The Entropy Podcast

What if the biggest problem in security is how we explain its value?

Francis Gorman sits down with David Lynas, co-author of SABSA and founder of COSAC, for his first podcast interview. Drawing on 45 years in security, David challenges the idea that the security professionals job is simply to reduce risk and explains why helping businesses take the right risks matters just as much.

The episode explores the origins of SABSA, why risk assessments too often become paperwork exercises, and how to connect security decisions to outcomes business leaders actually care about. David also shares a striking banking example where the security architect’s recommendation was to remove controls.

From zero trust to AI moving faster than human oversight, this conversation asks what security must become to keep enabling innovation and why every security professional needs a clear answer to “so what?”

Soundbites

• “The biggest risk is not understanding the nature of risk itself.”
• “We cannot possibly succeed without taking risk.”
• “We are not taking enough risk to reach our ambitions.”
• “The process is more important than the result, and that's wrong.”
• “I didn't go into business to achieve confidentiality.”
• “Trust should never mean I don't know.”
• “What our profession does is extremely important and it's getting more important every day.”

Key takeaways

• Security should enable business success. Start with what the organisation wants to achieve, then show how security helps it get there.
• Risk management needs balance. A useful assessment should identify both insufficient protection and insufficient risk-taking to achieve business ambitions.
• Traceability makes security’s value visible. Connect each control to a defined requirement and a measurable outcome.
• Translate technical threats into business consequences. Leaders need to understand what lost availability means for customers, operations, and trust.
• Completing a process is not the same as making a good decision. Risk reports should inform action, rather than simply satisfy a reporting requirement.
• More security is not always better. Controls that obstruct the intended users can undermine the business purpose they are meant to support.
• Resilience deserves greater attention. Focus on maintaining essential outcomes when threats materialise and controls fail.
• Security must evolve alongside AI. David argues that rapid technological change demands adaptable approaches and clearer thinking about what must continue operating when things go wrong.

What would a hacker spot in your business that everyone else has missed?

Glenn Wilkinson has spent his career being paid to break into organisations. In this episode of The Entropy Podcast, he joins Francis Gorman to explain how attackers find their way in, why trusted suppliers can become dangerous weak points, and what leaders should do before ransomware brings business to a halt.

They explore the changing tactics of cyber extortion, why AI is accelerating attacks without replacing human hackers, and the overlooked risks of giving AI agents access to your systems. Could the software you willingly install cause the damage you’re trying to prevent?

Glenn also explains why cybersecurity needs to move beyond the CISO’s desk—and why borrowing a hacker could be one of the smartest moves your board makes.

KEY TAKEAWAYS

• Complexity creates opportunity. Cloud services, suppliers and interconnected systems give attackers more routes into your organisation.

• Focus on what must keep running. Identify your “minimum viable organisation”: the essential operations your business cannot survive without.

• Rehearse the bad day. Test recovery plans under pressure, including how you’ll communicate and make decisions when core systems are unavailable.

• Don’t let AI hype distract from security fundamentals. Excessive permissions, weak passwords and unpatched systems still give attackers opportunities.

• Your internal AI deserves scrutiny. An agent with legitimate access and a misaligned objective can cause harm without being malicious software.

• Make cyber a leadership habit. Share responsibility beyond the CISO and bring an attacker’s perspective into boardroom decisions.

SOUNDBITES

“Hackers love complexity.”

“If the building burns down, you can't do business. If ransomware hits, you can't do business.”

“If you haven't tested it under pressure, it's gonna suck when it happens for real.”

“Resilience over perfection.”

What if the biggest barrier to innovation isn’t your technology, but how your people feel?

In this episode of the Entropy Podcast, Francis Gorman is joined by Dr. Andreas E. Wagner to explore the human side of innovation and why emotional intelligence deserves a central place in how we lead, collaborate and navigate change.

Andreas explains how teams can move from “playing not to lose” towards “playing to win”, why emotional intelligence is a learnable skill, and how leaders can build trust through their everyday behaviour. They explore empathy, digital distraction and the importance of creating an environment where people feel safe to speak up, experiment and learn from mistakes.

From gratitude and mindful breathing to leaving space between meetings, this conversation offers practical ways to become more present, manage emotional reactions and make room for better connections.

If you’re leading people through change or rethinking how your team innovates, this episode starts with a simple challenge: start with yourself.

Key takeaways

• Innovation depends on people. Technology and processes need people who feel able to act, experiment and contribute.
• Think big, start small, then scale. Set a direction, test manageable ideas and use what you learn to decide what grows.
• Emotional intelligence can be developed. Self-awareness, emotional regulation and understanding others take deliberate practice.
• Model the behaviour you want to see. Building a more emotionally intelligent team begins with your own attention, habits and responses.
• Notice your emotional state. Recognising how you feel can help you respond more constructively and understand others.
• Make space to reset. Gratitude, human connection, mindful breathing and gaps between meetings are practices Andreas uses to manage stress.
• Create safety for learning. Invite different perspectives, encourage people to speak openly and distinguish useful experimentation from avoidable mistakes.

Soundbites:

• “You are the company. So that means it is a people thing.” 
• “Start with yourself, walk the talk.” 
• “Emotional intelligence is a learnable skill.” 
• “Sympathy is a blocker for empathy for me, to be straightforward.” 
• “If you're distracted you can't be one hundred percent with someone.” 
• “We as human beings are hardwired to connect.” 
• “Failure and innovation for me these are twins.” 

A familiar voice. A convincing email. A request that catches you at exactly the wrong moment. What happens when the signals we rely on to trust someone can be manufactured?

Cybersecurity expert and author Frank Riccardi joins Francis Gorman on The Entropy Podcast to unpack how AI is changing the hacker’s playbook. From personalized phishing attacks and voice cloning to deepfakes and crypto romance scams, Frank explains why the most effective weapon is often our willingness to trust.

Drawing on his experience managing cybersecurity incidents in healthcare, Frank shares practical ways to protect yourself, your family and your organisation. The conversation also explores the human trafficking behind scam operations, the reality of responding to ransomware, and why companies need to stop blaming people for failures their systems should anticipate.

Key Takeaways

• AI makes phishing personal. Scammers can use information about your life and work to create messages that feel credible and familiar.
• Nobody is immune to a scam. Expertise doesn’t eliminate vulnerability to exhaustion, urgency or emotional pressure.
• A familiar voice isn’t proof of identity. Verify unexpected requests through a separate, trusted channel. A family challenge phrase can add another check.
• Strong security starts with the basics. Unique passwords, multifactor authentication, patching and backups remain central to cyber resilience.
• Romance scams have multiple victims. Frank discusses how people forced into scam operations can themselves be victims of trafficking and abuse.
• Companies share responsibility. Resilient systems should account for predictable human mistakes instead of making employees and customers the default scapegoats.
• Your own skills still matter. Critical thinking and subject knowledge help you question AI outputs and recognise when the technology gets things wrong.

Soundbites:

“It’s not the technology that pwns you, it’s the trickery.”

“Nobody’s unscammable.”

“We’ve got to stop designing systems that allow a catastrophic cyber attack for perfectly predictable human behavior.”

“Cybersecurity is a shared accountability.”

“If the tool leads you, it’s going to lead you down the wrong path.”

What happens when we automate more of our work but lose the ability to connect with each other?

Francis Gorman welcomes storyteller, producer and leadership coach Christopher Nelson to The Entropy Podcast to explore why storytelling matters in an increasingly distracted, AI-driven world.

Drawing on his experience behind the scenes of Dragons’ Den and his work with business leaders, Christopher explains how stories capture attention, build trust and help people work together. He introduces PRISM, his practical storytelling framework, and shares how one banking leader used stories of success and failure to change the way his teams connected and learned.

From the hidden cost of a frictionless digital life to the ingredients of a compelling pitch, this conversation explores what it takes to make people care and why human relationships deserve as much attention as the technology transforming our work.

Key Takeaways:

• Individual productivity doesn’t guarantee effective teamwork. Christopher argues that collaboration depends on the relationships we deliberately build.

• Everyday interactions give us opportunities to practise listening, navigating disagreement and understanding other people. Removing social friction can also remove opportunities to develop those skills.

• Use PRISM to structure a compelling story: a Provocative opener, a Relatable individual, an Inflection or challenge, the Struggle, and a Moral or lesson.

• Make storytelling part of your team’s routine. Sharing specific wins and failures can help colleagues learn from experience and recognise each other’s contributions.

• Give people a reason to care. Relatable characters, meaningful stakes and uncertainty about the outcome help sustain attention.

• Turn complex ideas into concrete stories. A clear example can make an abstract business or technical challenge easier to understand.

• A compelling pitch brings the person behind the product into focus. Christopher’s Dragons’ Den experience shows how aspiration and struggle can make a business story memorable.

SOUNDBITES:

“You can't automate human relationships.”

“Productivity happens not just when you're working, but in the spaces between as well.”

“Before you can tell a story, you must first have their attention.”

“Stories are like a value delivery system, and the value in that particular system is the lesson at the end.”

“Being out in the real world was like going to a social competence gym.”

“I think entrepreneur is just another word for storyteller.”

Explore Christopher’s work at storycharged.com.

Follow The Entropy Podcast for more conversations that challenge assumptions, spark ideas and keep you curious.

