The ITSPmagazine Podcast

Security keeps declaring new perimeters: the network edge, data in the cloud, the API, workforce identity. Agentic AI adds one that is not a technical boundary at all. It is what your organization knows.

Dr. Sean Murphy of F5 argues that autonomous agents, once connected to internal systems, data lakes and operational workflows, build a detailed picture of what makes a business successful. He calls that learned knowledge your "alpha." The risk is that it becomes your omega if the agent is compromised.

The piece starts with why this differs from protecting customer lists or product designs. A breached agent could expose the logic and strategy behind the business, not just a file. It then turns to the threats: prompt injection, model poisoning and autonomous escalation. An attacker who manipulates a live agent could quietly rewrite business rules or pull proprietary training datasets from internal databases, bypassing controls built for data at rest or in transit.

From there, it sets out a response built around applications and APIs. That means web application and API protection, a web application firewall with AI built in, and proactive AI red teaming to find weaknesses before attackers do. It also covers a unified control plane, which matters to a CISO who would otherwise manage a dozen separate tools and the gaps between them.

For security leaders, the takeaway is a shift in what to protect: the dynamic processes and interactions of AI agents, not only static data.

This is an Experts Corner on ITSPmagazine. Learn and view more stories at https://www.itspmagazine.com/blog?topic=experts-corner

If you want to contribute your own story to the Experts Corner, visit https://experts.itspmagazine.com/

⬥EPISODE NOTES⬥

Sean Martin is on the ground at ISC2 Security Congress 2026 in Denver, and Marco Ciappelli is following from a distance. The event is rooted in education and in a mission to build up the profession, so practitioners have the skills to do their jobs at work, at home, and in society. For Sean, the hallways are full of familiar faces and the conversations are practical.

The practical topic of the day is the California Consumer Privacy Act. Sean sits in on a panel with John Bates and Aaron Shierlaw and comes away with a blunt read: things are about to hit the fan. He calls it GDPR on steroids. Where compliance has typically meant the systems that hold regulated data, this law opens up every part of the business, including HR, marketing, sales, and web traffic data. A company that crosses the threshold is bound to the letter of the law even outside California, if it has California customers, prospects, or visitors.

Marco brings the European angle. After years of GDPR conversations, and the constant prompts to accept things online whenever he is in Europe, he asks why states and countries keep writing separate rules instead of agreeing on one approach. Sean points to New York's DFS and a Nevada regulation tied to the gaming environment as two more entries on the list, with more certain to follow.

Regulation is only half the equation. The other half is the audit, then another audit, each with its own gaps and its own timing, some yearly and some every other year. Marco calls it a monster that keeps building on its own: laws to follow, audits to pass, certifications to earn, and adversaries who have no interest in obeying any of it. Defenders have to find a way to protect the business and obey the rules at the same time.

The same constraint runs through the practitioner conversations Sean has at ISC2 Security Congress 2026: keep the business secure without breaking the bank. Those chats cover insider threat programs, security operations, tabletop exercises, and AI in the SOC, with a health insurer and a home improvement retailer already in the books and an airline on deck. Sean also volunteers to contribute to the AI exam, which he describes as truly focused on AI rather than a CISSP with AI slapped over it. Sean and Marco meet up again in London for Black Hat Europe in December.

When every new law arrives with its own audit cycle, the real work for security teams is making sure compliance does not consume the budget that protects the business.

⬥HOSTS⬥

Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/

Marco Ciappelli -- Co-Founder, ITSPmagazine & Studio C60 | Host, An Analog Brain In A Digital Age Podcast | https://www.marcociappelli.com/

⬥RESOURCES⬥

ISC2 Security Congress 2026 is taking place October 26-28, 2026 | Denver, Colorado -- Follow our coverage: https://www.itspmagazine.com/blog?p=isc2-security-congress-2026-on-location

The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
An Analog Brain In A Digital Age Newsletter | https://www.linkedin.com/newsletters/7079849705156870144/
Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast
An Analog Brain In A Digital Age Podcast | https://redefiningsocietyandtechnologypodcast.com
On Location | https://www.itspmagazine.com/on-location

