AI is accelerating cyberattacks to machine speed. But most security programs were built for a world where attackers moved at human speed.

What happens when an attacker can move through an environment in seconds, security alerts keep multiplying, and hiring more analysts is no longer enough?

In this episode of the **TPRM Podcast, Threats, Pitfalls & Risk Myths**, Nate Lee sits down with **Mandy Andras, Chief Information Security Officer at Elastic**, to explore how artificial intelligence is changing the economics, operations, and strategy of cybersecurity.

Together, they examine how AI is accelerating existing attack techniques, why traditional security programs struggle to operate at machine speed, and how security leaders can redesign their approach to risk, detection, and response.

Mandy shares how Elastic is applying AI and agentic workflows to its security operations, including an experiment in which a multi-agent approach to automated alert triage proved five times less expensive than a single-agent approach.

But efficiency is only part of the equation.

As organizations adopt AI, security teams must balance detection quality, token consumption, operational costs, and human judgment. Mandy explains why adding more people won't solve the growing volume of security alerts and why the next generation of security programs will need to rethink how they allocate resources.

The conversation also explores how attackers are using AI to accelerate lateral movement, why traditional approaches to prevention need to evolve, and how security leaders can communicate risk in ways that resonate with business executives.

**The conversation covers:**

• Why AI is accelerating cyberattacks to machine speed

• How attackers can use AI agents to accelerate lateral movement after gaining access

• Why hiring more security analysts won't solve the growing volume of alerts

• How Elastic reduced automated alert triage costs by 5X using a multi-agent approach

• The economics of AI security, including token costs, detection quality, and operational efficiency

• Why prevention, least privilege, and limiting the blast radius matter in an AI-driven environment

• How red team exercises help organizations identify and prioritize real business risks

• The changing role of human judgment in security operations

• Why curiosity, critical thinking, and adaptability remain essential cybersecurity skills

• How AI could transform governance, risk, compliance, and continuous risk assessment

Mandy also shares how Elastic has experienced a more than 100-fold increase in bug bounty submissions over approximately nine to ten months, illustrating the scale of the operational challenges security teams are beginning to face.

Drawing on her background in accounting, technology, auditing, and law, she offers a business-focused perspective on building security programs that can adapt to rapidly changing technology without losing sight of cost, effectiveness, and organizational priorities.

Whether you're a CISO, security engineer, SOC analyst, technology executive, or business leader navigating AI adoption, this conversation offers practical insights into how security programs can evolve to meet the challenges of an increasingly automated world.

---

## Watch the Full Episode

**YouTube**

https://www.youtube.com/@TPRMPodcast

**Spotify**

https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=21e30095e8d94cf4

**Apple Podcasts**

https://podcasts.apple.com/us/podcast/the-tprm-podcast

---

## About the Guest

Mandy Andras is Chief Information Security Officer at Elastic. Her career spans accounting, systems auditing, security consulting, architecture, and enterprise security leadership.

She also holds a law degree, bringing a multidisciplinary perspective to cybersecurity, risk management, governance, and regulatory requirements.

At Elastic, she leads security efforts in an environment where AI and agentic technologies are reshaping both the threats organizations face and the tools available to defend against them.

---

## About the Host

Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

---

## About the Show

The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators who are reshaping the future of cybersecurity.

Each episode goes beyond headlines to explore the threats, pitfalls, and risk myths behind modern security programs, AI, software development, governance, and business resilience, helping leaders navigate technology with greater confidence.

---

#AI #CyberSecurity #Elastic #CISO #SecurityOperations #TPRMPodcast

AI isn't just changing how we write software.

It's changing how organizations capture knowledge, how security teams operate, and how expertise itself is created, shared, and retained.

But what happens when your experience becomes part of the AI systems you build?

In this episode of the TPRM Podcast: Threats, Pitfalls & Risk Myths, Nate Lee sits down with Joe Sullivan, Chief Trust Officer at Corridor and former Chief Security Officer at Facebook, Uber, and Cloudflare, to explore one of the biggest shifts facing cybersecurity and every knowledge-based profession.

Together they discuss how AI is reshaping security leadership, why organizations need to rethink vulnerability management, what trust means in an AI-first world, and how security professionals can prepare for a future where human expertise increasingly becomes part of intelligent systems.

As AI agents become more capable, organizations aren't just automating tasks—they're beginning to codify institutional knowledge. That creates tremendous opportunities for innovation while raising new questions about ownership, privacy, resilience, and the future of work.