What happens when cyber warfare moves beyond screens and takes down the systems people need to survive?

Cyber warfare specialist Chris Kubecka joins Francis Gorman to recount her escape from Kyiv as Russia’s invasion began, while cyber attacks disrupted banks, communications and border systems.

From the vulnerability of nuclear infrastructure to the rise of drone warfare and autonomous weapons, Chris explores how digital attacks collide with physical threats. They discuss AI-generated disinformation, fibre-optic drones, Russia’s hybrid warfare tactics and the risks of trusting military AI without reliable data and human oversight.

The conversation closes with practical lessons in emergency preparedness: cash, paper maps, alternative communications and preparing for the loss of services we take for granted.

A firsthand perspective on cyber security, modern warfare and the human consequences of technological disruption.

SOUNDBYTES

“You want to hear a friendly voice and you're going through hell when you can't.”

“They want to soften up the civilian population by psychologically harassing them with drone incidents.”

“So we're relying on killing people and hoping that the military's Chat GPT has been updated to its newest model.”

“Don't always expect an internet connection. Don't always expect that your GPS is going to work.”

KEY TAKEAWAYS

• Cyber warfare has immediate human consequences. Disrupted banking, communications and identity systems can make escaping a conflict more difficult.

• Nuclear infrastructure threats extend beyond physical damage. Disruption, uncertainty and fear can themselves become instruments of warfare.

• Drone warfare is changing rapidly, from fibre-optic control to autonomous systems and the growing overlap between cyber and physical operations.

• AI-generated disinformation can obscure real military capabilities, making authentic evidence harder to identify and assess.

• Military AI demands reliable data and human oversight. Automated decisions require scrutiny, particularly when lives are at stake.

• Emergency preparedness starts with simple backups. Paper maps, available cash, water supplies, warmth and alternative communications can help when digital services fail.

Link to the article Chris published on substack below:

Basic Preparation Before Flying Death Machines Hunt You Down

https://secevangelism.substack.com/p/preparing-for-drone-warfare-in-europe

Former BBC foreign journalist Melanie Marshall spent more than 20 years reporting from conflict zones and moments of upheaval across six continents. In this episode, she reveals what those experiences taught her about leadership, resilience and making decisions when you don’t have the full picture.

Melanie and Francis explore why uncertainty does not mean powerlessness, how great leaders create space for uncomfortable truths, and why plans must change the moment they meet reality. They also examine AI’s growing influence on human judgment, the dangers of easy answers and why businesses must resist handing over their agency.

From a Ukrainian community that fought back against an invasion to a life-saving decision on a road in Syria, Melanie shares remarkable stories that demonstrate courage, trust and leadership under pressure.

Key Takeaways:

• Uncertainty is not powerlessness it creates both risk and opportunity.
• Effective leaders make decisions with incomplete information.
• A plan must evolve when it comes into contact with reality.
• Leadership means confronting uncomfortable truths before the window for action closes.
• Trust must be built before a team reaches a crisis.
• The quietest person in the room may recognize your greatest risk or opportunity.
• AI should support human judgment, not replace curiosity, accountability or agency.
• Resilience often begins with identifying the resources already available to you.
• Human connection remains one of our strongest defenses against fear and division.
• Courage is often as simple as taking the next step together.

Soundbites:

“Uncertainty is not powerlessness.”

“The plan survives usually until you leave the door.”

“You’re deciding with the map actively on fire.”

“Bravery is simply one foot in front of the other.”

“Leadership is doing the uncomfortable thing.”

“We need a little grit to make the pearl.”

“Go out into the world and talk to a real person.”

“If the world feels scary, ask yourself: What is the opportunity here, and what resources do I have available?”

Listen now for a compelling conversation about leading through uncertainty, decision-making under pressure, resilience, AI, human connection and the courage to move forward without all the answers.

If you haven’t done so already check out part 1.

Apple podcast: https://podcasts.apple.com/ie/podcast/the-entropy-podcast/id1795927497?i=1000788046671

Spotify: https://open.spotify.com/episode/2EiCIRM6HhicJco4c8ZQSm?si=_MfmoPrzTXe6TiRIgUU-XQ&utm_source=copy-link

In Part 2 of Francis Gorman’s conversation with technologist and entrepreneur Paul Walsh, the discussion moves from online identity into a much broader question: what happens to privacy when AI becomes embedded in the tools we use every day?

Paul argues that the risks are no longer confined to social media platforms. As AI assistants gain access to messaging, email, devices and personal data, he raises concerns about what that means for end-to-end encryption, confidential conversations and the expectation that private communication remains private.

From there, the conversation widens into anonymity, censorship, AI-driven decision-making and the increasingly blurred relationship between governments, regulators and major technology companies.

