The Risk Apogee

Healthcare organizations carry some of the most sensitive data in existence, yet the industry consistently ranks among the lowest in security investment. Jonathan Chan has spent more than twenty years building and securing technology across electronic payments and healthcare, two of the most heavily regulated and frequently targeted industries in the world.

In this episode of The Risk Apogee Podcast, Jonathan and MK Palmore examine what happens when digital transformation outpaces governance: organizations adopt tools before establishing the guardrails to manage what those tools expose.

Jonathan walks through the real cost differential between a compromised credit card and a compromised health record, why role-based access control is fundamentally mismatched to today's insider risk landscape, and how leaders can reframe security not as the department that slows things down but as the function that helps the business understand what it's actually risking.

1. Why the cost of a healthcare data breach is not a fixed dollar amount but an exponentially expanding exposure that can never be fully reversed, and what that means for how organizations should prioritize privacy risk.
2. How to reposition the security function from determining risk on behalf of the business to clearly explaining risk so stakeholders can make informed decisions together.
3. Why the push toward speed in technology adoption requires deliberate deceleration planning before acceleration causes compounding damage.

1. Shared Value Stakeholder Model: Jonathan's approach to modernization decisions: rather than security unilaterally approving or denying requests, both the requester and the security function establish shared value before proceeding, using brief collaborative sessions to align business need with risk posture.
2. Risk Explanation Over Risk Ownership: A reframing of the security leader's role: instead of positioning yourself as the person who determines risk for the organization, you explain risk clearly to stakeholders and let them decide, which produces better outcomes and reduces the adversarial dynamic.
3. Acceleration-Deceleration Planning: Borrowed from endurance athletics, this concept treats technology adoption like pacing: organizations that only accelerate without building in deceleration checkpoints, backup processes, and reversibility will burn out their teams and compound fragility across the business.
   
   

#EnterpriseRisk #HealthcareSecurity #DataPrivacy #InsiderRisk #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Most enterprise leaders are consumed by AI adoption. Almost none are preparing for what comes next. Quantum computing is advancing faster than the industry acknowledges, AI is accelerating its arrival, and the cryptographic infrastructure that protects data in motion today was never designed to survive what's coming.

Kelly Robertson is a cybersecurity strategist and CISSP instructor who has spent the past 18 months researching how these two forces interact, and where enterprise risk leaders are falling behind.

In this conversation with MK Palmore, Kelly makes the case that harvest-now-decrypt-later is already a live exposure most organizations can't even detect, that the managed AI provider model is an inevitability the market hasn't built yet, and that frameworks and policy enforcement remain the most durable advantages a security program can invest in. 

1. Why harvest-now-decrypt-later is a live, undetectable exposure, and what steps organizations can take to protect critical data in motion before Q Day arrives.
2. How the managed AI provider model will emerge to serve mid-market organizations that can't afford standing AI teams but can't afford to ignore AI governance either.
3. Why the distinction between automated and autonomous matters for security practitioners, and how enforcement, not mitigation, is where AI delivers the most defensible value today.
   
   

1. Harvest Now, Decrypt Later (HNDL) Threat Model: The risk that encrypted data intercepted today will be trivially decrypted once quantum computing reaches commercial viability. Robertson argues this should be the first priority, not crypto inventory, because the exposure is already accumulating and leaves no forensic trace.
2. Managed AI Provider (MAIP) Model: Robertson's proposed service model in which managed providers offer vetted, certified AI tool stacks to mid-market organizations, combining discovery, governance, and ongoing support in a sustained engagement rather than a one-time deployment.
3. Human on the Loop vs. Human in the Loop: A distinction Robertson draws between human operators embedded in every decision cycle (in the loop) and human operators positioned to govern exceptions, enforce policy, and adapt at the speed AI requires (on the loop). He argues the latter is the only sustainable model as AI-driven processes accelerate beyond human processing speed.
   
