incident response and resilience in place, but that they also have a tried and tested plan, so this is good old fashioned BCP — business continuity planning — with a cyber flavor.” - Steve Durbin
“Cyber risk reporting has to be business outcome oriented. Boards, business executives understand revenue, operations, customer impact, legal exposure. That's the way we have to be reporting cyber risk. It's not about how many attacks we repelled, it's not about how good our systems might be. You need to translate it into business language. If you can do that, not only will you get buy-in, but you'll also have a much richer conversation about the role that cyber and therefore cybersecurity and cyber resilience play in the business.” - Steve Durbin
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
29 min
August 18353: SUMMER LISTENING: Rest After Stress: The Psychology of High Performance
Today, Steve speaks with Lauren Farina, psychotherapist and founder of Invited Psychotherapy & Coaching. Lauren and Steve discuss how wellness is becoming a bigger part of the workplace and how we can stay mentally healthy during times of stress and pressure. Also an expert on “high-performance individuals,” Lauren shares what it means to be high-performing and why rest can be just as productive as work.

Key Takeaways:
Being a high-performer isn’t just about work.
Rest is productive
Building psychological safety within an organization is the most important contributor to elite performance.
Tune in to hear more about:
What the “High Performer Archetype” is (6:15)
The risks of not taking time to rest (11:22)
How leaders can improve the performance of their teams (19:33)
Standout Quotes:
“ As many of us know, acute stress is quite good for us. But in the long term, the chronic unrelenting demands that I think remote working arrangements have placed on the workforce, really can erode our performance because our cognitive functioning is not at its peak when we're chronically stressed, our memory, our learning, our judgment, our decision making is compromised.” - Lauren Farina
“ There was a five -year study at Google called the Aristotle Project, and the Aristotle project found that psychological safety is the single most important factor when it comes to the elite performance of individuals and groups.“ - Lauren Farina
“ It is my hope that there will be an increased focus on intersectionality of performance and wellbeing and increased support of individuals and groups in cultivating wellbeing. Not only for the sake of wellbeing, but also for the sake of peak performance.” - Lauren Farina
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.
27 min
August 11 352: SUMMER LISTENING: Geoff White – Ransomware Is a Business and It's Competing Against You
In today’s episode, we welcome another ISF veteran: journalist Geoff White. The last time Geoff was a guest on the podcast, it was 2024 and he had just released a book about how the tech industry launders money for criminal organizations. Today, Geoff comes on to talk about the latest installment in his podcast series The Lazarus Heist – now known as Cyber Hack – in which he dives deep into ransomware attacks. Steve and Geoff discuss the changing nature of ransomware attacks, how AI is used, crypto and ransomware laundering, and the importance of businesses having a plan to deal with an attack when it inevitably comes.
Key Takeaways:
1 Ransomware attacks remain similar in strategy, but have become more industrialized in recent years.
2 Crime groups utilizing ransomware view themselves as businesses. and view targets not as victims but as competitors.
3 An immediate, outright criminalization of paying ransoms is the wrong path forward, but if done in phases it can be the best way to solve the issue of ransomware attacks.
Tune in to hear more about:
1 Geoff’s investigation into Conti, one of the world’s most notorious ransomware gangs (7:33)
2 The impact of AI on ransomware attacks (13:52)
3 How money laundering is changing (17:03)
Standout Quotes:
1 “I think for defenders, the listeners of your podcast, understanding [ransomware] is a business and understanding you're not being attacked by a crime gang, you're being challenged by a business competitor, is a really interesting way of thinking about this. This is like a hostile takeover. The crime gangs do not think of themselves as hackers. They think of themselves as a business. Your security was weak, that's bad news for you, buddy. Our security, our technology was better, so you now have to pay us. It's effectively like a corporate raider mentality.” - Geoff White
2 “I think we're in a good place with cybersecurity, relatively speaking, where the defensive AI use is so strong and so well-funded and pumping so hard that make hay while the sun shines, get your AI defensive stuff in line, keep our advantage going, because I think the cybercrime gangs are a bit behind the curve there.” - Geoff White
3 “Let's imagine as a thought experiment,, the UK government tomorrow introduces legislation that says no more ransoms, illegal, enforceable by criminal law, illegal, criminally illegal to pay a ransom. Immediately you'll just be set with problems. Hospitals, there's points where hospitals to get the patients to survive would need to pay a ransom. Are you prepared to let people die because you don't want to pay a ransom?” - Geoff White
Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter
From the Information Security Forum, the leading authority on cyber, information security, and risk management.
29 min

About ISF Podcast

From the publisher's feed

The ISF Podcast brings you cutting-edge conversation, tailored to CISOs, CTOs, CROs, and other global security pros. In every episode of the ISF Podcast, Chief Executive, Steve Durbin speaks with…