The Tea on Cybersecurity

By Trava Security

Cybersecurity—a word we hear all the time, but do you really know what it means?

The Tea on Cybersecurity breaks it down without the confusing jargon. We spill the truth about sec

... more

Download on the App Store

Download on the App Store

Get it on Google Play

FAQs about The Tea on Cybersecurity:

How many episodes does The Tea on Cybersecurity have?

The podcast currently has 51 episodes available.

The Tea on Cybersecurity episodes:

October 20, 2025SOC 2 Certification in 60 Days? Here’s What They’re Not Telling You
Some companies boast about earning their SOC 2 certification in just two months. While technically possible, that speed usually comes with stress, shortcuts, and costly tradeoffs.

In this episode, Marie Joseph, Manager of Compliance Advisory at Trava, explains why true SOC 2 compliance takes more than 60 days. She breaks down the difference between Type 1 and Type 2 reports, outlines what a realistic timeline looks like, and highlights the team effort required to build a sustainable program.

Whether you're starting from zero or in the process of certification, this is your SOC 2 reality check.

Want to know what it really takes to get SOC 2 certified? Check out our blog, How To Prove SOC 2 Compliance, to see what goes into building a strong program and preparing for a successful audit. Read: https://travasecurity.com/proving-SOC2

Key takeaways:
The difference between SOC 2 Type 1 and Type 2
What a realistic SOC 2 timeline looks like
How team bandwidth, funding, and tools affect SOC 2 certification

Episode highlights:
(00:00) SOC 2 in two months: Myth or reality?
(03:26) The SOC 2 certification process
(06:29) Understanding SOC 2 Type 1 vs. Type 2
(10:37) Factors affecting SOC 2 certification speed
(11:58) Do you need SOC 2 for VC funding?

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Marie Joseph’s LinkedIn - https://www.linkedin.com/in/marie-joseph-a81394143/

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
15min
October 07, 2025 Introducing Season 5 of The Tea on Cybersecurity
Cybersecurity can feel overwhelming with its many acronyms, shifting rules, and conflicting advice.

That’s why Season 5 of The Tea on Cybersecurity is all about separating fact from fiction. Host Jara Rowe kicks things off by identifying the common questions business leaders have about SOC 2 certification, automation tools, and AI policies. This season keeps episodes short and to the point, so you can get the info you need without wasting time.

Subscribe, share, and send in your questions. Season 5 is just getting started.

Episode highlights:
(00:00) Welcome to Season 5 of The Tea on Cybersecurity
(01:50) Common questions on SOC 2, automation, and AI
(02:57) What’s new this season

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
4min
August 12, 2025Key Lessons from Season 4 of The Tea on Cybersecurity
If there’s one key takeaway from Season 4 of The Tea on Cybersecurity, it’s that cybersecurity is a shared responsibility.

With this in mind, host Jara Rowe wraps up the season by sharing valuable insights that everyone can use. She reflects on the most impactful lessons about compliance, AI, and penetration testing.

Key takeaways:
The importance of vCISOs and cyber engineers
How to approach penetration testing and PTaaS
Why transparency and training are essential for AI safety

Episode highlights:
(00:00) Today’s topic: Key insights from this season
(01:16) The role of vCISOs and cyber engineers
(02:47) Responsible AI use
(03:51) Penetration testing and PTaaS for small teams

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
7min
July 29, 2025Breaking Down PTaaS: Continuous Security for Modern Companies
Most companies continually push code, launch new features, and update their infrastructure. However, for many businesses, security testing occurs only once a year. That gap leaves systems exposed to risks that go unnoticed.

In this episode, Anh Pham, Director of Penetration Testing at Trava, explains the concept of Penetration Testing as a Service (PTaaS). He shares how it works and why it's more beneficial than one-time pentests. You’ll also learn how AI fits into the picture and what to consider when choosing a provider.

Key takeaways:
The difference between PTaaS and traditional pentesting
How PTaaS supports fast-changing environments
The qualities of a trustworthy PTaaS provider

Episode highlights:
(00:00) Today’s topic: Penetration Testing as a Service
(03:16) PTaaS vs one-time pentests
(08:36) How PTaaS works
(11:59) Choosing a secure PTaaS provider
(13:17) Can AI help in PTaaS?
(15:22) A key reminder for businesses getting started

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Anh Pham’s LinkedIn - @anhpham11

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity

Listen to past episodes:
Unveiling Vulnerabilities: The Power of Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/unveiling-vulnerabilities-the-power-of-pen-testing-in-cybersecurity/

Proving Compliance and Security Effectiveness Through Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/proving-compliance-and-security-effectiveness-through-pen-testing/
...more
20min
July 15, 2025Understanding Cyber Engineering to Build Stronger Security
Cyber engineering is a broad and often misunderstood field, covering everything from cloud architecture to compliance. But one thing is clear: someone needs to take responsibility for the security of your business’s digital infrastructure.

In this episode, host Jara Rowe is joined by Michael Magyar, vCISO at Trava Security, to explore the intersection of cybersecurity, compliance, and engineering. Michael shares what smart architecture looks like in practice, where organizations often fall short, and how emerging trends like AI impact cyber engineering.

Key takeaways:
How smart cyber engineering impacts security and operations
The influence of AI on cyber engineering tasks
When to seek outside help for technical implementation

Episode highlights:
(00:00) Today’s topic: Cyber engineering
(05:29) The push for more security and compliance
(07:44) Being intentional with security architecture
(10:33) Cybersecurity engineering in the real world
(13:52) Cyber engineering trends and AI
(19:37) Discerning when to hire outside experts

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Michael Magyar’s LinkedIn - @michael-magyar-cyqual

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
24min
July 01, 2025The Core Pillars of AI Governance
The rapid adoption of AI brings opportunities, yet new risks. Strong governance enables organizations to remain innovative while maintaining trust and protecting data.

In this episode, host Jara Rowe welcomes Jim Goldman, Co-Founder of Trava Security, to discuss how clear oversight, board engagement, and high-quality data enable the creation of ethical AI that aligns with business goals.
They outline practical steps, common blind spots, and proven frameworks for trustworthy automation.

Key takeaways:
AI governance versus compliance in plain language
Why data quality shapes reliable machine output
How leaders and teams share accountability from policy to practice

Episode highlights:
(00:00) Today’s topic: AI Governance
(02:46) Governance reaches the boardroom
(04:09) Big shifts in NIST CSF 2.0
(06:01) Governance versus compliance explained
(07:45) Data quality risks in AI
(10:55) Core parts of a governance framework
(13:32) Roles and ownership across teams
(14:55) Designing ethical, transparent AI
(19:06) Proving accountability in decisions
(23:37) Easing public worries with openness
(26:41) Criminal abuse and law response

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Jim Goldman’s LinkedIn - @jigoldman

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
33min
June 17, 2025Don’t Overtrust the Robots: The Real Tea on AI Compliance
Businesses rely on AI for everything from streamlining communication to managing hiring and forecasting trends. It’s fast, efficient, and deeply embedded in daily operations. But as AI becomes more common, one critical piece is often overlooked: compliance.
In this episode, Jara Rowe sits down with Dr. Marwan Omar, Chief AI Officer at Insight Assurance, to talk about the growing need for AI compliance. They explore what it really means, why it’s not just a concern for tech giants, and how overlooking it could expose your business to legal, ethical, and reputational risks.

Key takeaways:
What makes AI compliance different from traditional IT compliance
Where to start with AI risk assessments
How real companies have gotten AI compliance wrong

Episode highlights:
(00:00) Today’s topic: AI compliance and why it matters
(05:23) Key laws shaping AI compliance today
(07:25) The nuances of AI compliance
(10:14) First steps to build AI compliance internally
(13:26) How explainability strengthens trust in AI models
(15:32) Challenges with regulations and data privacy
(18:24) Staying informed as AI laws evolve

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Marwan Omar’s LinkedIn - @dr-marwan-omar

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
23min
June 03, 2025Proving Compliance and Security Effectiveness Through Pen Testing
Many companies start penetration testing to address compliance requirements. However, it can also provide valuable insights beyond just meeting standards.

In this episode, host Jara Rowe sits down with Anh Pham and Christina Annechino from Trava to talk about how pen tests uncover hidden risks and strengthen your cybersecurity. They explain compliance frameworks, typical pen test schedules, and common mistakes to avoid.

Key takeaways:
Compliance frameworks and their pen test requirements
The different types of penetration testing
How to prepare your environment for a successful pen test

Episode highlights:
(00:00) Today’s topic: Penetration Testing and Compliance
(03:42) Pen testing compliance frameworks
(05:46) The difference between vulnerability scans and pen tests
(09:11) How often to conduct pen tests
(11:04) Qualities of a good penetration testing vendor
(14:34) Making pen testing work on a budget
(16:49) Scoping mistakes that limit test outcomes
(18:53) Using pen tests to improve overall cybersecurity

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Anh Pham’s LinkedIn - @anhpham11
Christina Annechino’s LinkedIn - @christinaannechino

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity

Listen to a related episode:
Unveiling Vulnerabilities: The Power of Pen Testing - https://travasecurity.com/learn-with-trava/podcasts/unveiling-vulnerabilities-the-power-of-pen-testing-in-cybersecurity/
...more
27min
May 20, 2025Getting CMMC Right: Scope, Budget, and Certification Tips
Think compliance is just an IT problem? It’s a revenue problem, too. Without it, some contracts will stay out of reach.

In this episode, Jara Rowe talks with Tom Greco, vCISO at Trava Security, about what companies need to know about the Cybersecurity Maturity Model Certification (CMMC). It’s a Department of Defense requirement that verifies whether companies are securely handling Controlled Unclassified Information (CUI). Tom Greco explains what CMMC involves, how scoping affects your readiness, and how to maintain compliance over time. In short, if you want to win or keep federal contracts, CMMC compliance isn’t optional.

Key takeaways:
What CMMC is and why it exists
The importance of accurate scoping
Tools and tips to maintain CMMC compliance

Episode highlights:
(00:00) Today’s topic: What is CMMC?
(02:20) What CMMC means for your business
(06:05) The nuances of scoping
(10:07) How contracts set your CMMC level
(13:44) Self-assessment vs third-party audits
(17:36) Maintaining CMMC compliance over time
(22:17) Perform gap assessments ASAP

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Thomas Greco’s LinkedIn - @thomas-greco

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
27min
May 06, 2025Security Leadership Without the Full-Time Price Tag for Small Teams
Is your business one cyberattack away from chaos? Most companies don’t think about cybersecurity until they’re in crisis mode—but by then, the damage is done.

In this episode, Jara Rowe talks with Michael Magyar, an experienced virtual Chief Information Security Officer (vCISO). They cover what a vCISO does, why more companies are choosing virtual over full-time, and how to know when it’s time to bring one in. Michael shares examples of helping businesses avoid costly mistakes, explains how vCISOs assess risk, and offers advice for small teams trying to do more with less.

Key takeaways:
Common cybersecurity challenges vCISOs help solve
What a typical engagement with a vCISO looks like
Advice for SMBs with limited budgets trying to prioritize cybersecurity

Episode highlights:
(00:00) Today’s topic: Breaking down the role of a vCISO
(05:32) vCISO vs. traditional in-house CISO
(07:11) Why small businesses benefit from a vCISO
(09:53) Real examples of vCISOs making a difference
(13:52) What it’s like working with a vCISO
(16:00) Key indicators your business needs a vCISO
(20:54) How to prioritize cybersecurity on a budget

Connect with the host:
Jara Rowe’s LinkedIn - @jararowe

Connect with the guest:
Michael Magyar’s LinkedIn - @michael-magyar-cyqual

Connect with Trava:
Website - www.travasecurity.com
Blog - www.travasecurity.com/learn-with-trava/blog
LinkedIn - @travasecurity
YouTube - @travasecurity
...more
28min

FAQs about The Tea on Cybersecurity:

How many episodes does The Tea on Cybersecurity have?

The podcast currently has 51 episodes available.