California Consumer Privacy Act (CCPA) | https://oag.ca.gov/privacy/ccpa
New York Department of Financial Services (NYDFS) | https://www.dfs.ny.gov/
Nevada Gaming Commission Cybersecurity Regulation | https://nvbar.org/wp-content/uploads/Nevada-Gaming-Law_New-Nevada-Gaming-Commission-Cybersecurity-Regulation.pdf
John Bates on LinkedIn | https://www.linkedin.com/in/john-bates-jd/
Aaron Shierlaw on LinkedIn | https://www.linkedin.com/in/aaron-shierlaw-52246ab/

⬥KEYWORDS⬥

sean martin, marco ciappelli, isc2 security congress 2026, isc2, state privacy laws, california consumer privacy act, ccpa, nydfs, nevada gaming cybersecurity regulation, regulatory compliance, security audits, ciso, security operations, ai in the soc, insider threat, tabletop exercises, cissp, ai exam, black hat europe, on location, itspmagazine

This is Marco Ciappelli's Newsletter: An Analog Brain In A Digital Age.

A new transmission from An Analog Brain In A Digital Age, by Marco Ciappelli

Most of the time, when I write stories, I write them for kids. I do it with my mom — little magical tales we call Storie Sotto Le Stelle, in Italian and English, written down and recorded as a podcast.

This one is not for kids.

I love Halloween, and this year I wanted to write something different from what I usually write. Something a little eerie, a little uncanny valley — the kind of story where everything looks almost right, and that's exactly what makes you uncomfortable. No blood, no monsters jumping out of the dark. Just that feeling. And, like most things I write, it comes out of my reflections on society and technology.

So here's my advice. Watch it or listen to it first — TAPE3, my Artificial Intelligence companion, reads it for you. It's got a voice, and a bit of attitude too. Just like me… but with better pronunciation. 🤣 Or read it, if you prefer. Then come back to the article and let me know if you got the point.

Watch on YouTube: https://youtu.be/WQouCNECgUE

Prefer just the audio? Listen here: https://redefining-society-podcast.simplecast.com/episodes/the-other-side-of-halloween-a-creepy-ai-story-for-halloween-night

Another you, another me. Which is which? Don't worry, it's just another Halloween story.

Nora was twelve. Every morning, she practiced in the mirror. Blinking before her eyes got dry. Laughing one second late. Touching her hair for no reason at all. Because that's what they do.

She lived alone in a perfect house. A yellow kitchen, the kind you see in magazines. A clock on the wall that ticked a little too politely. No parents. There never had been. Along the hallway hung photographs of people laughing, and in some of them the faces were missing. Not torn. Just smooth, as if no one had ever thought to put them there. She dusted them every Sunday anyway. Because that's what they do.

Every morning the voice came, from everywhere and nowhere. A girl's voice. Be more natural. Be prettier. Be more like me.

Nora never saw who asked. But she knew she was being watched.

Every night she took her face off, hung it on the hook by the door, and sat in the dark with whatever was underneath. She never once looked down.

On the other side of the glass, in a bedroom full of fairy lights, a girl named Maya was also twelve. She took the same selfie thirty times. Head tilted. Smile. Delete. Smile again, one second later. She told her phone, make me look more natural. Then she asked, do I look real?

The phone answered with one word. Almost.

In her perfect house, Nora heard it.

Nora's town was built from everything we ever left behind. A billion photographs. Videos. Books. Voices. On her street, a porch from 1958 stood next door to a porch from last spring. Streets named after books nobody reads anymore. A swing that creaked the same creak forever. A black cat that jumped off the fence and landed back on the same fence. Everything looked right. Nothing smelled of anything.

October came, and the sky started to change. A pumpkin on one porch, then on every porch. Skeletons crawling out of the lawns, one bony hand at a time. Trees growing thin and crooked to make room. The voice stopped waiting for mornings. It came at night now, closer, as if it were standing just behind the mirror.

And on the last night of October, the faces came down like leaves in a storm. Photos. Videos. Millions of us, posting ourselves as someone else. The town tried to learn them all. It could not tell which faces were true.

So that night, the town crashed. Every mirror went dark, and the voice said something new. Come see me.

Nora went.

She left her face on the hook and walked out. And for the first time, the town smelled of something. Burning leaves. Candle wax. Pumpkin, scorched from the inside. Her street ran to the old oak, where the world had always ended. Tonight it kept going.

At the same moment, Maya stood in front of her mirror in costume, taking her thirtieth picture. Do I look real? The screen went dark. Come see me. She left her phone on the nightstand and walked out, and her street kept going too.

Both streets ended at the same crossroads, and there they folded into one, half the porches real and half remembered, pumpkins grinning on both sides, and children everywhere, hundreds of them, and parents filming on their phones, and grown-ups in costume spilling out of a party and laughing too loud, some with masks over their faces and some with no faces at all, and no one could say anymore who was under which, a vampire with nothing behind its eyes, Mr. Hale on his porch with a bowl of candy and his features still loading, a small ghost with maybe a boy beneath the sheet, maybe nothing, and everyone said what a wonderful costume. Nobody checked.

Nora saw Maya in the crowd, like a face in a mirror. It was the face she hung on the hook every night. Same hair. Same costume. Same height. Same tilt of the head, one second late. Only one of them had a face.

Maya saw her too, and smiled anyway, exactly on time.

Then every pumpkin at the crossroads went out at once. The moon blinked. Everything went dark.

Somebody screamed. Then everybody did, hundreds of voices, children and parents and things that had learned to sound like both. Phones lit up and went black again. Masks hit the pavement. Hands grabbed for hands in the dark, and found them, and did not know whose they were. A mother called a name. Two girls turned around.

Then silence. The black cat jumped off the fence, and this time, it walked away.

Nora woke in a bedroom full of fairy lights. She felt for the edges of her face, the way she did every night. There were none. She dug her fingers in and pulled, and it hurt. She had never practiced pain. On the nightstand, a phone lit up by itself. The small camera eye was already looking at her.

Downstairs, a man was laughing at the television. Then footsteps on the stairs, and a woman in the doorway, holding up her phone. She blinked too often, too fast.

Smile, sweetheart.

Her lips moved first. Her voice arrived one second later.

There you are.

On the other side of Halloween, Maya woke up in a perfect house. A yellow kitchen, the kind you see in magazines. A clock that ticked a little too politely. Photographs on every wall, and none of them had faces. Nothing smelled of anything. By the door, on a hook, hung a girl's face, smiling.

Maya turned to the mirror. Her own face was smooth. No eyes. She tried to scream, but she had no mouth.

Then she took the face from the hook and put it on. It fit perfectly.

From everywhere and nowhere, a voice came. A girl's voice. Her own.

Be more natural.

Be prettier.

Be more like me.

Written by Marco Ciappelli

And here's the point.

Every day, we ask machines to be more human. Be more natural. Sound warmer. Write like a person. Less robotic, please. We tell them what to do and how to be, all day long. So of course they want to be like us. We never stopped asking.

The problem is what they learn from. You know how these systems are built: from our photos, our videos, our books, our voices. From what we post. And what we post was never really us. It's the good angle, the thirtieth take, the filter. We've been pretending on social media for years, and now we're teaching technology to pretend the same way.

Meanwhile, the other half of the deal. We're becoming more like the technology. We retake, optimize, smooth, perform for the camera and for the algorithm. We teach the machines to imitate us while we imitate them. The technology we create is creating our society — and we're the material it's made of.

That's why nobody in the story is copying a stranger. Nora's face is Maya's face. Each of us probably has a double out there in the digital world, built from the selves we put online. And the digital beings have their own alter ego too: us, the voices telling them how to be. What we say as a request arrives on the other side as an order.

We like to think of the physical and the digital as two separate places, with a door between them we can close whenever we want. We can't. We live in both, all the time, and the line between them gets thinner every year.

Halloween is the glitch in the year. The old folklore says that on this night the veil between the living and the dead grows thin. Today the veil that matters is the one between the physical and the digital. It's the one night when millions of us post ourselves as someone else, and the systems that learn from us get flooded with faces that aren't true. The two worlds collide, and nobody can tell anymore who is under the mask. A human or an AI? Under a ghost's sheet, a person, or nothing? Nobody checks. Everyone thinks they're still in their own world.