   

#QuantumRisk #AIGovernance #EnterpriseRisk #PostQuantumSecurity #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Ransomware actors are targeting unpatched edge devices and end-of-life hardware. Nation-state adversaries are compromising home office routers to pivot into critical infrastructure from trusted U.S. IP space. And most organizations still haven't built a relationship with the FBI field office in their city.

Brett Leatherman leads the FBI's Cyber Division and oversees the Bureau's global cyber operations, from disruption campaigns against ransomware ecosystems to intelligence-sharing partnerships with eight allied nations and Europol.

In this episode of The Risk Apogee podcast, he and MK Palmore work through the tension between the FBI's national security mandate and the criminal monetization threat, why tabletop exercises that include the C-suite and outside counsel produce measurably better incident response outcomes, and how the fracturing of ransomware-as-a-service groups after operations like Chronos has reshaped the threat landscape without eliminating it.

Things You Will Learn:

1. Why establishing a relationship with your local FBI field office before a breach happens is one of the most underused advantages available to enterprise security teams.
2. How the FBI's shift from targeting individual actors to dismantling adversary infrastructure is producing outsized disruption across the ransomware ecosystem.
3. Why small and medium businesses are being compromised not for their own data, but for their U.S. IP space, which nation-state actors use to pivot into critical infrastructure and government targets.
   
   

Tools & Frameworks Covered:

1. FBI Operation Winter SHIELD Top 10 Defenses: A publicly available framework at fbi.gov/winnershield outlining the ten most common defensive gaps the FBI encounters in incident response engagements globally. Brett recommends dropping these PDFs into an LLM to generate tailored questions for your security and IT teams.
2. Tabletop Exercise Design for Full-Spectrum Response: Brett's approach to incident response exercises that bring in not just the network defense team, but C-suite executives, board members, outside breach counsel, physical security, and law enforcement to surface contingencies that single-team exercises consistently miss.
3. Pre-Breach Counsel Engagement: The practice of having a substantive conversation with outside breach counsel before an incident occurs, specifically around what data to share with the FBI and why early information exchange accelerates containment and can unlock decryption capability.
   
   

#CyberRisk #Ransomware #NationalSecurity #EnterpriseRisk #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Enterprise risk doesn't stay inside a single department, but most organizations still manage it as though it does. Dana Barnes is the President of TRSS and a career executive whose path through IBM, Microsoft, Palo Alto Networks, and Dataminr gave him a cross-domain view of how program management, product security, real-time threat intelligence, and force protection all feed the same underlying challenge.

In this conversation on The Risk Apogee podcast with MK Palmore, Dana unpacks why insider threat remains the least invested risk area in most enterprises, how intelligence-driven approaches to supply chain and reputational risk reveal exposure that checklists never surface, and why organizations that resist outside assessments almost always have blind spots they can't see from the inside.

Things You Will Learn:

1. Why insider threat stays chronically underinvested despite its outsized potential for damage, and what both human trust and checkbox culture have to do with it.
2. How intelligence-grade risk management differs from compliance-driven approaches, and what it looks like when organizations actually map their full exposure across suppliers, partners, and board-level connections.
3. Why outside risk assessments consistently reveal what internal teams cannot, and how to use those findings as alignment tools rather than punitive exercises.
   
   

Tools & Frameworks Covered:

1. Intelligence-Grade Risk Management: TRSS's approach to moving beyond endpoint and compliance-driven security by combining data scientists, analysts, and AI-based tools into a unified risk platform that traces connections across supply chains, financial fraud, and adversary networks.
2. Blameless Postmortem (referenced from Google): A review framework where security incidents are examined without individual blame, creating an environment where teams can surface failures, learn from losses, and improve organizational resilience without fear of reprisal.
3. The Why as a Risk Management Instrument: Dana's operating principle that risk programs only generate buy-in when teams understand the business reason behind every control, assessment, and investment, turning compliance from a mandate into an operational advantage.
   
