The Security Strategist

In this episode of the Security Strategist podcast, Chris Steffen speaks with Sudhir Reddy, the CTO of Esper, about the imperative balance between security and user experience in dedicated devices. 

They discuss the unique challenges of securing these devices, the role of Mobile Device Management (MDM), compliance issues, and practical steps enterprises can take to optimise their device fleets. The conversation not only spotlights the importance of proactive security measures but also the need for organisations to address vulnerabilities in their dedicated devices.

From kiosks and point-of-sale machines to medical devices and airport check-in counters, these ubiquitous tools present idiosyncratic security vulnerabilities that demand proactive strategies. 

MDM is the first line of defense. Sudhir says, “This is your interface to secure everything that's happening on the device, whether it's bits and bytes that get on the device.” 

“Whether it's what peripherals are allowed on the device, what device serial numbers of peripherals are allowed to talk to the device,” he added. “All of these are things that managers of large fleets have to think about."

Tune into the podcast to hear more about dedicated device security as a critical component of a detailed security strategy and adopting a proactive, data-driven approach to help organisations mitigate risks and ensure harmonious operation of their edge device fleets.

Takeaways

• Dedicated devices present unique security challenges compared to traditional devices.
• The presence of humans is a key factor in security compliance issues.
• MDM can enhance both security and user experience.
• Compliance is crucial for devices handling sensitive data.
• Patching and updating devices can be challenging due to downtime.
• Proactive measures can minimise vulnerabilities before exploitation.
• Organisations should start with smaller, manageable security issues.
• Gradual rollout of updates can prevent widespread issues.
• Device management should not be an afterthought.
• There are tools available to help secure dedicated devices.

Chapters

00:00 Introduction to Dedicated Devices and Security Challenges

03:01 The Unique Landscape of Dedicated Devices

05:48 The Role of MDM in Security and User Experience

08:57 Compliance and Data Security in Dedicated Devices

12:05 Patching and Updating Challenges

15:02 Proactive Security Measures for Device Management

18:53 Practical Steps for Improving Security Posture

25:06 Final Thoughts and Key Takeaways

Welcome back to Meeting of the Minds, a podcast series that brings industry leaders together for the most engaging conversations of the year. In our inaugural episode, cybersecurity experts Christopher Steffen, Richard Stiennon, and Brad LaPorte, joined by Evgeniy Kharam, provided a comprehensive overview of the current cybersecurity landscape. They explored the complexities and challenges that organisations face in today's digital age, setting the stage for a deeper exploration of what the future holds.

This episode, Steffen, Stiennon, and LaPorte were joined by moderator Alejandro Leal, a senior analyst specialising in cybersecurity, digital identity, and AI at KuppingerCole. Throwing out the script, they took the conversation to the next level, venturing into uncharted territory and pushing the boundaries of cybersecurity.

Prepare for a no-holds-barred discussion as the analysts speculated on the disruptive forces that will shape the future of cybersecurity, dissecting everything from the intricate challenges of DOGE and securing AI to the potential paradigm shifts brought about by quantum computing.

The cybersecurity experts did not shy away from controversial topics, but instead provided their unfiltered opinions on the impact of government initiatives like DOGE and the UK's Investigatory Powers Act.

They also talked about the ethical dilemmas surrounding data privacy and security, and debated the potential consequences of a "quantum day" – the moment when quantum computing breaks current encryption standards. Brace yourself for some surprising hot takes and thought-provoking insights that will challenge your understanding of the cybersecurity landscape.

Watch the first episode of Meeting of the Minds State of Cybersecurity in 2025 podcast.

Takeaways

• The chaotic approach to government efficiency can hinder cybersecurity efforts.
• Bureaucracy can provide stability but also opens doors for corruption.
• The balance between efficiency and oversight is crucial in cybersecurity.
• Recent government actions raise concerns about privacy and security.
• Reckless adoption of new technologies poses significant risks.
• The cybersecurity landscape is influenced by political decisions.
• The historical tension between privacy and state surveillance continues.
• Court orders should be the standard for accessing private information. Lawful Intercept has led to vulnerabilities in telecom systems.
• Businesses must use secure communication methods, even with trusted devices.
• Sensitive data should not be stored on mobile devices.
• Organisations should avoid using apps like WhatsApp for sensitive communications.
• Most organisations lack basic encryption for their data.
• Organisations must understand their data infrastructure before preparing for quantum.
• The future of cybersecurity will require adaptability and innovative thinking.

