The Security Strategist

“For a long time, we focused on defending the perimeter and thought that was enough to keep businesses safe,” stated Ram Varadarajan, CEO and Co-founder of Acalvio. “It’s like putting locks on doors. The problem is that more people are finding ways to cross those boundaries and enter your business at an alarming rate.”

In the recent episode of The Security Strategist podcast, Chris Steffen, the Vice President of Security Research at Enterprise Management Associates (EMA), sits down with Varadarajan to talk about how deception is changing threat detection in compromised enterprise environments. 

The CEO of Acalvio, alluding to the main issue in modern cybersecurity, explains that the old security model, which aims to create an impenetrable perimeter, is no longer enough. Attackers, equipped with more advanced tools, are discovering new methods to bypass these defences. The old "fortress mentality" is outdated.

Both Varadarajan and Steffen agree that modern-day cybersecurity is not a matter of if an attacker will get in, but it's about anticipating when the attacker will get in. This mindset, referred to as "assumed compromise," means that a determined attacker will eventually find a way inside your network, especially with AI in the picture.

Varadarajan explains, "The defender has to be right all the time in stopping the attacker at the door, whereas the attacker needs to be only right once to get past the perimeter and get inside the house."

This imbalance gives attackers a significant edge. The vast number of entry points—from on-premise systems to cloud services and remote access—makes it impossible to secure each one perfectly. Consequently, the focus should be on what happens after an attacker is inside.

So, how are businesses approaching such constantly looming threats?

This is where deception technology becomes an effective, proactive defense strategy. Instead of waiting for a breach to happen and then trying to fix the damage, deception actively engages and misleads the attacker.

"If you're assuming that the attacker is going to be inside, the question is how do you find these attackers and bad actors quickly and precisely so that you can conduct the enterprise's business?,” elucidates Varadarajan.

Deception technology creates a web of fake assets, data, and credentials, forming a digital minefield for attackers. When an attacker tries to move laterally through the network or gain higher privileges, they interact with these decoys. This interaction provides an immediate, clear signal that a malicious actor is present, allowing defenders to stop them before they can reach their real target.

The old methods of securing a network are no longer enough, agree both Varadarajan and Steffen. The rise of sophisticated, AI-driven attacks requires a new, proactive approach.

"Preemptive defense based on deception is a very legitimate and well-understood way of solving this problem,” stated Varadarajan.

Enterprises are advised to switch strategy from defending the perimeter to actively deceiving and identifying within the network. This would help organisations to regain control. Deception technology offers a vital home-field advantage, making it an important part of any modern cybersecurity strategy.

• Deception technology is a natural and effective strategy in cybersecurity.
• Traditional perimeter defenses are no longer sufficient against modern threats.
• The 'assumed breach' mindset is essential for contemporary cybersecurity strategies.
• Operationalizing deception technology can significantly enhance threat detection.
• AI can streamline the creation and management of deception environments.
• Preemptive defense is more effective than reactive strategies in cybersecurity.
• Organizations must adapt to the increasing number of entry points into their networks.
• Reducing dwell time for attackers is crucial for effective defense.
• Cybersecurity strategies should account for both external and internal threats.
• Deception technology can help identify both active attackers and dormant malware.

• 00:00 Introduction to Cybersecurity Challenges
• 03:05 Understanding Deception Technology
• 06:14 Shortcomings of Conventional Cybersecurity
• 09:11 The Shift from Fortress Mentality
• 12:03 Assumed Breach: The New Normal
• 15:00 Operationalizing Deception Technology
• 18:01 The Role of AI in Cybersecurity
• 21:03 Velocity of Cyber Attacks
• 23:46 Preemptive Defense Strategies
• 26:59 Key Takeaways and Conclusion

Passwords remain one of the weakest links in enterprise security. Despite advances in multi-factor authentication (MFA), recent data breaches show that attackers continue to bypass traditional protections. In this episode of The Security Strategist, host Trisha Pillay speaks with Nic Sarginson, senior solutions engineer at Yubico.

Together, they explore the vulnerabilities of passwords and conventional MFA, and why phishing-resistant authentication is no longer optional; it’s a strategic imperative for chief information security officers (CISOs).

"Passwords alone just don’t cut it," says Sarginson. Hackers can launch sophisticated attacks in minutes, and traditional MFA often isn’t enough to stop them. Organisations should turn to device-bound passkeys and physical security keys not just as tools, but as a way to rethink enterprise security, stay ahead of compliance pressures, and embrace a passwordless future.

