PrOTect It All

Work with Aaron: https://protectitallpod.com/work/

AI is rapidly transforming cybersecurity but are critical infrastructure environments ready for what comes next?

In this episode of Protect It All, host Aaron Crow sits down with longtime colleague and cybersecurity expert Clark Liu to explore how artificial intelligence is reshaping both IT and OT security operations.

From incident response and compliance frameworks to workforce shifts and operational resilience, Aaron and Clark unpack the real-world opportunities and very real risks of integrating AI into industrial environments.

Together, they tackle the evolving role of frameworks like NERC CIP and NIST, the challenges of balancing compliance with actual security outcomes, and how organizations can responsibly adopt AI without increasing exposure.

You’ll learn:

Whether you’re leading OT security, managing critical infrastructure, or evaluating AI adoption in your organization, this episode delivers practical guidance for navigating cybersecurity’s next major shift.

Tune in to learn how AI is transforming cyber defense and what organizations must do to stay resilient only on Protect It All.

Key Moments; 

05:33 Understanding cybersecurity compliance frameworks

07:11 Overlooked vulnerabilities in systems

09:59 Balancing multiple firewall vendors

15:17 Delegating tasks to AI

19:11 Importance of documenting commits

21:51 Hospital system shutdown crisis

25:11 AI uncovering software vulnerabilities

26:37 Engineers implementing AI in automation

31:26 AI tools and personal security

32:55 Password security practices

36:46 Using AI for basic tasks

39:38 Transition to off-the-shelf software

42:29 Going back to basics with appliances

47:02 Excitement About Future AI Capabilities

Guest Profile : 

Clark Liu is a veteran OT cybersecurity expert and one of the original contributors to the NERC CIP standards. With nearly two decades in energy and critical infrastructure security - including leadership roles at EY and GALLO - Clark specializes in OT risk management, compliance strategy, and securing industrial operations from the plant floor to the cloud.

How to connect Clark: 

LinkedIn :  https://www.linkedin.com/in/clarkliu/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

AI agents are changing cybersecurity faster than most organizations can adapt.

In this episode of Protect It All, host Aaron Crow welcomes back cybersecurity veteran Ken Foster for a deep dive into how AI is reshaping risk, identity, and resilience across IT and OT environments.

With more than 30 years of experience spanning the Navy, manufacturing, fintech, government programs, and startups, Ken brings a grounded, real-world perspective on what organizations are getting right and dangerously wrong about AI adoption.

Together, Aaron and Ken explore the growing challenges around AI agents, identity governance, shadow AI, compliance, and attribution in highly regulated industries. As AI tools become embedded into workflows and decision-making, organizations must rethink how they manage access, monitor activity, and maintain resilience against rapidly evolving threats.

You’ll learn:

Whether you’re leading cybersecurity strategy, managing critical infrastructure, or navigating AI adoption inside regulated environments, this episode delivers practical insights for securing the next generation of digital operations.

Tune in to learn how AI is transforming cybersecurity - and what leaders must do to stay ahead - only on Protect It All.

Key Moments: 

07:47 AI guardrails discussion

12:02 Patching and network segmentation

20:44 AI changing job roles

24:24 FISMA and FedRAMP concerns

29:18 Emergency response planning

35:36 Choosing the right tech team

37:14 Discussing accountability and risk

46:31 Developer access problems

51:50 AI Dependence Risks

57:36 AI in pen testing

58:55 AI in risk prevention

About the guest :

Ken Foster is a veteran cybersecurity leader with 25+ years of experience in enterprise security, risk governance, and global infrastructure strategy. Currently Head of Global Architecture at Adient, Ken has previously led cybersecurity and compliance programs at Fleetcor and Fiserv, specializing in IAM, cloud security, regulatory compliance, and risk-based cybersecurity strategy. He is known for helping organizations balance innovation, resilience, and operational execution in highly regulated environments.

How to connect Ken: http://linkedin.com/in/kennethfoster/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Cybersecurity isn’t just about technology - it’s about people.

In this episode of Protect It All, host Aaron Crow sits down with Sean Tufts for a conversation that goes far beyond tools and tactics. From the locker room to control rooms, Sean shares how his journey from professional football to OT cybersecurity shaped his approach to trust, teamwork, and leadership.

Together, they unpack one of the biggest challenges in OT environments: building trust between IT and OT teams. Because without trust, even the best tools fail.

You’ll learn:

Whether you’re leading cybersecurity, working in OT environments, or building cross-functional teams, this episode delivers practical insights on the human side of security—where real progress happens.

Tune in to learn why the strongest cybersecurity programs are built on people, not just platforms only on Protect It All.

