In this episode, Howard Holton joins the No Trust podcast team to discuss why AI governance may be one of the most important and misunderstood challenges facing cybersecurity today.

Drawing on decades of experience across IT, technology leadership, security, and emerging technologies, Howard shares his perspective on the rapid growth of the AI ecosystem, why organisations need to approach AI vendors and startups with a healthy degree of scepticism, and why applying traditional security and governance thinking to AI may not be enough.

The conversation explores the non-deterministic nature of AI, AI governance, vendor evaluation, technical debt, DevSecOps, AI-driven security operations, and the challenge of securing systems that may not behave exactly the same way twice. Howard explains why this fundamentally changes the way we need to think about identity, risk, testing, controls, and accountability.

The episode also looks at the importance of combining human judgement with AI capabilities rather than simply replacing people with automation. As organisations begin making more decisions at machine speed, understanding context, validating outcomes, and maintaining meaningful human oversight will become increasingly important.

Finally, the conversation turns to Black Hat, from navigating an increasingly crowded AI vendor landscape to the value of stepping away from the technology and experiencing the people, food, culture, and community that make conferences memorable.

Key Takeaways:

• AI governance is rapidly becoming one of the most important areas of cybersecurity and technology risk.

• AI is fundamentally non-deterministic, which challenges many traditional approaches to governance, testing, security, and assurance.

• Organisations need to understand how AI systems make decisions—not simply whether they produce the expected output.

• Traditional governance frameworks may need to evolve to deal with autonomous and non-human identities.

• Human oversight remains critical, particularly as AI systems are given greater autonomy and decision-making authority.

• AI security should be approached pragmatically, with strong DevSecOps, risk management, validation, and security fundamentals underneath it.

• The explosion of AI startups makes vendor evaluation increasingly important; organisations need to consider technical debt, long-term viability, architecture, and security rather than simply buying into the AI label.

• AI can strengthen cybersecurity operations, but organisations need to understand the variability and uncertainty inherent in AI-generated decisions.

• Pairing humans with AI can provide better security outcomes than simply attempting to automate people out of the process.

• Understanding context and gaining real-world experience remain essential—whether you're evaluating technology, managing security risk, or navigating Black Hat.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Evgeniy Karam joins the No Trust podcast team live at Black Hat in Las Vegas for a quick-fire conversation about AI, cybersecurity hype, emerging vendors and the challenges of cutting through the noise.

Evgeniy shares how he evaluates new security technologies, including why vendors should be able to explain in plain English what problem they solve, how they solve it and where they might fail. The conversation also explores why much of the AI security debate ultimately comes back to data protection and understanding the crown jewels organisations actually need to protect.

The team also discusses the pressure to adopt AI without clearly defined business outcomes, why AI isn't magic, and the importance of understanding where it genuinely adds value. Evgeniy finishes with advice for people entering cybersecurity, choosing the right conferences and continuing to learn as the industry evolves.

Key Takeaways:

• Black Hat is packed with new vendors, but don’t judge a company by its booth or its marketing.

• Ask vendors to explain in plain English what problem they solve and how they solve it.

• A great question for any vendor is: what would make your technology fail in a POC?

• AI security gets the headlines, but much of the real challenge still comes back to protecting data.

• Organisations need to understand their crown jewels, why they matter and what happens if they become unavailable.

• Security should protect business outcomes, not simply deploy more controls.

• AI needs a defined business problem, not just a mandate from the board.

• AI isn’t magic. Organisations need to understand where it genuinely adds value.

• If you’re starting in cybersecurity, smaller events and communities can sometimes offer more value than Black Hat.

• Whatever conference you attend, go with a plan or the sheer volume of information can quickly become overwhelming.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn [www.linkedin.com/company/zero-trust-forum/](http://www.linkedin.com/company/zero-trust-forum/).

Follow Jaye Tillson on LinkedIn - [www.linkedin.com/in/jaye-tillson/](http://www.linkedin.com/in/jaye-tillson/)

Follow John Spiegel on LinkedIn - [www.linkedin.com/in/john-spiegel-2011543/](http://www.linkedin.com/in/john-spiegel-2011543/)

In this episode, Ginny Yon joins the No Trust podcast team live at Black Hat in Las Vegas to discuss how Hacker Summer Camp is evolving, the explosion of AI and agentic security, and why separating genuine innovation from hype is becoming increasingly difficult.