"Attackers can now launch sophisticated campaigns quickly and cheaply using publicly available data. That’s why breaches today are far more dangerous, and why weak MFA or social engineering is often involved." — Nic Sarginson, Yubico,

Cybersecurity leaders face growing pressure to defend against phishing attacks, navigate evolving compliance demands, and deliver secure experiences for users. Sarginson shares practical strategies, expert insights, and real-world examples to help CISOs and IT leaders build a stronger, passwordless future.

• Passwords are fundamentally broken and pose a major vulnerability.
• Recent breaches highlight the inadequacy of traditional MFA.
• Device-bound passkeys offer stronger protection against phishing.
• Integration of new security methods is a significant challenge for enterprises.
• Real-world case studies show measurable improvements with security keys.
• Regulatory frameworks are increasingly mandating strong MFA.
• Phishing resistance must become the default in security strategies.
• The technology for passwordless solutions is now prevalent.
• Security leaders must advocate for proactive security measures.
• User education is crucial for the adoption of new security technologies.
• 
  

00:00 Introduction to Authentication Challenges

02:15 The Impact of Recent Data Breaches

05:30 The Entrenchment of Passwords and MFA

08:22 Exploring Device Bound Passkeys

11:20 Integrating Physical Security Keys

14:34 Real-World Case Studies and Metrics

17:24 Regulatory Pressures and Future Trends

20:27 The Path to Passwordless Security

Nic Sarginson is a senior solutions engineer for UKI and RSA at Yubico. An industry veteran, he has held a range of roles in cybersecurity and enterprise solutions, helping organisations adopt strong authentication methods and enhance their phishing resistance strategies.

"With every technological wave, technology weaponises very quickly. You can create targeted attacks at an unprecedented scale, a human-centric attack at a scale that's never been before humanly possible,” states Sage Wohns, CEO and Founder of Jericho Security. 

In this episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, speaks with Wohns about modern-day cybersecurity threats driven by AI. They discuss the need for a strong security culture, innovative training methods, and the importance of adapting to new attack vectors. 

The founder of Jericho Security, an AI-powered human risk management platform, talks about the shift from traditional rule-based defences to probabilistic approaches. Additionally, Wohns spotlighted the necessity of using AI to counter AI in the fight against cyber threats. 

The speakers agree that every organisation today has one common and new challenge. It’s the rise of generative AI. This is because gen AI is a tool quickly and widely being used in cyber tech. “We have moved past simple, templated attacks to a new era,” iterated Wohns. Threats have now become more dynamic, personalised, targeted and scalable in ways the world has never witnessed before.

For years, cybersecurity training has depended on static, rule-based defences. Consider those generic phishing emails from a "Nigerian Prince" or a fake Google logo. However, as Wohns points out, attackers no longer follow a script. They are using AI to create complex, multi-channel attacks that can take advantage of publicly available information and stolen data to target individuals.

This new reality shows that old "checkbox training" is outdated. An attack on a salesperson will differ significantly from an attack on an accountant, and both will be tailored to exploit specific weaknesses. These attacks go beyond emails; they include deepfake voice calls, fake videos, and coordinated messages that blur the line between what is real and what poses a threat.

• AI is rapidly changing the landscape of cyber threats.
• A strong security culture is essential for organisations.
• Traditional training methods are outdated and ineffective.
• Probabilistic defences are needed to counter dynamic attacks.
• Creating a positive security culture encourages reporting mistakes.
• Multi-channel attacks are becoming more sophisticated.
• Generative AI can be used to simulate realistic attacks.
• Tailored training can enhance employee engagement and effectiveness.
• Using real-world data makes training relevant and impactful.
• AI solutions must evolve to keep pace with attackers.

• 00:00 Introduction to Cybersecurity and AI Threats
• 03:01 The Evolution of Cyber Threats
• 05:50 Innovative Approaches to Security Training
• 08:55 Probabilistic Defences vs. Rule-Based Systems
• 11:49 Creating a Positive Security Culture
• 15:02 Multi-Channel Attacks and Emerging Threats
• 18:13 Key Takeaways for IT Decision Makers

Jericho Security is transforming cybersecurity training with an AI-powered platform that defends against modern phishing threats. Its proprietary agentic AI delivers multi-channel simulations mimicking real-world attacks across email, voice, messaging, and video. Designed for highly scalable deployments, customizable training and performance tracking. Trusted by the U.S. Department of Defense and honoured with four Global InfoSec Awards at RSA Conference 2025, Jericho is at the forefront of human-centred, AI-driven cyber defence.

