The ITSPmagazine Podcast

⬥GUEST⬥

Sarah Fluchs, CTO at admeritia | CRA Expert Group at EU Commission | On LinkedIn: https://www.linkedin.com/in/sarah-fluchs/

⬥HOST⬥

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine: https://www.itspmagazine.com/sean-martin

⬥EPISODE NOTES⬥

The European Commission’s Cyber Resilience Act (CRA) introduces a regulatory framework designed to improve the security of digital products sold within the European Union. In a recent episode of Redefining CyberSecurity, host Sean Martin spoke with Sarah Fluchs, Chief Technology Officer at admeritia and a member of the CRA expert group at the EU Commission. Fluchs, who has spent her career in industrial control system cybersecurity, offers critical insights into what the CRA means for manufacturers, retailers, and consumers.

A Broad Scope: More Than Just Industrial Automation

Unlike previous security regulations that focused on specific sectors, the CRA applies to virtually all digital products. Fluchs emphasizes that if a device is digital and sold in the EU, it likely falls under the CRA’s requirements. From smartwatches and baby monitors to firewalls and industrial control systems, the regulation covers a wide array of consumer and business-facing products.

The CRA also extends beyond just hardware—software and services required for product functionality (such as cloud-based components) are also in scope. This broad application is part of what makes the regulation so impactful. Manufacturers now face mandatory cybersecurity requirements that will shape product design, development, and post-sale support.

What the CRA Requires

The CRA introduces mandatory cybersecurity standards across the product lifecycle. Manufacturers will need to:

• Ensure products are free from known, exploitable vulnerabilities at the time of release.
• Implement security by design, considering cybersecurity from the earliest stages of product development.
• Provide security patches for the product’s defined lifecycle, with a minimum of five years unless justified otherwise.
• Maintain a vulnerability disclosure process, ensuring consumers and authorities are informed of security risks.
• Include cybersecurity documentation, requiring manufacturers to provide detailed security instructions to users.

Fluchs notes that these requirements align with established security best practices. For businesses already committed to cybersecurity, the CRA should feel like a structured extension of what they are already doing, rather than a disruptive change.

Compliance Challenges: No Detailed Checklist Yet

One of the biggest concerns among manufacturers is the lack of detailed compliance guidance. While other EU regulations provide extensive technical specifications, the CRA’s security requirements span just one and a half pages. This ambiguity is intentional—it allows flexibility across different industries—but it also creates uncertainty.

To address this, the EU will introduce harmonized standards to help manufacturers interpret the CRA. However, with tight deadlines, many of these standards may not be ready before enforcement begins. As a result, companies will need to conduct their own cybersecurity risk assessments and demonstrate due diligence in securing their products.

The Impact on Critical Infrastructure and Industrial Systems

While the CRA is not specifically a critical infrastructure regulation, it has major implications for industrial environments. Operators of critical systems, such as utilities and manufacturing plants, will benefit from stronger security in the components they rely on.

Fluchs highlights that many security gaps in industrial environments stem from weak product security. The CRA aims to fix this by ensuring that manufacturers, rather than operators, bear the responsibility for secure-by-design components. This shift could significantly reduce cybersecurity risks for organizations that rely on complex supply chains.

A Security Milestone: Holding Manufacturers Accountable

The CRA represents a fundamental shift in cybersecurity responsibility. For the first time, manufacturers, importers, and retailers must guarantee the security of their products or risk being banned from selling in the EU.

Fluchs points out that while the burden of compliance is significant, the benefits for consumers and businesses will be substantial. Security-conscious companies may even gain a competitive advantage, as customers start to prioritize products that meet CRA security standards.

For those in the industry wondering how strictly the EU will enforce compliance, Fluchs reassures that the goal is not to punish manufacturers for small mistakes. Instead, the EU Commission aims to improve cybersecurity without unnecessary bureaucracy.

The Bottom Line

The Cyber Resilience Act is set to reshape cybersecurity expectations for digital products. While manufacturers face new compliance challenges, consumers and businesses will benefit from stronger security measures, better vulnerability management, and increased transparency.

Want to learn more? Listen to the full episode of Redefining CyberSecurity with Sean Martin and Sarah Fluchs to hear more insights into the CRA and what it means for the future of cybersecurity.

