PrOTect It All

Work with Aaron: https://protectitallpod.com/work/

The small water utility down the road cannot afford a big consultancy, and it still has to be defended. Erin Burns is building a company around that problem.

Erin is an Army veteran with roughly two decades in cyber operations and the founder of EVR:RDY Defensive Operations Group. He and Aaron take on the question every transitioning veteran asks, how do I get into OT, and the problem behind it: automation is closing the entry-level door just as small utilities need defenders most. They get into hiring troubleshooters instead of job reqs, engineering a low-cost data diode, why a tool nobody runs is worse than no tool, the air gap myth, and how Erin's team weaponized sneaker net to get packet capture out of sites that will never allow remote access.

The utilities that cannot afford a big consultancy still have to be defended. If you mandate a standard, fund it, and build the people pipeline the same way you build the product: with problem solvers, hands-on apprenticeship and tools small operators will actually use. A tool nobody uses is worse than no tool.

Erin Burns is an Army veteran with roughly two decades in cyber operations and defensive work, and the founder of EVR:RDY Defensive Operations Group, a company focused on affordable OT/ICS defense for critical infrastructure operators with limited budgets and resources. He came up through special forces support and early military cyber, became a cyber warrant officer, and by his account spent five years on an Army cyber team defending OT environments, on factory floors and in hard hats. He is now building EVR:RDY around that experience, with a focus on water utilities and other sites that cannot afford commercial tooling.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Zero trust asks whether something should be allowed. Zach Miller asks a different question: if it is allowed, and something blows up, how far does it go?

Zach is a cybersecurity engineer in Colorado Springs who came up through K-12 network support on a shoestring budget, defense contracting and managed services. On the side he runs Skip to Secure, where he publishes research on trust concentration and management-plane abuse, including his Blast Radius framework.

He and Aaron trace one pattern through five years of incidents. Kaseya and SaltStack in 2020 and 2021, then Stryker in 2026: each time the management platform itself became the way in, and the authority it already held decided how far the damage went. Segmentation is the fix everyone already knows. It is still a hard sell.

Zach Miller is a cybersecurity engineer based in Colorado Springs. He started as a network and switching specialist supporting K-12 education, then moved through defense contracting, consulting and managed services into cybersecurity engineering. Through Skip to Secure, his independent research and training effort, he publishes white papers on trust concentration and management-plane abuse, including the Blast Radius framework and the LOLMgmt paper on living-off-the-land management attacks.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Shadow IT used to be a server in a closet. Today it is Linda from sales uploading confidential quotes to whatever AI tool she found first, and your corporate data leaving with it.

Jack Smith has spent more than 25 years in enterprise IT, across infrastructure, networks, datacenters, cloud and incident management, and he hosts the IT Horror Stories podcast. His argument is that AI is not a new problem, it is the latest version of an old one, and that the reflex to block it at the firewall has never worked and will not work now.

Aaron and Jack get into where AI genuinely helps, where it quietly does not, and the question of what happens when a system that gives a different answer every time is asked to make a decision that has to be the same every time.

Jack Smith has spent more than 25 years working in enterprise IT across infrastructure, networks, datacenters, cloud and incident management. He hosts IT Horror Stories, a weekly podcast about real-world IT incidents, what went wrong, how they were fixed, and what we can learn from them.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

A wireless engineer sat in a parking lot, connected to a plant's crane anti-collision network, and had everything he needed to stop the cranes inside 20 minutes. Nobody inside the fence ever knew he was there.

In this episode of Protect It All, host Aaron Crow talks with Scott McNeil, Industrial Network and Security Architect II at Global Process Automation (GPA), about the part of the OT network most plants never look at: the airspace. Scott has spent more than 20 years in networking and wireless, the last ten of them entirely in OT, and he sits in the integrator's seat, working across every manufacturer's gear without a product to sell.

The conversation starts where most plants actually are: one flat network, off the shelf gear on the floor, and no budget. Scott's argument is that the low hanging fruit costs time and effort, not money, and that a stable network is the foundation for everything security asks for later: segmentation, inventory, monitoring, then a firewall between OT and IT. He walks through war driving your own plant, why a hidden SSID is not security, the wild west of industrial wireless protocols, wireless that was abandoned in power plants years ago and is still on the air, and where wireless earns its place.