When cybercriminals breach an organization, they're not just after one piece of data - they're hunting for the keys that unlock everything.

"Think of Hardware Security Modules (HSMs) like a master vault in a bank for an entire organization's digital security," said David Close, Chief Solutions Architect at Futurex. More than just an analogy, this is the reality of how modern enterprises are secured.

Cybersecurity is full of complexities despite various advancements. Some aspects of it run constantly behind the scenes and occasionally go unnoticed until a breach strikes. Among these essential elements, Hardware Security Modules (HSMs) play a key role in maintaining digital trust. 

In a recent episode of The Security Strategist podcast, Richard Stiennon explores with Close why HSMs have become the invisible guardians protecting our digital lives.

At its core, a Hardware Security Module (HSM) is specialized, tamper-proof hardware that protects cryptographic keys and performs cryptographic operations. Close alludes to an analogy to describe an HSM, stating it's "the vault where you store all the keys to everything. The vault keys, the safety deposit keys, even the digital keys to the security system itself." 

Born in the early 1980s for the payment industry, HSMs have evolved into the root of trust for almost every sector. They verify authenticity and safeguard encryption for tasks like processing payments, signing code, issuing identities, and encrypting sensitive data. 

"If someone gets into the master vault, they don't just have access to one thing. They have access to everything," says Close, illustrating the importance of HSMs for stronger security. This is why regulatory bodies like PCI mandate HSM usage for organizations handling sensitive payment data.

To make HSMs more accessible and user-friendly, Futurex's main solution is CryptoHub Cloud. It works as an HSM as a Service (HSMaaS).

Close describes HSMaaS as not just a cloud version of HSM but a "centralized cryptographic service provider." Unlike some solutions that operate in shared cloud infrastructure, Futurex's CryptoHub Cloud runs in purpose-built cryptographic environments that are fully isolated. 

Such a unique approach gives customers full control, predictable performance, and independence from the cloud provider's native crypto stack. This is also an important factor for organizations in regulated industries.

"HSMs don't just solve crypto problems,” says Close, “they create predictability and enforce policy, also allow you to have a true security model that is effective at scale."

In a world that depends more on digital systems, it is essential to understand and use the power of HSMs. They act as invisible protectors, making sure our most sensitive digital assets remain secure and trustworthy.

• HSMs are essential for protecting cryptographic keys and sensitive data.
• The evolution of HSMs has made them easier to use and integrate into cloud environments.
• Crypto agility allows organizations to adapt to new cryptographic algorithms without replacing existing infrastructure.
• HSMs enforce strict access controls and audit logs for all cryptographic operations.
• Regulatory bodies mandate the use of HSMs for managing sensitive payment data.
• HSMs provide a physical layer of security that software alone cannot offer.
• Organizations can achieve significant performance improvements by offloading cryptographic operations to HSMs.
• Futurex's CryptoHub Cloud offers a centralized cryptographic service for organizations.
• HSMs help organizations meet compliance requirements while leveraging cloud benefits.
• Real-world use cases demonstrate the operational efficiencies gained through HSM deployment.

• 00:00 Introduction to Cybersecurity and Cryptography
• 02:19 Understanding Hardware Security Modules (HSMs)
• 08:00 FuturexX CryptoHub Cloud and Its Applications
• 11:04 The Importance of HSMs in Payment Security
• 13:02 True or False: HSM Myths and Facts
• 20:56 Real-World Use Cases of HSMs

For over 40 years, Futurex has been an award-winning leader and innovator in the encryption market, delivering uncompromising enterprise-grade data security solutions. Over 15,000 organizations worldwide trust Futurex to provide groundbreaking hardware security modules, key management servers, and cloud HSM solutions.

Futurex is headquartered outside of San Antonio, Texas, with regional offices worldwide and over a dozen data centers across five continents, and delivers unmatched support for its clients’ mission-critical data encryption and key management requirements.

"In this technology-centric world, where we see new advantages, new paths, new adventures, at the end of the day, the other side of the screen is always a human being,” Bartosz Skwarczek, Founder & President at G2A Capital Group, reflectively said. 

