Let's Talk About (Secur)IT

We keep hearing about the hundreds of thousands of unfilled cybersecurity jobs. But what if the problem was never a shortage of talent — it was a shortage of opportunity?I sat down with Bruce Johnson, who has spent nearly four decades in tech and security, to talk about why graduates with cybersecurity degrees can't get hired — and what he's doing about it.

Bruce runs student-powered SOCs — real security operations centers where students from schools across the country (Louisiana, NJIT, Georgetown, Rutgers) defend their own institutions against live threats. Not simulations. Not labs. The real thing.

His analogy stuck with me: "We were training students to ride a bicycle and asking them to merge onto a highway."

We got into:• Why AI isn't replacing analysts — it's reshaping what they need to know• How critical thinking beats certifications every time• Why academia can't keep pace with the rate of change (3 years to approve a curriculum vs. 3 weeks in the real world)• The hiring myths that are holding the industry back• And yes — a story about a candidate caught with ChatGPT on the screen behind him during an interview

Bruce's closing line: "The security workforce challenge won't be solved by creating more job postings. It'll be solved by creating more pathways."

That's not just a workforce strategy. It's a resilience strategy.

Worth the 30 minutes.

I sat down with Luis Luque, Managing Director and Global Cyber Physical Security Lead at Accenture, straight from the RSA conference floor, to talk about the intersection of operational technology, physical security, and cyber risk. And honestly, it was one of those conversations that changed how I think about the space.

A few things that stuck with me:

• Most executives still believe OT and IT are separate worlds. They are not. The convergence is already happening, and the companies that pretend otherwise are the ones leaving backdoors wide open.

• Boards are paying attention, but most still cannot answer a simple question: if an OT incident happened tomorrow, who is responsible? Not who should be notified. Who owns it end to end. The silence in that room is the real vulnerability.

• Supply chain risk goes all the way down to the electron microscope level. Some companies are still running critical manufacturing on Windows NT in 2026 because replacing it would cost tens of millions.

• The basics—immutable backups, visibility, and containment—are still the things most organizations get wrong.

Luis made a point that I keep coming back to: the most successful OT security programs are not funded as security projects. They are funded as business enablement. When you can show a plant manager that the right security investment will keep the line running and make their job easier, the conversation changes completely.

If your organization touches anything physical, from a factory floor to a hospital to a data center, this is worth 44 minutes of your time.

What if one of cybersecurity’s biggest problems isn’t technology, but the way we’ve chosen to fight?

I sat down with Michael Daniel, former White House Cybersecurity Coordinator and CEO of the Cyber Threat Alliance, to discuss a reality every CEO, CISO, and board member needs to understand:

Your cyber risk is no longer just your risk.

We explore why the old “castle and moat” model is broken, how competitors can collaborate against common threats, what boards still misunderstand about cyber risk, the coming impact of quantum computing, and why fatalism may be one of cybersecurity’s most dangerous mindsets.

As Michael puts it: “Your risk is also my risk.”

The future of cybersecurity won’t simply be determined by who has the best technology. It will be determined by who can collaborate, adapt, and recover faster than the threat.

"Every organization I've tested — I've always found a way in."

That's not a hacker bragging.That's Hanna Linderstål — a cybersecurity strategist, who teaches digital espionage at the Swedish Defence University, and is one of Europe's most respected voices on autonomous defense.

She started coding at 11. No internet. Just a modem, a phone line, and curiosity that never stopped.

In our latest SecurIT episode, she said something that should keep every CISO up at night:"Most organizations are defensive in posture and delusional in practice."

We talked about:

• The signal intelligence blind spot almost no company is watching
• Why more data ≠ better security (it's just noise without context)
• The OODA loop what the military knows about crisis response that your board doesn't
• How a spy was caught downloading files at midnight on a Saturday — and why your systems wouldn't have caught him either
• Why the next pandemic might not be biological it might be three weeks without internet

The most uncomfortable quote of the episode?"I have never found an organization where we didn't find a potential risk we could exploit. Not one."

If you're in security, leadership, or you just rely on the internet to run your business — this one's for you.

The internet runs on cables buried at the bottom of the ocean. Quantum computers will soon break the encryption protecting them. Most leaders don't even know the clock has started. 

I sat down with one of the most consequential voices in global cybersecurity — Tom Patterson, Managing Director of Emerging Tech Security at Accenture, FormerChief Trust Officer at Unisys, and White House NSTAC Cyber Moonshot Co-Lead. 

Tom has spent decades advising the world's largest governments and enterprises on the threats they don't see coming. 

In this conversation, we went deep on the four forces quietly reshaping the security of our entire digital world:

🛰️ Space — satellites are infrastructure, and they're exposed

🌊 Subsea cables — the physical backbone of the internet, increasingly targeted

🤖 AI — a tool for both defenders and adversaries

⚛️ Quantum Computing — not coming. Already here. 

Tom's message was clear: "This is not Star Wars. This is real life."

