The Professional CISO

"I get it. I need to stop banging on the table. This will be fixed in future episodes. Sorry for the poor sound experience." - David

Get your Responsible AI Vendor Due Diligence Checklist here: https://webforms.pipedrive.com/f/ccV6a7kFIWKZpodmLcDbBhKhYnVU5N81A2tM20DGC8gepc0UtzfcqYaHXfzBi8gzuz

Episode Summary:

In this episode of The Professional CISO Show, David Malicoat explores whether “Responsible AI” pledges from vendors are genuine safeguards or simply marketing buzz. Using Zscaler’s recent claims as a case study, David walks through vendor promises, compliance implications, audit gaps, and blind spots around explainability, bias, and portability.

The episode introduces a practical CISO Vendor AI Evaluation Sheet across six domains — data handling, AI governance, auditability, liability, transparency, and exit strategy — to help CISOs push beyond assurances and demand evidence.

Key Takeaways:

• Why “Responsible AI” is often indistinguishable from “Responsible Marketing”
• The compliance challenges with GDPR, HIPAA, CCPA, SR 11-7, and the EU AI Act
• How metadata, audit evidence gaps, and third-party dependencies introduce hidden risk
• Why boards must be educated on AI risk vs. AI marketing hype
• Why CISOs must own the Responsible AI conversation before regulators step in

Notable Quotes:

• “Responsible AI should be more than a press release. It must be auditable, enforceable, and defensible in front of a regulator.”
• “When regulators knock, they won’t call the vendor first. They’ll call you.”
• “Don’t just take a vendor’s word for it — ask hard questions, demand evidence, and get it in writing.”

Listener Benefits:

By listening, you’ll gain a sharper lens for evaluating AI vendor claims, practical tools to strengthen your vendor management process, and strategies to get ahead of inevitable regulation.

Call to Action:

👉 Download the free CISO Vendor AI Evaluation Sheet from the show notes.

👉 Share this episode with your peers and comment your perspective on LinkedIn.

👉 Subscribe on Spotify, Apple Podcasts, and YouTube.

🔖 Hashtags

#ResponsibleAI #CISO #CybersecurityLeadership #TheProfessionalCISO #AICompliance #VendorRisk #AIGovernance

Sponsors:

ObservoAI (www.observo.ai)

Guidepoint Security (www.guidepointsecurity.com)

Episode Summary:

AI isn’t just hype anymore — it’s transforming the way enterprises operate. At GPSEC St. Louis, David Malicoat sits down with Felix Simmons, Principal Security Architect at GuidePoint Security, to cut through the noise around AI adoption, risk, and controls.

Felix explains why AI is unlike past technology waves, how business demand is driving adoption faster than security teams can keep up, and what enterprises can do to prepare. From agentic AI and non-human identities to offline models and emerging security tooling, this conversation offers a practical guide for CISOs navigating AI in the enterprise.

What You’ll Learn in This Episode:

• The real risks of AI adoption beyond the hype
• How business-driven demand changes the security equation
• Why AI controls lag adoption — and what to do about it
• The rise of agentic AI and new identity risks
• Offline models, adversarial risks, and scanning challenges
• What the future of AI-driven enterprise security may look like

Guest:

Felix Simmons — Principal Security Architect, GuidePoint Security

Links & Resources:

• 🌐 Website: www.thpc.co
• 📺 Watch More Episodes: http://www.youtube.com/@TheProfessionalCISO 
• 🎧 Listen on https://open.spotify.com/show/2C7JojNZPdg1g6AXvpKDfn?si=a7ac3172bb414673 
• 🍏 Listen on https://podcasts.apple.com/us/podcast/the-professional-ciso/id1731138021 
• 💼 Connect on https://www.linkedin.com/company/the-professional-ciso-show 

Hashtags:

#Cybersecurity #CISO #AI #EnterpriseSecurity #GPSEC #GuidePointSecurity #ObservoAI

Summary:

Recorded live at CISO XC DFW, this episode of The Professional CISO Show features three powerful conversations from leaders shaping the future of cybersecurity.

First, Sonya Wickel shares her 24-year career journey from IT generalist to CISO & CIO, offering insights on fourth-party risk, the value of empathy in leadership, and the importance of staying sharp in both IT and cybersecurity.

Then, Eric Bowerman takes us inside the complex task of securing Dallas Fort Worth International Airport — from operational technology and stakeholder management to implementing passwordless authentication and preparing for global events like FIFA.

Finally, Tera Davis explains how CyberOne has built a true community partnership with CISO XC, scaling professional services, preparing organizations for AI adoption, and fostering the next generation of security talent.