The quote sets the tone of the recent episode of The Security Strategist podcast. In this episode, Shubhangi Dua, Podcast Host and Producer, sits down with Skwarczek, an award-winning CEO recognised by Forbes. They talk about the evolution of online marketplaces, the importance of security, and the role of people in business. 

They discuss the challenges of operating a global marketplace, the significance of diversity in teams, and the future of payment security technologies. 

Bartosz emphasises the importance of a proactive approach to cybersecurity and the use of AI in business operations. He also highlights the essential role of human values and communication in creating a successful organisation.

Security is a top priority for G2A, Skwarczek articulated. He adds that it's a "constant improvement" and a "kind of battle that you have with the bad actors." To stay "one step ahead of attackers," G2A deploys a multi-layered defence strategy.

The multi-layered strategy starts with careful monitoring of threat intelligence channels to ensure organisations stay on top of the latest threats, vulnerabilities, and methods used by malicious actors.

A dedicated incident response team has clearly defined roles and responsibilities. They can respond immediately to any security incidents, especially those related to different types of fraud, such as friendly fraud (chargeback fraud) or traditional credit card fraud. 

Skwarczek says that employee training is extremely important. G2A conducts mandatory training every month for its employees, assuring they know how to avoid common mistakes like phishing emails. Especially considering that over 3 million phishing emails are sent every day.

Skwarczek also emphasises the importance of these ongoing audits. Alluding to the constantly changing market, He says cyber criminals constantly devise new tricks. This is why frequent evaluations are needed to ensure G2A is moving in the right direction. 

Looking ahead, Skwarczek talked about the future of payment security. He recognised the complicated relationship between new technologies and strict regulations.

The payment industry is inherently "conservative because it's regulated," he added, with extensive regulatory frameworks that ensure the safety of people's money. This intentional pace, however, coexists with rapid technological advancements. Skwarczek specifically pointed to the growing influence of AI and blockchain.

While AI offers immense promise in enhancing security and streamlining operations, it's also a "double-edged sword," with "bad actors" leveraging AI to become "smarter with cheating." G2A's approach to AI is to be "AI native," focusing on educating every department on the basics of AI and guiding them to use specific AI tools relevant to their functions, from marketing to security. Regular evaluations ensure that these AI implementations are effective and continually improved.

• The core message is always about people.
• Security is a top priority in online marketplaces.
• Diversity presents both challenges and opportunities.
• Building a strong team is essential for global operations.
• AI can be both beneficial and a threat in cybersecurity.
• Education and training are crucial for preventing phishing attacks.
• Proactive cybersecurity measures are necessary to stay ahead of threats.
• Communication within teams is vital for success.
• Diversity enhances problem-solving and innovation.
• The future of payment security is uncertain but full of potential.

00:00 Introduction to G2A and Bartosz Skwarczek

02:10 The Importance of People in Business

03:23 Understanding Cloud Marketplaces

05:08 Security Frameworks in Online Marketplaces

06:38 Challenges of Global Payment Diversity

11:15 Building a Strong Team for Global Operations

15:54 The Role of AI in Cybersecurity

20:03 Securing Transactions and Avoiding Fraud

24:40 Proactive Cybersecurity Measures

27:34 The Importance of Communication in Teams

29:52 Diversity as a Strength in Business

32:03 Future of Payment Security Technologies

36:37 Key Takeaways for Decision Makers

G2A.COM is the largest and most trusted marketplace for digital entertainment in the world. More than 30 million people in 180 countries have made over 100 million purchases on the platform. 

Customers can explore a vast catalogue of over 75,000 digital products, including games, DLCs, in-game items, and non-gaming items like gift cards, subscriptions, software, and e-learning resources. These products are offered by sellers from around the globe.

G2A.COM is also known for its strong focus on online security. It has received the American CNP award, joining well-known companies like Microsoft, Barclay's Bank, and First Data.

Artificial intelligence (AI) is on everyone’s mind, and its impact doesn't escape the cybersecurity industry. The industry experts acknowledge not just the benefits but also the cybersecurity threats of AI integrations.

As Pascal Geenens, Director of Threat Intelligence at Radware, puts it, "It's AI, so everything is changing weekly. What I talked about two weeks ago has already changed again." 

The constant change means that malicious actors are not just adopting AI, they're leveraging it to create new threats at a striking pace. 