The conversation explores how AI is accelerating cybersecurity startups and product development, why security leaders may need to make smaller and more calculated technology bets, and why understanding the company behind the technology is becoming just as important as evaluating the product itself.

Ginny also shares her advice for getting the most from Black Hat, the importance of community and those unexpected hallway conversations, and why the next generation of cybersecurity professionals still needs strong foundations alongside an understanding of AI.

And, because it’s the No Trust podcast, there’s also time for oysters, mussels and the inevitable pineapple on pizza debate.

Key Takeaways:

• Black Hat is about the people and community as much as the technology.

• Go with a plan, but leave space for unexpected conversations and connections.

• AI and agentic security are everywhere, but separating innovation from hype is getting harder.

• AI is dramatically reducing the time it takes to build and launch new cybersecurity products.

• Security leaders need to understand the company behind the technology, not just the product.

• Smaller, calculated technology bets may make more sense in a rapidly changing market.

• Start with the problem you need to solve, not the latest AI terminology.

• Waiting for the AI security market to settle carries its own risk.

• AI is becoming a foundational cybersecurity skill, but traditional security disciplines still matter.

• Find the area of cybersecurity you enjoy, build strong foundations and keep learning.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn [www.linkedin.com/company/zero-trust-forum/](http://www.linkedin.com/company/zero-trust-forum/).

Follow Jaye Tillson on LinkedIn - [www.linkedin.com/in/jaye-tillson/](http://www.linkedin.com/in/jaye-tillson/)

Follow John Spiegel on LinkedIn - [www.linkedin.com/in/john-spiegel-2011543/](http://www.linkedin.com/in/john-spiegel-2011543/)

In this episode, Trey Ford joins the No Trust podcast team at Black Hat in Las Vegas to discuss how cybersecurity is evolving as AI accelerates software development, vulnerability discovery, and the speed of both attack and defence.

Drawing on decades of experience across offensive security, vulnerability research, and the Black Hat community, Trey shares his perspective on how the industry has changed, why the next 18–36 months could bring a significant increase in vulnerabilities, and why AI will allow us to make both good and bad decisions at machine speed.

The conversation explores AI-generated code, vulnerability management, open-source security, human oversight, patching pressure, and why strong foundations in networking, troubleshooting, debugging, and systems thinking will become even more important as AI takes on more of the traditional technical workload.

The episode also looks at the changing career path into cybersecurity, the importance of being able to think beyond individual technologies and vulnerabilities, and why Black Hat remains as much about people, relationships, and community as it is about research and technology.

Key Takeaways:

• Black Hat is about the people and community as much as the research and technology.

• Go to Black Hat with a purpose, but leave enough space for unexpected conversations and connections.

• The smaller vendors, startups, and researchers are often where you find the most interesting innovation.

• AI will let us work at machine speed, but it will also allow us to make bad decisions at machine speed.

• Human oversight, challenge and validation will remain critical as AI becomes more autonomous.

• The next 18–36 months could bring a significant increase in vulnerabilities as AI accelerates software development.

• Faster exploitation means organisations will increasingly have to balance the risk of patching quickly against the risk of waiting.

• Cybersecurity professionals need strong foundations in networking, systems, troubleshooting and debugging, not just specialist skills.

• The future belongs to people who can think across systems and understand how technology, security and business connect.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Howard Holton joins the No Trust podcast team to discuss why AI is exposing long standing weaknesses across cybersecurity, identity, and IT operations.

Drawing on decades of experience as a CIO, CTO, and CISO, Howard shares practical insights into why organisations continue to struggle with security fundamentals, how technical debt has created massive hidden risk, and why AI is accelerating the impact of those problems rather than creating entirely new ones.

The conversation explores identity hygiene, least privilege access, blast radius reduction, Zero Trust principles, board level accountability, and the growing gap between business speed and secure delivery.

The episode also looks at why organisations need to rethink culture, governance, and leadership if they want to build sustainable security strategies in the AI era.

Key Takeaways:

• AI is exposing years of poor security hygiene.

• Identity and access control matter more than ever.

• Technical debt is becoming a major security risk.

• AI increases the speed and scale of attacks.

• Businesses still prioritise speed over security.

• Least privilege is critical in the AI era.

• Zero Trust helps reduce blast radius.

• Security must become part of doing things right.

• Boards need stronger cybersecurity understanding.

• Organisations need time to clean up legacy issues.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Gina Yacone joins Jaye Tillson and John Spiegel to discuss the latest trends in cybersecurity, Zero Trust, AI, identity, vulnerability management, and the evolving industry landscape.