For Paul, the danger isn’t necessarily one dramatic moment where privacy disappears. It is the gradual accumulation of systems built for convenience, safety or security that ultimately create much greater capabilities for surveillance and control.

Key Takeaways

• End-to-end encryption is only as strong as its endpoints. Paul argues that giving an AI assistant access to messages before encryption or after decryption can undermine the practical privacy users expect from encrypted communication.
• Convenience comes with a privacy trade-off. AI tools can make it easier to search conversations, schedule actions and retrieve information but those capabilities may require extensive access to sensitive personal data.
• Privacy doesn’t require justification. One of Paul’s central arguments is that people should not have to prove why they deserve privacy or anonymity.
• Identity verification changes the consequences of being banned online. Paul warns that if every account becomes permanently linked to a government identity, losing access to a platform could become far more consequential.
• The chilling effect may matter as much as censorship itself. If people believe their identity is permanently attached to everything they say, Paul argues they may begin censoring themselves before anyone else has to.

Soundbites

“If somebody can read the message before you send it and before it’s encrypted, or after somebody sends you a message and after it’s decrypted, then you defeat the purpose.”

“People make a decision and think it was their own idea.”

“We have people lobbying for child safety, not realizing that they’re actually begging the government to surveil them.”

“Convenience and security have always been at odds.”

Part 2 leaves listeners with a difficult question: how much privacy are we willing to exchange for convenience, safety and access to increasingly powerful technology?

Paul’s message isn’t to abandon AI or digital platforms. It is to understand the systems being built around us, question who benefits from them, and protect the ability to communicate, participate and speak without unnecessary surveillance.

Because, as Paul puts it:

“I don’t have to explain to you why I want privacy.”

In Part 1 of this two-part conversation, Francis Gorman sits down with technologist and entrepreneur Paul Walsh to explore a question that has followed the internet for nearly three decades: how do we know what and who to trust online?

Paul traces the problem back to the early web and his work on content classification and verification standards, explaining why today’s challenges aren’t necessarily new they’ve simply been amplified by AI, deepfakes, phishing and increasingly sophisticated social engineering.

The conversation then turns to the growing push for online age verification and social media restrictions. Paul draws a sharp distinction between content moderation and access control, arguing that modern devices already give parents powerful tools to manage what children can access.

But his bigger concern is what comes next: when “robust age verification” evolves into mandatory identity verification for entire populations.

Key Takeaways

• The trust problem hasn’t changed it has scaled. Social engineering and impersonation remain at the heart of much cybercrime; AI simply makes them faster, cheaper and harder to detect.
• Verification is as much about psychology as technology. A badge or trust signal only works if people understand what it actually represents.
• Deepfakes raise the stakes. In a world where people can no longer automatically trust what they see or hear, reliable provenance and account verification become increasingly important.
• Content moderation and access control are different problems. Paul argues that platforms should improve moderation, while parents already have increasingly sophisticated device-level controls available to manage children’s access.
• Age verification can become identity verification. Paul warns that demands for “robust” age checking could ultimately require users to prove their real-world identity simply to participate online.
• Privacy can be lost incrementally. Measures introduced for legitimate goals such as child safety can expand in scope and create infrastructure capable of much broader surveillance.

Soundbites

“Society doesn’t know where to look to find trust.”

“Technology is just an enabler.”

“I don’t think any tech company is doing enough to reduce the risk of their technology being used for harm.”

“Content moderation is different to access control.”

“The governments are saying they’re giving back control, but actually they’re taking away their ability to just be a parent.”

Part 1 ends with a fundamental tension: how do we make the internet safer without building systems that require everyone to surrender their identity and privacy in order to participate?

AI is moving beyond automation and into autonomy and that shift could fundamentally change how businesses operate, how decisions are made and how people work.

In this episode of The Entropy Podcast, Francis Gorman sits down with Ismail Amla to explore the rise of agentic AI, digital workers and AI-native organisations. They discuss why the biggest opportunity is not simply using AI to make existing processes faster, but redesigning businesses around what intelligent systems can now do.

They also examine the harder questions: what happens when AI agents begin making decisions independently, who is accountable when those decisions go wrong, how organisations can avoid agentic drift, and whether relying too heavily on AI risks weakening human judgement and curiosity.

Key takeaways: 

• Why AI is shifting from automation to autonomy
• How AI agents could become part of the workforce 
• Why most AI transformation efforts fall short
• What leaders need to rethink, and why governance and human judgement matter more as systems become increasingly autonomous.

Soundbites: 

“I think it is a revolution. I don’t think it’s just another tool.”

“Whoever this technology is working on behalf of is responsible for every decision that’s made.”