In this episode of The Security Strategist Podcast, Richard Stiennon, an industry Analyst, Author and Chief Research Analyst at IT-Harvest, speaks with Geenens.

They discuss how cybersecurity threats are enhanced by AI. This includes how attackers are using AI tools, the implications of new technologies like agentic AI, and the challenges posed by AI advancements. 

The conversation also touches on the role of nation-states in utilising AI for cyber operations, the concept of vibe hacking, and the future of interconnected AI agents.

Malicious hackers evidently first used AI in 2023, specifically through prompt injection attacks on large language models (LLMs) such as ChatGPT. 

Attackers would find "evasion techniques" to bypass ethical guardrails, asking questions indirectly to generate malicious scripts or gather information for attacks. 

Geenens says, "If you would ask the direct question, how can I commit a murder and get away with it? He would say, no, no, no, that goes against my ethical principles. But there are ways around it."

The game changed with the emergence of offline models and specialised services like WormGPT and FraudGPT. These models, distilled from larger ones and enhanced with hacking-specific information from underground forums, lowered the barrier to entry for aspiring cyber criminals. 

"They created their own model and sold it as a service underground. And that model was geared towards helping anyone with questions to interact with a prompt and to make their malware better, increase the effectiveness of their malware," explained Geenens. 

This accessibility meant that "more actors would actually move from script kiddie level to a more sophisticated level." Teenagers, in particular, took advantage of these AI assistants. They provided a friendly, non-toxic environment to learn and develop hacking tools, unlike the often unwelcoming underground forums.

In 2024, the focus shifted to AI agents, which provide attackers with automated workflows. Unlike LLMs, agents can interact with their environment, gather updated information, execute tools, and even spawn new agents that communicate with each other. 

"You can have a manager agent that says, okay, I need to develop something. It’s a big problem here. I need to develop a tool. I have an agent that does the development. I have an agent that does the QA testing,” depicts Geenens. “And then I have another agent who's a problem solver who will help the other tools do their job. And they interact with each other.”

This agentic capability majorly hastens the exploitation of vulnerabilities. Research showed that AI agents can quickly rebuild proof-of-concept exploits for published CVEs. 

Geenens stressed the dramatic reduction in time: "Earlier, when the CVE was published, it took 24 hours-48 hours and a security researcher who typically posted a proof of concept online in Python before the actual attacks in the wild would start.” 

“But now with those agents and those workflows has been proven as much easier to get access and to get a proof of concept. That window might now reduce from 48 hours to a couple of minutes,” he added. 

• AI is changing the landscape of cybersecurity threats.
• Attackers are using AI to enhance their hacking capabilities.
• Guardrails in AI are not foolproof against malicious intent.
• Teenagers are increasingly entering the cybercrime space due to AI tools.
• Agentic AI allows for automated workflows in attacks.
• The sophistication of attacks has not drastically changed, but entry barriers have lowered.
• Nation-states are using AI for disinformation and phishing.
• Vibe hacking represents a new frontier in automated vulnerability discovery.
• MCP and agent-to-agent protocols will shape the future of AI interactions.
• AI will be necessary to combat AI-driven threats.

00:00 AI in Cybersecurity: The New Frontier

06:51 The Evolution of Hacking: From Script Kiddies to AI-Enhanced Threats

12:48 Nation States and AI: The New Age of Cyber Warfare

15:12 Vibe Hacking: The Future of Coding and Security

19:14 The Internet of Agents: A New Era in Cybersecurity

25:11 Emerging Threats: Indirect Prompt Injection Attacks

"The thing to challenge is the fact that fraud prevention is a vertical by itself," says Guido Ronchetti, CTO at XTN Cognitive Security. He stresses that recent fraudulent trends exhibit "no real separation between fraud, cybersecurity, and AML.”

In this episode of The Security Strategist podcast, Jonathan Care discusses fraud prevention with Ronchetti and Paolo Carmassi, Head of Sales at XTN. They explore the connection between fraud, cybersecurity, and artificial intelligence (AI), emphasising the need for a holistic approach to tackle modern fraud challenges. 

The conversation further spotlights how to take advantage of local identity and data privacy as competitive advantages, particularly in Europe. The speakers discuss emerging threats such as shell game malware. 