Chapters

00:00 Introduction to Cybersecurity in 2025

01:30 Impact of Government Efficiency on Cybersecurity

11:09 Bureaucracy vs. Efficiency in Cybersecurity

16:56 UK Government's Demand for Encrypted Data Access

24:08 The Risks of Backdoors in Technology

27:21 Preparing for Quantum Computing

39:01 Current State of Quantum Authentication

47:07 The Future of Cybersecurity and Quantum Technology

Andrea Cullen discusses her extensive experience in cybersecurity, focusing on the gender imbalance and cultural stereotypes that have historically dominated the field. She emphasizes the importance of diversity and mentorship in fostering innovation and problem-solving within cybersecurity teams. Andrea advocates for a more inclusive approach to recruitment and highlights the need for creative thinking in addressing cybersecurity challenges. The discussion also touches on the significance of leadership in creating a welcoming environment for diverse talent.

Key takeaways

• Cybersecurity has been male-dominated for decades.
• Cultural stereotypes contribute to gender imbalance in tech.
• Diversity enhances problem-solving and innovation.
• Mentorship is crucial for underrepresented groups.
• Leadership should model openness to mistakes.
• Cybersecurity requires both technical and creative skills.
• Recruitment should focus on potential, not just certificates.
• Real-world experiences can change perceptions of cybersecurity.
• Diverse teams lead to better solutions and outcomes.
• Everyone has something to contribute to cybersecurity.

“Continuous threat exposure management is the new phrase for what we used to call vulnerability management programs," said J.J. Guy, CEO and Co-Founder of Sevco Security.

In this episode of The Security Strategist podcast, Richard Stiennon, Founder and Chief Analyst at IT-Harvest speaks with Guy about the evolution of vulnerability management into Continuous Threat Exposure Management (CTEM). 

Guy stresses that traditional vulnerability management falls short in modern environments, which is why there's a critical shift towards CTEM. This isn't just a rebranding, it's a fundamental change in approach. As attack surfaces expand, so do the types of exposures organisations need to address. A fragmented approach to vulnerabilities leaves organisations overwhelmed.

"We've all told all auditors we've got it under control and we've all pointed to the CMDB as the tool to accommodate that control. But at the same time, we've known that the CMDB is wildly inaccurate," Guy voiced, spotlighting the need for a better system.

CTEM programs offer a structured framework, integrating the interconnectedness between vulnerabilities and devices, users, threats in the wild, and the business impact of a breach to drive more effective prioritisation, mitigation, and remediation of vulnerabilities in increasingly complex environments. As Guy says, welcome to Vulnerability Management Programs 2.0.

This is just a taste of what was discussed on the podcast. Watch the podcast for deeper insights and unconventional notions for businesses to succeed in today’s rapidly involving cybersecurity sphere.

Takeaways

• Continuous Threat Exposure Management (CTEM) is the evolution of vulnerability management.
• CTEM is seen as vulnerability management 2.0, adapting to the changing landscape of cybersecurity.
• A strong asset inventory is foundational for effective CTEM.
• Organisations often face challenges in managing multiple vulnerability assessment tools.
• The importance of real-time, live operational views of assets cannot be overstated.
• Threat intelligence plays a critical role in prioritizing vulnerabilities.
• Data aggregation from multiple sources is essential for a complete inventory.
• The industry needs to move away from compliance-oriented activities to operational ones.
• Emerging trends indicate a consolidation of tools and deeper integrations in cybersecurity.
• Better data leads to better decisions and outcomes for organisations.