Key Moments: 

05:11 Importance of communication in tech

06:58 Learning from early career mistakes

11:40 Implementing network scanning in OT environments

15:50 Debating project priorities in cybersecurity

18:24 Improving system reliability and ROI

20:28 Convincing plants to self-fund projects

26:21 Creating layered RACI charts

26:57 Discussing people, process, and technology

31:15 Easy validations and big risks

34:35 Operators' productivity challenges

37:21 Network security in hospitals

42:25 Creating a safe network environment

43:10 Addressing network configuration issues

46:55 Different types of AI users

About the guest : 

Sean Tufts is Field CTO at Claroty and a cybersecurity leader with deep expertise in industrial environments. With leadership roles at GE and Optiv, he has helped asset-intensive industries navigate the intersection of OT, IT, and cyber risk. Before cybersecurity, Sean was a standout linebacker and team captain at the University of Colorado and went on to play in the NFL with the Carolina Panthers bringing the same discipline, teamwork, and leadership mindset to securing critical infrastructure today.

How to connect Sean : 

LinkedIn: https://www.linkedin.com/in/sean-tufts-36b4909/

Website: https://claroty.com/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Construction sites are no longer just physical - they’re digital, connected, and increasingly vulnerable. In this episode of Protect It All, host Aaron Crow sits down with Lee Carsten to explore the rising cyber risks across the architecture, engineering, and construction (AEC) industry.

As digital transformation accelerates - with AI, digital twins, and connected building systems becoming standard - construction projects are expanding their attack surface in ways many organizations don’t fully understand.

Aaron and Lee unpack the unique challenges facing AEC environments, from fragmented systems and evolving workflows to the growing need for integrating cybersecurity into business decisions - not just IT functions.

You’ll learn:

Whether you’re in construction, engineering, IT, or OT security, this episode delivers real-world insights to help you protect the infrastructure we rely on every day.

Tune in to learn how to secure modern construction in a connected world - only on Protect It All.

Key Moments: 

05:39 Importance of interpersonal skills

08:08 Construction security and recent projects

11:46 Challenges in AEC industry adoption

19:30 Importance of disaster recovery

20:31 Discussing costs of business interruptions

24:06 RFP process and bid management

27:25 Complexity of building projects

32:02 FBI investigation triggers and readiness

36:55 Managing complex building assets

39:37 Choosing durable equipment and future tech

42:01 Understanding OT data for security

About the guest : 

Lee Carsten’s journey in technology began in the era of punch cards - painstakingly sorted and fed into compilers, where a single fumble could mean hours' worth of work undone. Lee studied COBOL in college, envisioning a future as a programmer. That path nearly led to Walmart, where Lee’s mother worked on the company’s pioneering buyer decision support system under Randy Mott. While the family connection and an offer from Kevin Turner to join a new team were tempting, Lee ultimately decided against moving to Bentonville and working for $18,000 annually. This early exposure to large-scale business technology, combined with pivotal career choices, shaped Lee Carsten’s perspective on IT and the evolving world of software development.

How to connect Lee: https://www.linkedin.com/in/leecarsten/

Website: https://whitecaprisk.com/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

The biggest challenge in OT cybersecurity isn’t just technology - it’s people.

In this episode of Protect It All, host Aaron Crow sits down with Mike Holcomb to explore one of the most urgent issues facing the industry today: the growing skills gap in OT and ICS cybersecurity.

Mike shares his journey from IT into operational technology security and breaks down why more professionals are needed to defend the systems that power energy, manufacturing, and critical infrastructure worldwide.

This conversation goes beyond awareness - it’s about practical pathways into the field and how the community is stepping up to make OT cybersecurity more accessible.

You’ll learn:

Whether you’re looking to break into cybersecurity, pivot your career, or build stronger teams, this episode delivers actionable guidance and inspiration from someone actively shaping the future of OT security.

Tune in to learn how to build a career while helping protect the infrastructure the world depends on - only on Protect It All.

Key Moments: 

03:07 Getting started in cybersecurity

06:33 Early passion for cybersecurity

11:54 Hurricane Katrina aftermath discussion

15:50 Awareness and education on OT security

17:49 First experiences with GRID class

25:07 Early challenges in OT cybersecurity

29:17 Importance of effective communication

35:11 Global expansion of cybersecurity events

39:52 Building a foundation in OT cybersecurity

43:36 Excitement for new CompTIA exam

46:48 Expressing appreciation for community involvement

About the guest: 