The enterprises and governments preparing now will define the next decade. The ones waiting will be playing catch-up in a game they can't win.  

If you lead a team, run an organization, or make decisions about technology and risk — this conversation is not optional.

Most companies think cybersecurity is an IT problem. 

It's not. 

It's a leadership problem. A culture problem. A boardroom problem. 

I sat down with Joe Sullivan — former Chief Security Officer at Facebook, Uber, and Cloudflare, federal prosecutor, and member of the Obama Cyber Commission — and what heshared should be required listening for every executive, board member, and founder. 

We talked about:

• Why your security tools don't matter if your culture is broken
• What boards get wrong about cyber risk
• How to build security programs that actually scale
• The mindset shift that separates resilient organizations from vulnerable ones 

If you're a leader responsible for people, data, or decisions — this episode is for you.

Is AI your biggest security threat—or your next unfair advantage?
In this episode of Secure(It), host Philip de Souza sits down with Craig Nelson, founder of GrowthIQ.ai, to unpack how AI is reshaping cyber defense, data governance, and mission critical operations for security minded organizations.

🧠 Built for security and technology leaders:
• Why AI adoption is accelerating now—and what’s structurally changed in the last 12–18 months for enterprise teams.
• How to build secure AI knowledge bases without leaking your company DNA or violating client trust.
• The gap between “defensive” security and strategic AI implementation that actually moves the revenue and risk needles.
• Common data governance mistakes that quietly expand your attack surface.
• How to balance innovation with compliance, privacy, and regulatory pressure in sectors like wealth management, real estate, and mortgage.
• Why “we’ll secure it later” might be the most dangerous phrase in your AI roadmap.
• Practical deployment patterns and guardrails for SMB and mid market environments.

🔍 We also dig into:
• A 21 Day AI Challenge for ingesting internal data safely.
• Vector databases vs relational databases—what technical leaders really need to consider for secure retrieval.
• Who should own AI governance: security, data, product, or a new cross functional group.
• Real world AI agent and autonomous workflow examples—productivity breakthrough and new risk category.
• How adversaries are already weaponizing AI faster than most defenders expect.

🎙 About the guest:

Craig Nelson, co-founder of GrowthIQ.ai, helps organizations go from random and unsecure use of AI into a secure and optimized AI operating capability. Through Navi, GrowthIQ’s AI orchestration platform, he works with companies across multiple verticals to align people, data, various AI systems and agents into repeatable workflows with strong security and governance guardrails.

If you’re responsible for both innovation and risk, this conversation is for you.

In this Secur(IT) episode, host Philip de Souza talks with George Tsantes, Partner at Newport LLC, former Accenture partner, EY principal, and co‑author of Cyber Attacks: Managing the Risk and Results. They explore how boardscan turn cybersecurity into business strategy by prioritizing vigilance over pure prevention, protecting the “crown jewels,” and using business metrics instead of vanity dashboards. The conversation also covers AI‑driven threats, third‑party and “meta‑enterprise” exposure, incident readiness, and how CISOs can “prove cybersecurity” in clear board language

Is your organization treating cybersecurity as a technical issue or a strategic business imperative?

In this episode of Secure (IT), host Philip de Souza is joined by two powerhouses in the tech and governance space: Tamara Gracon (Founder of TBG Consulting) and Jenny Kay Pollock (Co-Founder of Women x AI).

Together, they dive deep into the intersection of Cybersecurity, AI Empowerment, and Cognitive Diversity. As AI reshapes the corporate landscape, boards and executives face the challenge of adapting governance frameworks to match the speed of innovation. Tamara and Jenny share their expertise on the AI Governance Compass Framework, the human element of digital transformation, and how to prepare leadership for the next wave of cyber risks.

In this episode, you will learn:

• The Strategic Shift: How to move cybersecurity from the server room to the boardroom.

• The AI Governance Compass: A specific framework for managing the rapid pace of AI policy changes.

• Cognitive Diversity: Why organizational transformation fails without inclusive leadership and diverse perspectives.

• AI Empowerment: How to use AI for good while navigating ethical dilemmas.

ABOUT OUR GUESTS:

Tamara Gracon is a seasoned executive and board member with nearly 20 years at KPMG. She is the founder of TBG Consulting and a passionate advocate for bringing talented executives into board service via the Private Directors Association and How Women Lead.

Jenny Kay Pollock is the Co-CEO and Co-Founder of WOMEN x AI (WxAI), a global community amplifying female voices in AI. She is also the Founder of Luminizing Growth and serves as an advisor and investor in early-stage women-founded startups.

In this episode of "SecurIt," I'm thrilled to reconnect with Roger Grimes the Data-Driven Defense Evangelist at KnowBe4, as he shares his groundbreaking ideas for defeating hackers and malware. Explore the world of phishing-resistant MFA, the challenges of implementing real IDs, and the promise of quantum computing. Get ready to elevate your understanding of cybersecurity to new heights!