Nate and Joe explore why the next generation of security leaders must think beyond prevention, how AI is changing the relationship between people and technology, and why adaptability may become the most valuable skill of all.

The conversation covers:

• Whether AI is capturing more than just our work—it may be capturing our expertise
• How AI is transforming cybersecurity operations and security leadership
• Why vulnerability management needs a fundamentally different approach
• The future of AI agents inside the enterprise
• Open source AI, transparency, and building trust in intelligent systems
• Why adaptability may matter more than prevention in modern cybersecurity
• How security leaders can embrace AI while managing real business risk
• What the future of work looks like for security professionals, executives, and knowledge workers

Joe also shares lessons from decades of experience leading security at Facebook, Uber, and Cloudflare, along with practical insights into how organizations can prepare for an AI-driven future.

Whether you're leading security, building AI products, managing technology risk, or simply trying to understand how artificial intelligence is reshaping the workplace, this conversation offers practical insights into one of the most important technology shifts of our time.

Watch the Full Episode

YouTube
https://youtube.com/@TPRMPodcast

Spotify
https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA

Apple Podcasts
https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

About the Guest

Joe Sullivan is Chief Trust Officer at Corridor and previously served as Chief Security Officer at Facebook, Uber, and Cloudflare. Before joining the technology industry, he was a federal prosecutor specializing in cybercrime. Throughout his career, he has helped shape modern cybersecurity practices while advising organizations on security, trust, governance, and the responsible adoption of emerging technologies.

About the Host

Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show

The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators who are reshaping the future of cybersecurity.

Each episode goes beyond headlines to explore the threats, pitfalls, and risk myths behind modern security programs, AI, governance, software development, and business resilience, helping leaders navigate technology with greater confidence.

Most conversations about AI focus on one question:

**Will AI replace jobs?**

Alex Stamos thinks that's only part of the story.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Alex Stamos, Chief Product Officer at Corridor, former Chief Security Officer at Facebook, former CISO of Yahoo, and founding director of the Stanford Internet Observatory.

The conversation explores how AI is fundamentally changing software development, cybersecurity, and the future of work.

As autonomous coding agents become more capable, organizations are entering a world where software can be written, reviewed, and deployed at unprecedented speed. That creates enormous opportunities, but it also introduces entirely new security challenges that many organizations are unprepared for.

Nate and Alex discuss how AI is reshaping application security, why security teams can no longer rely on saying "no," and how organizations should rethink software development, vulnerability management, and business risk in an AI-first world.

The conversation also explores:

• Why AI will permanently change software engineering
• How autonomous coding agents are transforming development
• The future of application security and vulnerability discovery
• Why security leaders must become business enablers
• The growing gap between AI adoption and governance
• Career advice for professionals navigating rapid technological change
• The societal impact of AI and what happens if organizations move faster than people can adapt
• Why resilience, not prevention, will define the next generation of cybersecurity

Alex also shares lessons from leading security at Facebook, Yahoo, SentinelOne, and Stanford, along with practical advice for CISOs, engineers, founders, and technology leaders preparing for an AI-driven future.

Whether you're leading security, building software, managing risk, or simply trying to understand how AI is changing work, this conversation offers thoughtful insights into where technology is headed and what leaders should do next.

## Listen & Subscribe

Spotify
https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA

Apple Podcasts
https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

YouTube
https://youtube.com/@TPRMPodcast

## About the Guest

Alex Stamos is Chief Product Officer at Corridor and one of the cybersecurity industry's most respected leaders. Previously, he served as Chief Security Officer at Facebook, Chief Information Security Officer at Yahoo, founding director of the Stanford Internet Observatory, and CISO at SentinelOne. He has advised governments, taught cybersecurity at Stanford University, and spent decades helping shape modern security practices.

## About the Host

Nate Lee is a B2B scale-up CISO and Founder of Cloudsec.ai and TrustMind. He helps SaaS companies build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

## About the Show

The TPRM Podcast features candid conversations with security leaders, founders, and technology innovators exploring the real-world challenges shaping cybersecurity today.

Each episode goes beyond headlines to examine the threats, pitfalls, and risk myths behind modern security programs, AI, governance, and business resilience.

Most conversations about AI and cybersecurity focus on a simple question:

Will AI help defenders, or will it help attackers?

But that may be the wrong question entirely.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Trey Ford, Chief Strategy & Trust Officer at Bugcrowd, former General Manager of Black Hat, former CISO of Deepwatch, and former security leader at Salesforce and Heroku.

The conversation explores what Trey calls the "Bugpocalypse" and why AI is fundamentally changing the economics of vulnerability discovery.