The conversation explores how organisations are being forced to rethink security because of rising cyber threats, AI-driven attacks, regulatory pressure, and the growing importance of business-aligned cybersecurity leadership.

They also share practical insights on reducing attack surface, managing technical debt, preparing for quantum risks, securing AI adoption, and why modern CISOs must increasingly speak the language of the business rather than just technology.

Key Takeaways:

• Zero Trust is moving from buzzword to business necessity.

• Identity is back at the centre of serious security conversations.

• Zero Trust is about reducing blast radius, not pretending breaches will never happen.

• AI is helping attackers move faster, scale better, and make fewer mistakes.

• Defenders need AI too, but adoption and operationalisation are still hard.

• Vulnerability management must move from counting CVEs to understanding real exposure.

• CTEM is changing how organisations prioritise risk and patching.

• Quantum readiness should start now with simple assessments and crypto visibility.

• CISOs need to speak business language, not just technical language.

• Secure AI, data governance, and SDLC controls are becoming urgent priorities.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Sarah Thaler shares expert insights on the behind-the-scenes planning and execution of trade show booths, especially at RSA.

Discover how to maximize your presence, create engaging experiences, and avoid common pitfalls at major cybersecurity conferences.

Key Takeaways:

• Plan RSA nearly a year in advance

• Align booth messaging with business goals

• Design booths to create engagement, not just visibility

• Train booth staff to start strong conversations

• Match booth size and location to your objectives

• Use demos and experiences to attract crowds

• Avoid vague messaging and passive booths

• Plan your time and meetings to maximize value

• Manage energy during long conference days

• Networking events often create the biggest opportunities

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Jacob Friedman, Strategic Account Director at ThreeTree, shares insights on the current state of cybersecurity, startup evaluation, and tips for navigating the RSA conference.

Discover how to cut through industry noise, evaluate emerging tools, and build successful vendor relationships.

Key Takeaways:

• Bigger security budgets do not automatically make organisations safer.

• AI hype does not replace architectural discipline.

• The best startups solve real problems, not buzzwords.

• Clean, classified data creates business value, not just risk reduction.

• RSA should be a strategy mission, not a swag tour.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode of the No Trust podcast, Chase Cunningham discusses the evolution of Zero Trust, reflecting on the growth and challenges faced in 2025 and looking ahead to 2026.

The conversation covers the hype cycle of Zero Trust, the importance of leadership in strategy implementation, the need for cultural shifts, and the metrics that matter in measuring success.

The discussion also touches on the role of AI in cybersecurity and the future of Zero Trust as a standard practice in organizations.

Key Takeaways:

• 2025 was a year of significant international growth for Zero Trust.

• The Zero Trust hype cycle has transitioned to a phase of practicality.

• Leadership is crucial for the continuous execution of Zero Trust strategies.

• Organizations often misinterpret Zero Trust as a completed project rather than an ongoing strategy.

• Incentives in cybersecurity need to shift from punitive measures to positive reinforcement.

• Cultural challenges in adopting Zero Trust can hinder its effectiveness.

• Metrics should focus on real-world outcomes rather than superficial statistics.

• Zero Trust is becoming a necessary standard for modern businesses.

• Technical debt poses a significant challenge for legacy organizations in adopting Zero Trust.

• The future of Zero Trust will likely see it integrated as a default practice in new organizations.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode of the No Trust podcast, John Spiegel engages with cybersecurity expert Joshua Copeland, who shares his insights on the fundamental flaws in the cybersecurity landscape.

They discuss the leadership vacuum in the industry, the pitfalls of compliance theater, and the overwhelming vendor hype that complicates tool selection.

Joshua emphasizes the need for a proactive approach to security, aligning cybersecurity with business objectives, and the importance of effective communication with leadership.

The conversation culminates in actionable takeaways for cybersecurity leaders looking to improve their strategies and outcomes.

Key Takeaways:

• Cybersecurity has a leadership vacuum that needs addressing.

• Compliance does not equate to security; it's often just theater.

• Organizations suffer from tool sprawl and lack of strategy.

• Vendor hype can distort risk perception and lead to poor decisions.

• Security leaders must communicate in business terms to gain support.

• Proactive security measures can prevent costly breaches.

• Understanding the business is crucial for effective cybersecurity leadership.

• Cybersecurity can be a revenue-generating function if aligned with business goals.

• Leverage existing tools before chasing new ones.

• Focus on redesigning critical processes for better security outcomes.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/