Mike Holcomb is an independent consultant focused on OT/ICS cybersecurity and an educational content creator. Prior to supporting clients full-time through UtilSec, he was the Fellow of Cybersecurity and the OT/ICS Cybersecurity Global Lead for one of the world’s largest engineering and construction companies, providing him with the opportunity to work in securing some of the world’s largest OT/ICS environments, from power plants and commuter rail to manufacturing facilities and refineries. As part of his community efforts, Michael founded the BSidesICS/OT with multiple events planned globally in 2026. He has his master’s degree in OT/ICS cybersecurity from the SANS Technology Institute. Additionally, he maintains cyber security and OT/ICS certifications such as the CISSP, GRID, GICSP, GCIP, GPEN, GCIH, ISA 62443, and more. He was awarded the SANS Difference Maker Award for Practitioner of the Year: ICS/OT Defender for 2025 and BEER-ISAC's Community Builder Award for 2026. He posts regularly on LinkedIn and YouTube to help others learn more about securing OT/ICS and critical infrastructure. 

How to connect Mike: 

Main Site: mikeholcomb.com

LinkedIn: linkedin.com/in/mikeholcomb

YouTube: youtube.com/@utilsec

Instagram: instagram/_mikeholcomb/

Newsletter: utilsec.kit.com/95e31307f7

BSidesICS/OT: bsidesics.org

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

You can’t manage risk you can’t measure - or even see.

In this episode of Protect It All, host Aaron Crow sits down with Nicholas Friedman to explore how organizations can move beyond compliance and build real, measurable cybersecurity programs across IT and OT environments.

With experience spanning banking, aerospace, and critical infrastructure, Nicholas shares how risk management principles translate across industries - and why understanding business context is critical to protecting operational systems.

This conversation dives into one of the biggest challenges in OT today: asset visibility and risk quantification. From outdated spreadsheets to modern automation, Aaron and Nicholas break down what it actually takes to understand exposure, justify investment, and communicate risk at the board level.

You’ll learn:

Whether you’re leading a cybersecurity program, managing OT environments, or presenting to the board, this episode delivers practical strategies to align security with business value and measurable outcomes.

Tune in to learn how to turn cybersecurity into a risk-driven, business-aligned strategy - only on Protect It All.

Key Moments: 

05:14 Understanding business risk basics

08:40 Building effective OT cybersecurity teams

13:26 Challenges with aging IT and OT systems

14:19 Organizing IT and OT assets

18:31 Understanding OT and IT risks

21:53 Evaluating security risks and priorities

25:31 Improving asset deployment and management

29:14 Evaluating and prioritizing risks

31:12 Shifting focus to success plans

35:59 Selling tech that delivers results

37:22 Hands-on approach to cybersecurity

42:39 Challenges with NERC audit processes

44:47 Balancing compliance and security

49:45 Challenges in power utility operations

51:55 AI, OT, and risk management

56:31 Importance of early compliance planning

About the guest : 

Nicholas Friedman is an enterprise risk and governance leader with 25+ years of experience across Fortune 500 companies and government sectors. He specializes in integrated risk management, compliance, and AI governance - helping organizations build scalable frameworks that align security, risk, and business resilience.

How to connect Nicholas Friedman : 

Linkedin :  https://www.linkedin.com/in/nicholasfriedman/

Website : https://www.templarshield.com/

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

In this special milestone episode of Protect It All, host Aaron Crow steps away from the usual format to share his personal journey - from early days working with PLCs at a kitchen table to building a platform that connects and educates cybersecurity professionals around the world.

This episode is more than a reflection - it’s a story of persistence, curiosity, and community.

Aaron walks through the evolution of IT and OT cybersecurity, the lessons learned from decades in the field, and how conversations with experts across 100 episodes have shaped his perspective on what it truly means to “Protect It All.”

You’ll hear:

Whether you’ve been listening since episode one or you’re just discovering the show, this episode offers inspiration, perspective, and a deeper look behind the mic.

Tune in to celebrate 100 episodes and the journey of protecting what matters most - only on Protect It All.

Key Moments: 

04:12 Early tech projects and hobbies

09:31 First tech job setting up classrooms

11:20 Getting certified in IT

16:49 Early career in power and cybersecurity

18:08 Building a versatile IT team

24:23 Starting the cybersecurity podcast journey

26:28 Feeling recognized in the podcast world

29:22 Getting started in cybersecurity

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Strong OT cybersecurity programs aren’t built on tools alone, they're built on strategy, communication, and smart investment.

In this episode of Protect It All, host Aaron Crow is joined by cybersecurity expert Don C. Weber for a candid, real-world discussion on what it actually takes to build and sustain effective security programs across IT and OT environments.

From CapEx vs OpEx decisions to the growing role of AI in both attack and defense, this conversation cuts through the noise and focuses on what drives real outcomes: understanding business workflows, aligning with leadership, and developing the soft skills needed to turn strategy into action.