The second half is about vendors and access. Do not take the vendor's word for it, ask the questions before the gear ships, and treat every third party connection as your own exposure. Scott's rule for remote access is simple: this is my house, vendors connect on my terms, every session logged, with an approve or deny button before anyone gets in. Aaron adds the zip tie in the fan story, a backup switch that had silently failed months earlier and nobody knew until monitoring went on, and the two close on shrinking the wireless footprint that leaves your site and on Scott's podcast, The Industrial Wi-Fi Shop.

Tune in to hear why your industrial airspace deserves the same design, monitoring, and ownership as any wired connection.

Scott McNeil is an Industrial Network and Security Architect II at Global Process Automation (GPA), where he helps manufacturers design, secure, and modernize the OT networks that keep critical processes running: architecture, IT/OT convergence, segmentation, resilient connectivity, and industrial wireless. A longtime wireless engineer, he created and co-hosts The Industrial WiFi Shop Podcast with Jeremy Baker, speaks regularly at OT and industrial cybersecurity events, holds a bachelor's degree in Industrial Technology from East Carolina University with multiple wireless and network certifications, and serves on the UNC Wilmington Cybersecurity Advisory Board.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

NIS2, the EU Cyber Resilience Act, and CIRCIA are converging between now and 2027, and for the first time the law is pushing cybersecurity requirements upstream into product design and supply chain. What does that actually change on the plant floor?

In this episode of Protect It All, host Aaron Crow talks with Tobias Nitzsche, Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, about the shift regulation is driving in OT: responsibility moving from the server rooms into the boardrooms, and from the operator to the manufacturer.

Tobias makes the case that what gets regulated are fundamentally the basics: risk assessment, asset inventory, cyber hygiene, and detection. The industry has preached these for a decade. Now the law demands them, which makes compliance the business case that finally unlocks long-overdue modernization budget. His advice: do not treat legislation as a paper exercise. Treat it as a utility.

The second half is about recovery, the foundation most plants skip. Aaron and Tobias dig into the vendor-install backup that has never been tested, recovery targets that ignore how long a plant really takes to come back, retain values operators tuned for years that live nowhere else, redundant controllers that are not cyber resilience, and vendor SLAs that send a system engineer when you needed a cyber expert. Tobias's practical pattern: keep a replica of your critical systems, restore into the bubble, and be as intrusive as you like there, scanners and all, without touching production.

Also in this one: NIS2 Article 20 and personal liability for executives, why a cyber incident does not need a nation state (bad firmware counts), where AI belongs in the Purdue model and where it does not, AI as the daily brief for the one-person water utility, Aaron's Exchange 5.5 story about the week the executives lost their email, borrowing the safety engineers' hazard studies as risk input, and why you should never fire up a wireless pineapple on an airplane.

Tune in to hear how the biggest regulatory wave in industrial cybersecurity history can become the budget unlock OT has been waiting for.

Tobias Nitzsche is Head of Legislation and Technology for Cybersecurity at ABB Energy Industries, where he translates the fast-moving regulatory landscape, including NIS2, the EU Cyber Resilience Act, and CIRCIA, into how products are designed and projects are delivered for critical infrastructure. Before this role he was ABB's Global Cyber Security Practice Lead, capping more than 20 years across IT and OT security. Having sat on both sides of the table, first delivering cybersecurity services to critical infrastructure operators and now shaping how legislation lands in engineering practice, he brings a combined view of policy, technology, and plant-floor reality that few in the industry carry. Tobias is based in Germany.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

AI is a consensus engine, and consensus on the internet is frequently wrong. So what does that mean for the people defending power plants, water systems, and factories with it?

In this episode of Protect It All, host Aaron Crow welcomes back Jori VanAntwerp, CEO and founder of EmberOT, for a completely unscripted conversation on AI in OT. Two practitioners who use AI aggressively every day make the case for restraint in exactly the places that matter.

Jori explains why human in the loop is non-negotiable: AI shapes a junior's output to look senior without the understanding underneath, so you have to be able to interrogate it. Aaron walks through his own sandbox discipline, where AI gets a folder and not the keys, and nothing goes in that he would not publish on the internet.

The conversation then turns to the OT reality behind AI-found vulnerabilities, why an attacker who can reach your HMI or PLC does not need your unpatched CVE, teaching AI your voice with markdown primers, the build-versus-buy MVP trap, the submarine principle for modular defense, and why an operator flipping to manual is still the save of last resort.

Underneath all of it is the workforce math nobody is doing on air: if one person plus AI does the work of five, nobody is training juniors, and no juniors today means no seniors in ten years. OT's aging-out workforce is the preview.

Tune in for the most honest AI conversation the show has had, from the people who actually run it in OT.