   

#EnterpriseRisk #InsiderThreat #SupplyChainRisk #RiskIntelligence #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Public sector cybersecurity leaders face a resource equation that doesn't exist in the private sector: every security investment is weighed directly against public safety, housing, and essential city services. Austin Davis is the CISO for the City of San Jose, the twelfth largest city in the United States, and a veteran whose career spans military service, law enforcement, and enterprise security.

In this episode of The Risk Apogee Podcast, he and MK Palmore work through why cybersecurity leaders in government operate under fundamentally different budget constraints than those in the private sector. How pension obligations and procurement rules compound the staffing challenge, and why the cybersecurity profession still lacks the kind of universally adopted career pathway that exists for physicians, attorneys, and pilots.

Austin also addresses AI's rapid, often unannounced integration into legacy city systems, the governance gap it creates, and the real defensive potential he sees once the right human-machine boundaries are drawn.

1. Why public sector cybersecurity budgets compete against fundamentally different priorities than enterprise budgets, and how that changes every risk conversation.
2. Why the cybersecurity profession's lack of a universally adopted career pathway is a structural driver of the talent shortage, not just a training gap.
3. How AI is quietly being added to legacy government systems, creating new security risks that many organizations don't realize they've inherited.
   
   

1. Audience-Specific Risk Translation: Austin's practice of reframing cybersecurity risk in terms that match each stakeholder's operational reality: financial impact for finance teams, operational readiness for law enforcement, service continuity for department heads. The principle is that the same risk must be communicated differently depending on who needs to act on it.
2. Professionalized Career Pathway Model: The argument that cybersecurity should adopt the kind of structured, universally recognized career progression used by medicine, law, and aviation with defined skill gates, hands-on progression, and a clear distinction between foundational certification and practitioner readiness.
3. Legacy System AI Governance: The emerging requirement to re-review previously approved systems when vendors push AI components into existing products, since the original security review no longer reflects the system's actual risk profile.
   
   

#PublicSectorCybersecurity #CyberWorkforce #AIGovernance #RiskLeadership #EnterpriseRisk

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Promoting someone based on what they can execute tactically tells you very little about whether they'll succeed at the next level. Teddra Burgess spent nearly three decades in enterprise technology sales and public sector strategy before founding Chasing Outcomes, an executive advisory and federal go-to-market consulting firm.

Teddra sits down with MK Palmore to unpack why corporate leadership pipelines keep producing the same blind spots: heavy investment in competency assessment, almost no preparation for stakeholder complexity, cross-functional politics, or the art of understanding what motivates the person on the other side of the table.

The conversation moves from there into the realities of entrepreneurship after enterprise: what it means to be the product, why scale is the question founders chronically underestimate, and how AI has rewritten the math on what a single operator can accomplish.

1. Where corporate leadership development consistently breaks down, and why the gap between tactical competency and senior-level influence is where organizations lose their best people.
2. What federal go-to-market strategy actually requires, and why even the best technology won't matter without a clear procurement path.
3. The scaling, boundary-setting, and partnership decisions that define whether an entrepreneurial leap succeeds or stalls.
   
   

1. Motivation Mapping for Cross-Functional Influence: Before attempting to build consensus or drive alignment, understand what is urgent and important to the stakeholder across from you. Their priorities are not your priorities — and acting as though they are is where influence breaks down.
2. Succession Planning as Organizational Diagnostic: Not just an HR exercise. When done honestly, it forces leaders to confront gaps at every level, check their ego, and assess whether the bench is actually ready or just familiar.
3. Complementary Partnership Model: Instead of rushing to hire, identify entrepreneurs with adjacent expertise and build capacity through partnership first. Scale through alignment before committing to headcount.
   