⬥SPONSORS⬥

LevelBlue: https://itspm.ag/attcybersecurity-3jdk3

ThreatLocker: https://itspm.ag/threatlocker-r974

⬥RESOURCES⬥

Inspiring Post: https://www.linkedin.com/posts/sarah-fluchs_aaand-its-official-the-cyber-resilience-activity-7250162223493300224-zECA/

Adopted CRA text: https://data.consilium.europa.eu/doc/document/PE-100-2023-INIT/en/pdf

A list of Sarah's blog posts to get your CRA knowledge up to speed:

1️⃣ Introduction to the CRA, the CE marking, and the regulatory ecosystem around it: https://fluchsfriction.medium.com/eu-cyber-resilience-act-9e092fffbd73

2️⃣ Explanation how the standards ("harmonised European norms, hEN") are defined that will detail the actual cybersecurity requirements in the CRA (2023): https://fluchsfriction.medium.com/what-cybersecurity-standards-will-products-in-the-eu-soon-have-to-meet-590854ba3c8c

3️⃣ Overview of the essential requirements outlined in the CRA (2024): https://fluchsfriction.medium.com/what-the-cyber-resilience-act-requires-from-manufacturers-0ee0b917d209

4️⃣ Overview of the global product security regulation landscape and how the CRA fits into it (2024): https://fluchsfriction.medium.com/product-security-regulation-in-2024-93ddc6dd8900

5️⃣ Good-practice example for the "information and instructions to the user," one of the central documentations that need to be written for CRA compliance and the only one that must be provided to the product's users (2024): https://fluchsfriction.medium.com/how-to-be-cra-compliant-and-make-your-critical-infrastructure-clients-happy-441ecd859f52

⬥ADDITIONAL INFORMATION⬥

✨ More Redefining CyberSecurity: 

🎧 https://www.itspmagazine.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

Interested in sponsoring this show with an ad placement in the podcast? Learn more:

👉 https://itspm.ag/podadplc

The Wondrous Vegetable Shop

With the arrival of spring, beneath the soft mantle of the earth, tubers and roots began to awaken. The carrots stretched their orange tips with their green tufts. The round and plump potatoes whispered among themselves.

“I can feel the warmth of the sun even down here,” said a deep red beetroot. “Doesn’t it seem like the perfect moment to show ourselves to the world?”

“You’re right!” an enthusiastic onion replied. “Enough of staying down here! I want to shine on the shelves of a beautiful shop.”

So, they began their journey toward the surface. The earth gently parted to let those cheerful and determined roots pass through. Once they emerged, they started strolling carefree among the olive trees of the Tuscan hills, chatting happily about their new adventure.

Along their path, some sparrows hopped on the branches and, seeing the lively and chatty group, immediately chirped: “Chirp, chirp, chirp! Where are you going, fragrant vegetables?”

“To find the most special shop in town and put ourselves on display,” they replied.

A farmer, who had cultivated with passion for many years and cared deeply about the quality of his produce, noticed them and gently gathered them. He placed them in a basket and took them to a shop in Sesto Fiorentino, well known for its dedication to the finest products of the land.

Above the shop’s window, the sign read: THE WONDROUS VEGETABLE SHOP.

In baskets lovingly arranged, the carrots displayed their vibrant orange color, the potatoes gleamed, and even the onions proudly showed off their shining hues. The radishes giggled and happily put themselves on display as well.

Customers couldn’t resist such a spectacle of colors and scents and stopped, enchanted, saying: “What spectacular vegetables! Now this is a well-stocked and high-quality shop!”

The vegetables were delighted to be appreciated and purchased—they knew they would bring flavors and smiles to every kitchen with delicious dishes. Full of taste and nutrients, they were happy to be healthy and wholesome ingredients for everyone, from the youngest to the oldest, bringing to the table the joy and warmth of a meal shared with family and friends, following Italian tradition.

And so, buon appetito to everyone!
________________________________________________________________________

Each story is currently written and narrated in both Italian and English.

The translation from Italian (the original language) to English and the reading of the stories are performed using Generative Artificial Intelligence — which perhaps has a touch of magic... We hope it has done a good job!

If you like it, make sure to tell your friends, family, and teachers, and subscribe to this podcast to stay updated. You’ll be able to read or listen to new stories as soon as they become available.