The relation between fraud, cybersecurity, and AI is apparent in scenarios like authorised push payment fraud. It often involves an initial data breach, followed by social engineering, and culminating in financial fraud. 

To effectively fight such threats, a detailed picture of the entire "kill chain" is critical. It should include expertise from cybersecurity and anti-money laundering (AML).

Expanding on “kill chain,” Carmassi says that "fraud is no longer a case of just the banking industry or the financial services at large. It's something that is starting to spill out into other industries as well." 

The head of sales points to examples in gambling, with issues like account takeover and bonus abuse, and even the automotive sector, where app vulnerabilities could lead to physical security threats. 

The emergence of sophisticated bots further complicates this space. That makes it a unified defence strategy pressing across all sectors.

Alluding to an example, Ronchetti explained, "Last year we were dealing with one of the top 10 European banks. The reason for that was GDPR." The bank had to replace a well-established American vendor after over a year of a Proof of Concept (POC). This was because the vendor's data-sharing practices, particularly with clients outside the European Union, clashed with GDPR requirements. 

This incident stresses the importance of a provider's ability to tackle the complex European regulations. The upcoming AI Act further accentuates this divide, with European and US approaches to AI regulation diverging significantly.

The episode concludes with insights on the future of fraud prevention, focusing on trust and the integration of behavioural biometrics.

• Fraud prevention must integrate with cybersecurity and AI.
• The traditional view of fraud as a silo is outdated.
• Emerging technologies blur the lines between industries.
• GDPR sets a global standard for data privacy.
• Cultural and geographical factors influence fraud solutions.
• New threats like shell game malware are evolving.
• Younger demographics are becoming targets for fraud.
• Trust is essential for competitive advantage in fraud prevention.
• Behavioural biometrics can enhance identity validation.
• A holistic view of fraud prevention is necessary.

00:00 Introduction to Cognitive Security

04:01 Rethinking Fraud Prevention

08:12 Leveraging Local Identity and Data Privacy

11:53 European-Centric Fraud Solutions

16:07 Behavioural Biometrics in Fraud Prevention

20:11 Emerging Threats in Fraud

23:59 Future Paradigms in Fraud Prevention

XTN is a European vendor of online fraud prevention solutions, empowering organisations to trust their digital users. Our AI-powered platform delivers top-level protection against fraud and cyber threats across multiple sectors and channels. Since 2024, XTN has been part of the CY4GATE Group, strengthening its international leadership in the cybersecurity sector.

"What we're seeing now is a lot of the vendors that were traditionally one of the identity pillars are kind of expanding into other pillars,” says Kevin Converse, Vice President, Identity and Access Management, GuidePoint Security. 

In this episode of The Security Strategist podcast, Richard Stiennon speaks with Converse, VP at GuidePoint Security. They discuss identity management, focusing on identity convergence, the impact of agentic AI, and the complexities of non-human identities. 

The conversation also taps into ethical dilemmas surrounding AI decision-making and future predictions for digital identity in a rapidly changing technological environment.

Identity and Access Management (IAM) takes centre stage in this episode. The speakers spotlight two major relevant trends – identity convergence and the influence of agentic AI on digital identity.

Converse explains that traditionally, IAM was built on "three pillars—the IGA stack, the privilege access management, and the access manager." However, a change in fashion is taking place where "a lot of the vendors that were traditionally one of those pillars are kind of expanding into other pillars."

This change is a result of cybersecurity challenges that require businesses to adopt comprehensive solutions and tap into new markets. Converse further notes, "Some of it for the capabilities so they can expand on what they're doing, but it's also to hit some customers and verticals that we didn't usually do in identity." 

This means moving from a multi-tool approach to a more unified platform, aiming to provide a "one-stop shop" for identity needs. 

"There's a lot of focus on unified platforms for identity, particularly," Converse says, "that's a big investment piece right now." He also points out, "vulnerability management tools right now are getting in there too. You name it, they're coming into identity. Identity is the hot space at the moment."

This offers cost-saving potential, but Converse urges caution. "The question is, from an overall risk perspective, is that enough for your company?" He stresses the importance of evaluating whether integrated solutions deliver the same "functionality and the same security posture" as specialised tools. 

The VP also reminds us that "the tools are all pretty capable, but it's just a matter of understanding exactly what you're trying to accomplish and what you're willing to accept as a risk."