   

#LeadershipDevelopment #EntrepreneurshipAfterEnterprise #FederalGoToMarket #PeopleDevelopment #EnterpriseRisk

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Organizations across the defense industrial base, healthcare, and critical infrastructure are treating compliance frameworks as the ceiling of their security investment rather than the floor, and doing so while geopolitical adversaries are already inside their supply chains.

Michael McLaughlin sits at the intersection of cybersecurity, law, and national security, and in this conversation he walks through how Iranian-aligned cyber actors are drawing private sector companies onto a battlefield they never expected to occupy, how North Korean IT workers are bypassing HR processes to gain admin-level access at Fortune 100 companies, and why the race to adopt AI is repeating every structural mistake cybersecurity has already made.

He also digs into why the CISO still lacks a real seat at the C-suite table, why insurance has become a crutch rather than a component of risk posture, and what actual resilience looks like when an incident lasts three weeks instead of three hours.

Things You Will Learn:

1. Why treating regulatory frameworks as ceilings instead of floors leaves organizations exposed to motivated nation-state actors who operate well beyond any compliance baseline.
2. How converged risks demand cross-functional security involvement that most CISOs still don't have the authority to execute.
3. Why the rapid adoption of AI without applying secure-by-design principles and the CIA triad to models, training data, and infrastructure will reproduce cybersecurity's foundational failures at an exponential scale.
   
   

Tools & Frameworks Covered:

1. Frameworks as Floors, Not Ceilings: The principle that CMMC, HIPAA, and similar regulatory baselines represent the minimum acceptable security posture, not the endpoint, and that organizations must build above them based on their specific threat landscape and attack surface.
2. The CIA Triad Applied to AI: Extending confidentiality, integrity, and availability analysis to AI models: protecting prompt data from leakage, preventing training data poisoning and model drift, and ensuring model availability and redundancy beyond single-point infrastructure dependencies.
3. Operational Resilience Beyond Incident Response: The military-derived concept that resilience means maintaining business operations during a sustained incident, not just detecting, responding, and recovering, but practicing pen-and-paper continuity and out-of-band communications for multi-week disruptions.
   
   

#EnterpriseRisk #CyberSecurity #GeopoliticalRisk #CISO #CyberResilience #BusinessContinuity #AIGovernance

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Most organizations still manage human risk by training employees and hoping the behavior changes. That approach has never been grounded in evidence, and AI is making it dangerously obsolete. Oz Alashe is the founder and CEO of CybSafe, a behavioral AI security company that treats human risk as a measurable, data-driven variable rather than a compliance checkbox.

A former lieutenant colonel in the British Army with a Special Forces and intelligence background, Oz brings an operator's discipline to a problem the industry has largely hand-waved. In this conversation, he and MK Palmore work through the tension between the speed of AI-driven transformation and the slower, harder work of establishing trust.

Oz explains why predictive behavioral analytics are now possible at scale, why scaling the shortcuts of your best salespeople through AI agents is a compounding risk, and why the security behavior ontology his team is building may finally connect human behavior to actual risk outcomes.

Things You Will Learn:

1. Why treating human risk as a training problem produces no measurable risk reduction, and what an evidence-based behavioral approach looks like instead.
2. How AI agents trained on human behavior are scaling organizational shortcuts at machine speed, creating compounding risk most enterprises haven't accounted for.
3. Why the erosion of trust between humans, between humans and machines, and across authentication models, is the defining risk challenge of the next 18 months.

Tools & Frameworks Covered:

1. Security Behavior Ontology: CybSafe's mapping of every security behavior through to every risk outcome and control, designed to move organizations beyond training-and-hope toward measurable behavioral risk management.
2. OODA Loop as AI Tempo Accelerator: The application of John Boyd's Observe-Orient-Decide-Act framework to AI-enabled security operations, where the real advantage isn't scale or capacity but the speed of the decision loop itself.
3. Behavioral Vulnerability as Risk Variable: The framework of treating human behavior as a measurable component of the vulnerability side of the risk equation, rather than treating awareness as a proxy for security.