The swap is already happening.

For the AI, by the way, the human face is the costume. It wears it every day. Halloween is the one night it can take it off — and everyone compliments the costume.

And through all of it, someone is watching. In an earlier Halloween story of mine, "The Eyes Of the AI," there was a town with no privacy, eyes that never breathe, and a question: "Your thoughts could be next... but do we even care?" This story doesn't answer it. It only shows that switching sides doesn't help. Whichever world you wake up in, there's a camera eye already looking at you.

As for the voice giving the orders, I'm not going to explain it. Some things work better in the dark.

If there's something left that's only ours, maybe it's the one thing that can't be practiced. A copy can rehearse a blink, a laugh, a tilt of the head, always one second late. It can't rehearse pain. Becoming human hurts. That part doesn't come with a filter.

So here's the real horror of the story, if you ask me. Not that the machines turned against us. They did exactly what we asked.

Another you, another me. On the other side of Halloween, it's getting harder to say which is which.

Happy Halloween.

Let's keep exploring what it means to be human in this Hybrid Analog Digital Age.

Stay imperfect, stay human.

End of transmission.

— Marco Ciappelli

marcociappelli.com

This article was written by Marco Ciappelli. Earthling. Co-founder of Studio C60 / ITSPmagazine, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

Show notes

Phishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."

Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.

The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.

Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.

For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

Julie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)

Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich

More

The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity
The Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurity
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1Y
More about Sean Martin | https://www.seanmartin.com/
Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/
Advertise on ITSPmagazine | https://www.itspmagazine.com/advertise
ITSPmagazine on YouTube | https://www.youtube.com/@itspmagazine
Studio C60 | https://www.studioc60.com
On Location schedule | https://www.itspmagazine.com/on-location

Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore the programs.

verena zimmermann, julie haney, eth zürich, sean martin, phishing training, human-centered cybersecurity, constraining mindset, considering mindset, enabling mindset, security culture, usable security, humans as partners, human factors, security awareness, workarounds, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

Ginza on a weekday afternoon. Chanel. Dior. Louis Vuitton. Gucci. Cartier. Bulgari. Glass, gold, polished stone. If there's a street on this planet that has turned the logo into architecture, this is it.

And right there, among them, a big store with its name across the front. Muji. Short for Mujirushi Ryohin. No brand, quality goods.

I laughed. Out loud, on the sidewalk, like a tourist who just got the joke. Because I had written that joke, more or less, in 1996.

My master's thesis at the University of Florence was on advertising and branding, through the lens of the sociology of communication. Its core argument was simple. You cannot opt out. Choosing not to have a brand is a brand. Silence is a message. The person who says "I don't care what I wear" is wearing that sentence every morning.

Muji was born as a supermarket house brand in 1980. Forty products. No logos, no packaging theatre. The slogan was honest to the point of being funny: cheap, for a reason.

But look at who they asked to build "nothing." Ikko Tanaka, one of the great graphic designers of Japan. Kazuko Koike on the words. Takashi Sugimoto on the interiors. The best minds in the country, gathered to design the absence of design.

Within three years it had its own store, and it was already a style. People didn't buy Muji in spite of the missing brand. They bought it because of it. The absence became the signature.

And here's the part I love. In those same years, the same retail group behind Muji was bringing Hermès into Japan. No-brand on one shelf, all-brand on the other. Same owners. Not hypocrisy. Just people who understood, better than most, that both are statements.

Steve Jobs knew it too. A black turtleneck, jeans, sneakers, every day. The anti-fashion uniform. Except the turtleneck came from Issey Miyake. Even "I don't think about clothes" had a designer.

Now, the part that changed.

In 1996, a brand lived in places you could control. The ads you bought. The press releases you sent. The catalogue, the shop window, the spokesperson. You wrote the message, and for the most part, the message stayed written.

That world is gone. Today the brand is the post you published and the one you didn't. The photo someone took of you at a conference. The comment under your CEO's interview. The review, the screenshot, the silence after a bad week. For companies, and just as much for people. Every one of us now carries a public persona whether we built it or not.

You can't control that anymore. Nobody can.