Sponsors

Valence Security (www.valencesecurity.com)

CISO XC (www.cisoxc.com)

Key Topics Covered:

• CISO/CIO dual-role challenges & strategies
• Third & fourth-party risk management best practices
• Critical infrastructure & OT security challenges
• Building trust and stakeholder alignment in high-impact environments
• Passwordless authentication for operational teams
• Authentic sponsor–community relationships
• Scaling professional services & AI readiness

Links & Resources:

🌐 Website: www.thpc.co

📺 Watch More Episodes: 

http://www.youtube.com/@TheProfessionalCISO

🎧 Listen on Spotify: Open on Spotify

🍏 Listen on Apple Podcasts: Open on Apple Podcasts

💼 LinkedIn: Follow on LinkedIn

Hashtags:

#CyberSecurity #CISO #TheProfessionalCISO #CISOXC #CyberLeadership #RiskManagement #OTSecurity #ThirdPartyRisk #AirportSecurity #Passwordless #CyberCommunity #CyberOne #ValenceSecurity

Sponsors

AIM Security (www.aim.security)

Guidepoint Security (www.guidepointsecurity.com)

Kristi Cook, Head of Cybersecurity at Peabody Energy, joins David Malicoat live from GPSEC St. Louis — with AIM Security as our midday sponsor — to discuss how she’s leading her team through AI adoption, data governance, and talent development.

From leveraging conferences as both morale boosters and strategic accelerators, to building a sustainable talent pipeline through the CyberUp apprenticeship program, Kristi offers actionable insights for CISOs facing rapid technological change.

We also dive into the unique trust and collaboration in the St. Louis cybersecurity community, and why AI may finally give security leaders the leverage to fix long-standing data governance challenges.

Key Topics Covered:

• Leadership panel insights: AI, SaaS security, hiring, and retention
• Using conferences for team building and strategy alignment
• Justifying training investments to executive leadership
• Foundations for AI security: IAM and data protection
• Solving the talent gap with apprenticeship programs
• Why local community trust matters in cybersecurity
• Preparing for the next wave of rapid tech change

Resources & Links:

• AIM Security: www.aimsecurity.ai
• CyberUp Apprenticeship Program: wecyberup.org
• The Professional CISO Show Website: www.thpc.co
• Watch on YouTube: @TheProfessionalCISO
• Listen on Spotify: Click Here
• Listen on Apple Podcasts: Click Here
• Connect on LinkedIn: The Professional CISO Show

#️⃣ Hashtags

#Cybersecurity #CISO #TheProfessionalCISOShow #DataGovernance #AIsecurity #Leadership #TeamBuilding #CyberTalent #IdentityAccessManagement #StLouisCybersecurity #GPSEC #PeabodyEnergy #CyberUp

Sponsored by HivePro (www.hivepro.com) and CISO XC (www.cisoxc.com).

EP80 – CISO XC DFW | Hive Pro Special: AI, Identity & The Future of Cyber Roles

Live from CISO XC DFW, The Professional CISO Show dives into the intersection of innovation, leadership, and cyber resilience. Host David Malicoat sits down with:

• Ted Sanders, BISO and cybersecurity educator, to discuss embedding cyber strategy at scale and why the BISO role is the next great proving ground for future CISOs.
• Jon Brickey, SVP & Cybersecurity Evangelist at Mastercard, as he unpacks his unique career journey from NSA to Mastercard and explains how cyber innovation, threatcasting, and AI will reshape the landscape.
• Travis Farral, CISO at RK Energy, who shares actionable insights on session token hijacking, third-party risks, and his strategic push for FIDO2 adoption in a hybrid environment.

Sponsored by Hive Pro, a leader in Continuous Threat Exposure Management. Learn more at 

https://hivepro.com

Key Takeaways:

• The BISO role as a critical extension of CISO leadership
• Why threat translation is a core skill for cyber leaders
• How AI will augment, not replace, cybersecurity roles
• Jon Brickey’s “Forrest Gump” career across the evolution of cyber defense
• Identity strategy as a cornerstone of modern resilience

🎯 Perfect for: CISOs, aspiring cyber leaders, SOC managers, and innovators thinking about the future of security and strategy.

🔗 Links & CTAs

🌐 Website: www.thpc.co

📺 Watch More Episodes: YouTube

🎧 Listen on Spotify | Apple Podcasts

🔗 Follow us on LinkedIn

👤 Guest Info

• Ted Sanders – BISO in financial services, Cybersecurity Instructor at Collin College
• Jon Brickey – SVP & Cybersecurity Evangelist, Mastercard
• Travis Farral – CISO, RK Energy

📌 Related Episodes

• EP79: Rob T. Lee on Cybersecurity Training Futures
• EP77: The AI Opportunity for CISOs

🔖 Hashtags

#Cybersecurity #CISO #BISO #AIinSecurity #CyberInnovation #MastercardSecurity #FIDO2 #ThreatExposure #HivePro #TheProfessionalCISO #CISOStrategy #CyberEvangelism #CyberLeadership #CyberPodcast

In this special RSA Conference edition of The Professional CISO Show, host David Malicoat sits down with Rob T. Lee—Chief of Research at SANS Institute and a foundational figure in cybersecurity. With nearly three decades of experience spanning the Air Force, Mandiant, and SANS, Rob shares his insights on the evolving challenges of the CISO role, the toxicity of today’s security environments, and the urgent need for AI literacy across the industry.