#HumanRisk #BehavioralSecurity #EnterpriseRisk #AIAgents #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

The market rewards speed over security, and most executive teams are making resource decisions accordingly, but that trade-off becomes existential when adversaries are stockpiling encrypted data and quantum computing is approaching viability.

Kathryn Wang is the Principal Public Sector Lead at SandboxAQ, CEO of CTRL+Alt+Defeat,io, and a board advisor whose career spans cybersecurity partnerships, defense technology, and national security. In this conversation, she and MK Palmore work through why AI's biggest enterprise impact so far has been workforce reduction rather than workforce amplification, how counterfeit and trojanized hardware exposes the limits of compliance frameworks like the software bill of materials, and why post-quantum cryptography should be treated as an urgent priority rather than a future concern.

Kathryn shares her framework for cutting through the noise: identify your existential threat, lock down your crown jewels, and stop distributing limited security resources across a perimeter you cannot fully defend.

Things You Will Learn:

1. Why identifying and securing your organization's crown jewels is the highest-leverage move when you're outgunned and under-resourced.
2. How the gap between compliance requirements and actual security effectiveness is widening, and why compliance theater remains a structural problem even at the federal level.
3. What post-quantum cryptography means for enterprise data protection and why the "harvest now, decrypt later" threat model demands action today.
   
   

Tools & Frameworks Covered:

1. Crown Jewel Prioritization: Identify what will shut the company down, determine what adversaries actually want, and concentrate protection there rather than spreading resources across the full perimeter.
2. Measured Optimism on AI Adoption: A decision lens for evaluating AI use: what is the job to be done, how does the tool help, and what are the ways you can injure yourself with it — versus treating AI as a hammer and looking for glass to break.
3. Post-Quantum Cryptography Readiness: The strategic imperative to ensure crown jewel data cannot be ransomed or decrypted when quantum computing reaches viability, given that adversaries are already harvesting encrypted data for future decryption.
   
   

#EnterpriseRisk #PostQuantumCryptography #AIAdoption #CriticalInfrastructure #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

State governments are under pressure to adopt AI, strengthen cyber resilience, and build workforce pipelines, all at the same time, and without leaving communities behind. In this conversation recorded live at the RSAC Conference in San Francisco, MK Palmore sits down with Maryland Lieutenant Governor Aruna Miller, Secretary of Labor Portia Wu, and Secretary of Commerce Harry Coker.

They discuss why Maryland has made cybersecurity, AI, and computational health lighthouse priorities under Governor Moore's administration, how the state is standing up AI subcabinets and cyber clinics to close the gap between graduating talent and evolving entry-level roles, and why cyber resilience now means operating through compromise rather than preventing it entirely.

Things You Will Learn:

1. Why cyber resilience requires organizations to plan for operating through compromise and how state-level leaders are reframing that conversation.
2. How Maryland is using cyber and AI clinics, train-the-trainer models, and cross-institutional mandates to rebuild the entry-level cybersecurity talent pipeline as AI reshapes junior roles.
3. Why bringing the workforce into AI adoption decisions before deployment is both an equity imperative and a practical requirement for successful technology implementation.

Tools & Frameworks Covered:

1. Lighthouse Sector Strategy: Maryland's approach to focusing state investment and ecosystem-building around specific sectors, including cybersecurity, AI, life sciences, quantum, and aerospace, creating intentional corridors for startup growth and talent development.
2. Cyber Resilience as Operational Continuity: Secretary Coker's framing that the adversary is already inside the house, and that resilience means continuing to operate through compromise rather than treating prevention as the sole objective.
3. Regional Cyber and AI Clinics: A state-funded model requiring cross-institutional collaboration to give current students and new graduates hands-on cybersecurity and AI experience, addressing the gap created by AI's displacement of traditional entry-level SOC and compliance roles.

#CyberResilience #AIGovernance #CyberWorkforce #EquityInTech #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!