Chapters

00:00 Introduction to Continuous Threat Exposure Management

02:52 The Evolution of Vulnerability Management

05:52 The Importance of Asset Inventory

08:54 Challenges in Vulnerability Management

11:50 Characteristics of a Strong Security Inventory

15:01 Emerging Trends in Exposure Management

17:57 Key Takeaways for CISOs

In today's deeply connected world, cybersecurity is no longer just a technical issue—it's deeply intertwined with geopolitics. This episode explores this complex relationship, talking about the ever-shifting threat space and examining how international regulations and geopolitical tensions impact organisations' cybersecurity posture. 

The episode also discusses the double-edged sword of artificial intelligence in cybersecurity, acknowledging its potential to enhance defenses while also requiring skilled personnel to effectively leverage its capabilities. 

It further spotlights that achieving zero risk in cybersecurity is an unrealistic goal, and enterprises must focus on building strong risk management frameworks and selecting the right security controls to mitigate potential damage.

The podcast provides valuable takeaways for businesses of all sizes, stressing the importance of continuous improvement and adaptation in the face of ever-evolving cyber threats.

Tune in for a deep dive into the intersection of geopolitics and cybersecurity. Gain valuable insights on how to navigate the complex regulatory environment, leverage the power of AI, and develop effective risk management strategies to protect your organisation in today's interconnected world.

In this episode of the EM360Tech’s The Security Strategist podcast, host Shubhangi Dua speaks with Bryan Marlatt, Chief Regional Officer at CyXcel, about the complex relationship between geopolitics and cybersecurity. 

Takeaways

• The global regulatory landscape for cybersecurity is complex and fragmented.
• Privacy regulations are critical for enterprises to monitor and comply with.
• AI can enhance cybersecurity processes but requires skilled personnel to leverage effectively.
• Zero risk in cybersecurity is unrealistic; organisations must manage acceptable risk.
• GDPR has significantly influenced how organisations approach data protection.
• Phishing attacks remain a prevalent threat across all sectors.
• Operational technologies are increasingly vulnerable to cyber threats.
• Organisations need to adopt a proactive approach to cybersecurity.
• Choosing the right security controls is essential for effective risk management.
• Continuous improvement and adaptation are necessary in the cybersecurity landscape.

Chapters

00:00 Introduction to Geopolitics and Cybersecurity

02:29 Navigating the Complex Regulatory Landscape

05:15 The Role of AI in Cybersecurity

12:15 Understanding Acceptable Risk in Cybersecurity

18:24 Global Perspectives on Cybersecurity Regulations

23:04 Emerging Cyber Threats and Mitigation Strategies

In this conversation, Rob Demain shares his extensive background in cybersecurity and discusses the importance of neurodiversity in the field. He emphasizes how neurodiverse individuals can bring unique problem-solving skills that drive innovation in cybersecurity. The discussion also covers the significance of diversity in teams, the need for resilience in cybersecurity strategies, and the role of AI in enhancing human capabilities rather than replacing them. Rob highlights the balance between automation and human expertise, advocating for a thoughtful approach to implementing AI in organizations.

Key Takeaways

• Neurodiversity brings unique problem-solving approaches to cybersecurity.
• Diverse teams are essential for tackling complex cybersecurity challenges.
• Resilience is key in responding to cyber threats effectively.
• AI should enhance human capabilities, not replace them.
• Organizations need clear AI strategies and policies.
• Creating environments that nurture diverse talents is crucial.
• Cybersecurity requires a balance between automation and human expertise.
• Proactive resilience is necessary for effective cybersecurity.
• Diversity of thought prevents groupthink in cybersecurity.
• Continuous learning and adaptation are vital in the cybersecurity landscape.

Chapters

00:00 Introduction to Cybersecurity and Neurodiversity

03:01 The Role of Neurodiversity in Cybersecurity Innovation

06:05 Diversity in Cybersecurity Teams

08:58 Resilience in Cybersecurity Strategies

12:06 AI's Impact on Cybersecurity

14:59 Balancing Automation and Human Expertise

18:01 Implementing AI Strategies in Organizations

The digital warground is constantly advancing, with increasingly sophisticated malware and attack vectors challenging traditional cybersecurity defences. The critical role of AI and Zero Trust has been shaping the future of cyber defence for a while now. 