As AI dramatically lowers the cost of finding security flaws, organizations are entering a world where vulnerabilities can be discovered faster than ever before. The challenge is no longer simply finding problems. The challenge is validating them, prioritizing them, and deciding what to do when security teams are suddenly faced with thousands of findings and limited resources.

Nate and Trey discuss how bug bounty programs are evolving, why AI is accelerating both offensive and defensive security capabilities, and how organizations need to move beyond individual vulnerabilities and start thinking in systems.

They explore the future of software security, AI-assisted development, vulnerability management, technical debt, and why many organizations may need to rethink long-held assumptions about patching, remediation, and risk management.

The conversation also dives into AI governance, agentic systems, security operations, and the challenges security leaders face as every department begins adopting AI-powered tools faster than organizations can fully understand or govern them.

Trey shares lessons from decades of experience across consulting, vulnerability research, security leadership, and some of the industry's most influential organizations, offering practical insights into how security teams can adapt to a rapidly changing landscape.

This episode is essential listening for CISOs, security leaders, developers, risk practitioners, and anyone trying to understand how AI is reshaping cybersecurity.

Listen and Subscribe

Spotify - https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=1c7d77143ad7424a

Apple Podcasts - https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

YouTube - https://youtube.com/@TPRMPodcast

Episode Sponsor

This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.

TrustMind uses AI to automatically complete security questionnaires using your existing documentation, policies, and prior responses so security teams can spend less time copying and pasting and more time securing their platforms.

Learn more at https://trustmind.com

About the Guest

Trey Ford is Chief Strategy & Trust Officer at Bugcrowd.

Previously, Trey served as General Manager of Black Hat, Chief Information Security Officer at Deepwatch, and held security leadership roles at Salesforce and Heroku. He began his career as a security consultant and PCI assessor and has spent decades helping organizations understand and manage cyber risk.

His work spans vulnerability research, security operations, product security, bug bounty programs, governance, and cybersecurity strategy.

About the Host

Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai and TrustMind. He works with SaaS companies to build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show

The TPRM Podcast features real-world conversations with security leaders who are reshaping how we think about cybersecurity and risk.

Each episode explores the threats, pitfalls, and risk myths behind modern security programs and what it actually takes to protect organizations operating at scale.

Most security teams still treat patching as the front line of defense.

But what happens when attackers move faster than your remediation cycle, vulnerabilities are discovered at machine speed, and security teams are still optimizing around outdated assumptions?

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Jerry Perullo, former CISO of Intercontinental Exchange, where he spent more than two decades securing critical infrastructure, including the New York Stock Exchange. Jerry is now Founder & CTO of Adversarial, Professor at Georgia Tech, and co-host of The Adversarial Podcast.

The conversation explores why many security programs are still solving the wrong problems. Jerry breaks down the difference between threats and risks, why organizations often confuse activity with progress, and how security leaders should think more intentionally about tradeoffs, governance, and real business impact.

Nate and Jerry unpack why vulnerability management has become overly narrow, why patching alone cannot be the strategy, and what organizations should be doing instead to reduce real exposure.

They also discuss board communication, security decision-making, vendor-driven fear, and how security teams can avoid reacting to every headline while staying grounded in what actually matters.

Jerry shares practical lessons from securing some of the world’s most critical financial infrastructure, including how mature organizations think about prioritization, resilience, and continuous improvement when the stakes are exceptionally high.

This episode is essential listening for CISOs, security leaders, risk practitioners, and security teams trying to build programs grounded in reality instead of noise.

Listen and Subscribe
Spotify - https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=1c7d77143ad7424a
Apple Podcasts - https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699
YouTube - https://youtube.com/@TPRMPodcast

Episode Sponsor
This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.

TrustMind uses AI to automatically complete security questionnaires using your existing documentation, policies, and prior responses so security teams can spend less time copying and pasting and more time securing their platforms.

Learn more at
https://trustmind.com

About the Guest
Jerry Perullo is the Founder & CTO of Adversarial, a former CISO of Intercontinental Exchange, and a Professor at Georgia Tech.

Over a 20+ year career leading security for critical financial infrastructure, including the New York Stock Exchange, Jerry developed practical approaches to cyber risk management, governance, and adversarial resilience.

He is also co-host of The Adversarial Podcast, where he explores modern cybersecurity strategy with fellow former CISOs and security leaders.

About the Host
Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai and TrustMind. He works with SaaS companies to build business-aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show
The TPRM Podcast features real-world conversations with security leaders who are reshaping how we think about cybersecurity and risk.