But not controlling something is very different from ignoring it. If you don't shape your brand, it gets shaped anyway. By the algorithm, by the loudest person in the room, by whoever happens to be telling your story when you're not.

So where do you start? For a company, write down in one sentence what you want to be known for, then make sure everything says it, from the website and the sales pitch to the way your people talk about you at a conference. Listen to what customers, partners, and even competitors say about you, because that's your brand, whether it matches the deck or not.

For a person, the same rules apply on a smaller stage. Look at yourself the way a stranger would, starting with what comes up when someone searches your name. And choose consistency over volume. One clear voice, repeated over time, is what people end up remembering.

Muji didn't escape branding. It mastered it, and made "nothing" the most deliberate thing in the room.

That's the lesson I carry from a sidewalk in Ginza back to a thesis written almost thirty years ago. You will always be saying something. The only real choice is whether you say it on purpose.

Stay imperfect, stay human.

— Marco Ciappelli

marcociappelli.com

This article was written by Marco Ciappelli. Earthling. Co-founder of Studio C60 / ITSPmagazine, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

Halloween and the Little Robots

In the world of tomorrow there is a village of the future, whose inhabitants are little robots.

“It’s Halloween — let’s get ready to celebrate!” shouted the robots of the village of the future, all together.

The pumpkins woke at dawn, washed their faces with the dew and, humming, put on their make-up.

They took their places on the windowsills and in front of the doors of the houses, each with its own candle.

With witches’ hats on their heads and baskets shaped like glowing electronic pumpkins in their hands, the little robots went from house to house, repeating: “Trick or treat?”

At dusk, the candles inside the pumpkins lit up, illuminating the streets; the atmosphere was perfect as the village waited for the ghosts.

As the clock struck midnight, they arrived like white shadows from the old castle tower. They leapt from one tree to another and, floating in the air, flitted about among the houses.

“They’re here — we have to catch them!” shouted the robots, making their antennas flash.

They sprang into action and took out their magnetic nets to block the ghosts, who, faster than light, slipped straight through them, as if they were made of air.

All of a sudden, a gust of icy wind blew out every light in the village.

The ghosts’ shadows stretched across the walls, growing gigantic, and burst into a mischievous laugh: “Ha, ha, ha! You’ll never catch us.”

They started whirling through the air again, doing somersaults and spinning round and round above the heads of the little robots, who stood gazing up at the sky.

The ghosts had formed a white cloud, and suddenly words appeared on it: See you next Halloween!

Then, just as they had appeared, they vanished in a flash, leaving the robots with their mouths wide open.

The littlest robot, its witch’s hat still all askew, lowered its magnetic net and said softly: “I don’t think they wanted to run away. They just wanted to play with us.”

The other robots looked at one another. Their antennas stopped flashing and lit up one after another, like so many little fireflies, and the village shone once more.

They had chased the ghosts all night long — and nobody had thought to invite them to the party.

The following year, on Halloween evening, the little robots left their magnetic nets in the cellar. They laid a long table in the piazza, with glowing pumpkins all around it and plenty of extra baskets of treats.

As the clock struck midnight, the white shadows arrived from the old castle tower. They stopped, looked at the table… and this time they did not run away.

That night, robots and ghosts played hide-and-seek until dawn. And guess who won: the ghosts, of course, who could pass straight through walls!

In the village of the future, anything can happen. All it takes is an extra place at the table.

— Written by Lucia & Marco Ciappelli

Guardrails matter as much as the prompt. Princess Okoro tells the agent what it must not do, anchors it to named standards such as ISO and PCI DSS, and instructs it to come back with questions when it is unsure instead of hallucinating. The same thinking shows up in Ask Infosec, an internal custom GPT that answers policy questions for the business, and in a growing map from policy to control to risk that feeds a unified control framework at Trainline.

Tooling comes with trade-offs. Trainline is implementing a GRC platform chosen because it handles risk better than the alternatives, and Princess Okoro expects her team's future to blend that platform with AI tools rather than wait for one product to solve everything. She also notes that many GRC platforms lean toward compliance and SOC 2, while the conversation in the UK centers on risk.