Visit us On The Official Website https://www.storiesottolestelle.com/

Guest: Precious Perez, President at RAMPD | On LinkedIn: https://www.linkedin.com/in/precious-perez-a0548915b/ | Website: https://preciousperezmusica.com/

Host: Sean Martin, Co-Founder at ITSPmagazine and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

The intersection of music, technology, and accessibility is shaping how artists create, perform, and share their work. In this episode of Music Evolves, host Sean Martin speaks with singer, songwriter, and educator Precious Perez, a Berklee College of Music graduate with degrees in music education and vocal performance. As a blind Latina artist and disability advocate, Perez shares her journey in music, the role of technology in her creative process, and how she works to increase opportunities for musicians with disabilities.

A Life Shaped by Music

Perez’s passion for music started early, surrounded by the diverse sounds of her Puerto Rican household. From salsa and reggaeton to R&B and pop, her exposure to various genres helped shape her identity as an artist. She recalls her first songwriting experience in fourth grade, when she transformed a poem into a song with the help of a music teacher. That moment solidified her desire to pursue music professionally, leading her to Berklee, where she refined her skills in both performance and education.

As a blind musician, Perez explains how she interacts with music differently from sighted artists. She describes her early experiences learning Braille music and how tactile memory plays a role in understanding composition. While she primarily relies on her ear, her knowledge of Braille notation helps her analyze rhythm and structure in a unique way.

Technology as a Tool for Inclusion

For Perez, technology has been both a gateway and a challenge. She demonstrates how she uses a BrailleSense note taker, a device that allows her to type lyrics and read them in Braille while composing. She also shares how screen reading software enables her to navigate recording software like Logic Pro and Pro Tools, ensuring she can produce and edit her music independently.

Beyond the studio, accessibility in live performance is another key consideration. Whether using in-ear monitors or giving cues to her bandmates through verbal or physical signals, Perez emphasizes that clear communication and collaboration make performances seamless.

Advocating for Disability Representation in Music

Perez is also the president of RAMPD (Recording Artists and Music Professionals with Disabilities), an organization founded by recording artist Lachi and NPR Tiny Desk Contest winner Gaelynn Lea. RAMPD is dedicated to amplifying disability culture, promoting accessibility, and ensuring that disabled artists have equitable opportunities in the music industry. The organization consults with major industry events like the Grammys, NAMM, and Folk Alliance to improve accessibility and representation.

She stresses that disability is an often-overlooked part of diversity and that anyone, at any time, could join this community due to illness, injury, or aging. Through RAMPD, Perez and her colleagues are breaking down barriers and proving that disabled musicians are just as competitive and professional as their peers.

A New Era of Music

Perez is embracing a new era in her music, blending her Latin roots with her pop and R&B influences. She performs her latest song, Rosé, a Spanish-language track about embracing the present moment with a loved one despite life’s difficulties. With plans to record a new project with We Could Be Music in Costa Rica, she is leaning into the Latin music space in a way she has always envisioned.

Her story is one of resilience, innovation, and passion. From navigating music education as a blind student to advocating for industry-wide accessibility, Perez is proving that talent and determination—not sight—define an artist’s success.

Listen to the full episode to hear Precious Perez’s insights on technology, performance, and advocacy in music.

Are you interested in sponsoring this show or placing an ad in the podcast?

Sponsorship 👉 https://itspm.ag/annual-sponsorship

Ad Placement 👉 https://itspm.ag/podadplc

Precious' LinkTree: https://linktr.ee/preciousperezmusica

Recording Artists and Music Professionals with Disabilities (RAMPD): https://rampd.org/

Guest: Frank Scalise

Website | https://franksaverio.com
Website | https://frankscalise.com
Website | https://frankzafiro.com

_____________________________

Host: Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast

Website: https://www.marcociappelli.com

_____________________________

Episode Title: 🎙️✨ Shifting Realities: Crime, Sci-Fi, and the Art of Storytelling with Frank Scalise

Guest: Frank Scalise 

Short Intro: In this episode of Audio Signals, host Marco Ciappelli sits down with Frank Saverio / Zafiro / Scalise to explore the evolution of his writing career. 

Show Notes:

🎙️✨ Shifting Realities: Crime, Sci-Fi, and the Art of Storytelling with Frank Saverio

📚 From crime-ridden streets to the vast unknown of space, author Frank Scalise (a.k.a. Frank Zafiro a.k.a. Frank Saverio) is no stranger to weaving gripping tales across multiple genres. With a background in law enforcement, he first made his mark writing gritty crime fiction before diving into the speculative realms of sci-fi and fantasy. But what drives a storyteller to switch between such different worlds?

