TechSpective Podcast

Security teams know the pressure all too well: attackers move faster, the attack surface expands every year, and the tools meant to protect enterprises often create more friction than clarity. Traditional SOAR platforms promised efficiency but often delivered complexity, inflexibility, and frustration. Now, a new wave of AI-driven automation is reshaping the conversation—and the stakes couldn’t be higher.

In the latest episode of the TechSpective Podcast, I sat down once again with Ajit Sancheti of CrowdStrike to dig into what this next chapter of automation really looks like. If you’ve listened to Ajit before, you know he has a talent for breaking down complex cybersecurity challenges into practical, human-focused insights. This time, our discussion centered on the intersection of agentic AI and the modern SOC—a space where innovation and risk run side by side.

Why Old SOAR Models Fell Short

We start off with a reality check on traditional SOAR solutions. Many organizations invested heavily, only to find themselves burdened by rigid workflows, brittle integrations, and tools that couldn’t keep up with evolving threats. The issue often revolves around whether security teams can adapt responses in real time without breaking the system.

Ajit offers a perspective on why legacy approaches struggled to gain traction and how attackers’ increasing use of AI has made flexibility and speed non-negotiable. That tension—between what defenders need and what their tools can actually deliver—sets the stage for where agentic AI enters the picture.

Agentic AI: Promise and Caution

If generative AI brought us new ways of working with text and language, agentic AI goes a step further: it doesn’t just generate, it acts. That opens doors for SOCs to automate targeted, granular responses at machine speed. But it also introduces a new kind of trust problem.

How much autonomy are you comfortable handing over to an AI agent? What happens when it makes the wrong call? Ajit and I explore the idea of “earned trust”—why human oversight will remain essential and why AI “performance reviews” might become as routine as employee evaluations.

It’s a fascinating parallel: treating these agents not just as tools, but as teammates that require accountability.

The Human Factor in Automation

One theme we return to often in our discussion is simplicity. For too long, security technology has required deep expertise just to ask the right question or interpret the right output. That has to change. Future SOC tools need to feel less like command-line puzzles and more like natural conversations—where context, clarifying questions, and intuitive design make security accessible to more people across the organization.

The democratization of security is one of the most exciting trends on the horizon. Smaller companies that never imagined deploying advanced detection or response tools are suddenly finding themselves able to do so—without a staff of experts on hand. Ajit points out how this shift could level the playing field for businesses of all sizes.

Looking Ahead

We don't go so far as to try to predict a perfect AI-secured future. Instead, we talk about what’s realistic over the next 12 to 24 months. Expect more narrowly focused AI agents, more orchestration challenges, and an evolving role for humans in the loop. There will be setbacks, and likely some very public failures, but also tremendous opportunities for organizations willing to adapt.

As always, Ajit brings an optimistic yet grounded perspective. Security is a constant cat-and-mouse game, but this new generation of automation might just give defenders the flexibility and speed they’ve been missing.

Why You Should Listen

This episode is a candid exploration of where automation stands today, where it needs to go, and how organizations can prepare themselves for an AI-driven future without losing sight of human judgment.

If you want a glimpse into the future of SOC operations, and if you’ve ever wondered whether AI can truly lighten the load for overworked security teams, this is a conversation you’ll want to hear.

Artificial intelligence is transforming nearly every industry, and cybersecurity is no exception. On the latest episode of the TechSpective Podcast, I spoke with Kevin Simzer, COO of Trend Micro, about how generative and agentic AI are reshaping development and defense strategies.

Kevin shared why AI should be seen as neither magic nor snake oil, but as a powerful tool that can accelerate innovation while still requiring human expertise. From code generation to enterprise-scale deployment, the opportunities are immense—but so are the risks. That’s why security must be built in from the start, not bolted on after the fact.

One of the most fascinating parts of our discussion centered on digital twin technology. Traditionally used in fields like manufacturing or engineering, digital twins are now emerging as a game-changer for cybersecurity. By creating a virtual replica of an organization’s environment, enterprises can continuously run simulations, red-team scenarios, and experiment with different defenses—without putting live systems at risk. Instead of waiting for quarterly tests, organizations can stress-test their infrastructure constantly, learning and adapting in real time.

As Kevin explained, this shift could fundamentally change how enterprises think about resilience. Combined with the rapid rise of AI-driven agents, digital twins offer a way to stay ahead of evolving threats while navigating the complexity of modern IT environments.

Cybersecurity has always been about anticipating the next move. With AI and digital twins in play, the game board itself is changing—and those who embrace these tools early will be far better prepared for what comes next.