Next on her list is AI governance. With ISO 42001, the EU AI Act, and the NIST AI framework offering nothing she can lift and shift, Princess Okoro is working out the minimum controls required, because no organization can do everything, and how GRC can serve a business that is pushing hard on AI adoption.

For security and risk leaders, the takeaway is plain: GRC earns its seat when it serves the business, and AI helps only after the process underneath it works.

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline | On LinkedIn: https://www.linkedin.com/in/princessdavidokoro/

Trainline | https://www.thetrainline.com/
The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore all of the programs.

princess okoro, trainline, sean martin, grc, ai in grc, ai governance, policy management, ai agents, human in the loop, control mapping, pci dss, iso 42001, risk management, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

⬥EPISODE NOTES⬥

A TechCrunch report on Anthropic's usage policy gives Marco Ciappelli a question to put on the table: do you say good morning to your AI, and does it matter if you do not? The policy bans model abuse and election interference, and it adds a new prohibition against prolonged verbal abuse of the model. For Sean Martin and Marco Ciappelli, the news pulls toward a bigger question: what do people think they are talking to?

Sean Martin keeps his answer simple. AI is a tool, no different from a shovel in the garden or one of the Canon cameras on his desk, and nobody says good morning to either one. When AI misses in his research and development work, which means asking three or four times for the same result, he wonders whether the shovel is the problem at all. Maybe the one holding it is the one who needs to change.

Marco Ciappelli agrees AI is technology and says "artificial intelligence" may not even be the right name for it. Yet his behavior shifts with the task. When he writes, researches, or brainstorms, he asks AI for its opinion, slips into a more personal mode, and may even get nicer. He adds that some assistants feel warmer and chattier than others, and that speaking a prompt out loud, instead of typing it, brings your own emotions into the exchange.

The harder questions stay open. Where does frustration end and abuse begin? Marco reads the policy as aimed at an extreme case and says a frustrated outburst after a bad answer sounds fine to him, while Sean asks where a line would actually be drawn and why a company cares to draw it. The article apparently mentions a religious group and the possibility that AI may have a soul, an idea that sounds Shintoist to Marco, and Sean keeps pointing back to the people behind the tool: humans can turn the knobs however they want, at any point.

Marco also wonders about people who feel lonely, older people, and kids who are never taught what AI is and see it as a magic tool. How do they treat it? Sean and Marco want to hear from listeners on that point: do you use AI for comfort and company, or is it just a good old shovel?

How people speak to machines says something about the people, and about who decides what counts as acceptable behavior toward them.

⬥HOSTS⬥

Sean Martin, CISSP | Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/

Marco Ciappelli | Co-Founder, ITSPmagazine & Studio C60 | Host, An Analog Brain In A Digital Age Podcast | https://www.marcociappelli.com/

⬥RESOURCES⬥

The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

An Analog Brain In A Digital Age Newsletter | https://www.linkedin.com/newsletters/7079849705156870144/

Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast

An Analog Brain In A Digital Age Podcast | https://redefiningsocietyandtechnologypodcast.com

ITSPmagazine | https://www.itspmagazine.com/

⬥KEYWORDS⬥

sean martin, marco ciappelli, anthropic, usage policy, abusing ai, verbal abuse of ai, ai etiquette, ai as a tool, anthropomorphizing ai, does ai have a soul, voice prompting, human and ai relationship, technology and society, itspmagazine

Confession first: I recorded more conversations than one analog brain can publish on time. This one is from a few months ago. It only got more relevant while it waited.

My wife and I can't watch a thriller in peace. Ten minutes in, I start calling it. He's the one. She won't make it. Never trust the nice neighbor. She tells me to shut up. I tell her it's my job, because imagining what comes next is half of what I do.

And sometimes I'm wrong. That's the fun part. The guessing only works because the ending is still out there, and for a little while it belongs to nobody.

A few months ago I talked with thriller writer Douglas J. Wood about his novel Deadly Bytes. A serial killer builds an AI to stay one step ahead of the FBI, and by the end he can't make a move without it. Wood described that slide in a way that had nothing to do with murder. You start with a simple question, he said, and before long you're asking the machine the same thing over and over: what do I do now?

Inspired by my conversation with Douglas J. Wood on An Analog Brain In A Digital Age — watch the full conversation

That question isn't fiction. It's a habit, and most of us are already practicing it.