Jori VanAntwerp is a two-time cybersecurity founder and CEO who has spent over two decades helping industrial and IT/OT organizations reduce risk, strengthen compliance, and mature the way they defend critical infrastructure. He has held executive and leadership roles at McAfee, FireEye, CrowdStrike, Dragos, and Gravwell before stepping into the founder seat, first at SynSaber and now as the Founder and CEO at EmberOT. The result is a vantage point that runs from the boardroom to the packet capture, from silicon to the cloud. At EmberOT, he is focused on bringing visibility, security, and risk quantification to the critical infrastructure the rest of the world takes for granted.

Want to see what is really happening in your OT environment? EmberOT provides flow-first, passive OT visibility and threat detection without requiring proprietary hardware.

Learn more about EmberOT: https://emberot.com/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Get your tickets for CYBR.SEC.CON., a two-day cybersecurity conference, here: https://www.cybrseccon.com/

What started with 120 people and a homemade Word flyer has grown into a cybersecurity community of more than 3,000. So what does it take to build a community that can scale without losing its personal connection?

In this episode of Protect It All, host Aaron Crow sits down with Michael Farnum, CEO and co-founder of CYBR.SEC.Community, and Sam Van Ryder, co-founder and an OT sales expert, to explore the story behind the growth of CYBR.SEC.CON and the community surrounding it.

Michael and Sam share how they went from a grassroots cybersecurity gathering to a thriving community while keeping the relationships and sense of connection that made the event special in the first place.

The conversation goes beyond conferences. Aaron, Michael, and Sam discuss the challenges facing people trying to break into cybersecurity and OT, why entry-level opportunities can be difficult to find, and what experienced professionals can do to help develop the next generation of cyber defenders.

They also share their hands-on efforts to introduce young people to cybersecurity, including bringing 75 high school students into the community, with plans to reach 150.

From hiring and firing lessons to career advice, community building, and the future of OT cybersecurity, this episode offers practical insight for anyone looking to grow their career, build meaningful connections, or help strengthen the cybersecurity workforce.

CYBR.SEC.CON 2026 brings the cybersecurity community together again on September 15 and 16 at the George R. Brown Convention Center in Houston, Texas.

If you're looking to connect with cybersecurity professionals, expand your network, learn from practitioners, discover career opportunities, and be part of a growing cyber community, CYBR.SEC.CON 2026 is an event worth checking out.

Tune in to hear the story behind CYBR.SEC.CON, the people building the community, and why the future of cybersecurity depends on bringing more people into the conversation.

Michael Farnum is the CEO and co-founder of CYBR.SEC.Community and has worked in IT and cybersecurity since 1994. He founded HOU.SEC.CON. in 2010, which evolved into CYBR.SEC.CON., now attracting more than 3,000 cybersecurity professionals annually. Michael is passionate about cybersecurity community building, workforce development, education, and career development, and is a frequent speaker and podcaster on security leadership and industry trends.

Sam Van Ryder is the CoFounder of CYBR.SEC.Community and Director of Strategic Accounts at Dragos. With more than 20 years of experience spanning mechanical engineering and technology sales, including over a decade focused on ICS and OT security, Sam brings deep industry expertise and a strong passion for cybersecurity community building. He is also a co-founder of HOU.SEC.CON., now CYBR.SEC.CON., which has grown into a major regional cybersecurity gathering.

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

AI has made it easier than ever to build a cybersecurity product. But has it also made it harder to build a valuable cybersecurity company?

In this episode of Protect It All, host Aaron Crow sits down with Ken Elefant, Founding Managing Director of the venture group at Sorenson Capital, for a candid conversation about what really makes cybersecurity startups succeed.

Ken shares a venture investor's perspective on the rapidly changing security market, including why simply wrapping a product around an LLM may not create lasting value, how AI is accelerating commoditization, and what founders need to do to build a meaningful competitive advantage.

The conversation goes beyond technology to explore the often-overlooked role of people, process, market positioning, and execution. Aaron and Ken discuss the importance of finding the right "wedge" into enterprise security, solving real customer problems, differentiating in crowded markets, and building companies that can create lasting value rather than chasing the latest technology trend.

They also draw on lessons from successful cybersecurity exits and the changing threat landscape to examine what investors are looking for as AI reshapes both cybersecurity products and the businesses behind them.