In this episode of Audio Signals, host Marco Ciappelli sits down with Frank to explore the evolution of his writing career. They discuss the importance of keeping reader expectations clear (hence the multiple pen names), the unexpected parallels between crime fiction and sci-fi, and how storytelling serves as a powerful lens to examine society, human nature, and even our own mortality.

🚀 Frank’s latest sci-fi novel, Kemper’s House, is a thought-provoking exploration of space travel, time dilation, and the unsettling feeling of being a "man out of time." Inspired by both historical cycles and the rapid acceleration of technology, the book raises deep philosophical questions about progress, cultural shifts, and what it truly means to belong.  In a distant future where humanity has finally unlocked the ability to travel at 87% the speed of light, an interstellar crew embarks on a deep-space mission after intercepting mysterious radio signals from a distant civilization. Captain Adrian Kemper leads the expedition to the Chiron system, but what they find is far different from what they imagined. By the time they arrive, nearly 1,000 years have passed on the distant planet, and civilization has either evolved or vanished entirely. But the real challenge comes when they return to Earth—another 1,500 years later.

🎸 Beyond writing, Frank also shares his passion for music—despite self-proclaimed struggles with guitar and rhythm. Whether it's crafting a novel, strumming a few chords, or reflecting on the changing world around him, one thing remains clear: storytelling is at the heart of it all.

📌 Join us on this conversation to uncover how Frank balances multiple creative identities, why genre-hopping makes for richer storytelling, and what’s next on his ever-expanding horizon.

📌 Discover more storytellers on Audio Signals: https://www.itspmagazine.com/audio-signals

Watch the video version on-demand on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllQvnJ8eHUlVX8AuyhehtexA

_____________________________

Resources

Kemper's House Kindle Edition
https://www.amazon.com/Kempers-House-Frank-Saverio-ebook/dp/B0CWGC6QGL

by Frank Saverio (Author) Format: Kindle Edition

What if the cost of first contact was leaving behind a world you’d never recognize upon return?

On the heels of discovering interstellar travel, humanity has stumbled upon the first signs of intelligent life in another system. Captain Adrian Kemper is selected to lead the expedition to Kyra-2B in order to make first contact with the Kyrans. He departs a world struggling to deal with overpopulation, knowing that the realities of space travel will mean the Earth he eventually returns to will no longer be home. Even the stone cottage he loves may not remain.

Despite this, Kemper accepts the mission. He leads an elite crew of optimistic scientists on a journey that will traverse hundreds of light years before reaching an alien world.

What they find is truly unexpected.

_____________________________

For more podcast stories from Audio Signals: 
https://www.itspmagazine.com/audio-signals

Watch the video version on-demand on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllQvnJ8eHUlVX8AuyhehtexA

Are you interested in advertising your brand on ITSPmagazine?
👉 https://www.itspmagazine.com/advertise

Organizations build and deploy applications at an unprecedented pace, but security is often an afterthought. This episode of ITSPmagazine’s Brand Story features Jim Manico, founder of Manicode Security, in conversation with hosts Sean Martin and Marco Ciappelli. The discussion explores the current state of application security, the importance of developer training, and how organizations can integrate security from the ground up to drive better business outcomes.

The Foundation of Secure Development

Jim Manico has spent decades helping engineers and architects understand and implement secure coding practices. His work with the Open Web Application Security Project (OWASP), including contributions to the OWASP Top 10 and the OWASP Cheat Sheet Series, has influenced how security is approached in software development. He emphasizes that security should not be an afterthought but a fundamental part of the development process.

He highlights OWASP’s role in providing documentation, security tools, and standards like the Application Security Verification Standard (ASVS), which is now in its 5.0 release. These resources help organizations build secure applications, but Manico points out that simply having the guidance available isn’t enough—engineers need the right training to apply security principles effectively.

Why Training Matters

Manico has trained thousands of engineers worldwide and sees firsthand the impact of hands-on education. He explains that developers often lack formal security training, which leads to common mistakes such as insecure authentication, improper data handling, and vulnerabilities in third-party dependencies. His training programs focus on practical, real-world applications, allowing developers to immediately integrate security into their work.

Security training also helps businesses beyond just compliance. While some companies initially engage in training to meet regulatory requirements, many realize the long-term value of security in reducing risk, improving product quality, and building customer trust. Manico shares an example of a startup that embedded security from the beginning, investing heavily in training early on. That approach helped differentiate them in the market and contributed to their success as a multi-billion-dollar company.

The Role of AI and Continuous Learning

Manico acknowledges that the speed of technological change presents challenges for security training. Frameworks, programming languages, and attack techniques evolve constantly, requiring continuous learning. He has integrated AI tools into his training workflow to help answer complex questions, identify knowledge gaps, and refine content. AI serves as an augmentation tool, not a replacement, and he encourages developers to use it as an assistant to strengthen their understanding of security concepts.

Security as a Business Enabler

The conversation reinforces that secure coding is not just about avoiding breaches—it is about building better software. Organizations that prioritize security early can reduce costs, improve reliability, and increase customer confidence. Manico’s approach to education is about empowering developers to think beyond compliance and see security as a critical component of software quality and business success.

For organizations looking to enhance their security posture, developer training is an investment that pays off. Manicode Security offers customized training programs to meet the specific needs of teams, covering topics from secure coding fundamentals to advanced application security techniques. To learn more or schedule a session, Jim Manico can be reached at [email protected].

Tune in to the full episode to hear more insights from Jim Manico on how security training is shaping the future of application security.

Learn more about Manicode: https://itspm.ag/manicode-security-7q8i

Note: This story contains promotional content. Learn more.

Guest: Jim Manico, Founder and Secure Coding Educator at Manicode Security | On Linkedin: https://www.linkedin.com/in/jmanico/

Resources

Download the Course Catalog: https://itspm.ag/manicode-x684

Learn more and catch more stories from Manicode Security: https://www.itspmagazine.com/directory/manicode-security

Are you interested in telling your story?
https://www.itspmagazine.com/telling-your-story

In an era where personal and professional lives are increasingly intertwined in the digital realm, the security of high-profile individuals extends far beyond corporate firewalls. Executives, board members, and high-net-worth individuals face growing threats not just to their businesses but also to their families and personal lives. The convergence of cybersecurity and physical security has never been more evident, and BlackCloak is at the forefront of addressing this modern challenge.

In this episode of ITSPmagazine’s Brand Story series, hosts Marco Ciappelli and Sean Martin sit down with Dr. Chris Pierson, CEO and Founder of BlackCloak, to explore the increasing risks posed by cybercriminals, data brokers, and even nation-state actors, all of whom exploit publicly available information to orchestrate real-world threats. With the rise of doxing, swatting, and targeted attacks on corporate leadership, it is clear that safeguarding digital identities is no longer optional—it is essential.

Dr. Pierson shares insights on how BlackCloak’s concierge approach blends cutting-edge technology with a personalized human touch, ensuring that executives and their families can navigate the digital world securely. From removing personal information from data broker websites to mitigating deep web threats, BlackCloak’s unique approach focuses on proactive protection rather than reactive crisis management. The conversation also touches on recent high-profile security breaches and their implications, highlighting the urgent need for businesses to extend cybersecurity measures beyond the enterprise network.

As digital and physical threats continue to merge, organizations must rethink their approach to executive security. This episode is a wake-up call for leaders who may underestimate the exposure they and their families face. Tune in to learn why digital executive protection is no longer a luxury but a necessity, and how BlackCloak is setting the standard for safeguarding the modern executive.

For those looking to take control of their digital privacy and security, visit BlackCloak.io and connect with Dr. Chris Pierson on LinkedIn. The intersection of cybersecurity and personal safety is here—how prepared are you?

Learn more about BlackCloak: https://itspm.ag/itspbcweb

Note: This story contains promotional content. Learn more.

Guest: Chris Pierson, Founder and CEO of BlackCloak | On Linkedin: https://www.linkedin.com/in/drchristopherpierson/

Resources

Download the Whitepaper | Executive Protection at Home is the Major Gap in Cybersecurity: https://itspm.ag/blackcue74

Learn more and catch more stories from BlackCloak: https://www.itspmagazine.com/directory/blackcloak

Are you interested in telling your story?
https://www.itspmagazine.com/telling-your-story

Guest:
Guest: Joanne Higgins 

👉 https://laist.com/podcasts/la-made
_____________________________

Host: Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society & Technology Podcast

Visit Marco's website 👉 https://www.marcociappelli.com 
_____________________________

This Episode’s Sponsors

BlackCloak 👉 https://itspm.ag/itspbcweb

_____________________________

Show Notes Blog:

The moon landing was one of humanity’s most celebrated achievements—a technological marvel, a leap into the unknown, and a moment that defined an era. But history is often incomplete, and some of the most brilliant minds behind that achievement were left out of the story.

That’s where LA Made: The Other Moonshot comes in. Host Joanne Higgins takes us on a journey to uncover the untold contributions of three Black aerospace engineers who helped make the Apollo mission possible—despite facing systemic discrimination every step of the way. These men weren’t just solving some of the most complex engineering challenges of their time; they were also battling for their place in an industry that barely acknowledged them.

Joanne’s personal connection to this story—growing up hearing these experiences firsthand from her godfather, Charlie Cheathem—drove her to document their legacy before it was lost. What she uncovered is more than just a piece of forgotten history; it’s a story about resilience, recognition, and the ongoing struggle for inclusion in science and technology.

In this episode of Redefining Society & Technology, we explore not just the space race but the human race—the fight for acknowledgment, the hidden struggles behind innovation, and the lasting impact of these unsung pioneers. Because technology is only part of the equation; the people behind it matter just as much.

Let’s talk about it.

Subscribe to this Redefinign Sociey & Technology podcast on your favorite Podcast Player and stay tuned for the next episode!

Thank you for listening,
Marco Ciappelli
_____________________________

Resources/References
LA Made: The Other Moonshot
Exploring stories of bold Californian innovators and how they forever changed the lives of millions all over the world.

“LA Made: The Other Moonshot,” tells the story of three Black aerospace engineers in Los Angeles, who played a crucial role in America’s race to space, amid the civil unrest of the 1960s. Host Joanne Higgins grew up hearing her godfather tell stories about his work on the Apollo mission to the moon. But as an adult, Higgins realizes his contributions – and those of other Black engineers – had been overlooked and left out of history books. She sets out to correct that and ensure their stories are finally told. Join Higgins in this four-part series, as three “hidden figures” give their accounts for the first time of their experiences in aerospace that broke racial barriers and helped the U.S. land on the moon.

👉 https://laist.com/podcasts/la-made

____________________________

Listen to more Redefining Society & Technology stories and subscribe to the podcast:
👉 https://redefiningsocietyandtechnologypodcast.com

Watch the webcast version on-demand on YouTube:
👉 https://www.youtube.com/playlist?list=PLnYu0psdcllTUoWMGGQHlGVZA575VtGr9

Are you interested Promotional Brand Stories for your Company and Sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/advertise-on-itspmagazine-podcast

Guest: Gary Hayslip, CISO, SoftBank Investment Advisors

LinkedIn: https://www.linkedin.com/in/ghayslip/

Website: cisodrg.com/biographies/gary-hayslip/

Host: Dr. Rebecca Wynn

On ITSPmagazine  👉  https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/rebecca-wynn

________________________________

This Episode’s Sponsors

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

________________________________

Episode Description

In this episode of Soulful CXO, host Dr. Rebecca Wynn speaks with Gary Hayslip about how elite cybersecurity teams stay ahead of constantly evolving threats. Gary shares insights from his extensive experience across government, military, and corporate sectors, discussing the critical role of proactive defense strategies, risk governance frameworks, and resilience-building techniques. He highlights the importance of aligning cybersecurity initiatives with business objectives, fostering executive collaboration, and developing a security culture that enables organizations to thrive in an unpredictable digital landscape. With practical leadership advice and real-world examples, this episode provides valuable strategies for CISOs and security professionals looking to strengthen their cybersecurity posture.

________________________________

Resources

Gary Hayslips books, CISO Reference Guides: https://a.co/d/clcNIBd
________________________________

Support:

Buy Me a Coffee: https://www.buymeacoffee.com/soulfulcxo

________________________________

For more podcast stories from The Soulful CXO Podcast With Rebecca Wynn: https://www.itspmagazine.com/the-soulful-cxo-podcast

ITSPMagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

⬥GUEST⬥

Jake Braun, Acting Principal Deputy National Cyber Director, The White House | On LinkedIn: https://www.linkedin.com/in/jake-braun-77372539/

⬥HOST⬥

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine: https://www.itspmagazine.com/sean-martin

⬥EPISODE NOTES⬥

Cybersecurity is often framed as a battle between attackers and defenders, but what happens when hackers take on a different role—one of informing policy, protecting critical infrastructure, and even saving lives? That’s the focus of the latest Redefining Cybersecurity podcast episode, where host Sean Martin speaks with Jake Braun, former Acting Principal Deputy National Cyber Director at the White House and current Executive Director of the Cyber Policy Initiative at the University of Chicago.

Braun discusses The Hackers’ Almanack, a project developed in partnership with DEF CON and the Franklin Project to document key cybersecurity findings that policymakers, industry leaders, and technologists should be aware of. This initiative captures some of the most pressing security challenges emerging from DEF CON’s research community and translates them into actionable insights that could drive meaningful policy change.

DEF CON, The Hackers’ Almanack, and the Franklin Project

DEF CON, one of the world’s largest hacker conferences, brings together tens of thousands of security researchers each year. While the event is known for its groundbreaking technical discoveries, Braun explains that too often, these findings fail to make their way into the hands of policymakers who need them most. That’s why The Hackers’ Almanack was created—to serve as a bridge between the security research community and decision-makers who shape regulations and national security strategies.

This effort is an extension of the Franklin Project, named after Benjamin Franklin, who embodied the intersection of science and civics. The initiative includes not only The Hackers’ Almanack but also a volunteer-driven cybersecurity support network for under-resourced water utilities, a critical infrastructure sector under increasing attack.

Ransomware: Hackers Filling the Gaps Where Governments Have Struggled

One of the most striking sections of The Hackers’ Almanack examines the state of ransomware. Despite significant government efforts to disrupt ransomware groups, attacks remain as damaging as ever. Braun highlights the work of security researcher Vangelis Stykas, who successfully infiltrated ransomware gangs—not to attack them, but to gather intelligence and warn potential victims before they were hit.

While governments have long opposed private-sector hacking in retaliation against cybercriminals, Braun raises an important question: Should independent security researchers be allowed to operate in this space if they can help prevent attacks? This isn’t just about hacktivism—it’s about whether traditional methods of law enforcement and national security are enough to combat the ransomware crisis.

AI Security: No Standards, No Rules, Just Chaos

Artificial intelligence is dominating conversations in cybersecurity, but according to Braun, the industry still hasn’t figured out how to secure AI effectively. DEF CON’s AI Village, which has been studying AI security for years, made a bold statement: AI red teaming, as it exists today, lacks clear definitions and standards. Companies are selling AI security assessments with no universally accepted benchmarks, leaving buyers to wonder what they’re really getting.

Braun argues that industry leaders, academia, and government must quickly come together to define what AI security actually means. Are we testing AI applications? The algorithms? The data sets? Without clarity, AI red teaming risks becoming little more than a marketing term, rather than a meaningful security practice.

Biohacking: The Blurry Line Between Innovation and Bioterrorism

Perhaps the most controversial section of The Hackers’ Almanack explores biohacking and its potential risks. Researchers at the Four Thieves Vinegar Collective demonstrated how AI and 3D printing could allow individuals to manufacture vaccines and medical devices at home—at a fraction of the cost of commercial options. While this raises exciting possibilities for healthcare accessibility, it also raises serious regulatory and ethical concerns.

Current laws classify unauthorized vaccine production as bioterrorism, but Braun questions whether that definition should evolve. If underserved communities have no access to life-saving treatments, should they be allowed to manufacture their own? And if so, how can regulators ensure safety without stifling innovation?

A Call to Action

The Hackers’ Almanack isn’t just a technical report—it’s a call for governments, industry leaders, and the security community to rethink how we approach cybersecurity, technology policy, and even healthcare. Braun and his team at the Franklin Project are actively recruiting volunteers, particularly those with cybersecurity expertise, to help protect vulnerable infrastructure like water utilities.

For policymakers, the message is clear: Pay attention to what the hacker community is discovering. These findings aren’t theoretical—they impact national security, public safety, and technological advancement in ways that require immediate action.

Want to learn more? Listen to the full episode and explore The Hackers’ Almanack to see how cybersecurity research is shaping the future.

⬥SPONSORS⬥

LevelBlue: https://itspm.ag/attcybersecurity-3jdk3

ThreatLocker: https://itspm.ag/threatlocker-r974

⬥RESOURCES⬥

The DEF CON 32 Hackers' Almanack: https://thehackersalmanack.com/defcon32-hackers-almanack

DEF CON Franklin Project: https://defconfranklin.com/ | On LinkedIn: https://www.linkedin.com/company/def-con-franklin/

DEF CON: https://defcon.org/

Cyber Policy Initiative: https://harris.uchicago.edu/research-impact/initiatives-partnerships/cyber-policy-initiative

⬥ADDITIONAL INFORMATION⬥

✨ More Redefining CyberSecurity: 

🎧 https://www.itspmagazine.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

Interested in sponsoring this show with an ad placement in the podcast? Learn more:

👉 https://itspm.ag/podadplc

The intersection of cybersecurity and healthcare is more critical than ever, as technology continues to shape the way patient care is delivered. At HIMSS 2025 in Las Vegas, we sat down with Lee Kim, Senior Principal of Cybersecurity and Privacy at HIMSS, to discuss the pressing security challenges facing healthcare organizations, the role of artificial intelligence, and the balance between innovation and risk.

AI in Healthcare: Promise and Peril

Artificial intelligence is rapidly being adopted across the healthcare sector, yet many organizations still lack structured governance around its use. Kim highlights the “wild west” nature of AI adoption, where policies are either non-existent or underdeveloped, creating risks related to privacy, data security, and patient outcomes. While AI-powered diagnostic tools, like those used in radiology, have the potential to improve patient care by identifying critical conditions early, blind trust in AI-generated results presents serious risks. Without proper oversight, reliance on AI could lead to incorrect medical decisions, putting patient safety in jeopardy.

Cybersecurity Gaps in Healthcare Organizations

One of the biggest concerns in healthcare cybersecurity is the over-reliance on security tools without a clear strategy. Many organizations invest in the latest technology but neglect foundational security practices, such as governance, policy development, and staff training. Kim points out that less than half of cybersecurity budgets are allocated to governance, leading to disorganized security programs.

Another persistent challenge is the human factor. Social engineering and phishing attacks remain the top attack vectors, exploiting the inherent culture of healthcare professionals who are trained to help and trust others. Organizations must focus on proactive security measures, such as regular training and simulated attacks, to reduce human error and strengthen defenses.

The Financial and Operational Reality

Budget constraints continue to be a challenge, particularly for smaller hospitals and community healthcare providers. While larger organizations may have more resources, cybersecurity spending often focuses on acquiring new tools rather than optimizing existing defenses. Kim stresses the importance of a balanced approach—investing in both technology and governance to ensure long-term resilience.

Another concern is the increasing dependence on third-party services and cloud-based AI tools. If these services become too expensive or go offline, healthcare organizations may face operational disruptions. The lack of contingency planning, such as backup vendors or alternative systems, leaves many institutions vulnerable to supply chain risks.

Building a More Resilient Healthcare Security Model

As technology continues to drive innovation in healthcare, organizations must adopt a proactive cybersecurity stance. Business impact analyses, vendor risk assessments, and tabletop exercises should be standard practice to prepare for disruptions. Kim also raises the idea of cyber mutual aid—a model similar to emergency medical mutual aid, where healthcare organizations collaborate to support each other in times of crisis.

HIMSS 2025 provides a forum for these critical conversations, bringing together global healthcare leaders to share insights, challenges, and solutions. For those interested in diving deeper, the HIMSS Cybersecurity Survey is available online, offering a comprehensive look at the current state of healthcare security.

To hear the full discussion on these topics and more, listen to the episode featuring Lee Kim, Sean Martin, and Marco Ciappelli from HIMSS 2025 On Location.

Guest: Lee Kim, Senior Principal of Cybersecurity and Privacy at HIMSS | On LinkedIn: https://www.linkedin.com/in/leekim/

Hosts:

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber] | On ITSPmagazine:  https://www.itspmagazine.com/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast | On ITSPmagazine: https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

HITRUST: https://itspm.ag/itsphitweb

____________________________

Resources

Learn more and catch more stories from HIMSS 2025 coverage: https://www.itspmagazine.com/himss-2025-health-technology-and-cybersecurity-event-coverage-las-vegas

HIMSS 2024 Cybersecurity Report: https://www.himss.org/resources/himss-healthcare-cybersecurity-survey/

____________________________

Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast

To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast

Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf

Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us