Secured with Dr. KJ

Episode Summary
In the Season 4 finale, Dr. KJ closes the season solo with the thread that ran through nearly every conversation this year: agents and apps. Drawing on what Season 4 guests shared, this episode looks at how autonomous software changes the attack surface, why governance is lagging behind capability, and what leaders must do before the next launch instead of after the next incident. Gartner predicts that up to 40 percent of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5 percent in 2025, which makes these questions urgent now.

What You Will Learn

• How agents and apps expand the attack surface, and why identity is usually the first thing to break
• Why the gap between AI capability and AI governance is the real risk
• How to think about speed and security together, with brakes as the model
• Why deciding what to build is a leadership discipline and not only a technical task
• Three questions to ask out loud before any agent or app goes live

Top 3 Takeaways

1. Treat every agent like a new hire who is very fast and has no common sense. Keep permissions tight and assume identity breaks first.
2. The capability is not the problem. The governance lag is. Leaders who close that gap early get to use this technology, and everyone else ends up cleaning up after it.
3. Before any agent or app goes live, ask who owns it, what it is allowed to do, and how you will know when it misbehaves. If nobody can answer all three, it is not ready.

Memorable Quotes
Cybersecurity is like awesome brakes on a fast car, giving you the confidence to go faster, not to slow you down. – Antony Abraham

AI has been the disruptor. The disruptor is over. Now this is just how things are. – Dr. Pierrette Renée Dagg

The sense of speed can sometimes be a fallacy if we do not stop and slow down and take the time and the strategy approach to make sure that we are designing the right thing. – Nick Cawthon

If the boss cannot identify something impactful that you have done in the past 12 months, you are in danger. – M.K. Palmore

Connect with the Season 4 Guests
Antony Abraham: https://www.linkedin.com/in/antony-a/
Dr. Pierrette Renée Dagg: https://www.linkedin.com/in/pierrette-renee-dagg/
Nick Cawthon: https://www.linkedin.com/in/nickcawthon
Eric Shoemaker: https://www.linkedin.com/in/advisoryciso/
M.K. Palmore: https://www.linkedin.com/in/mkpalmore/
Lawrence Wagner: https://www.linkedin.com/in/lawrence-wagner/

Listen and Subscribe
Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com
Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517
Spotify: Secured with Dr. KJ
YouTube: Secured with Dr. KJ

Support the Show
If this season brought value, share it with a peer in your network. Every share helps grow a community built on substance over sales: real practitioners, real insights, no pitches.

Securing tomorrow, one episode at a time.

Episode Summary
Employees are adopting AI faster than organizations can write policy for it, and most leaders have no idea how much is already happening inside their walls. In this episode, Dr. KJ sits down with Bruno Lecoq, CEO of BEMO and a trusted voice in cybersecurity compliance for small and mid-sized defense contractors. Bruno shares why blocking AI outright backfires, how frameworks like CMMC, SOC 2, and ISO 27001 still provide a foundation for AI governance, and how his own company placed AI agents on the org chart with human owners and risk levels. He also offers a candid look at how consumption-based AI pricing is changing the conversation from innovation to cost discipline.

What You Will Learn

• Why most organizations underestimate how much shadow AI is already in use
• Why securing data access must come before deploying AI tools
• A four-step journey from shadow AI discovery to agents and compliance
• How existing frameworks map to AI risk through access control, inventory, and monitoring
• How to govern AI agents with owners, risk levels, and regular testing
• Why small and mid-sized businesses are bigger targets than they think
• How consumption-based pricing forces leaders to decide which work belongs to agents and which belongs to people

Top 3 Takeaways

1. Visibility before blocking. Show leaders what AI is already in use, then have an open conversation about what to allow. Blocking everything only pushes employees to personal devices and deeper into the shadows.
2. Security before AI. If permissions in SharePoint and OneDrive are not set correctly, AI will surface sensitive data like salaries to anyone who asks. Fix data access first, then deploy AI.
3. Govern agents like people. Every agent should have an owner, a risk level, and a human accountable for its output. Employees own their work, and AI is a copilot, not a replacement.

Memorable Quotes
Copilot is here to be your copilot to help you. It is not here to replace you. – Bruno Lecoq

The day you get certified is the day your baby is born. Then you have to manage the compliance for the next 18 years. – Bruno Lecoq

You have to deploy security before you can start using AI. – Bruno Lecoq

SOC 2 is the kindergarten version. ISO 27001 is high school. CMMC is graduating from university. – Bruno Lecoq

Connect with the Guest
Bruno Lecoq, CEO of BEMO
LinkedIn: https://www.linkedin.com/in/brunolecoq/

Listen and Subscribe
Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com
Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517
Spotify: Secured with Dr. KJ
YouTube: Secured with Dr. KJ

Securing tomorrow, one episode at a time.

Episode Summary

In this episode, Dr. KJ sits down with Antony Abraham, Deputy CISO for Enterprise at Hewlett Packard Enterprise, to explore how AI is reshaping the front lines of cyber defense. Antony draws on twenty-four years of experience, including seventeen years at State Farm, to unpack how frontier models are changing offensive and defensive security alike, why defense in depth still matters even as the threat landscape evolves, and how security leaders can build lasting trust with executives and boards. The conversation closes with a look three years into the future, where organizational context and human coaching of AI agents may become the true differentiators of success.

What You Will Learn

How modern AI models are chaining lower severity vulnerabilities into critical attack paths
Why binary analysis at scale is changing long held assumptions about source code protection
How defense in depth must evolve rather than disappear in an AI driven threat landscape
What it takes to build trust with executives and boards as a security leader
Why organizational context, not just model capability, will define success in the next three years

Top 3 Takeaways

AI is a leveling tool that benefits attackers and defenders alike, and defenders must actively embrace it rather than fall behind
Cybersecurity works best when framed as an enabler of business speed rather than a source of fear, uncertainty, and doubt
The organizations that thrive in the AI era will be those that codify institutional context and develop leaders who can coach teams of agents

Memorable Quotes

Antony Abraham on the role of security leadership: Cybersecurity is like awesome brakes on a fast car, giving you the confidence to go faster, not to slow you down.

Antony Abraham on the shifting threat landscape: The attackers are either already have these capabilities or soon catching up.

Connect with the Guest

Antony Abraham, Deputy CISO for Enterprise, Hewlett Packard Enterprise
LinkedIn: https://www.linkedin.com/in/antony-a/

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com
Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517
Spotify
YouTube

Support the Show

If you enjoyed this conversation, please leave a rating and review on your favorite platform and share this episode with a colleague who is thinking seriously about AI and cyber defense.

Securing tomorrow, one episode at a time.

Secured with Dr. KJ | Season 4
The Blind Spots AI Safety Cannot Afford
Guest: Lawrence Wagner, Executive Director and Co-Founder, Black in AI Safety and Ethics (BASE)

Episode Summary

Lawrence Wagner, Executive Director and Co-Founder of BASE, joins Dr. KJ to examine where the security community stands on AI governance and why inclusive pipelines in AI safety are essential to building better, safer AI for everyone.

What You Will Learn

• Why the security community is not yet ready to govern AI systems at the pace frontier models operate
• How adversarial challenge formats surface vulnerabilities but fall short of addressing systemic governance failures
• How BASE is building a global pipeline for black researchers and professionals to shape the AI safety field
• Why senior black leadership in AI and cybersecurity is essential to influencing research, hiring, and company culture

Top 3 Takeaways

1. AI is moving faster than governance. Frontier models can identify and exploit vulnerabilities at a speed that outpaces even the most advanced security professionals, making proactive governance essential rather than optional.
2. Governance must be lived, not filed. Organizations that treat AI governance as a compliance trophy remain exposed. True governance is built into strategic policy and practiced as a core business function.
3. Diversity in AI safety is a technical imperative. When only one group builds AI systems, blind spots get baked into the models. BASE exists to bring more perspectives and talent into AI safety so the field can address risks it cannot currently see.

Memorable Quotes

If you only have one group driving a bus, they can only see a part of the road. They cannot see the whole world.

You cannot put AI governance on the shelf and not implement it. If you do not know how to implement it, people and systems are going to be vulnerable.

AI is not coming to take your job. AI is coming to complement your job. Educate yourself and get involved, because if you do not, you will fall behind the industry.

Connect with Lawrence Wagner

LinkedIn: https://www.linkedin.com/in/lawrencewagner
BASE Website: https://www.baseresearch.org
Support BASE: https://www.baseresearch.org/donate

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com

Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517
Spotify: Secured with Dr. KJ
YouTube: Secured with Dr. KJ

Support the Show

Enjoying the show? Share this episode with a colleague, leave a review on Apple Podcasts, and subscribe wherever you listen to help more security professionals find the content they need.

Securing tomorrow, one episode at a time.

Episode Summary

Lora Mouammer, Security Senior GTM Manager at Microsoft, joins Dr. KJ to break down what it truly means to bring cybersecurity products to market with clarity, empathy, and purpose. Lora shares her framework of translation, connection, and alignment as the foundation for effective go-to-market strategy in cybersecurity. The conversation explores how AI is reshaping product positioning, why fear-based messaging is losing its power, and what it takes to build cross-functional credibility as a security leader. Lora also reflects on the importance of continuous learning in a field where what worked last quarter may not apply next quarter.

What You Will Learn

How to sequence technical depth so security messaging reaches decision-makers at the right time. Why empathy is replacing fear as the most effective go-to-market approach in cybersecurity. How to distinguish genuine AI value from overhyped noise when positioning security products. Why cross-functional alignment does not just happen and must be built with intentionality. The role of community insights and customer feedback in shaping go-to-market strategy. What continuous learning looks like for go-to-market professionals in a rapidly evolving security landscape.

Top 3 Takeaways

1. Translation, connection, and alignment are the three pillars of an effective cybersecurity go-to-market strategy. Start with what matters to the business, lead with empathy over fear, and ensure every internal team is telling the same story before anything goes out the door.
2. AI is no longer a differentiator in cybersecurity. The real challenge is whether you can explain what AI actually does in your product and why it matters. If the answer does not help someone make a better decision faster, it is probably overhyped noise.
3. Go-to-market is not just the engine that launches a product because engines get turned off. It is the power grid that keeps the lights on for the business, constantly fueling sellers with the right narratives and meeting customers where they are.

Memorable Quotes

"The key is not to simplify and move away from the technical depth. It is to sequence the conversation."

"Instead of leading with fear, lead with empathy. Go-to-market should show that we understand the customer's world."

"AI for the sake of AI does not sell and does not work. What sells is solving real pressing problems for our customers better than before."

"Go-to-market is not the engine that launches the product because the engine gets turned off sometimes. Go-to-market is the power grid. It is always on."

Connect with the Guest

Lora Mouammer on LinkedIn: https://www.linkedin.com/in/loramouammer

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com

Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 Spotify: Secured with Dr. KJ YouTube: Secured with Dr. KJ

Support the Show

Share this episode with a colleague who works in go-to-market, product marketing, or cybersecurity strategy. Every share helps grow the community.

Securing tomorrow, one episode at a time.

Episode Summary

In this episode, Dr. KJ sits down with Eric Shoemaker, Advisory CISO and owner of Genius GRC, to challenge how cybersecurity programs communicate their value. Eric makes the case that security leaders must move beyond vanity metrics and position their programs as business enablers. The conversation covers practical approaches to AI governance in startup environments, foundational controls that still deliver outsized protection, and what it actually looks like to build a compliance program without slowing down engineering teams.

What You Will Learn

How to move beyond vanity metrics and tie cybersecurity outcomes to business revenue and deal velocity Why the board is your customer and how to tailor your communication to their background and priorities How shadow AI and ungoverned tool adoption are creating real risk inside organizations right now Which foundational controls matter most for AI-first startups and why they are still being missed How a skilled security consultant approaches the first 30 to 60 days of a new engagement Why change control is not always the first thing to implement, and when it becomes critical

Top 3 Takeaways

1. Security's real value is measured in enablement, not prevention. Counting blocked port scans is not a board-level story. The more powerful narrative is when your team helps close a deal, removes a procurement obstacle, or enables a customer integration that would have otherwise stalled. Raise your hand when security moves the business forward.
2. Foundational controls are still being missed. Phishing-resistant MFA and URL filtering remain two of the most protective and underutilized controls available, even in well-funded startups. Free and low-cost options from Cloudflare and Microsoft remove the budget excuse. The gap is not access to the tools; it is implementation.
3. Compliance should accelerate the business, not hold it back. The most effective security leaders understand the cost of every control they impose. For an early-stage company without customers yet, unnecessary process overhead slows engineering velocity. The right move is to prioritize what gets you to market securely and implement the rest when the moment actually requires it.

Memorable Quotes

We are not your no guys. We enabled the business. We did not just stop things. — Eric Shoemaker

The CISO's number one job is to enable the business. Protecting the organization is how the CISO does that. — Eric Shoemaker

We should understand the cost of what we are asking people to do. It might be a necessary burden, but everything we do has a cost. — Eric Shoemaker

Connect with the Guest

Connect with Eric Shoemaker on LinkedIn: https://www.linkedin.com/in/advisoryciso/

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com

Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 Spotify: Search Secured with Dr. KJ YouTube: Search Secured with Dr. KJ

Support the Show

If this episode brought value to you, share it with a colleague, leave a review, and help us grow the Secured with Dr. KJ community.

Securing tomorrow, one episode at a time.

Episode Summary Dr. Pierrette Renée Dagg, Director of Research and R&D at Merit Network, explores post-quantum cryptography, AI governance, and technology leadership. Drawing on her work across institutions from R1 universities to rural libraries, she offers practical steps for quantum readiness, the growing importance of vendor scrutiny in AI adoption, and the leadership the security field urgently needs.

What You Will Learn

• Why capacity is the biggest barrier to post-quantum readiness
• How the "harvest now, decrypt later" threat is changing encryption urgency
• Why data classification is the best starting point for quantum migration
• How AI governance must become part of all technology policy
• Why vendor scrutiny and data ownership are critical yet overlooked risks
• Why philosophy must precede technology in security leadership

Top 3 Takeaways

1. You cannot fix what you cannot see. Inventory your encryption and revisit your data classification chart — starting with your most sensitive data first.
2. AI governance is no longer a separate conversation. AI is embedded in existing enterprise systems, often without notification. Supplier scrutiny and data ownership must be part of every technology governance framework.
3. Philosophy before technology. Effective security leaders ask the deeper questions about social good and unintended consequences before acting.

Memorable Quotes "You can't fix what you can't see." "AI has been the disruptor. The disruptor is over. Now this is just how things are." "Opting out is entirely illusional — which is why we need to be having these conversations." "Stay curious. The more that I am learning, the more I know I know absolutely nothing."

Connect with the Guest Dr. Pierrette Renée Dagg Director of Research and R&D, Merit Network LinkedIn: https://www.linkedin.com/in/pierrette-renee-dagg/

Listen and Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 Spotify: Search Secured with Dr. KJ on Spotify YouTube: Search Secured with Dr. KJ on YouTube

Support the Show If you find value in these conversations, please share this episode, leave a review, and subscribe so you never miss an episode.

Securing tomorrow, one episode at a time.

Episode Summary

In this episode of Secured with Dr. KJ, M.K. Palmore, Board Director and Managing Partner at Apogee Global RMS, joins the conversation to explore the evolving threat landscape shaped by artificial intelligence, the strategic gaps organizations face in cybersecurity planning, and what it truly means to lead in an era of machine-speed risk. Drawing on his experience across the Marine Corps, FBI, and the private sector, M.K. delivers a candid, practitioner-driven perspective on where organizations are falling short and what it will take to close the gap.

What You Will Learn

• Why AI has created a genuine parity between adversaries and defenders, and what that means for how organizations must respond
• The difference between tactical tool adoption and strategic security planning, and why CISOs need both running simultaneously
• How to evaluate AI-powered security vendors beyond the marketing label and ask the questions that surface real capability
• Why Zero Trust remains unfinished business for most organizations even as the industry pivots to AI
• What it means to make yourself indispensable as a mid-career cybersecurity professional

Top 3 Takeaways

1. AI has leveled the playing field between attackers and defenders. The winner will not be determined by who has the most tools, but by who executes the fundamentals with the most discipline.
2. CISOs must separate strategic planning from day-to-day tactical operations. Without a dedicated forward-looking function, organizations will always be building for yesterday's threat.
3. Mid-career professionals who make themselves indispensable through continuous learning, visible impact, and substantiated thought leadership will be the ones retained and relied upon when organizations face pressure to cut.

Memorable Quotes

I do believe that in this world of AI, there is finally a parity between the adversary and the defender. The winner is left to the individual exercising the best practices, frameworks, and analysis.

If the boss cannot identify something impactful that you have done in the past 12 months, you are in danger.

Before we even get done being excellent at one thing, innovation moves so fast that we are already onto the next major pivot. Zero Trust is a great example. Most organizations still have not gotten that right.

Connect with the Guest

Connect with M.K. Palmore on LinkedIn: https://www.linkedin.com/in/mkpalmore/

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com

Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517

Spotify: Search Secured with Dr. KJ

YouTube: Search Secured with Dr. KJ

Support the Show

If this episode brought value to you, share it with a colleague, leave a review, and help us grow the community of security practitioners committed to protecting tomorrow.

Securing tomorrow, one episode at a time.