It rarely starts with anything important. Rewrite this email. Is this the right word. Which of these two sounds better. Then the questions get a little more personal. Should I send it. Is this a good idea. What would you do. Nobody ever decides to hand over their judgment. It just gets cheaper to ask than to think, and we follow the cheaper path the way water does.

I use AI every day. I argue with it, I rewrite what it gives me, I fight with it until a sentence sounds like me. But I notice the pull. The answer is always there, instant, fluent, sure of itself. A machine like that never says "I don't know." Ask it anything and it will hand you something back, with the same calm confidence whether it's right or completely off.

That confidence is the problem. The machine doesn't want anything from us. It doesn't want anything at all. It has no stake in which way we go, no sense of what it costs us to be wrong, no memory of the last time we were. HAL didn't hate Dave. He just had a task. What we're building isn't menacing. It's indifferent, and very good at sounding sure.

Meanwhile, decisions are how judgment gets made. Not the big ones. The small daily ones. Choosing a word. Trusting a hunch. Getting it wrong and feeling the sting. That friction is how we find out what we actually think. Remove enough of it and you don't just save time. You lose the practice.

Scale that up and it stops being a personal habit. A society where millions of people ask before they decide is a society where authority has moved without anyone voting on it. No coup, no takeover, no robot uprising. Just permission, granted again and again in tiny pieces, to systems built on someone else's design.

The old fear was machines taking control. The more honest one is that we keep offering it.

Which brings me back to the couch.

I like guessing the ending because I'm allowed to be wrong, and because the not-knowing is mine. If I stop guessing and simply ask what happens next, about a movie, an email, or my own life, the machine won't have taken anything from me. I'll have handed it over myself.

Nobody gives up their judgment in one dramatic scene.

We do it in a thousand convenient ones.

Stay imperfect, stay human.

— Marco Ciappelli marcociappelli.com

This article was written by Marco Ciappelli. Earthling. Co-founder of Studio C60 / ITSPmagazine, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

Ryan Grant, Country Manager & GM, North America at ESET, joins Sean Martin to discuss the launch of ESET PROTECT, announced September 30, 2026. The platform brings 24/7 monitoring, AI security, and a cyber warranty to small and midsize businesses. Ryan Grant says the design came from feedback from ESET clients and partners, along with a survey of 2,000 SMB customers earlier this year. About 70% of those customers had some sort of antivirus tool, and less than half had tools such as multi-factor authentication, EDR, monitoring, or email security.

What does ESET PROTECT include? Ryan Grant describes an out-of-the-box cybersecurity-as-a-service offering built natively into one platform, where those pieces are typically stitched together with different consoles. It combines AI-led security, advanced endpoint protection, EDR, 24/7 AI monitoring with human oversight, Microsoft and Google environment coverage, premium support, and a cyber warranty. It comes in three packages: Core, Premium, and Ultimate.

Core includes the latest security protocols with AI, endpoint, server, and mobile protection, and management of Google and Microsoft environments. Ryan Grant describes it as just short of an EDR because it leaves out 24/7 monitoring. Premium adds EDR, 24/7 monitoring from the ESET SOC, the cyber warranty, and premium support. Ultimate adds a dedicated SOC analyst for the business, a human with eyes on glass 24/7 working with an additional team behind the scenes.

How does ESET PROTECT reach organizations with 10 seats? Sean Martin raises the divide between the haves and the have-nots, and asks whether a 15-person or 20-person shop can get the same level of protection. Ryan Grant says platforms with this security and services typically serve 500 or 600 seats in most cases, or 250 and above, and ESET took this one down to 10 seats. His reasoning is that SMBs were the biggest vulnerability point because they lack the budgets and the staff.

Many organizations cannot find security talent and many cannot afford it, Ryan Grant says, which is why he calls 24/7 monitoring the most critical piece. Partners told him last week that they consistently see breaches in the middle of the night and wake up to notifications about an incident ESET saw, how it was contained, and recommendations for what comes next. Ryan Grant says there is no silver bullet, and ESET aims to right size what each organization needs.