• Identity convergence is reshaping the identity management landscape.
• Agentic AI requires a mature identity framework for effective implementation.
• Non-human identities present unique challenges in cybersecurity.
• Ethical considerations are crucial when allowing AI to make decisions.
• Organisations must balance speed and security in adopting new technologies.
• Real-time visibility and control are essential for managing non-human identities.
• AI can automate low-level tasks but requires careful oversight.
• The convergence of identity pillars can lead to cost savings but may compromise functionality.
• Future technologies like quantum computing could disrupt current encryption methods.
• Continuous adaptation is necessary to keep pace with evolving cyber threats.

00:00 Introduction to Identity and Access Management

02:57 Understanding Identity Convergence

06:02 The Role of Agentic AI in Identity Management

08:59 Navigating Non-Human Identities

11:47 Ethical Dilemmas in AI Decision-Making

14:46 Future Predictions for Digital Identity

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organisations make better decisions that minimise risk. Their experts act as your trusted advisors, helping you understand your business and challenges. They evaluate your cybersecurity posture and ecosystem to identify risks, optimise resources, and implement best-fit solutions. 

GuidePoint’s unmatched expertise has enabled Fortune 500 companies and U.S. government cabinet-level agencies to improve their security posture and reduce risk. Learn more at www.guidepointsecurity.com.

In this episode of The Security Strategist podcast, host Richard Stiennon, industry analyst and author, speaks to Craig Roberts, Principal Software Engineer at Rapid7, about digital exposure and the increasing challenges of Attack Surface Management (ASM).

The conversation peels back the layers of hidden vulnerabilities and misconfigurations that plague today’s digital world. The speakers offer expert advice into how businesses can better understand, prioritise, and manage their expanding attack surfaces.

"It's all about the kind of different steps an attacker takes. The attack surface simply means when an attacker can exploit to get to my goal and align to my mission," says Craig Roberts, Principal Software Engineer at Rapid7.

Also the Co-founder of Noetic (acquired by Rapid7), Roberts’ journey into attack surface management began from a practical observation. He found that many cybersecurity incidents came from overlooked assets. Such incidents could be unmonitored servers or lack of Endpoint Detection and Response (EDR). 

"We set out to raise that hygiene bar through preventative controls," he explains. The typical view of an attack surface is often limited to external website scans. "That's only a small piece of it these days. It's often where an attacker will start. It’s an initial foothold. Everything past that point is also still an attack surface." 

Emphasising the diverse nature of attack vectors, Roberts adds, "We don't have a homogenous way. Attackers both initially gain access and then start moving towards their target." This means that a single misstep or vulnerability across any of these areas can allow an attacker to achieve their objective.

Looking ahead, Roberts recommends CISOs to focus on having all enterprise data and understanding their environment across all assets. These assets are – cloud, users, and traditional infrastructure. 

Then, layer on an understanding of "exposures" rather than just Common Vulnerabilities and Exposures (CVEs). This includes cloud misconfigurations, identity-related issues like MFA misconfigurations, and, zero-days.

"Treat those in a similar way because at the end of the day, we need to prioritise those exposures because the attacker isn't going to care about the weapon they use," Roberts concludes. This holistic approach, built on foundational trust in shared data across various security vendors and tools. 

Such a strategy is crucial for gaining a central view of risk and efficiently mitigating the diverse threats facing modern enterprises.

A key takeaway from the discussion is the importance of understanding an organisations’ assets and how critical each is. Roberts argues that, while organisations may spend significant effort on re-scoring and building "vulnerability intelligence pipelines," it’s not often known which critical assets those vulnerabilities reside on.

"The asset is a really important thing. How important that is to your business, and what data and mitigations it has in it hugely affects the risk of that vulnerability," he stresses.

• Understanding the attack surface is crucial for effective cybersecurity.
• Attackers exploit various vulnerabilities to achieve their goals.
• Prioritization of vulnerabilities is essential due to the overwhelming number of CVEs.
• Zero-day vulnerabilities pose significant risks that require immediate attention.
• IoT devices present unique challenges in vulnerability management.
• Effective management of attack surfaces can deter opportunistic attackers.
• Visibility into assets and their configurations is key to risk management.
• Collaboration between security vendors enhances data sharing and threat response.
• Organisations must treat all exposures equally, regardless of their nature.
• A proactive approach to security can reduce the likelihood of successful attacks.