SHOW NOTES

Episode Summary

In this episode, Dr. KJ sits down with Nick Cawthon, founder of Gauge and a leading voice in human-centered design, to explore a dimension of cybersecurity that is too often overlooked: the human one. Nick breaks down how experience design is not just a product concern but a frontline defense. From analyst fatigue to AI-accelerated social engineering to the politics of getting a seat at the security table, Nick brings a practitioner's lens to the question of how we build systems that actually work for the people using them.

What You Will Learn

How human-centered design reduces the conditions that lead to security failures, why the analyst experience inside security operations centers has been shaped by consumer UX patterns that were never meant for high-stakes environments, how AI is accelerating the social engineering threat and what design can do about it, what forward-deployed experience design looks like in practice, and why design teams must be present from the start of any security product conversation rather than brought in at the end.

Top 3 Takeaways

1. Fatigue is a vulnerability. Repetitive, poorly designed workflows lead to analyst burnout and missed signals. The MOOSEC framework — Methods for Understanding Security Experiences — offers a structured way to identify where human strain is creating exploitable gaps in the defense chain.
2. Speed without strategy is a trap. AI tools have compressed development timelines, but moving faster than ever does not mean building the right thing. The most important question any security team can ask is not what can we design, but what should we design.
3. Design earns its seat by showing up early. UX professionals who enter security conversations late are fighting for relevance. Those who are present at the start, helping teams map personas, workflows, and user needs before a single line of code is written, become indispensable strategic partners.

Memorable Quotes

"The sense of speed can sometimes be a fallacy if we don't stop and slow down and take the time and the strategy approach to make sure that we're designing the right thing." — Nick Cawthon

"Let's make sure that we can go in with enough candor and confidence that when we do design this, we're meeting the needs of the people we intend." — Nick Cawthon

"It takes a human being to recognize those kinds of hurdles." — Nick Cawthon

Connect with the Guest

Nick Cawthon, Founder of Gauge and Professor of Data Literacy and Visualization at California College of the Arts: https://www.linkedin.com/in/nickcawthon

Listen and Subscribe

Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com

• 🎙 Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517
• 🎵 Spotify
• 📺 YouTube

Support the Show

If this episode brought value, share it with a peer in your network. Every share helps grow a community built on substance over sales — real practitioners, real insights, no pitches.

Securing tomorrow, one episode at a time.

Secured with Dr. KJ — Season 4, Episode 1 Risk Before Technology with Nett Lynch

Episode Summary

Season 4 premiere, Dr. KJ sits down with Nett Lynch, CISO at Kraft Kennedy and Emperor of Legion, to explore what it truly means to get left of boom in cybersecurity. Nett shares how she helps organizations move beyond checkbox compliance by leading with risk instead of fear, uncertainty, and doubt. Drawing on 28 years of IT experience and nearly two decades in the managed service provider space, she breaks down why SMART goals should drive every security roadmap, how AI-powered threats are reshaping the attack landscape, and what it takes to earn executive trust through listening and long-term partnership.

What You Will Learn

Why compliance is not the same as security and how the treasure and crown jewels analogy helps executives understand where their real risk lives. How AI-powered threats have shifted from technical sophistication to credibility and speed, and why passwordless authentication should be at the top of every organization's priority list. The importance of including the CFO in tabletop exercises and how to build security roadmaps that align to three- and five-year business goals.

Top 3 Takeaways

1. Lead with risk, not fear, uncertainty, and doubt. Clients who feel scared into a decision walk away uncomfortable and are less eager to have the next conversation. Framing security as a business enabler through SMART goals creates lasting partnerships.
2. Identity is now the primary attack surface. Threat actors are using AI to conduct faster reconnaissance and build attacks that are indistinguishable from real business activity. Passwordless authentication and strong multifactor are no longer optional.
3. Trust is built through listening, not credentials. Asking open-ended questions, understanding the politics and growth plans of a business, and meeting clients where they are will always outperform a list of certifications.

Memorable Quotes "Compliance is not security. They are not the same thing. It is kind of like a Venn diagram. There is a little bit of overlap, but there is stuff on either side that one does not equal the other." "All of their data is treasure. It is all valuable, but not all treasure are the crown jewels." "It is not your credentials. It is not your experience. It is how much you care." "You have one mouth and two ears. You should listen more than you speak."

Connect with the Guest Nett Lynch on LinkedIn: https://www.linkedin.com/in/nett-s-lynch-mba

Listen and Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 Spotify YouTube

Support the Show If this episode brought you value, share it with a colleague, leave a review, and help us grow the community.

Securing tomorrow, one episode at a time.