It’s become absolutely necessary to adopt a zero-trust security model to protect against today's complex threats. AI too has become a powerful tool for enhancing cybersecurity measures, from threat detection to security operations, while also acknowledging its potential misuse by malicious actors. 

In this episode, Danny Jenkins, CEO of ThreatLocker, discusses the intersection of cybersecurity and artificial intelligence. The conversation explores the ethical considerations surrounding AI in security, spotlighting the need for strong regulatory frameworks that foster education and responsible development rather than stifling innovation.

Join us as we unpack the vital components of building a future-proof cybersecurity strategy in the age of AI and Zero Trust.

Key Takeaways

• AI can help identify threats but also aids attackers.
• The threat landscape has evolved with sophisticated malware.
• Zero trust security is essential for modern defence.
• AI should assist in decision-making, not replace it.
• Education on AI risks is crucial for organisations.
• Regulatory frameworks should focus on education, not restriction.
• AI can create unique malware easily, complicating detection.
• Organisations must reassess their threat models regularly.
• Collaboration and understanding are key to effective AI use.

Chapters

00:00 Introduction to Cybersecurity and AI

03:09 The Evolving Threat Landscape

06:11 Zero Trust Security: A New Mindset

09:03 AI as a Tool for Cyber Defense

12:10 Ethical Considerations in AI Security

14:50 Regulatory Frameworks and Global Collaboration

17:51 Conclusion and Future Directions

The state of cybersecurity is rapidly and constantly evolving, and the future is not necessarily certain.

In the first episode of Meeting of the Minds, three leading industry analysts – Christopher Steffen, VP of Research at EMA; Richard Stiennon, Founder and Chief Analyst at IT-Harvest; and Brad LaPorte, Morphisec CMO & Advisor at Lionfish Tech Advisors – along with moderator Evgeniy Kharam, Founder of EK Cyber & Media Consulting, explore the critical challenges and opportunities that will shape the state of cybersecurity in 2025.

They discuss the complex role of AI in security, examining both its potential to enhance defences and the new vulnerabilities it introduces. The experts also tackle the security implications of open-source technologies such as DeepSeek and the ongoing debate surrounding self-regulation within the industry.

A key focus of the conversation is the strategic approach to cybersecurity. The analysts break down the merits and drawbacks of platform solutions versus best-of-breed tools, considering the importance of maturity levels in tool selection and the integration challenges that often follow acquisitions. 

The episode also explores the tension between achieving compliance and building a truly secure environment. The panel highlights the importance of moving beyond simply checking boxes and instead focus on developing strong security postures.

Join us for this vital discussion as we navigate the complex sphere of cybersecurity in 2025. 

Takeaways

• AI is both a tool and a potential vulnerability in cybersecurity.
• Guardrails are essential to prevent misuse of AI technologies.
• The rapid adoption of AI has outpaced the establishment of security measures.
• Open-source AI models like DeepSeek can introduce significant security risks.
• Self-regulation and testing are critical for organisations using AI as the trustworthiness of AI outputs is a major concern for decision-making.
• Companies should focus on enhancing core capabilities with AI, not just adopting it for marketing.
• Choosing between specialised tools and comprehensive platforms is a key decision for businesses. Companies that rely on platformisation are often doomed to fail.
• Compliance does not guarantee security; many compliant companies have faced breaches.
• Organisations should focus on quick wins in security improvements.
• Training and staffing are crucial for effective tool management.
• The lifespan of a CISO is short; quick gains are necessary.
• Understanding the roadmap of existing tools can prevent unnecessary purchases.

Chapters

00:00 Introduction to Cybersecurity in 2025

02:05 The Role of AI in Cybersecurity

09:49 Vulnerabilities in AI Models

16:04 Open Source AI and Security Challenges

19:59 Best of Breed vs. Platform Solutions

22:34 The Perils of Platformisation

25:05 Maturity Levels and Tool Selection

28:07 Integration Challenges in Acquisitions

34:13 Compliance vs. Security

44:05 Proactive Security Strategies

This conversation explores the critical and ever-evolving relationship between data infrastructure and cybersecurity, shining a light on the necessity of proactive security measures in an increasingly interconnected digital world. The discussion highlights essential themes such as data resilience, the seamless integration of security and recovery strategies, and the complex role of artificial intelligence, which simultaneously bolsters and challenges cybersecurity efforts. A call to action is made for organisations to shift their perspective, viewing cybersecurity as a strategic enabler rather than a mere cost, while also emphasising the value of comprehensive employee training to maintain strong security practices.

In a captivating second act, Jim Liddle dives into the transformative potential of leveraging AI and other emerging technologies to predict and neutralise threats before they occur. By aligning cybersecurity initiatives with broader organisational objectives, he illustrates how businesses can turn security into a driver of innovation and competitive advantage. Through engaging real-world examples and actionable advice, the conversation urges listeners to abandon outdated, reactive strategies in favour of a forward-looking, resilient approach.

Key Takeaways

• True cybersecurity leadership comes from data infrastructure.
• Companies need to adopt a proactive approach to cybersecurity.
• Data resilience is crucial for effective recovery from attacks.
• AI can both enhance and complicate cybersecurity efforts.
• Security should be integrated into the core infrastructure.
• Training employees is essential to mitigate human error.
• Cybersecurity can be a competitive advantage for businesses.
• Organisations must plan for potential security breaches.
• Immutable data architectures can prevent data loss.
• Investing in security is investing in business growth.

Chapters

00:00 - Introduction to Cybersecurity and Data Infrastructure

02:54 - The Importance of Data Resilience in Cybersecurity

05:58 - Integrating Security and Recovery for Resilience

08:59 - AI: A Double-Edged Sword in Cybersecurity

12:11 - Transforming Cybersecurity into a Competitive Advantage

15:10 - Fostering Innovation While Ensuring Security

17:55 - Conclusion and Future Directions

Today, organisations are grappling with the critical challenge of securing APIs in an era dominated by AI integration and increasing cyber threats. APIs, the backbone of modern technology, are vital for enabling seamless communication between applications. However, as their usage grows, so do the risks associated with inadequate API management and security. These vulnerabilities can lead to unauthorised access, data breaches, and system disruptions, making API security a top priority for businesses of all sizes.

In the face of these challenges, safeguarding APIs demands more than basic measures. Organisations must adopt a comprehensive approach that integrates proactive security practices, advanced tools, and a culture of security embedded within the development lifecycle. Just as an assembly line ensures precision in manufacturing, API security must be built into every stage of application development to mitigate risks effectively.

The stakes are particularly high in this rapidly evolving landscape. As highlighted by Marco Palladino, CTO and co-founder of Kong, organisations must stay ahead of emerging trends in AI and API usage while addressing the challenges of protecting their systems. Proactive measures, such as implementing API gateways, monitoring traffic for anomalies, and employing zero-trust principles, are essential to ensure robust protection.

Key Takeaways

• APIs are essential for connecting software and services.
• AI integration relies heavily on APIs for functionality.
• Effective API management is crucial for security and compliance.
• Organisations must adopt proactive security measures for APIs.
• Security should be integrated into the development lifecycle.
• API-related attacks are on the rise, necessitating better security practices.
• Automation can help identify security issues early in development.
• The accuracy of AI responses remains a significant challenge.
• Organisations need to balance retrieval and generation in AI applications.
• Emerging trends in AI require organisations to adapt their API strategies.

Chapters

00:00 - Introduction to APIs and Their Importance

02:59 - The Role of APIs in AI Integration

05:50 - API Management and Security Concerns

09:00 - Best Practices for API Security

11:56 - Challenges and Threats in API Security

14:56 - Proactive Security Measures for APIs

17:45 - The Future of APIs in AI Development

21:07 - Emerging Trends in AI and API Usage