Ransomware has been part of the cybersecurity conversation for years, but if you think it’s yesterday’s problem, think again. The headlines might be dominated by AI these days, yet behind the scenes, ransomware continues to disrupt organizations of every size — from small businesses to multinational enterprises.

In this episode of the TechSpective Podcast, I sat down with Rob Harrison, Senior Vice President of Product Management at Sophos, for a wide-ranging conversation about findings from the recent Sophos State of Ransomware Report, ransomware’s persistent threat, the critical role of Managed Detection and Response (MDR), and how AI is reshaping the security landscape.

Fortunately, it was not a typical “cyber doom” discussion.

Rob brings a unique perspective, blending his experience leading Sophos’ MDR business with a career that’s spanned everything from defending national security to protecting critical cloud workloads. Our talk dives into the trends shaping both the technical and human sides of ransomware response — and why some organizations emerge stronger while others don’t survive at all.

Why This Conversation Matters

While ransomware hasn’t disappeared, the tactics have evolved. The game is no longer just about encrypting data and demanding payment. The threat landscape is shifting toward double extortion, data exfiltration, and in some cases, skipping encryption altogether. Rob and I explore how this evolution is forcing organizations to rethink their approach to prevention, detection, and response.

We also discuss how MDR can be a game-changer, particularly for organizations without the resources or expertise to run a 24/7 security operation in-house. It’s not just a question of technology — it’s about having the right people, processes, and visibility to act decisively when every second counts.

But what about AI? It’s easy to assume that “AI in security” is just another buzzword. We unpack how AI — especially in its more agentic and automation-focused forms — is already making a real impact in the SOC. From handling tedious, repetitive tasks to providing richer context for human analysts, AI is becoming a force multiplier for security teams.

The Human Factor

One of the most compelling parts of our conversation focuses on the human cost of ransomware — the stress, burnout, and organizational disruption it leaves behind. Rob offers insights on how to prepare for worst-case scenarios, not just from a systems and data standpoint, but from a leadership and team perspective.

We also touch on the importance of preparation and practice. Just as pilots run flight simulations and first responders drill for emergencies, organizations need to rehearse their incident response. That way, when the heat is on, muscle memory kicks in, roles are clear, and decisions are made with confidence.

Why You Should Listen

If you’re a security leader, business owner, IT professional, or simply someone interested in how technology, strategy, and human decision-making intersect in the fight against ransomware, this episode is for you. We cover:

The changing tactics of ransomware operators

How MDR can extend or even replace in-house capabilities

The role of AI in modern security operations

Strategies for reducing the human toll of cyber incidents

The importance of preparation, communication, and trust in response efforts

This is not a doom-and-gloom story. It’s a conversation about resilience, about making smarter security decisions, and about ensuring that when — not if — an incident occurs, your organization is ready.

Listen to the full episode now to hear the full discussion and take away actionable insights you can apply today.

Cybersecurity strategy has evolved over the years—first focusing on keeping the bad guys out, then on detecting and responding to threats faster, and now on cyber resilience and the notion of ensuring business continuity no matter what happens.

In the latest episode of the TechSpective Podcast, Druva Chief Security Officer Yogesh Badwe joined me to talk about why the next phase of security maturity must be built around a single, non-negotiable truth: data is the real crown jewel.

The Shift to Data-Centric Security

Historically, organizations poured resources into protecting networks and identities, often treating data as a secondary concern. “Breaches are inevitable,” Badwe explained. “Detection is a lagging indicator. Organizations need to be ready to respond and recover from bad scenarios—and that starts with the data itself.”

With sprawling hybrid environments, complex supply chains, and AI agents introducing new attack vectors, prevention alone isn’t enough. Security teams need full visibility into what data exists, where it resides, and who can access it.

Backups: From IT Tool to Security Backbone

Most companies think of backups as an IT disaster recovery resource. Badwe argues they must be elevated to a frontline security capability.

Recovering from ransomware isn’t as simple as restoring a snapshot—you need to identify clean copies, remove malicious artifacts, and, in some cases, blend files from different points in time to minimize business disruption. “Security recovery is completely different than IT recovery,” he noted.

Attackers know this, too. Modern ransomware campaigns often target backup systems directly to remove a company’s safety net.

Preparing for Emerging Risks

The conversation also touched on two looming challenges:

Double-extortion ransomware, where attackers both encrypt and exfiltrate data to increase leverage.

Post-quantum cryptography, and the “harvest now, decrypt later” risk that stolen encrypted data could be cracked in the future.

Organizations should begin mapping their encryption landscape now to prepare for a PQC transition within the next few years.

The Visibility and Classification Challenge

Centralizing all corporate data is unrealistic. Instead, companies need tools that can provide visibility where the data lives—whether that’s in SaaS apps, multi-cloud environments, or third-party systems.

Badwe sees automated classification as essential, not just for prevention but for rapid incident response. Knowing which 20% of your data is truly sensitive allows you to focus security controls where they matter most.

AI’s Real Role

AI in security is often overhyped, but Badwe sees practical value in tier-one SOC triage, automating runbooks, and enhancing secure software development processes. AI can’t replace sound security architecture, but it can accelerate analysis and decision-making.

Looking Ahead

As AI agents and integrated corporate search platforms become more common, traditional authentication and authorization models will be tested. Security leaders will need to rethink access controls for human-to-agent and agent-to-agent interactions.

For Badwe, resilience isn’t just about bouncing back—it’s about making data the centerpiece of prevention, detection, response, and recovery. Because in the end, it’s not the network or the identity we’re protecting—it’s the information that keeps the business running.

Check out the full podcast for more:

When it comes to cybersecurity, it’s easy to fall into the trap of thinking in binaries—good guys and bad guys, black hats and white hats, defenders and attackers. But the reality is far more complex, especially in an age where artificial intelligence is changing the rules for everyone, whether they like it or not.

In the latest episode of the TechSpective Podcast, I sat down with Myke Lyons, CISO of Cribl, for a conversation that spans a lot of ground. And I mean a lot of ground. From retail fraud and social engineering to ransomware economics and the future of AI-powered search, we explore how cybercriminals are using the same tools defenders have access to—but with very different goals in mind.

We kick things off by unpacking Cribl’s unique role in the world of IT and security telemetry. At one point, I draw the comparison of Cribl as a sort of Rosetta Stone for log data—helping organizations normalize, route, and optimize data flows to the right places for the right reasons. Myke shares how this kind of architectural flexibility isn't just convenient—it’s becoming essential in a world where data is growing at breakneck speed and attackers are using AI to move just as fast.

Then we shift into a broader discussion about why retail—especially during high-stakes periods like Prime Week or Black Friday—is such a tempting target for attackers. The emotional nature of shopping, the scale of operations, and the deeply trusted brand names all make retail a ripe hunting ground for bad actors. But it’s not just old-school fraud or phishing anymore. We get into how AI is helping attackers spoof websites, impersonate brands, and even fake their way through job interviews to infiltrate organizations from the inside.

One particularly eye-opening thread: the evolving ransomware playbook. Threat actors are now using AI to research their victims more thoroughly—tailoring ransom demands based on insurance coverage, revenue cycles, and organizational pain points. It’s strategic, it’s efficient, and yes, it’s unsettling.

But this conversation isn’t just doom and gloom. We also talk about how security teams can flip the script by using AI themselves—developing muscle memory with new tools, leveraging prompt engineering, and building infrastructure that adapts in real time. Myke makes the case for experimentation, curiosity, and staying a step ahead—not just with tech, but with mindset.

If you’re a security leader, a practitioner, or even just a curious listener trying to make sense of this rapidly evolving landscape, you’ll find a lot to chew on here. And if you think the line between helpful AI assistant and risky attack vector is starting to blur… you’re not alone.

Listen to the full episode now and hear why your AI should be more like JARVIS—and what happens when the bad guys figure that out first.

The ever-expanding world of cybersecurity is full of big promises, bold claims, and—if we’re being honest—a lot of noise.

As security leaders face mounting pressure to do more with less, it’s no longer enough to simply buy the newest tool or chase the latest trend. What organizations really need is a trusted advisor—someone who knows the landscape, understands the stakes, and can help make sense of it all.

That’s exactly the theme of the latest episode of the TechSpective Podcast. John Hurley, Chief Revenue Officer at Optiv joins me in a wide-ranging, candid discussion of the real challenges facing CISOs today: managing tool sprawl, justifying investments, cutting through cybersecurity jargon, and understanding where artificial intelligence fits into the modern security stack.

At the heart of our conversation is Optiv’s unique approach to helping organizations rationalize their security environments. John shares how Optiv leverages a decade’s worth of data and experience to guide clients through the decision-making process—moving from a transactional vendor model to a genuinely consultative partnership. The analogy I came up with for Optiv's role is that it essentially positions itself as a “pharmacist” in the cybersecurity ecosystem—helping organizations make sense of countless overlapping solutions and potential “side effects.”

The episode also addresses some timely questions: What does it mean to be a true advisor in an industry obsessed with buzzwords? How can AI be leveraged to bring real value, rather than just more noise? And what steps should organizations take when rethinking their security architecture in the face of continuous change?

Whether you’re a security leader looking for fresh perspective, a vendor navigating a crowded marketplace, or just a tech enthusiast fascinated by the challenges of enterprise security, this episode promises plenty of food for thought.

Curious? Give it a listen (or watch it on YouTube)—and hear firsthand how the conversation is evolving from selling tools to solving real business problems.

Cloud security is one of the most talked-about issues in cybersecurity today—but are we talking about the right things?

In the latest episode of the TechSpective Podcast, I sat down with Cristian Rodriguez, Field CTO for the Americas at CrowdStrike, to explore the evolving landscape of cloud threats and how defenders need to adapt. With over a decade at CrowdStrike and more than 20 years in the cybersecurity space, Cristian brings a seasoned perspective on how adversaries have shifted their tactics—and how security teams can respond effectively.

The Comfort Trap of Posture Management

A major theme of our conversation is the current overreliance on cloud security posture management (CSPM). While CSPM tools play a critical role in identifying misconfigurations, compliance gaps, and other baseline security issues, Cristian points out that they are inherently limited by their snapshot-in-time nature. They’re valuable for hygiene, but they don’t give you a dynamic view of what’s happening in your environment right now.

And that’s a problem—because attackers aren’t waiting for your next scan. They’re actively probing, logging in with stolen credentials, and moving laterally through cloud environments in ways that traditional security tooling often fails to detect.

Living Off the Land, Evolved for the Cloud

We also touch on a concept many security professionals know well: “living off the land.” This is when attackers use legitimate tools and processes already present in an environment to evade detection. What’s changing, Cristian explains, is how these techniques are now being used within cloud-native services—hiding in plain sight within container workloads, serverless functions, and IAM policies.

This shift demands a new level of runtime visibility. You can’t just know what resources exist and how they’re configured—you need to understand who is accessing them, when, from where, and why. Behavioral analysis, real-time anomaly detection, and identity-based insights are becoming table stakes in defending modern cloud architectures.

AI as a Force Multiplier for the SOC

Naturally, no conversation about modern cybersecurity would be complete without discussing AI. Cristian shares how CrowdStrike’s AI assistant, Charlotte, is changing the game for SOC analysts by helping them triage incidents faster, guide investigations, and even orchestrate responses across multiple systems using natural language commands.

But AI isn’t just about automation—it’s about augmentation. AI doesn’t replace the analyst; it frees them up to focus on what really matters. In a world where adversaries can break out and cause damage in under an hour, that time savings is crucial.

Preparing for What’s Next

We also touch on what has become a focus for me. It is one of the biggest questions for the future of AI: What happens when the next generation of cybersecurity professionals enters the field having never worked without AI? If level-one SOC roles are increasingly automated, how do tomorrow’s defenders gain the experience needed to make critical decisions in high-stakes situations?

It’s a thought-provoking discussion that blends current challenges with a forward-looking lens on where the industry is headed—and what that means for the people defending it.

Tune In to Learn More

If you're a security leader, cloud architect, SOC analyst, or anyone trying to keep pace with the changing threat landscape, this is a must-listen episode. We explore not just the threats themselves, but the mindset shift required to defend against them—and the technologies that can help tip the scales in our favor.

Listen now on your favorite podcast platform or watch the full conversation on YouTube.

Have thoughts on this episode or topics you'd like to see covered in future discussions? Let me know on LinkedIn—I’d love to hear what’s on your mind.

Artificial intelligence may be the headline, but data is the story.

In this episode of the TechSpective Podcast, I sat down with Todd Moore, VP of Data Security at Thales, to unpack the newly released 2025 Thales Data Threat Report. Our conversation explored the increasingly complicated intersection of data, AI, and cybersecurity—and why enterprises may be sprinting into transformation before securing their foundation.

Spoiler: It’s all about the data.

GenAI Is Booming—And So Are the Risks

According to the report, one-third of organizations are already in the integration or transformation phase of GenAI adoption. And while that sounds like progress, Todd and I both agreed it mirrors past tech hype cycles—cloud, Wi-Fi, mobile—where enthusiasm far outpaced security planning.

“The horse has left the barn,” Todd said. And that urgency to keep up with AI adoption is creating a familiar blind spot: data security.

In fact, the fast-evolving GenAI ecosystem ranked as the top concern among respondents (69%), followed closely by risks to data integrity (64%) and trustworthiness (57%). Enterprises are waking up to the reality that AI isn’t just a new technology—it’s a new attack surface.

Shadow AI, Prompt Injection, and Data Leakage

One recurring theme from our conversation was the rise of "shadow AI"—where employees use public tools like ChatGPT without guardrails. While it might boost productivity, it also introduces serious risk if sensitive internal data gets fed into public models.

We talk about how many organizations are adopting internal LLMs to mitigate this, but we acknowledge that enforcement is tough. The reality is that just like with shadow IT, if you don’t give people an approved tool that meets their needs, they’ll find workarounds.

That’s where security posture management becomes crucial. Visibility into who’s using what data—and where it’s going—is no longer optional.

Data Classification: Still a Work in Progress

You can’t protect what you don’t know you have. Yet the report found that only one-third of organizations can fully classify their data, while 61% are juggling five or more data discovery tools.

The inconsistency leads to fragmented policies, conflicting controls, and ultimately, more exposure. Todd and I agreed: classification has to be automated and context-aware. AI can help here—ironically—by understanding not just what a file says, but what it means based on surrounding data.

Still, as Todd pointed out, AI is also the biggest creator of new data. “It’s a feedback loop,” he said. “AI is creating more unstructured data than ever before, which just makes the classification challenge even bigger.”

Quantum Computing Is Closer Than You Think

Another headline from the report—and our conversation—was the growing urgency around post-quantum cryptography (PQC). The threat of “harvest now, decrypt later” is very real, especially for regulated industries that store data long-term.

Thales found that 63% of organizations are already concerned about future decryption of today’s data, and many are beginning to prototype PQC solutions. Todd emphasized that we now have a deadline: NIST and other global bodies are calling for a deprecation of classical algorithms by 2030.

“This isn’t Y2K,” Todd warned. “We don’t know when Q-day will arrive. But when it does, if you haven’t prepared, it’s already too late.”

Check It Out

This episode dives deep into AI, PQC, classification, and the cultural challenges of balancing innovation with risk. If you're a CISO, security leader, or just trying to make sense of the data security landscape in 2025, you won’t want to miss it.

In a sea of sameness in the cybersecurity market, it’s easy to walk away feeling like every company says the exact same thing. “Autonomous.” “Agentic.” “AI-powered.” After a while, it all blends together. But every now and then, a brand cuts through the noise—not just because of a flashy event booth or viral stunt, but because it tells a compelling story with intention behind it.

In the latest episode of the TechSpective Podcast, I sit down with Don Jeter, Chief Marketing Officer, and Leonid Belkind, CTO and Co-founder of Torq, to talk about what it takes to stand out in an industry that too often plays it safe. If you’ve seen Torq’s monster truck partnership or skeleton-themed branding at events like RSAC and wondered what’s behind the spectacle, this conversation peels back the curtain.

But this isn’t just a story about branding. It’s a deeper discussion about authenticity, culture, and why cybersecurity marketing so often misses the mark. We explore how Torq built a company that reflects its people—irreverent, passionate, and unapologetically bold—and why that matters more than ever in today’s overcrowded cybersecurity landscape.

We also talk about how automation is evolving beyond the limitations of legacy SOAR (Security Orchestration, Automation, and Response), and how AI—particularly agentic AI—is reshaping how security teams handle alerts, prioritize threats, and reclaim their time. The conversation touches on trust, risk, the future of security operations, and even gets into topics like self-driving cars, self-checkout lanes, and what it means for a new generation of analysts entering the field.

If you’re interested in cybersecurity, brand differentiation, or how AI is transforming security operations, this episode is one you don’t want to miss.

Check out the full episode now:

In the latest episode of the TechSpective Podcast, Errol Weiss, Chief Security Officer at Health-ISAC, joins me to dive into a timely and thought-provoking conversation on how cybersecurity collaboration is changing—especially when it comes to public and private sector relationships.

For over a decade, Health-ISAC has played a vital role in helping healthcare organizations share threat intelligence and best practices. But in today’s environment, that collaboration is under pressure. The lines between private and public sector responsibility are becoming more blurred, and recent shifts in government participation are raising tough questions. Who is ultimately responsible for defending critical infrastructure? And what happens when the expected support simply isn’t there?

Our discussion covers a wide range of themes—from the unique cybersecurity challenges facing hospitals and medical device manufacturers to the impact of political transitions on agency engagement. It also explores what it really means for organizations to be self-reliant in their defense efforts, and how global cooperation plays into the equation.

This episode doesn’t offer easy answers—but it will make you think.

If you’re in cybersecurity, healthcare, or just care about the systems we all depend on, this is one conversation you won’t want to miss. Tune in to hear how leaders like Weiss are adapting in real time and what the rest of us can learn from their approach.

Listen now wherever you get your podcasts—or watch the full episode on YouTube.