You’ll learn:

Whether you’re building a new security program or scaling an existing one, this episode delivers practical, experience-driven insights to help you make smarter decisions and drive real impact.

Tune in to learn how to align strategy, people, and investment for stronger OT cybersecurity only on Protect It All.

Key Moments: 

05:49 Technical skills and security requirements

09:10 Understanding data workflows

12:29 Building a vulnerability management program

13:26 Understanding organizational decision history

17:44 Budgeting challenges with CAPEX and OPEX

21:36 Steps in a security assessment

24:17 Starting a cybersecurity program

28:02 Prioritizing remote access security

31:21 Discussing AI's impact on cybersecurity

32:55 Using AI in cybersecurity

38:07 AI simplifying complex knowledge

40:35 AI tools making data queries easier

45:02 Detecting and responding faster

46:05 Networking and shared experiences

About the guest: 

Don C. Weber is a visionary cybersecurity leader who helps defenders safely prove security where it matters most in industrial operations. He is a SANS Principal Instructor, Founder of Cutaway Security, co-author of SANS ICS613: ICS/OT Penetration Testing & Assessments, and he also teaches SANS ICS410: ICS/SCADA Security Essentials to SANS student around the world. He brings years of field work into creating step-by-step labs and planning methods teams can use right away.

How to connect Don: 

LinkedIn: https://www.linkedin.com/in/cutaway/ 

Cutaway Security: https://www.linkedin.com/company/cutaway-security-llc 

CutSec Github: https://github.com/cutaway-security 

CutSec GasPot HMI Lab: https://github.com/cutaway-security/gaspot-hmi-lab 

SANS ICS ICS613 ICS/OT Penetration Testing and Assessments: https://www.sans.org/cyber-security-courses/ics-ot-penetration-testing-assessments

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Cyberattacks don’t just test your systems - they test your preparedness.

In this episode of Protect It All, host Aaron Crow breaks down key lessons from the Striker attack and what it reveals about today’s evolving threat landscape across IT and OT environments. From energy and healthcare to manufacturing systems, attackers are increasingly using sophisticated techniques like “living off the land” - blending into normal operations instead of deploying obvious malware.

Aaron takes this beyond theory, focusing on what organizations must do before an attack happens.

A major theme? Tabletop exercises. Not as a compliance activity - but as a critical tool for building real incident response readiness, improving team coordination, and exposing gaps that tools alone can’t catch.

You’ll learn:

Whether you’re defending critical infrastructure, leading a cyber team, or just starting your security journey, this episode delivers practical insights you can apply immediately.

Tune in to learn how to prepare before the next attack - not react after it - only on Protect It All.

Key Moments: 

04:59 "Modern Warfare: Cyber and Beyond"

08:47 "Security Risks of Remote Wipe"

10:31 "Living Off the Land Tactics"

13:11 "Balancing Power and Security"

19:12 "Vulnerabilities Demand Swift Action"

20:21 Prioritize Risk, Justify Investment

25:04 Practice Preparedness Before Crisis

26:48 Weak Links Threaten Cybersecurity

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify:

Work with Aaron: https://protectitallpod.com/work/

Global conflicts are no longer confined to physical battlefields - they’re spilling into cyberspace.

In this urgent episode of Protect It All, host Aaron Crow breaks down the rising wave of cyber threats targeting critical infrastructure, from energy and water utilities to manufacturing and transportation systems.

Drawing on recent global events and real-world incidents, Aaron explores how nation-state actors, hacktivists, and advanced adversaries are increasingly targeting operational technology environments. These attacks often rely on “living off the land” techniques - leveraging existing tools and access inside networks rather than deploying obvious malware.

But this episode isn’t about panic. It’s about practical defense.

Aaron outlines the immediate steps OT security teams can take to strengthen resilience - even with limited resources and tight budgets.

In this episode, you’ll learn:

Whether you operate power systems, water facilities, industrial plants, or transportation infrastructure, this episode provides real-world guidance to help you stay ahead of evolving threats.

Tune in to learn how OT teams can strengthen defenses and protect the systems society depends on - only on Protect It All.

Key Moments:

03:41 "Rising Cyber Threats Amid Tensions"

08:24 Nation-State Cyber Threats Unveiled

11:23 "Advanced Cybersecurity and Monitoring"

14:24 Prioritizing and Addressing Security Risks

17:24 Practical Steps for Cybersecurity Improvements

19:34 "Focus on Resources and Action"

Connect With Aaron Crow:

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/

To be a guest or suggest a guest or episode, email [email protected].

Please leave us a review on Apple or Spotify: