The Security Strategist

If you've ever tried to navigate the FedRAMP authorization process, you already know it's slow, expensive, and tedious when it comes to the documentation. For cloud service providers (CSPs) hoping to sell to the federal government, it has long been one of the biggest barriers to entry. That’s now changing. FedRAMP 20x is the most significant modernization of the Federal Risk and Authorization Management Program in its history and is reshaping how CSPs can achieve compliance.

In this episode of the Security Strategist podcast, Kenny Scott, founder and CEO of Paramify, joins host Richard Stiennon, Chief Research Analyst at IT-Harvest, to unpack what’s changing, why it matters, and how it could redefine the path to federal authorization.

FedRAMP 20x is set to help CSPs approach compliance by cutting costs, reducing timelines, and shifting the focus from paperwork to verifiable security evidence.

What Is FedRAMP And Why Did It Need to Change?

FedRAMP, the Federal Risk and Authorization Management Program, provides a standardised framework for the security assessment, authorisation, and continuous monitoring of cloud products and services used by U.S. federal agencies. In theory, it's a smart idea: one unified security standard that any agency can rely on.

In practice, the traditional process became a bottleneck. Scott puts it bluntly: "FedRAMP's original design had a fatal flaw; it prioritized documentation over deterministic security evidence."

The result? CSPs were spending months, sometimes years, and hundreds of thousands of dollars compiling documentation packages that didn't necessarily make their systems more secure. Agencies weren't getting the real-time, verifiable security assurance they needed. And smaller, innovative CSPs were priced out entirely.

• Lengthy approval times as authorisation could take 12–18+ months, delaying market entry for cloud providers.
• High compliance costs with smaller CSPs often couldn't afford the financial burden of full FedRAMP authorization.
• Documentation overload with extensive paperwork, distracted from actual security practices and outcomes.

FedRAMP 20x goes beyond a version update; it signals a fundamental shift in how compliance is defined in modern cloud environments. Announced by the General Services Administration, the initiative is designed to make authorizations faster, cheaper, and more meaningful.

• Streamlined authorization processes, which means faster pathways to approval, reducing time-to-market for CSPs.
• Automation-first compliance that replaces manual documentation with automated, machine-readable security evidence.
• Risk-based flexibility that tailors requirements to the actual risk profile of a service, rather than a one-size-fits-all model.

As Scott explains, the shift is from compliance as a paper exercise to compliance as a continuous, evidence-based practice. Agencies want real, deterministic security evidence, and FedRAMP 20x is built to deliver exactly that.

For CSPs, the modernization is a double-edged opportunity; those who adapt quickly will gain a significant competitive advantage; those who don't may find themselves falling behind as the compliance landscape evolves.

On the opportunity side, the most immediate impact is a faster time to market. With streamlined approval processes, CSPs can move through authorisation more efficiently and reach federal customers sooner than before. This acceleration is paired with lower compliance costs, as reduced documentation and administrative burden free up resources that can instead be directed toward innovation and strengthening security capabilities. Perhaps most significantly, the changes help level the playing field, enabling smaller CSPs with strong security practices to compete more effectively against larger, established incumbents.

At the same time, these benefits come with new demands. CSPs will need to stay closely aligned with an evolving framework, continuously tracking updates and guidance as FedRAMP 20x matures. In addition, fully realising the advantages of the new model will require investment in automation. Organizations that adopt compliance and security automation tooling will be better positioned to keep pace, reduce manual effort, and maintain consistent alignment with the updated requirements.

If you would like to find out about this visit paramify.com and connect with Scott on LinkedIn.

• 00:00 — Introduction to FedRAMP 20x
• 13:42 — The Need for Change in FedRAMP
• 20:20 — FedRAMP 20x: A New Approach
• 28:27 — Success Stories with FedRAMP 20x

• FedRAMP 20x modernizes federal cloud security compliance by replacing documentation-heavy processes with automation and evidence-based security.
• The traditional FedRAMP process was slow, costly, and document-intensive — a barrier that limited innovation and market access for CSPs.
• CSPs that invest in automation and stay ahead of evolving requirements will gain a clear competitive edge in the federal marketplace.
• Kenny Scott and Paramify are at the forefront of helping organizations navigate this shift intelligently and efficiently.

Keeping your organisation’s systems secure can feel like an endless battle. Patch management and vulnerability mitigation are often seen as tedious tasks, but they form the backbone of effective cybersecurity. In this episode of the Security Strategist podcast, host Richard Stiennon and Mike Walters, co-founder of Action1, break down why patching remains challenging and share practical strategies to make the process simpler, smarter, and more effective.

Patch management has been a concern since the earliest days of computing, dating back to mainframes and early PCs. Despite technological advances, it remains a "busy work" task that many IT teams find overwhelming. 

So what makes patching so hard today? One of the main reasons patching is still so difficult is the constant evolution of IT ecosystems. As Walters explains, "The biggest challenge is the ever-evolving nature of software with different applications, sources, and methodologies." 

Operating systems, third-party apps, and custom configurations all require tailored approaches for updates and patches, making uniform processes impossible. Large organisations often have hundreds or thousands of devices, each running different software versions requiring specific patches and testing before deployment. The COVID-19 pandemic has dramatically shifted traditional patching strategies. Pre-pandemic, enterprises could rely on corporate networks and distribution points for patches. Now, a dispersed workforce, VPNs, and hybrid cloud architectures have made remote patching more complex.

As Walters notes, "Remote endpoints become a big challenge. You need network-agnostic solutions that work regardless of whether a device is connected to the corporate network or a coffee shop." Connection issues, bandwidth limitations, and endpoint diversity all impact security teams' ability to apply patches swiftly.

To address these challenges, organisations are moving towards more intelligent and automated patching strategies. As Walters puts it, the starting point is simple: automation. By removing repetitive manual tasks, teams reduce the risk of human error and create space to focus on higher-value security work. Done properly, automation allows for scheduled updates, controlled testing, and the ability to roll back quickly if something goes wrong.

At the same time, how patches are delivered matters just as much as when. Large updates can put significant strain on networks if pushed out all at once, which is why approaches like peer-to-peer distribution are gaining traction. By allowing endpoints to share updates locally, organisations can reduce bandwidth pressure and avoid bottlenecks. Flexible “catch-up” windows also ensure that devices which miss an update cycle can still be brought into compliance without disrupting operations.

Modern environments are also driving a shift towards cloud-native, agent-based architectures. Instead of relying on a fixed network or VPN, these agents connect directly to cloud services, allowing patches to be deployed consistently across remote, mobile, and distributed devices. This approach reflects the reality of how people work today, where endpoints are no longer confined to a single network.

Finally, effective patching is as much about control as it is about speed. Progressive rollouts—testing updates on a small group before expanding—help organisations avoid widespread disruption. By identifying issues early and isolating them quickly, teams can maintain stability while still ensuring that critical vulnerabilities are addressed without delay.

Action1’s innovative model offers 200 free endpoints forever with no feature limitations, facilitating all sizes and types of organisations to implement effective patching solutions. By removing entry barriers, Action1 enables organisations to test, scale, and secure their patches more affordably. 

As Walters shares, "Offering free endpoints helps small IT teams get started, and as they grow, they stay with the platform."This approach promotes widespread adoption, accelerates security improvements, and creates a community of organisations committed to better vulnerability management.

As cybersecurity environments become more complex and distributed, patching will remain a critical task—if not the critical task—of your security strategy.

If you would like to find out more, visit: https://www.action1.com/

• The history and persistent nature of patch management issues
• How remote and hybrid work models impact patching strategies
• The importance of network-agnostic, agent-based patching solutions
• How to leverage automation and orchestration to reduce IT workload
• Peer-to-peer distribution to optimise bandwidth during large-scale updates
• Developing a phased, ring-based approach to patch deployment
• Real-world challenges of patching high-availability systems and remote endpoints
• Action1’s unique offer of 200 free endpoints without feature limitations
• The significance of thinking like an attacker to anticipate vulnerabilities

00:40 - Mike Walters’ background and company journey

02:00 - Why patching remains a complex, evolving task

04:35 - The need for specialisation and solving patching for good

05:11 - Why patch management feels like busy work and its inherent difficulties

06:44 - Lessons from early vulnerability management experiences

09:38 - Handling patching challenges for remote and mobile users

10:15 - The implementation of agent deployment and catch-up windows

12:22 - Innovative bandwidth management using peer-to-peer distribution

14:55 - The value of automation and trust in large-scale environments

16:50 - Utilising update rings for safer, staged patch deployment

17:45 - Prioritising patching for zero-day vulnerabilities and rapid response

18:43 - Action1’s free tier for small IT environments supporting smaller organisations

21:35 - Practical insights for IT leaders: automation, application patching, and attacker mindset

24:53 - Closing thoughts: automation and proactive attack thinking

The way organizations access and use enterprise data has fundamentally changed. Knowledge workers now operate in browser-based environments, relying heavily on SaaS applications and increasingly experimenting with AI-powered tools to boost productivity.

In the Security Strategist podcast, Chris Steffen, Vice President of Research at Enterprise Management Associates (EMA), spoke with Michael Leland, Field Chief Technology Officer at Island, about the growing cybersecurity challenges associated with browsers, SaaS platforms and AI tools and how organizations can adapt their enterprise security strategies.

While this shift has accelerated innovation, it has also introduced new cybersecurity risks. Sensitive information now flows through consumer browsers, AI assistants, browser extensions and cloud platforms; often outside the visibility of traditional security controls. As a result, enterprise security teams must rethink how they approach data protection, governance and access control in a browser-driven workplace.

Enterprise security models were historically built around network perimeters, firewalls and on-premise infrastructure. Today, however, most work happens inside web browsers, where employees interact with SaaS platforms, cloud storage systems and AI tools.

According to Leland, this shift has significantly expanded the attack surface.

“The majority of knowledge workers are accessing business applications primarily via the web, whether it’s a SaaS application or a web front end to a legacy application. But they’ve been doing so in a consumer browser,” he explains. 

Consumer-grade browsers were designed for convenience and personal use, not enterprise security. As a result, they often introduce vulnerabilities that can expose sensitive corporate data.

Traditional enterprise controls such as VPNs, secure web gateways and zero trust architectures attempt to mitigate these risks. However, these tools frequently operate outside the browser itself, leaving gaps in visibility and control.

The challenge becomes even more complex when browser extensions are added to the mix. Many extensions request extensive permissions and can access sensitive information inside SaaS applications.

“In the last 18 months, almost 40 per cent of browser extensions published have something to do with AI. Some offer real productivity gains, but the provenance of many of these tools is questionable,” Leland notes. 

This growing ecosystem of extensions and cloud tools has created a new security frontier where enterprise data protection must operate directly at the user interaction layer.

Alongside browser-driven workflows, organizations are also dealing with a rapid surge in AI adoption. From tools like ChatGPT and Copilot to embedded AI features inside SaaS platforms, AI is becoming a standard part of the modern workplace.

However, this rapid adoption is also creating a phenomenon known as AI sprawl. Knowledge workers increasingly select their own AI tools based on preference or convenience, leading to a patchwork of unsanctioned platforms operating across the enterprise.

“Each knowledge worker may have their own AI tool of choice. So the whole BYO AI—bring your own AI—trend is becoming very real,” says Leland. 

While these tools can deliver productivity gains, they also create serious data governance risks. Many AI platforms process prompts and inputs in external cloud environments, meaning that sensitive information could be inadvertently shared or stored outside company-controlled systems. Even seemingly harmless productivity tools may capture user data.

With browser usage and AI adoption accelerating, many cybersecurity teams are shifting their focus toward controlling data at the point of interaction rather than relying solely on network-based controls.

One emerging concept is the use of data boundaries—defined environments where organizations can control how sensitive information moves between applications.

A data boundary acts as a secure enclave that determines which applications are trusted and what data can flow between them.

“If you trust application A and application B, you might allow data to move freely between them,” Leland explains. “But you still enforce guardrails that prevent data from leaving that boundary.”

This approach allows organizations to balance security and productivity, an increasingly important consideration as knowledge workers rely on multiple SaaS platforms and AI assistants to complete daily tasks.

Another critical component of modern enterprise security is visibility. Security leaders cannot govern AI tools or protect sensitive data if they do not understand how employees are using them. As enterprises continue to embrace cloud applications and AI tools, protecting sensitive data will require a shift in cybersecurity thinking.

If you would like to find out more, visit island.io

• Establish a secure data boundary to control data flow between trusted applications.
• Utilize AI to automate data protection and enhance real-time monitoring.
• Foster a culture of security awareness among employees to strengthen your organization’s security posture.

00:00 Introduction to Cybersecurity and AI

03:07 The Evolution of Browsers for Knowledge Workers

06:03 Challenges in Enterprise Security

09:04 Balancing Data Protection and Productivity

11:48 Navigating AI Risks in the Workplace

14:59 Understanding AI Sprawl and Governance

17:50 The Role of Presentation Layer in Data Protection

21:10 Real-World Applications in Financial Services

23:57 Final Thoughts on Securing Knowledge Workers

Keeping your organisation’s systems secure can feel like an endless battle. Patch management and vulnerability mitigation are often seen as tedious tasks, but they form the backbone of effective cybersecurity. In this episode of the Security Strategist podcast, host Richard Stiennon and Mike Walters, co-founder of Action1, break down why patching remains challenging and share practical strategies to make the process simpler, smarter, and more effective.

Patch management has been a concern since the earliest days of computing, dating back to mainframes and early PCs. Despite technological advances, it remains a "busy work" task that many IT teams find overwhelming. 

So what makes patching so hard today? One of the main reasons patching is still so difficult is the constant evolution of IT ecosystems. As Walters explains, "The biggest challenge is the ever-evolving nature of software with different applications, sources, and methodologies." 

Operating systems, third-party apps, and custom configurations all require tailored approaches for updates and patches, making uniform processes impossible. Large organisations often have hundreds or thousands of devices, each running different software versions requiring specific patches and testing before deployment. The COVID-19 pandemic has dramatically shifted traditional patching strategies. Pre-pandemic, enterprises could rely on corporate networks and distribution points for patches. Now, a dispersed workforce, VPNs, and hybrid cloud architectures have made remote patching more complex.

As Walters notes, "Remote endpoints become a big challenge. You need network-agnostic solutions that work regardless of whether a device is connected to the corporate network or a coffee shop." Connection issues, bandwidth limitations, and endpoint diversity all impact security teams' ability to apply patches swiftly.

To address these challenges, organisations are moving towards more intelligent and automated patching strategies. As Walters puts it, the starting point is simple: automation. By removing repetitive manual tasks, teams reduce the risk of human error and create space to focus on higher-value security work. Done properly, automation allows for scheduled updates, controlled testing, and the ability to roll back quickly if something goes wrong.

At the same time, how patches are delivered matters just as much as when. Large updates can put significant strain on networks if pushed out all at once, which is why approaches like peer-to-peer distribution are gaining traction. By allowing endpoints to share updates locally, organisations can reduce bandwidth pressure and avoid bottlenecks. Flexible “catch-up” windows also ensure that devices which miss an update cycle can still be brought into compliance without disrupting operations.

Modern environments are also driving a shift towards cloud-native, agent-based architectures. Instead of relying on a fixed network or VPN, these agents connect directly to cloud services, allowing patches to be deployed consistently across remote, mobile, and distributed devices. This approach reflects the reality of how people work today, where endpoints are no longer confined to a single network.

Finally, effective patching is as much about control as it is about speed. Progressive rollouts—testing updates on a small group before expanding—help organisations avoid widespread disruption. By identifying issues early and isolating them quickly, teams can maintain stability while still ensuring that critical vulnerabilities are addressed without delay.

Action1’s innovative model offers 200 free endpoints forever with no feature limitations, facilitating all sizes and types of organisations to implement effective patching solutions. By removing entry barriers, Action1 enables organisations to test, scale, and secure their patches more affordably. 

As Walters shares, "Offering free endpoints helps small IT teams get started, and as they grow, they stay with the platform."This approach promotes widespread adoption, accelerates security improvements, and creates a community of organisations committed to better vulnerability management.

As cybersecurity environments become more complex and distributed, patching will remain a critical task—if not the critical task—of your security strategy.

If you would like to find out more, visit: https://www.action1.com/

• The history and persistent nature of patch management issues
• How remote and hybrid work models impact patching strategies
• The importance of network-agnostic, agent-based patching solutions
• How to leverage automation and orchestration to reduce IT workload
• Peer-to-peer distribution to optimise bandwidth during large-scale updates
• Developing a phased, ring-based approach to patch deployment
• Real-world challenges of patching high-availability systems and remote endpoints
• Action1’s unique offer of 200 free endpoints without feature limitations
• The significance of thinking like an attacker to anticipate vulnerabilities

00:40 - Mike Walters’ background and company journey

02:00 - Why patching remains a complex, evolving task

04:35 - The need for specialisation and solving patching for good

05:11 - Why patch management feels like busy work and its inherent difficulties

06:44 - Lessons from early vulnerability management experiences

09:38 - Handling patching challenges for remote and mobile users

10:15 - The implementation of agent deployment and catch-up windows

12:22 - Innovative bandwidth management using peer-to-peer distribution

14:55 - The value of automation and trust in large-scale environments

16:50 - Utilising update rings for safer, staged patch deployment

17:45 - Prioritising patching for zero-day vulnerabilities and rapid response

18:43 - Action1’s free tier for small IT environments supporting smaller organisations

21:35 - Practical insights for IT leaders: automation, application patching, and attacker mindset

24:53 - Closing thoughts: automation and proactive attack thinking

Podcast Series: The Security Strategist

Host: Richard Stiennon, Chief Research Analyst at IT-Harvest

Guest: Dr Chris Pierson, Founder and CEO of BlackCloak

There has always been a boundary in the enterprise technology corporate network. However, that boundary has been fading for a while, and now it may have completely vanished.

In the recent conversation on The Security Strategist podcast, cybersecurity expert Dr Chris Pierson, also the Founder and CEO of BlackCloak, joined host Richard Stiennon, Chief Research Analyst at IT-Harvest.

The BlackCloak CEO presented a reality that many CISOs are only now facing. The most critical vulnerabilities in an enterprise may lie far beyond corporate control, embedded in the personal lives of its leadership.

Pierson explains that attackers are no longer focused on directly breaching secure enterprise systems. Instead, they are targeting individuals with the highest levels of access in a more effective way.

Executives and board members have always been appealing targets, but the strategies have changed. Personal email accounts, home Wi-Fi networks, and even family members are now part of the attack surface. These environments generally lack the layered defences of corporate infrastructure, making them easier to exploit.

The stakes are high. A compromised home network or personal device can quickly provide access to enterprise systems. Even simple attacks, such as text messages pretending to be from a CEO, can work when aimed at those outside formal security measures.

What makes this trend especially dangerous is its subtlety. These attacks rarely look like the major breaches that make the news. Instead, they happen quietly, taking advantage of everyday behaviours in settings that were never meant to withstand sophisticated threats.

Also Watch: How Do Attackers Exploit Executives’ Personal Lives to Breach Companies?

In response, many enterprises have implemented privacy-focused solutions to reduce the digital footprint of executives by removing personal data from broker sites. This is a logical first step, but as Pierson points out, it only offers partial protection.

Today, personal data isn’t limited to a single source. It is constantly collected, sold, leaked, and reshuffled across many channels. Even when successfully removed from one platform, it often reappears elsewhere—sometimes accidentally, through everyday activities like online shopping or registration for accounts.

More importantly, cutting down visibility does little to tackle active threats. An attacker doesn’t need complete information to succeed; they just need enough.

This creates a misleading sense of progress for security leaders. Privacy efforts may reduce the attack surface, but they don’t eliminate the underlying risks. Without additional layers of protection, executives remain vulnerable in environments where attackers increasingly target them.

Also Read: Deepfakes, Data Brokers, and Home Networks: The Executive Threat Landscape CISOs Can’t Ignore in 2026

What is developing is not merely an extension of existing cybersecurity practices but a new discipline. It’s an approach that treats executives as a critical, high-risk perimeter on their own.

The CEO of BlackCloak describes this as a more comprehensive protection model that covers all aspects of an executive’s digital life. It goes beyond corporate endpoints to include personal devices, home networks, and the wider ecosystem where executives and their families live.

Enterprise security can no longer focus solely on corporate assets. The home network, personal devices, and even the family environment are now part of the overall risk landscape. At the same time, the line between cyber and physical threats continues to blur, increasing the stakes further.

For IT leaders in enterprise technology, the question is no longer whether these risks exist but how they are being managed. As attackers continue to adapt, the path into the enterprise is not through the front door but through the people who have the keys and everything that surrounds them.

• Executives are the new cybersecurity perimeter and top attack targets.
• Personal devices and home networks increase enterprise cyber risk.
• Data broker removal alone cannot protect executive privacy.
• Digital executive protection requires multi-layered security solutions.
• Cybersecurity strategies must address physical and cyber threat convergence.

• 00:00 Introduction to Cybersecurity Challenges for Executives
• 01:02 Understanding Executive Risk and Attack Surfaces
• 06:31 The Role of Data Brokers in Cybersecurity
• 10:13 Home Networks as New Battlegrounds
• 13:00 Comprehensive Digital Executive Protection Strategies
• 18:40 The Importance of Outsourcing Executive Protection

For more information, please visit em360tech.com and blackcloak.io.

EM360Tech YouTube: @enterprisemanagement360

EM360Tech LinkedIn: @EM360Tech

EM360Tech X: @EM360Tech

Follow: @EM360Tech on YouTube, LinkedIn and X

BlackCloak YT: @blackcloakcyber

LinkedIn: @BLACKCLOAK

BlackCloak X: @BlackCloakCyber

#ExecutiveCybersecurity #DigitalExecutiveProtection #CyberRisk #BlackCloak #CISO #HomeNetworkSecurity #Cybersecurity #ExecutiveRisk #CorporateBreaches #CyberStrategy #CEORisk #HomeNetwork #PersonalLives #AttackSurface #DataBrokers #CyberThreats #PhysicalThreats #TheSecurityStrategist #DrChrisPierson #RichardStiennon #EM360Tech #SecurityStrategy #CorporateSecurity #AccountTakeover #SoftTargets #HomeWiFiBreach

There is a moment in every investigation where time becomes the deciding factor.

Not capability, not intent, but time. In modern counter-terrorism, that moment arrives faster than ever because the evidence is no longer waiting to be found. It already exists, scattered across devices, platforms, and networks, growing silently in volume.

The question is no longer whether the data is there. It’s whether it can be understood quickly enough to matter.

In this episode of Security Strategist, EM360Tech host Trisha Pillay and Chris Johnson, CEO of Cyacomb, explore how digital evidence is reshaping counter-terrorism and why the real challenge isn’t access to information, but the ability to act on it without crossing the line into overreach.

Digital evidence has become central to modern counter-terrorism investigations. From mobile devices and encrypted messaging platforms to online communities, nearly every case now involves large-scale digital analysis. The challenge is not access, it’s volume and complexity.

A single device can hold vast amounts of data, and across thousands of investigations, this creates significant backlogs. Investigators must sift through irrelevant, fragmented, and often encrypted information to identify credible threats.

At the same time, the threat landscape is changing drastically. Terrorist networks are more decentralised, digitally enabled, and adaptive in how they communicate. This forces law enforcement to rethink how investigations are conducted basically shifting toward digital forensics, data analysis, and real-time intelligence gathering. As Johnson highlights, the ability to deal with data quickly is not new, but the scale of the problem has changed dramatically.

Speed sits at the centre of modern counter-terrorism operations, where even minor delays in analysing digital evidence can result in missed warning signs or postponed intervention. The increasing speed is far from straightforward. Investigators must contend with vast volumes of data spread across multiple devices, alongside a growing diversity of formats and platforms that complicate analysis. 

Layered on top of this are manual processes that slow case progression and persistent operational backlogs that delay access to critical insights. The result is a bottleneck in which time-sensitive intelligence risks being lost in a sea of noise. In response, organisations are turning to advanced digital forensics tools and automation to streamline workflows, prioritise relevant data, and reduce the burden of manual investigation. However, efficiency alone does not solve the problem. Accelerating processes without robust controls introduces new risks, particularly when handling sensitive personal data, where speed must be carefully balanced with accuracy, oversight, and compliance.

Artificial intelligence is becoming an increasingly significant tool in digital forensics and counter-terrorism investigations, largely due to its ability to process data at scale, identify patterns, and rapidly surface relevant insights. This capability enables faster identification of high-risk material, more informed decision-making during investigations, and a reduced dependence on manual data review, which has traditionally been time-consuming and resource-intensive. 

However, the integration of AI into law enforcement also introduces important ethical and legal challenges that cannot be overlooked. Counter-terrorism operations must remain firmly within established frameworks that safeguard privacy and civil liberties, as failing to do so risks undermining public trust in both the technology and the institutions that deploy it. In response, privacy-assured AI and specialist investigative tools are emerging, designed to minimise exposure to irrelevant personal data, concentrate only on content linked to potential threats, and support transparent, compliant investigative processes. As Johnson notes, while AI has a clear and valuable role in modern law enforcement, its effectiveness ultimately depends on the responsibility and governance with which it is implemented.

The next phase of counter-terrorism will be defined by the ability to turn data into actionable intelligence quickly and responsibly.

This means:

• Reducing investigative backlogs;
• Integrating AI into core workflows;
• Improving collaboration across systems and teams;
• Embedding privacy into the design of investigative technologies.

Digital evidence will only continue to grow. The organisations that succeed will be those that can navigate the intersection of speed, scale, and privacy without compromising any one of them. In modern counter-terrorism, advantage is no longer just about access to information; it’s about how effectively you can act on it.

• Digital evidence and data volumes in investigations
• Evolving threat landscape and global tensions
• Privacy, civil liberties, and ethical considerations
• Operational efficiency and technological innovations
• Future trends in law enforcement technology

00:00 The Evolving Role of Digital Evidence in Counter-Terrorism

07:10 Challenges in Analysing Digital Evidence

13:02 Balancing Privacy and Security in Investigations

20:09 Future of Counter-Terrorism and Technology

AI isn’t introducing entirely new cyber threats, but it is changing how easily they can be executed, and by whom. In this episode of Security Strategist, EM360Tech host Trisha Pillay speaks with Darren Anstee, Chief Technology Officer for Security at NETSCOUT, about how conversational AI is lowering the barrier to entry for cyberattacks. 

Drawing on real-world telemetry from thousands of enterprises and service providers, Anstee outlines how the threat landscape is shifting not through new attack types, but through scale, speed, and accessibility. At the centre of that shift are two forces, in his words, simplification and automation.

From a Distributed Denial-of-Service (DDoS) perspective, Anstee says, “AI isn’t creating fundamentally new attack vectors. Instead, it’s making existing ones easier to execute”. Historically, launching a sophisticated attack required time, expertise, and intent. Attackers would need to scan a target, identify vulnerabilities, select the right attack vectors, and continuously adapt based on how defences responded. That process demanded both technical knowledge and active decision-making. Now, much of that can be abstracted away.

As a result, conversational interfaces are increasingly being integrated into attack tools, allowing users to issue simple, natural language instructions. Behind the scenes, those tools can run reconnaissance, analyse results, select attack methods, and even adapt in real time if defences respond. As Anstee puts it, “the whole need for there being any knowledge in the seat has gone away.” The result is not necessarily more advanced attackers, but more attackers capable of attempting advanced techniques.

This shift has direct implications for enterprise risk. As sophisticated capabilities become more accessible, the volume and distribution of attacks change. Organisations that were previously unlikely targets are now within scope, not because they are high-value, but because they are reachable.

Anstee points to a growing trend, and that is attackers moving beyond heavily defended primary targets and focusing on secondary organisations within the digital supply chain. Suppliers, service providers, and partners often present a weaker entry point, while still offering indirect access to larger ecosystems. In practical terms, this expands the attack surface.

It also exposes a gap in how many organisations think about risk. Dependencies are not always fully mapped, and the resilience of third-party services is often assumed rather than verified. When those dependencies fail, be it through DDoS disruption or another incident, the impact can cascade quickly. What’s changing is not just who gets targeted, but how risk propagates across interconnected systems. This shift is being accelerated by automation.

Automation is what turns accessibility into scale. The steps involved in launching an attack, reconnaissance, analysis, execution, and adaptation, can be structured as decision trees. AI systems can follow those paths quickly and consistently, removing the need for manual intervention at each stage. This has two consequences. First, it increases the frequency of attacks. More actors can launch them, and they can do so with less effort. Second, it compresses response time. Attacks can adapt dynamically, forcing defenders to react faster and with greater precision.

For many organisations, this exposes a mismatch between perceived and actual readiness. As Anstee notes, having defensive tools in place is not the same as knowing how they perform under real conditions. Firewalls and baseline protections may handle simple attacks, but they are often insufficient against multi-vector, adaptive threats. This is where his emphasis on certainty becomes critical.

Confidence—based on vendor claims or assumed coverage is not enough. Organisations need real visibility into how their defences behave in practice, across environments, and under pressure. Without that, decision-making is based on assumptions rather than evidence. In a landscape shaped by automation, that gap becomes harder to sustain.

For more information, visit netscout.com

• AI is simplifying and automating cyber attacks, making them accessible to a broader range of attackers
• Enterprises must reassess their risk management strategies 
• The cost of cybersecurity is likely to rise as organisations enhance their defences
• AI's impact on cyber attack sophistication
• Democratisation of attack capabilities
• Automation in attack execution
• Supply chain vulnerabilities and third-party risks
• Certainty vs. confidence in cybersecurity decision-making 

00:00 Introduction to Cybersecurity and AI

02:28 The Evolving Threat Landscape

06:36 Automation and Cost Implications of AI in Cybercrime

11:20 AI's Role in Existing and New Attack Vectors

13:36 Understanding Supply Chain Risks

17:25 The Importance of Certainty Over Confidence

20:33 Strategic Actions for C-Suite Leaders

Many organisations assume that moving to the cloud means much of their security posture is handled automatically. But that assumption can create blind spots. In the latest episode of the Security Strategist Podcast, Trisha Pillay from EM360Tech speaks with Rob Edmondson, Senior Director of Product Marketing at CoreView, about cyber resilience in Microsoft 365 environments and what tenant hardening means in practice.

As organisations rely more heavily on Microsoft 365 for collaboration, identity management, and device control, understanding how the environment is configured becomes increasingly important for security teams.

When Microsoft first introduced Microsoft 365 as Office 365, it primarily focused on email and productivity tools. Security strategies often revolved around protecting inboxes and ensuring that business data was backed up. According to Edmondson, that model no longer reflects how the platform is used today. Microsoft 365 now includes a wide range of services that support identity management, device management, compliance, and collaboration. Many of these services sit at the centre of daily business operations.

This shift means that security risks are no longer limited to email or file storage. Identity platforms, collaboration tools, and endpoint management capabilities all operate within the same tenant. If critical settings are misconfigured, the impact can extend across multiple systems at once. For security leaders, the challenge is recognising that the platform has evolved into something far more complex than many organisations initially planned for.

One of the main themes in the discussion is visibility. Edmondson explains that many organisations simply do not have a clear view of how configurations change within their Microsoft 365 tenants.

Attackers often exploit these blind spots. If they gain access to an environment, they may modify configurations that allow them to regain access later. Because some of these changes are subtle, they may go unnoticed for long periods. However, not all configuration drift comes from attackers. Administrative errors or platform updates can also change settings in ways that affect security or operations.

This is why documentation still plays a role. Edmondson suggests that even basic records of key configurations can help organisations understand their environment and recover faster during incidents. While documenting every setting in a large tenant may not always be practical, identifying and tracking the most critical configurations can provide a starting point for stronger oversight.

Another concern discussed in the episode is the issue of excessive privileges. Many administrator roles in Microsoft 365 grant access across an entire tenant, which can increase risk if those accounts are compromised. Edmondson argues that reducing standing privileges should be a priority. Instead of granting broad permissions by default, organisations should consider limiting administrative access to only what is necessary.

Tenant hardening plays an important role here. By tightening configuration controls and carefully managing privileges, organisations can reduce the likelihood that a single compromised account leads to a wider security incident.

The goal is not simply to add more security controls, but to build a clearer understanding of how the tenant operates and how it could be restored if something goes wrong. The full conversation on the Security Strategist Podcast explores these challenges in greater depth, including configuration visibility, tenant recovery scenarios, and the practical steps security teams can take to improve resilience in Microsoft 365 environments.

If you would like to find out more, visit coreview.com

00:00 Introduction to Cyber Resilience in Microsoft 365

01:01 Guest Introduction: Rob Edmison and His Role at CoreView

02:17 Why Confidence in Microsoft 365 Security Falls Short

04:24 The Expanding Scope of Microsoft 365 Services

05:27 Visibility Challenges in Microsoft 365 Security

07:20 Bridging the Gap: Improving Visibility and Configuration Management

11:05 Risks of Configuration Drift and Tenant Hardening

16:23 Importance of Configuration Backup in Cyber Resilience

21:28 Overprivileged Accounts and Tenant Security Risks

26:04 Balancing Security and Innovation with AI and Automation

28:37 Tips for Decision Makers

• Microsoft 365 now covers identity, device, compliance, and collaboration tools.
• Security risks extend far beyond just email and file storage.
• Limited visibility into configuration changes creates blind spots.
• Excessive administrative privileges increase the potential impact of a compromise.
• Strengthening configurations and planning for recovery helps organisations respond more quickly.

Podcast: The Security Strategist

Host: Richard Stiennon, Chief Research Analyst at IT-Harvest

Guest: Michael Kennedy, Ostra Security Founder

For leaders in enterprise technology, the pressure to show measurable cybersecurity outcomes has never been greater. Boards are asking tougher questions, attackers are moving faster, and conventional security awareness metrics aren’t telling the whole story.

In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, is joined by Ostra Security Founder Michael Kennedy, who pointed out a growing gap in how enterprises measure success. Despite years of investment in phishing training and user awareness, breaches keep happening—not because employees are failing on a large scale, but because enterprise systems aren’t designed to handle inevitable mistakes.

For CIOs, CISOs, and CTOs, this signals a major transition toward outcome-based security.

Phishing simulations, reduced click rates, and increased reporting are often seen as proof of a strong cybersecurity strategy. The metrics are easy to track, too.

However, as Kennedy notes, they provide limited insight into actual risk reduction. Even the most effective awareness programs leave some room for error. In reality, attackers only need one successful attempt to gain access. “If one gets through, that’s enough,” Kennedy suggests, highlighting a truth most security leaders understand but find difficult to measure.

What these metrics don’t capture is the downstream impact of that failure.

Two identical phishing attacks can lead to vastly different results depending on the enterprise security setup. In one situation, the threat is neutralised quickly. In another, it escalates into lateral movement, credential theft, or ransomware deployment. For enterprise settings, this gap reveals a basic problem – user-focused metrics assess behaviour.

The more effective approach, Kennedy argues, is to frame cybersecurity around engineering outcomes instead of user behaviour.

This means evaluating how well systems perform during attacks—not how well users avoid making mistakes.

The key markers of a strong enterprise cybersecurity strategy include how quickly threats are detected, how effectively security teams respond, and how well incidents are contained before they spread. These operational metrics give a clearer view of real-world readiness.

This shift lines up with the growing adoption of zero trust architectures, extended detection and response (XDR), and AI-driven security operations. All these frameworks focus on containment, visibility, and fast responses rather than the unrealistic goal of perfect user behaviour.

It also changes how breaches are examined. High-profile incidents are often simplified to stories about weak passwords or phishing clicks, while the more vital question—why controls failed to limit the impact—gets overlooked.

For enterprise buyers and decision-makers, this can lead to misaligned investments, over-prioritising awareness training while underfunding detection engineering, identity controls, and network segmentation.

While the focus shifts away from blaming users, Kennedy emphasises that people still play a vital role in enterprise cybersecurity—just not in the way many enterprises think.

In enterprise environments where employees fear blame, reporting delays are common. Suspicious emails go unreported, incidents remain unnoticed longer, and response times increase.

In contrast, organisations that create a no-blame security culture see users acting as an extension of their detection capabilities. Employees who feel safe reporting anomalies can identify threats earlier, often before automated systems escalate them.

This cultural change has measurable operational benefits. Faster reporting reduces dwell time, limits damage, and improves overall incident response effectiveness.

Some enterprises are formalising this approach through internal collaboration platforms, enabling real-time threat sharing across teams. In doing so, they turn their workforce into a distributed security layer—one that complements, rather than replaces, technical controls.

The enterprises that succeed in this next phase of cybersecurity maturity will be those that move beyond the “human error” narrative and embrace a truly outcome-based approach to security engineering.

Because in modern enterprise environments, the question is no longer who clicked—it’s how well the system absorbed the impact.

1. Cybersecurity failures are system design issues—not user mistakes.
2. Click-rate metrics are misleading
3. Real success is measured by containment speed and impact reduction.
4. Strong security culture encourages users to report threats without fear of blame.
5. Engineering outcomes (like detection speed and blast radius control) matter more than user behaviour metrics.
6. AI is reshaping both attacks and defence, making faster, smarter response capabilities essential.

1. 00:00 Introduction to Cybersecurity's Human Element
2. 03:15 Reevaluating User Responsibility in Cybersecurity
3. 06:44 Creating a Culture of Reporting
4. 09:25 Measuring Security Outcomes Beyond Click Rates
5. 12:05 The Role of AI in Cybersecurity
6. 15:06 Adapting to Evolving Threats
7. 17:44 Key Takeaways for Decision Makers

For more information, please visit em360tech.com and ostrasecurity.com.

EM360Tech YouTube: @enterprisemanagement360

EM360Tech LinkedIn: @EM360Tech

EM360Tech X: @EM360Tech

Ostra LinkedIn: Ostra Security

Ostra X: @ostra_security

Ostra YouTube: @OstraCybersecurity

#Cybersecurity #CISO #EnterpriseSecurity #OutcomeBasedSecurity #SecurityMetrics #Phishing #ZeroTrust #AIinSecurity #NoBlameCulture #SecurityStrategist #OstraSecurity

Podcast: The Security Strategist

Host: Richard Stiennon, Chief Research Analyst at IT-Harvest

Guest: Nathan Rollings, CISO at Zafran

The cybersecurity enterprise space has been transforming for years, going beyond traditional vulnerability management. According to Nathan Rollings, CISO at Zafran, the next shift is already underway in the B2B Enterprise technology space. It is being driven by automation, AI, and a deeper understanding of context within enterprise environments.

Rollings sat down with host Richard Stiennon, also the Chief Research Analyst at IT-Harvest on The Security Strategist podcast to talk about the need for security teams to move beyond dashboards and risk scores to something more operational–agentic exposure management.

“Attackers are already using automation and AI,” Stiennon says to Rollings during the podcast. “Meanwhile, most defenders are still focused on risk scores, dashboards, and ticket backlogs.”

Rollings believes the real opportunity lies in allowing intelligent systems to analyse exposure continuously and act on it.

Exposure management often appears as a new discipline, but Rollings believes its roots are much older.

“If you were to look at a vulnerability management maturity model five or 10 years ago, the characteristics of the most mature programs aligned with what we consider continuous threat exposure management today,” he said.

Traditional vulnerability management focused heavily on scanning and prioritising flaws. Continuous threat exposure management (CTEM) builds on that by adding context such as internet reachability, compensating controls, and real-time telemetry from security tools.

Agentic exposure management goes a step further, where autonomous systems help drive the processes themselves. “When we look back at the early days of vulnerability management, we did much of this manually,” Rollings said. “Then we moved toward automated processes. Now, we are moving toward autonomous.”

Instead of security teams manually distributing vulnerability reports or setting rigid rules for ownership and remediation, AI agents can interpret available telemetry and handle those workflows dynamically. Over time, those same systems may even take remediation actions on their own.

The challenge is trust, according to Zafran’s CISO. “Enterprises must trust that the actions taken by these systems are safe and effective within their environments.”

The podcast also covered a recent announcement from Anthropic regarding AI-driven code security. This move quickly sparked debate about how generative AI might reshape vulnerability management.

Stiennon suggested the technology could disrupt parts of the market focused on application security. However, Rollings believes its impact on exposure management will be more limited. “Code analysis is incredibly powerful,” he said. “But it’s very much a shift-left capability."

Exposure management operates on the opposite side of the lifecycle. It focuses on production environments, where context decides whether a vulnerability is actually exploitable.

“A good exposure management platform considers your defence-in-depth strategy,” Rollings explained. “That means tens of integrations across an organisation to understand the residual risk of specific exposures.”

Runtime behaviour, network paths to the internet, endpoint protection policies, and segmentation controls all influence whether a vulnerability is a real risk. Analysing source code alone cannot provide that operational picture.

For many security teams, vulnerability prioritisation still relies heavily on numerical risk scoring. Rollings argues that this approach often misses the bigger picture. “You’re spending so much money on these security tools,” he said. “The real question is, what is the return? What is the business value?”

Understanding the effectiveness of existing controls, such as intrusion prevention systems, endpoint detection, or micro-segmentation, can dramatically change how vulnerabilities are prioritised.

Research cited by Rollings suggests that only around one in 50k vulnerabilities is truly exploitable in a given environment once contextual factors are taken into account. “That means organisations spend enormous effort remediating vulnerabilities that may never actually be reachable,” he added.

Agentic systems that correlate telemetry across security tools could narrow that focus significantly. This would allow teams to prioritise the small subset of exposures that really matter.

“Security teams were so focused on detection, assessment, and ticketing that they didn’t have time to dig deeper,” Rollings tells Stiennon. “Agentic capabilities free them to concentrate on the things that truly make a difference.”

1. Exposure management prioritises vulnerabilities using real-world context, not just CVSS scores.
2. Agentic AI can analyse exposures and automate remediation workflows.
3. Security context—controls, network paths, and runtime data—determines real exploitability.
4. Only about 1 in 50,000 vulnerabilities are truly exploitable in most environments.
5. AI-secured code won’t remove runtime risk in live infrastructure.

1. 00:00 Introduction to Cybersecurity Challenges
2. 03:19 The Evolution of Exposure Management
3. 07:31 Impact of AI on Vulnerability Management
4. 11:34 Contextual Understanding in Exposure Management
5. 15:37 Efficiency and Cost-Effectiveness in Security Teams
6. 18:08 Key Takeaways for Security Practitioners

For more information, please visit em360tech.com and www.zafran.io.

EM360Tech YouTube: @enterprisemanagement360

EM360Tech LinkedIn: @EM360Tech

EM360Tech X: @EM360Tech

Zafran LinkedIn: Zafran Security

Zafran X: @Zafran_io

#AgenticAI #ExposureManagement #VulnerabilityManagement #CTEM #Cybersecurity #CISO #SecurityStrategist #RichardStiennon #NathanRollings #Zafran