Rob dives deep into the accelerating threat landscape, the need for cyber safe harbors, and why he believes we’re on the verge of normalizing breaches as the cost of doing business. He also makes the case for rewarding defenders and rethinking how we define cybersecurity success.

Key Highlights:

• Why most CISOs say “never again”—and what needs to change
• Why Rob coined DFIR and CTI (and the story behind it)
• The CISO “zero-sum game” and how toxic cultures persist
• Rob’s 4-part personal health mantra: Sleep, Diet, Exercise… and AI
• A call to “Learn AI daily”—for security pros and business leaders alike
• What boards should be doing—and why every board needs a cyber voice
• Rob’s RSA keynote preview: cyber safe harbors and AI velocity imbalance

Guest:

👤 Rob T. Lee – Chief of Research, SANS Institute

🔗 https://www.sans.org/profiles/rob-t-lee/

Host:

🎙️ David Malicoat, The Professional CISO Show

🌐 www.thpc.co

Listen & Subscribe:

🔊 Spotify: The Professional CISO Show on Spotify

🍎 Apple Podcasts: The Professional CISO Show on Apple

📣 Hashtags: #Cybersecurity #TheProfessionalCISO #RSA2025 #RobTLee #SANS #DFIR #AIinSecurity #CyberRisk #CISOLeadership #CTI #CyberSafeHarbor #LearnAIDaily #IncidentResponse #AIThreats #CyberCulture

Sponsors:

Rubrik (www.rubrik.com)

Guidepoint Security (www.guidepointsecurity.com)

In this episode of The Professional CISO Show, David Malicoat hosts a special two-part discussion live from GPSEC STL in St. Louis. First up is Marc Ashworth, CISO of First Bank and host of The Cyber Executive Podcast, who discusses leadership development, AI, mentorship, and why he started podcasting as a CISO. Then, Michael Evans, Head of Information Security at Energizer, shares his grounded take on data governance, foundational AI readiness, and why security conversations at live events are vital for industry growth.

Key Highlights:

• Marc Ashworth on AI maturity, team building, and starting a CISO podcast
• Michael Evans on AI implementation and why data governance must come first
• Live insights on talent retention, vendor risk, and security leadership
• A look ahead: quantum-safe encryption and what CISOs should watch next

Call to Action:

Subscribe to The Professional CISO Show for unfiltered conversations with the leaders shaping cybersecurity.

🎧 Listen on Spotify: The Professional CISO Show

📱 Listen on Apple Podcasts: The Professional CISO Show

🌐 More Episodes + Info: www.thpc.co

🔗 Follow us on LinkedIn: The Professional CISO Show

Hashtags:

#CyberSecurity #CISO #AI #DataGovernance #Leadership #TheProfessionalCISO #CyberPodcast #GPSEC #CyberTalent #QuantumSecurity #MarcAshworth #MichaelEvans

🔹 Live from CISO XC DFW (www.cisoxc.com) | Sponsored by Valence Security (www.valencesecurity.com)

In this field-recorded episode of The Professional CISO Show, host David Malicoat returns to CISO XC DFW for another round of dynamic, on-the-ground conversations with three influential cybersecurity leaders — each offering a unique and grounded perspective on today’s real-world risks and tomorrow’s security frontiers.

Cyber attorney and governance thought leader Shawn Tuma returns to discuss the resurgence of business email compromise (BEC), the importance of humility in cyber defense, and why AI governance is rapidly becoming a core CISO responsibility. Maritime security executive Glen Vickers walks us through the harsh realities of securing satellite-connected vessels, dealing with Starlink, and the challenges of maritime connectivity. Then, longtime friend of the show and security visionary Chris Cochran reveals his newest venture: Commandant, an AI-powered incident response co-pilot designed to fundamentally change how organizations respond to crisis events — complete with its own assistant, Lucy.

Throughout the episode, we also explore the challenges of securing SaaS ecosystems, managing identity at scale, and the rising importance of proactive vendor evaluation and tabletop readiness.

Whether you’re a field-hardened CISO or just starting your executive security journey, this episode brings you into the heart of cybersecurity’s most pressing conversations — unfiltered, insightful, and straight from the source.

🔑 What You’ll Learn in This Episode

• The dangerous re-emergence of BEC as a top threat vector — and why AI may be amplifying the risk
• Why CISOs must lead the charge on AI governance and strategy — or risk being sidelined
• How FIDO and identity modernization can reduce exposure to targeted fraud
• Insights on satellite cybersecurity, Starlink limitations, and maritime network vulnerabilities
• A behind-the-scenes preview of “Commandant,” an AI co-pilot for incident response — designed to help IR teams with note-taking, SLA tracking, notification workflows, and continuous tabletop exercises
• How vendor selection, tabletop simulations, and small supplier coordination can make or break your organization during a crisis
• Why humility, not hubris, is the most underrated leadership trait in cybersecurity

💬 Notable Quotes

🎧 Listen & Subscribe

📍 Available now on all major platforms:

🔗 Spotify

🔗 Apple Podcasts

🌐 Full episodes and show resources at www.thpc.co

📣 Stay Connected with The Professional CISO Show

📺 Watch on YouTube

💼 Follow on LinkedIn

🧠 Guest Info

• Shawn Tuma – Partner at Spencer Fane, co-author of GC + CISO Connection
• Glen Vickers – CISO at ABS Wavesight
• Chris Cochran – Co-founder, Commandant AI | Formerly of Netflix, NSA, Mandiant

📚 Related Episodes

• EP 71 – CISO Culture & AI Strategy
• EP 63 – AI Governance and the Role of the CISO
• EP 45 – Shawn Tuma on Legal Risk, AI, and Cyber Insurance

🔖 Hashtags

#CISO #CyberSecurity #TheProfessionalCISOShow #BusinessEmailCompromise #AIinSecurity #IncidentResponse #MaritimeCyber #StarlinkSecurity #ValenceSecurity #CommandantAI #LeadershipInCyber #FIDO #SupplyChainRisk #CyberInsurance #SaaSVisibility #RealWorldSecurity

Sponsors:

ObservoAI (www.observo.ai)

Guidepoint Security (www.guidepointsecurity.com)

In this episode of The Professional CISO Show, recorded live at GuidePoint Security’s GPSEC STL event, host David Malicoat sits down with David Young, Chief Revenue Officer at ObservoAI. Together, they unpack the explosive growth of security data, the hidden costs of legacy pipelines, and why modern SOCs are hitting a breaking point. David shares Observo AI’s origin story from within Rubrik, and how their AI-native platform helps security teams stop drowning in data, reduce costs, and uncover real threats faster. It’s a must-listen for CISOs, SOC leaders, and anyone dealing with the complexity of modern security data environments.

What You’ll Learn:

• Why traditional SIM and log management approaches are failing
• The origin of ObservoAI inside Rubrik’s massive 20PB security lake
• How AI and open-box ML models are transforming SOC operations
• Real-world cost reductions and productivity gains from major enterprises
• Where the future of data pipelines, SOAR, and AI in security is headed

Guest:

🎙 David Young, CRO at Observo AI

🔗 Connect: https://www.linkedin.com/in/davidmyoung/

Host:

🎤 David Malicoat, Host of The Professional CISO Show

🌐 www.thpc.co | LinkedIn

Listen + Subscribe:

🟢 Spotify

🍎 Apple Podcasts

Hashtags:

#Cybersecurity #CISO #SecurityData #AIinSecurity #SOAR #SecurityOps #ObservoAI #Rubrik #TheProfessionalCISOShow

Sponsors:

AIM Security (www.aim.security)

Guidepoint Security (www.guidepointsecurity.com)

In this special on-location episode, David Malicoat returns to The Professional CISO Show from the heart of the St. Louis cybersecurity scene—GPSEC STL—presented by GuidePoint Security and AIM Security.

He’s joined by two standout guests:

🔹 Andrew Wilder, CISO at VetCor and unofficial “cruise director” of the vibrant St. Louis CISO community

🔹 Carole Sharp, Lead Security Governance Analyst at Centene and a seasoned expert in GRC and risk quantification

From grassroots cybersecurity culture to the future of AI and post-quantum threats, this episode is a powerful snapshot of where security leadership is going—and who’s leading the charge.

🧠 Topics Covered

• The legendary St. Louis CISO community (“don’t mess with the family”)
• AI + DSPM in the real world: what’s working
• Agentic AI and the evolution of SOC work
• Risk quantification, FAIR, and practical GRC strategy
• The future of cybersecurity beyond AI: quantum readiness
• St. Louis as a cybersecurity hub with soul

🛠 Sponsored by AIM Security

AIM Security helps CISOs safely adopt AI across the enterprise—govern shadow AI, secure LLMs, and stop adversarial threats before they happen. Learn more at aimsecurity.ai

🔗 Subscribe & Follow the Show:

www.thpc.co

LinkedIn

Spotify

Apple Podcasts

#cybersecurity #CISO #AIsecurity #GPSEC #quantumcomputing #GRC #DSPM #TheProfessionalCISO #riskmanagement #infosec