Key Learning: 

Key Moments: 

03:43 Using AI in podcasting

07:41 Trusting vendors and cybersecurity risks

10:59 Building Connections for Early Investments

15:19 Investing in emerging tech markets

17:45 Supporting AI-based startup growth

20:19 Building simple websites for businesses

26:03 Attracted to boring, overlooked markets

27:21 Building compliance products at Industrial Defender

30:16 Investing in defense tech startups

33:20 Experienced founders leveraging AI for products

38:32 Navigating fast-changing tech landscape

40:09 Importance of Building Trust in Business

Whether you're a cybersecurity founder, investor, security practitioner, technology leader, or entrepreneur, this episode offers a behind-the-scenes look at how experienced investors evaluate innovation in one of the fastest-moving areas of technology.

Tune in to hear what separates a promising cybersecurity idea from a company capable of creating lasting value.

DISCLAIMER : "Any portfolio companies mentioned in this episode are investments of Sorenson Capital funds and do not represent all fund investments. A complete list of investments is available upon request. This podcast is for informational purposes only and does not constitute an offer to sell or solicitation to buy securities."

About the guest : 

Ken Elefant is a forward-thinking venture investor with a deep interest in how artificial intelligence is transforming society and business. Ken has focused on vertical applications of AI, like Jump.ai, a portfolio company that streamlines manual work for wealth managers. By backing companies that implement AI in targeted, thoughtful ways, Ken aims to help professionals become more efficient and better prepared, reflecting his belief that AI’s true value lies in practical, well-executed solutions.

How to connect Ken:

LinkedIn: https://www.linkedin.com/in/kenelefant/ 

Kencrypted newsletter: https://www.linkedin.com/newsletters/kencrypted-7307431988703940608/  

Sorenson team page: https://www.sorensoncapital.com/team/ken-elefant/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Offshore oil and gas operations don't have the luxury of simply shutting everything down and starting over.

In this episode of Protect It All, host Aaron Crow sits down with Josh Herr and Matt McLendon to explore the real-world challenges of modernizing cybersecurity and technology in offshore operational technology (OT) environments.

From million-dollar equipment and aging control systems to virtualization, containers, and edge computing, this conversation reveals what it actually takes to keep critical industrial operations running when technology fails, hardware is difficult to replace, and downtime can come at an enormous cost.

Aaron, Josh, and Matt share stories from the field, including the creative decisions operators sometimes have to make to keep one rig running when another goes down. They also explore the gradual shift from legacy Windows and Sun workstations toward Linux, containerization, and newer approaches to managing industrial systems.

But this isn't simply a conversation about replacing old technology with new technology. It's about understanding the realities of OT cybersecurity, where reliability, availability, safety, cost, and security all have to work together.

Key Learning: 

Key Moments:
06:16 Frustrations with vendor costs and delays

09:34 Offshore connectivity and autonomy challenges

13:02 Managing power plants across Texas

16:19 Challenges with industrial HMIs and alarms

19:40 Vendor control and security policies

21:16 Component delays and industry characters

24:08 Final integration testing and safety factors

28:20 Vendor management challenges with outdated tech

34:02 Missing sysadmin skills in industry

35:59 Challenges with ARM architecture

41:09 Managing hardware life cycles

44:23 Concerns about AI and open source

45:43 Future of JavaScript and integration

Whether you work in oil and gas, industrial cybersecurity, critical infrastructure, engineering, or OT operations, this episode offers an honest look at the gap between cybersecurity theory and what actually works in the field.

Listen in for the war stories, lessons learned, and "art of the possible" approaches helping bring modern technology into some of the world's most challenging OT environments.

About the guests: 

Matt is a multidisciplinary team leader and technology practitioner with experience spanning electrical systems, controls, automation, data systems, and IS/IT. His background includes offshore oil and gas electronics, systems administration, and computer hardware, with a strong emphasis on troubleshooting and component-level repair. Matt has led diverse technical teams in fast-paced, mission-critical environments, where collaboration, clarity, and effective problem-solving are essential.

Contact Matt: https://www.linkedin.com/in/matthewamclendon/

Josh is a software engineer and technology architect with more than a decade of experience designing and building systems across desktop applications, cloud infrastructure, and modern cybersecurity environments. His background spans multiple technology verticals and industries, giving him a practical, cross-functional perspective on how organizations secure complex systems at every layer of the technology stack. Josh brings deep expertise in software engineering, cloud architecture, and cybersecurity strategy, with a focus on helping organizations navigate evolving security challenges without sacrificing operational performance. His work combines hands-on technical knowledge with a strong understanding of how security, infrastructure, and business priorities intersect in real-world environments.

Contact Josh: https://www.linkedin.com/in/joshua-herr-ba4bba54/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify: