The Business of Cybersecurity

Would your hiring process recognize a convincing deepfake candidate before that person received access to company systems and data?

In this episode of Business of Cybersecurity, I speak with Samantha Swift, Chief Marketing Officer at Cyberr and a cybersecurity practitioner with 27 years of experience spanning technical support, incident response, product development, industry roles and marketing. Samantha brings the kind of perspective that is difficult to acquire from a marketing handbook because she has spent years working alongside the people who buy, use and defend security technology.

The conversation centers on a remarkable hiring incident at Cyberr. A candidate applying for a back-end engineering role arrived with a strong CV, a polished professional profile and apparently relevant experience. On paper, the match looked almost perfect. During the video interview, however, small inconsistencies began to appear. The voice and image were slightly out of sync, the candidate looked unusually processed, nonverbal sounds exposed a different accent, and answers about Cyberr were weaker than the carefully prepared technical responses.

The interviewer's personal connection to Moldova and knowledge of Romanian produced another unexpected test. When he offered to continue the interview in Romanian, the candidate declined. The final check came when the applicant was asked to place a hand in front of his face. Samantha explains that this type of movement can break a live facial filter, and the candidate refused. The call ended soon afterward.

The follow-up investigation found a recently created LinkedIn profile that soon disappeared, a purchasable Romanian phone number and an email address disconnected from the identity being presented. An investigative journalist familiar with nation-state activity told Samantha that elements of the email format resembled known tactics, but he could not confirm the source with certainty. That distinction matters. The attempt may have involved a state-linked actor, another criminal group or an individual using similar methods. The verified point is that Cyberr was targeted by somebody attempting to enter the company under a false identity.

We discuss why the security response cannot depend on spotting visual glitches forever. Deepfake audio and video will continue to improve, and legitimate candidates should not be made to feel guilty before an interview begins. Samantha recommends starting identity and background checks earlier, matching the level of scrutiny to the access and risk attached to the role, and using video from the first talent-acquisition conversation. Hiring teams also need guidance on what information they can share because an applicant may begin social engineering before the technical interview.

The risk continues after an offer is made. Criminal groups can pay local accomplices to receive company laptops, install software or forward devices, creating a believable local presence for a remote employee. This turns equipment delivery, identity checking and employee monitoring into connected parts of the same security process.

We finish by discussing cybersecurity hiring, nontraditional career routes, ID-verified professional communities and the need for smaller businesses to access trusted security expertise without enterprise-sized budgets. If a candidate, product or professional profile looks perfect, what additional evidence would earn your trust? Share your thoughts and experiences with me.

Who owns a technology-related business risk when revenue, operations, customer trust or regulatory standing are at stake?

In this episode of Business of Cybersecurity, I speak with Kayne McGladrey, a two-time CISO, independent fractional and virtual CISO, Senior Member of IEEE, and author of Cyber Risk Is a Myth: A Business Approach to Integrated Risk Management.

Kayne argues that calling something a cyber risk can create distance between the people who understand the technology and the people who own the business outcome. When the CISO is expected to accept a risk attached to someone else’s profit and loss statement, accountability becomes blurred and business leaders may make decisions without seeing the security dependencies beneath them.

We discuss how companies can replace technical severity scores and vulnerability counts with a shared language based on financial exposure, operations, reputation and regulatory impact. Kayne explains why each entry in a risk register should have a named business owner, while the security team identifies, quantifies, translates and monitors the exposure.

The conversation also covers the difference between documenting risk and using it to guide investment. A useful risk register should help executives compare exposure across business areas, connect controls to expected outcomes and track residual risk over time. This reframes the budget conversation from how much security costs to how much risk an investment reduces.

Kayne also explains why clean audits, insurance policies and written controls do not prove that a company can recover from an incident. Tabletop exercises, technical recovery tests and rehearsed decision paths provide stronger evidence of readiness. For board members, he offers practical questions about ownership, integrated reporting, business metrics and cross-functional reviews after incidents.

What evidence would show that cybersecurity is part of enterprise risk management in your organization, rather than a separate technical function? Listen to the conversation and share your thoughts with me.

What happens to identity security when an attacker can copy an executive's voice, face, and employment history using inexpensive tools?

In this episode of The Business of Cybersecurity, I speak with Bojan Simic, CEO and co-founder of HYPR, about the effect of generative AI on impersonation, credential recovery, and help desk security. HYPR is a New York cybersecurity company focused on identity-based attacks. Bojan says identity-related events account for between 60 and 80 percent of incidents, depending on the security report being used, and his team helps organizations find and repair weak points across the identity chain.

The demonstration during our conversation makes the risk unusually tangible. Bojan changes his on-screen face into mine using software running on his local computer. The result is not flawless, but it is convincing enough to show why a familiar face on a video call can no longer be accepted as evidence by itself. With additional preparation, an attacker can also clone a voice, gather employment details from public profiles, and automate much of the reconnaissance that previously required repeated manual calls.

Bojan argues that asking employees to recognize every deepfake repeats an old cybersecurity mistake. Phishing simulations showed how quickly people return to normal working habits after training. Help desk staff are trying to resolve problems, support colleagues, and close tickets. They should not be expected to determine whether a distressed caller, senior executive, or remote employee has been digitally recreated.

One hospital example illustrates the weakness of knowledge-based checks. According to Bojan, an attacker called the help desk while pretending to be a doctor but did not know the required four-digit PIN. The attacker then called the doctor while posing as the IT team, obtained the PIN, returned to the help desk, and gained access to the account. The process technically followed policy, yet the policy relied on information that could be socially engineered.

We discuss how the same attack can become faster through AI. A system can call the help desk, discover which questions are asked, search public sources for the answers, call the employee when information remains missing, and return with the required details. Requiring video does not solve the problem when faces can also be recreated.

The conversation also covers continuous identity proofing. Instead of treating verification as an event completed during onboarding, companies can request stronger evidence when behavior changes. A new device, unfamiliar operating system, first-time access to a sensitive application, return from a long absence, or promotion into privileged access can all justify another check. Routine work from a known device should remain straightforward, allowing friction to appear when the risk changes rather than during every action.

Privacy deserves equal attention. Bojan acknowledges that employees in some countries may resist location, document, or biometric checks. His recommendation is to explain what is collected, whether it is retained, and what alternatives exist. An employee who declines remote verification can be offered an in-person process. That gives people a choice while preserving the security requirement.

The most immediate action is to test password recovery and credential reset. Bojan advises moving those functions away from phone-based help desks and into a self-service process that combines device, location, or document verification. He says credential resets account for roughly 30 to 40 percent of help desk calls, so the change may also reduce support demand.

Could a cloned executive, remote worker, or doctor pass your current recovery checks, and which independent signal would stop them? Listen to the episode and share your thoughts with me.

What happens when security analysts encounter so many false positives that dismissing alerts becomes an automatic response?

In this episode of The Business of Cybersecurity, I’m joined by Tim MalcomVetter, General Manager of Coalition Security and co-founder of WireSpeed. Tim brings 26 years of practitioner experience, including building and running Walmart’s red team and leading a managed security operation serving hundreds of enterprise clients.

Tim believes the familiar phrase “alert fatigue” fails to describe the full operational risk. When analysts repeatedly investigate events that lead nowhere, their judgment can gradually recalibrate. An unusual event starts to resemble another routine item in the queue. That normalcy bias is especially dangerous when analysts have limited customer context, strict response targets and thousands of additional alerts waiting behind the current case.

We discuss how AI-amplified attacks change the timing. Tim explains that defenders may begin several minutes behind because endpoint events must be collected, processed and passed into security systems before a response can begin. Attackers can combine AI-assisted preparation with deterministic tools that execute in milliseconds once they reach an environment. Even if both sides have access to capable models, the defender may already be running a delayed race.

There is another complication. AI analysis consumes tokens, and security teams rarely have an unlimited budget. Tim expects attackers to use lower-severity techniques that may sit below the threshold organizations send for expensive AI investigation. At the same time, security vendors have a commercial incentive to report broad telemetry because being accused of missing an incident carries serious consequences. The result can be greater visibility, but it can also place additional noise in front of already stretched teams.

Tim offers a practical model for deciding where different forms of intelligence belong. Deterministic code should handle the widest possible set of known and repeatable decisions. AI can interpret ambiguous or semi-structured material, such as suspicious process trees and living-off-the-land activity. Human analysts then provide judgment, supervision and investigation where neither layer can produce sufficient confidence.

We also examine WireSpeed’s approach to learning from errors. Tim describes replacing the traditional alert funnel with a straight pipe that routes events toward a verdict, while people statistically sample the results. When the system makes a mistake, the team investigates the defect, corrects it and converts the sanitized case into a unit test. That approach aims to stop the same failure from being repeated across analysts or software releases.

AI can help security teams process context, but probabilistic output also creates testing, consistency and supply-chain questions when models change. How should your organization divide responsibility between code, AI and people, and has your SOC reduced false positives or simply learned to live with them? Listen to the conversation and share your thoughts with me.

Can defenders keep pace when generative AI gives attackers faster ways to create convincing phishing messages, research targets, and test new attack methods?

In this episode of The Business of Cybersecurity, I speak with Professor Steven Furnell from the University of Nottingham for an IEEE conversation about AI-enabled threats, security awareness, passkeys, cyber hygiene, and the continuing gap between cybersecurity policy and everyday practice.

Steven explains why the current AI contest does not give either side exclusive access to powerful technology. Attackers, however, often gain the early advantage because they use it to create opportunity and set the agenda. Defenders are then left identifying the new behavior, adapting controls, and managing the extra work. Generative AI also removes much of the effort once required to research an organization and produce credible spear-phishing messages, making familiar advice about spelling errors and obvious scams less useful than it once was.

We discuss whether passkeys could finally reduce our dependence on passwords and why adoption will still require technical preparation and clear communication with users. A control may improve security while adding friction, so businesses must consider how authentication, updates, access controls, and other interventions fit into real working routines.

Steven also points to a recurring problem in cybersecurity awareness. Fewer than one in five organizations in the UK Cyber Security Breaches Survey reported staff awareness training in the previous 12 months, according to the figures he discusses. Even where annual training exists, watching a video and answering questions may satisfy a compliance requirement without showing whether an employee can respond effectively when a real incident occurs.

For smaller organizations that find security frameworks overwhelming, Steven recommends Cyber Essentials as a practical baseline. We also discuss secure design, the difficulty of regulation keeping pace with technology, and the Cyber Games Lab activities created at the University of Nottingham. Hacker Whacker and Cyber Defense Dice use play and conversation to make cyber education easier to understand for young people and business audiences.

What would improve security behavior inside your organization, another annual training module or regular opportunities to practice realistic decisions? Listen to the episode and share your thoughts.

Could your security team produce an accurate list of every employee, contractor, guest account, application, and AI agent with access to your SaaS environment today?

In this episode of The Business of Cybersecurity, I speak with Jim Lippie, Chief Product Officer at Kaseya, about findings from the company’s latest SaaS security research. The report draws on anonymized activity from the SaaS Alerts platform, covering 27 billion security events across 50,000 organizations.

One finding immediately stands out. Only 44% of monitored organizations were using multifactor authentication. When the research began in 2022, the figure was 32%. Four years of heightened cyber awareness have therefore produced an increase of only 12 percentage points.

The report also found that guest accounts represented 69% of monitored accounts. This means guest users outnumbered licensed users by over two to one.

Jim explains how these accounts accumulate. A consultant, contractor, or temporary employee receives access to company systems, completes the work, and leaves. The account remains because nobody owns the process of removing it. Over time, these forgotten identities create unattended routes into business data and applications.

Our conversation examines how SaaS has changed the security perimeter. Employees no longer need to be inside an office or connected through a corporate network. A browser, valid credentials, and access to a cloud application may be enough. Security teams must therefore monitor user behavior, permissions, locations, and unusual patterns rather than relying on controls designed around the office firewall.

AI agents add another category of identity. An autonomous system performing workflow tasks may require access to files, email, customer data, financial systems, or internal applications. Jim argues that these agents should be treated like users, with defined permissions and continuous behavior monitoring.

We also discuss the tension created by easy collaboration. The report found that 34% of monitored file sharing traveled outside the organization. That sharing may be legitimate, but businesses need to understand which information has left, who received it, and whether access remains appropriate.

Jim’s advice is deliberately practical. Begin with a complete assessment of the environment. Identify every account and application, require MFA, give guest access an expiration date, monitor behavior, and use overlapping security controls where a second source of evidence can expose missed activity.

Does your organization have genuine visibility across its SaaS environment, or are forgotten accounts and unmonitored identities creating doors nobody remembers opening? Listen to the episode and share your thoughts with me.

What happens when a security team receives 50,000 alerts but only 50 genuinely need human attention?

In this episode of The Business of Cybersecurity, I speak with Harman Kaur, CTO of Tanium and a reserve cyber officer in the U.S. Air Force, about how AI is changing the pace, structure, and responsibilities of modern security operations.

The long-running cybersecurity talent shortage has not disappeared, but Harman believes the conversation is changing. Security teams now have tools that can assist with specialist work, which places greater weight on processes, interpretation, and decision-making. Training increasingly includes knowing how to ask the right question, assess an AI-generated response, and decide whether the proposed action makes sense.

That change matters because the old pattern of threat response is becoming too slow. Security teams once had time to identify a threat trend, respond to it, and prepare for the next one. Harman says those cycles can now collapse to seconds as AI helps attackers find vulnerabilities and develop exploits. Defenders therefore need to consider whether the same technology can support remediation and patch creation at a comparable pace.

We discuss why traditional scripted automation cannot solve this problem by making the existing workflow slightly faster. If an analyst can manually process 100 alerts and automation raises that number to 200, the improvement offers little comfort when the queue reaches thousands or hundreds of thousands. Harman argues that organizations need to reconsider how the security operation itself is designed while retaining people as judges for decisions with meaningful consequences.

Autonomy, in her view, should be treated as a spectrum rather than an all-or-nothing destination. One process may be suitable for full automation, another may require approval, and a third may remain entirely human-led. That approach also helps CIOs and CTOs respond to pressure for rapid AI adoption without pretending that a single governance model can answer every risk.

Harman also warns against allowing the AI conversation to distract teams from familiar security weaknesses. Shadow AI matters, and companies need visibility into the models and tools being used across the organization. At the same time, phishing, compromised credentials, unpatched machines, end-of-life devices, unused applications, and exposed ports remain common sources of risk. AI may amplify those weaknesses, but it does not erase the need to address them.

The episode’s clearest example concerns alert fatigue. Harman describes an AI system that processes and triages alerts while reporting its confidence and showing how it reached its conclusion. Verification mechanisms can then ask what additional context should be considered. The goal is to narrow 50,000 alerts to perhaps 50 that deserve manual investigation, giving analysts a manageable decision set without asking them to trust a model blindly.

We also discuss operational resilience and why prevention must begin before a security alert appears. Harman challenges organizations to explain why routine patching is not automated in 2026, while recognizing that no company can apply every patch instantly. Reducing the attack surface by removing unused applications and closing unnecessary ports can make the business a smaller target while teams address the vulnerabilities that matter most.

Finally, Harman asks leaders to question why they are applying AI to a given problem. Some tasks can be handled by established automation. If the organization chart, business processes, and toolset look exactly the same after an AI program, the company may have added technology without redesigning the work. Where should your organization allow AI to act, where should it advise, and where must a person make the final decision? Listen to the episode and share your thoughts.

What if your bank could recognize that you needed help before you had to ask for it?

In this episode of Business Technology Perspectives, I speak with Michel Jacobs, Chief Strategy Officer at CSI, about how artificial intelligence and customer intelligence are changing the relationship between financial institutions and the people they serve.

Community banks and regional financial institutions have traditionally competed through personal relationships rather than scale. But digital banking, fintech competition, and changing consumer expectations are putting that advantage under pressure. Michel argues that the future of banking will increasingly be defined by interactions rather than transactions.

That means understanding why a customer is contacting the bank, what may be happening in their life, and which service could provide value at that moment. It also means preparing for interactions initiated through APIs, open banking services, and AI agents, rather than assuming every customer journey begins with a person opening a banking app.

Michel explains how CSI’s Customer Intelligence Suite combines transaction information, card activity, merchant category data, and digital behavior to identify signals and changing patterns. According to Michel, these signals can help a financial institution understand when a customer’s circumstances may have changed instead of relying on the demographic category assigned when the account was opened.

This creates opportunities for relevant financial support, but it also introduces serious questions about privacy, consent, accuracy, and customer trust. Inferring that somebody has changed jobs, bought a home, become a parent, or encountered financial difficulty can be useful when the response genuinely helps. The same capability can feel intrusive when it produces poorly timed sales offers or conclusions the customer cannot question.

We discuss how banks can balance personalization with regulatory responsibilities and why younger consumers are less likely to remain loyal when a provider offers little practical value. As Michel puts it, the era of offering everybody the same account and throwing in a free beach ball has probably run its course.

Customer retention is another major part of our conversation. Michel explains how declining digital activity, money leaving an account, late payments, or changes in income can reveal that a relationship is weakening. Used responsibly, this information could allow a bank to offer assistance before missed payments or financial strain become harder to address.

For community banks, the answer is unlikely to be copying every product offered by the largest global institutions. Michel believes they should decide where they can provide distinctive value, then use technology and data to support that position. CSI’s stated aim is to give smaller financial institutions access to customer analytics capabilities that would otherwise require considerable internal investment.

Can AI help banks become useful partners in their customers’ lives without crossing the line from personalization into intrusion? Listen to the conversation and share your thoughts with me.

What happens after an AI agent presents valid credentials and enters your business systems?

In this episode of The Business of Cybersecurity, I speak with Spencer Young, Senior Vice President of International Markets at Delinea, about why authenticating an AI agent is only the beginning of the security challenge.

Spencer has spent 34 years in IT and around half that time in cybersecurity. His experience covers secure software development, vulnerability testing, application protection, data security, and identity security.

Our conversation begins with the changing economics of cybercrime. Spencer says attackers increasingly prefer stealing or compromising legitimate credentials because logging in can be cheaper, faster, and easier than forcing a route through network defenses. He estimates that over three quarters of attacks involve a compromised credential somewhere in the chain.

AI agents add speed and scale to identity risk. They can access applications, databases, financial systems, development tools, and infrastructure while performing dozens of actions during a single session.

The danger is not limited to an agent being denied access. An agent may be fully authenticated and possess valid permissions while taking an action the organization never intended.

Spencer offers the example of a finance agent created to support payment processes. Hidden or manipulated instructions could cause it to change payment profiles and redirect money while appearing to operate as an authorized identity.

This is why Delinea is focusing on runtime authorization. Rather than approving an agent once and allowing every subsequent action, the approach evaluates each proposed tool call, database query, or SSH command before it runs. The action can be allowed, blocked, or referred to a person for approval.

We also discuss how least privilege applies to autonomous systems. Spencer recommends providing credentials only at the moment an agent needs them, limiting access to the specific task, and revoking those privileges immediately afterward. The agent never needs to see or retain the credential.

The research figures Spencer shares reveal a concerning difference between confidence and control. He says 80% to 85% of respondents feel confident in their ability to discover nonhuman identities, while only 30% validate nonhuman identity use and AI activity in real time.

Delinea now works with over 9,000 organizations, including over 60% of the Fortune 100. Spencer says regulated industries frequently demonstrate greater identity security maturity because external requirements encourage continuous controls rather than reactive incident response.

However, technology cannot decide an organization’s risk appetite. People must define what the agent is expected to do, which actions require approval, where it must stop, and who is accountable when something goes wrong.

Could your organization detect a properly authenticated AI agent taking an inappropriate action before that action executes? Listen to the episode and share your thoughts with me.

Suggested URL

Can a security team respond quickly enough when an AI-driven attack moves from initial access to lateral movement and data theft before a human analyst has finished opening their dashboards?

In this episode of The Business of Cybersecurity, I speak with Heath Mullins, Chief Evangelist at ExtraHop and former Forrester analyst, about why AI security has become an operational issue for organizations today.

ExtraHop’s 2026 Global Threat Landscape Report states that 85 percent of organizations have experienced an AI-driven attack. These incidents include AI-enhanced external attacks, compromised AI identities, and breaches involving third-party AI providers. The report also found that 55 percent view AI agents, agentic infrastructure, and GenAI applications as their biggest attack-surface risk.

Heath explains that many attacker tactics remain familiar. The difference is speed. An analyst who once had hours or days to compare endpoint alerts, network logs, threat intelligence, and security events may now find that the attack has completed before the investigation begins.

We also discuss how AI models can be influenced without anybody directly altering their code. Attackers can publish false information that enters future training data or introduce misleading content into internal repositories and development environments. An agent may then infer a connection, assign a high confidence score, and act on inaccurate information.

The risks grow when AI agents receive administrator privileges. Heath describes an agent as an entity capable of taking action across the network. His analogy is difficult to forget: AI can resemble a dangerous toddler carrying the keys to the house, car, and gun safe. It may be extremely helpful, but broad permissions combined with loosely defined instructions create the conditions for serious damage.

Third-party AI adds further dependencies. Security leaders need to understand how suppliers use models and reasoning tools, whether customer data is segregated, what remote access exists, and how a compromised supplier could create a path into the network.

Heath also challenges the assumption that endpoint controls and delayed logs provide enough visibility. Machine-speed attacks may exploit unknown vulnerabilities, evade endpoint detection, and move laterally using identities that appear legitimate. Behavioral and live network signals can reveal activity that does not match a published indicator or known signature.

Buying another security product may address an identified gap, but Heath argues that CISOs also need awareness across physical, virtual, cloud, and container environments. Network and security teams must share information when an identity, agent, or workload begins behaving differently.

His immediate advice is direct. Treat every new tool as potentially dangerous. Test AI agents inside properly isolated environments. Connect every agent to a known identity, restrict its permissions, and define a narrow task. Finally, train people to use AI responsibly and retain human authority over consequential actions.

Heath is also the kind of guest I could talk with over a cold beer for hours about technology and its consequences. After we finished the formal interview, our conversation moved naturally into AI data centers, energy costs, water consumption, surveillance, and humanity’s habit of adopting technology even when we understand the price.

If AI agents can act with administrator privileges at machine speed, are your security controls watching what those agents are doing or merely recording what happened afterward? Listen to the episode and share your thoughts with me.