00:00 Introduction to Attack Surface Management

03:02 Understanding the Evolving Attack Surface

05:55 Types of Attackers and Their Motivations

08:52 Prioritizing Vulnerabilities and Exposures

12:09 Zero-Day Vulnerabilities and IoT Challenges

15:04 Management Strategies for Attack Surfaces

17:56 The Importance of Asset Visibility

20:57 Key Takeaways for CISOs

Rapid7, Inc. (NASDAQ: RPD) is on a mission to create a safer digital world by making cybersecurity simpler and more accessible. We empower security professionals to manage a modern attack surface through our best-in-class technology, leading-edge research, and broad, strategic expertise. Rapid7’s comprehensive security solutions help more than 11,000 global customers unite cloud risk management and threat detection to reduce attack surfaces and eliminate threats with speed and precision. For more information, visit our website, check out our blog, or follow us on LinkedIn or X.

Infosecurity Europe, Europe's leading cybersecurity event, is celebrating its 30th anniversary from June 3rd to 5th at ExCeL London. This year's conference is setting the stage for major moments in the enterprise tech space. The event aims to foster collaboration and promises to showcase the top cutting-edge cybersecurity solutions.

In this episode of the Security Strategist podcast, host Shubhangi Dua speaks with Saima Poorghobad, Portfolio director RX Global, the organiser of Infosecurity Europe about the upcoming Infosecurity Europe conference. 

They discuss the significance of the event, which celebrates its 30th anniversary, and explore key topics such as quantum computing, AI, and ransomware that will be highlighted this year. Saima shares insights into new features and innovations at the conference, emphasizing the importance of networking and preparation for attendees.

"What we're really passionate about at Infosecurity Europe is building a safer cyber world for everyone," says Poorghobad. "We support this mission by giving the community somewhere that they can combine innovation with insights, with relationships." 

Over the past three decades, Infosecurity Europe has served as a crucial cornerstone for the cybersecurity community, evolving alongside the rapidly changing threat scenarios, from the early internet to the rise of cloud and AI.

One emerging theme at Infosecurity Europe 2025 is expected to be quantum computing. Once a distant prospect but now quantum computing is a near-term horizon. The conference will kick off with a headline keynote from Professor Brian Cox, exploring how black holes and quantum mechanics hold the answer to the future of computing and cybersecurity. 

This will be followed by a panel discussion moderated by BBC cyber correspondent Joe Tidy, focusing on immediate actions organisations should take. 

Poorghobad emphasising the practical applications of this says, "teaming up that session with Professor Brian Cox followed by that panel kind of gives you that overarching theory and view of the overarching threat to see how we can actually implement and what should we be doing today and make it really practical?"

Geopolitics is another major driver of cyber. For this, Rory Stewart, former diplomat, politician, and host of "The Rest Is Politics," will speak at the event on global power dynamics. He plans to particularly discuss how shifting alliances, emerging threats, and potential global trade wars could impact access to essential hardware and software for cybersecurity. 

AI and Generative AI continue to be a key theme. Despite their initial hype, they remain at the forefront of cyber concerns. Cited as the most pressing threat in Infosecurity Europe's annual Trends Report, AI lowers the barrier to entry for bad actors and enhances capabilities for skilled attackers. A keynote session titled "Calling BS on AI" will bring together AI experts to provide insights on defending against AI threats, particularly deepfakes and AI-powered social engineering campaigns.

For more details on the event and some surprises planned, watch the full podcast.

• Infosecurity Europe is a leading gathering of cybersecurity professionals.
• The conference has evolved significantly over the past 30 years.
• Quantum computing poses a near-term threat to existing encryption protocols.
• AI is a pressing concern for cybersecurity professionals.
• Ransomware continues to be a major threat in the cyber landscape.
• New exhibitors and innovative formats are introduced each year.
• Networking opportunities are crucial for building relationships in the industry.
• Preparation is essential for maximizing the conference experience.
• Attendees can expect hands-on master classes and exclusive sessions.
• The 30th anniversary celebration will include special events and recognitions.

00:00 Introduction to Infosecurity Europe

02:45 The Evolution of Cybersecurity Over 30 Years

06:04 Key Topics for Infosecurity Europe 2025

09:12 Emerging Threats: Quantum Computing and Geopolitics

11:56 AI and Ransomware: Current Challenges

15:11 New Features and Innovations at Infosecurity Europe

22:03 Leveraging Opportunities at the Conference