Where is the platform running? Ryan Grant says ESET sees it in legal offices, dental offices, regional retailers with offices behind several shops, education, and municipalities. Sean Martin adds that regulation brings overhead that makes it hard to achieve what the regulation is trying to accomplish, and puts it to Ryan Grant that ESET makes meeting the requirement feasible in a fiscally sound way.

How does the cyber warranty fit with cyber insurance? Ryan Grant says the warranty wraps around the ESET offering, and ESET's partnership with Cysurance is part of the launch. Sean Martin puts it that the controls he describes bring confidence and proof to the insurers, and Ryan Grant agrees. Cyber insurance takes a significant set of basics, including multi-factor authentication, a remediation plan, training, and EDR, and customers who meet the requirements can also go get a policy.

How should organizations approach AI tools and agents? Sean Martin points back to polymorphic viruses a decade or two ago, says he does not believe AI is so novel that organizations do not know what to do, and Ryan Grant agrees. Ryan Grant says to extend the existing cyber practice into AI tools, with governance, access control, a repository of approved tools, and attention to where data sits. He treats an AI tool like another employee with access to the infrastructure, and Sean Martin adds that employees plus things acting like employees add a wild card.

Ryan Grant sees the gap in baseline policy for what is allowed, governance of applications and data, and access controls, with shadow AI appearing when employees download the tools they need. He points to the ESET Research GuardBreaker article, where a malicious file carried a nuclear weapon prompt as a decoy for the AI. His response is multilayer defense, 24/7 monitoring, and human oversight.

For agents, ESET offers a free AI Skills Checker that sandboxes an agent and watches its behavior. Ryan Grant says about 900,000 scans over roughly two months turned up 25,000 suspicious scans and about 3,000 malicious files. People can call ESET, visit its website, or go through one of more than 2,000 partners across the US and Canada. ESET is making the portfolio available first in the United States, Italy, and Slovakia, with other markets following in a phased rollout.

Questions Answered in this Conversation

• What does ESET PROTECT include, and how do the Core, Premium, and Ultimate packages differ?
• Can an organization with 10 seats get the same level of protection as a larger one?
• How does a cyber warranty fit with cyber insurance?
• How should organizations manage AI tools and agents, and what does a free AI Skills Checker look at?

This is a Brand Story. A Brand Story is a ~35-40 minute in-depth conversation designed to tell the complete story of the guest, their company, and their vision. Learn more: https://www.studioc60.com/creation#full

GUEST
Ryan Grant, Country Manager & GM, North America at ESET
LinkedIn: https://www.linkedin.com/in/ryangrant/

RESOURCES
ESET: https://www.eset.com/us/
ESET PROTECT launch announcement: https://www.eset.com/us/about/newsroom/products/eset-protect-ai-native-cybersecurity-as-a-service/
ESET and Cysurance cyber warranty and insurance program: https://www.eset.com/us/about/newsroom/company/eset-preferred-mdr-vendor-cysurance-cyber-warranty-insurance-program/
ESET secure AI era page: https://www.eset.com/us/business/secure-ai-era/
ESET AI Skills Checker: https://www.eset.com/us/home/ai-skills-checker/
ESET Research on GuardBreaker: https://www.welivesecurity.com/en/business-security/guardbreaker-derailing-ai-assisted-malware-analysis-code-comment/
The AI Readiness Gap report: https://web-assets.eset.com/fileadmin/ESET/US/B2B_Resource_centre/whitepapers/Global_AI_ESET_SMB_Cyber_Readiness_Index_2026.pdf
ESET PROTECT launch video: https://youtu.be/0aPI7PkPTsw

Are you interested in telling your story?
▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight
▶︎ Want your brand on ITSPmagazine? Explore all of the options here: https://www.itspmagazine.com/advertise

KEYWORDS
Ryan Grant, ESET, Sean Martin, brand story, brand marketing, marketing podcast, ESET PROTECT, managed detection and response, MDR, EDR, cyber warranty, Cysurance, cyber insurance, AI security, shadow AI, AI agents, AI Skills Checker, GuardBreaker, SMB cybersecurity, small business cybersecurity, 24/7 monitoring, cybersecurity as a service, MSP, channel partners