Each episode explores the threats, pitfalls, and risk myths behind modern security programs and what it actually takes to protect organizations operating at scale.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Ayoub Fandi, GRC Engineering Lead at GitLab and creator of the GRC Engineer podcast and newsletter.

As AI reshapes how security teams operate, many GRC programs are still built around audits, frameworks, and compliance driven workflows. Ayoub explains why this model is quickly losing relevance and why simply automating existing processes often leads to solving the wrong problems faster.

The conversation explores how security teams need to rethink their operating models in an AI driven world. Nate and Ayoub discuss the shift from compliance driven programs to risk driven decision making, and why teams must move beyond audit cycles and start rebuilding workflows from first principles.

They also examine how AI is changing the nature of work inside security, why compliance is becoming table stakes, and why risk management remains one of the most complex and human parts of security. This shift is forcing organizations to rethink how they approach workflows, decision making, and collaboration across teams.

Beyond tooling, the discussion dives into systems thinking, stakeholder alignment, and how GRC teams can become more embedded within engineering, security, and the broader business.

This episode is essential listening for CISOs, security leaders, engineers, and practitioners navigating AI driven change, modern security architecture, and the evolving role of security teams.

Listen and Subscribe
Spotify - https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=c862255fc2b84d12

Apple Podcasts - https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

YouTube - https://youtube.com/@TPRMPodcast

Episode Sponsor
This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.

TrustMind uses AI to automatically complete security questionnaires using your existing documentation, policies, and prior responses so security teams can spend less time copying and pasting and more time securing their platforms.

Learn more at https://trustmind.com

About the Guest
Ayoub Fandi is the GRC Engineering Lead at GitLab and creator of the GRC Engineer podcast and newsletter. He focuses on rethinking how governance, risk, and compliance evolve in an AI driven world.

His work centers on applying systems thinking, automation, and engineering principles to modernize GRC programs and better align them with modern security practices.

About the Host
Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai and TrustMind. He works with SaaS companies to build business aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show
The TPRM Podcast features real world conversations with security leaders who are reshaping how we think about cybersecurity and risk.

Each episode explores the threats, pitfalls, and risk myths behind modern security programs and what it actually takes to protect organizations operating at scale.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Michael Coates, Founding Partner at Seven Hill Ventures and former CISO of Twitter, Mozilla, and CoinList.

As AI continues to accelerate both attack speed and capability, the gap between attackers and defenders is rapidly shrinking. Michael explains how automated attacks are compressing response times to the point where human driven security models are no longer viable, and why organizations must begin removing humans from critical decision loops.

The conversation explores how security teams need to rethink their operating models in an AI driven world. Nate and Michael discuss the future of the SOC, the rise of automation and agent driven workflows, and why many traditional security practices may soon become obsolete.

They also examine how AI is lowering the barrier to entry for attackers, enabling capabilities that were once limited to nation state actors. This shift is forcing organizations to move faster, experiment more, and rethink how they balance risk, speed, and innovation.

Beyond technology, the discussion dives into how roles inside security teams are evolving, what skills will matter most going forward, and why security leaders must shift from gatekeepers to enablers of business velocity.

This episode is essential listening for CISOs, security leaders, and practitioners navigating AI driven threats, modern security architecture, and the rapidly changing role of cybersecurity.

Listen and Subscribe

Spotify - https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=c862255fc2b84d12

Apple Podcasts - https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

YouTube - https://youtube.com/@TPRMPodcast

Episode Sponsor

This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.

TrustMind uses AI to automatically complete security questionnaires using your existing documentation, policies, and prior responses so security teams can spend less time copying and pasting and more time securing their platforms.

Learn more at https://trustmind.com

About the Guest

Michael Coates is the Founding Partner at Seven Hill Ventures and former CISO of Twitter, Mozilla, and CoinList. He has spent his career building and scaling security programs at some of the most influential technology companies while also advising and investing in the next generation of cybersecurity startups.

Michael brings a unique perspective across operator, founder, and investor roles, with deep expertise in modern security architecture, risk, and the evolving impact of AI on cybersecurity.

About the Host

Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai and TrustMind. He works with SaaS companies to build business aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show

The TPRM Podcast features real world conversations with security leaders who are reshaping how we think about cybersecurity and risk.

Each episode explores the threats, pitfalls, and risk myths behind modern security programs and what it actually takes to protect organizations operating at scale.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Conor Sherman, CISO in Residence at Sysdig and host of the Zero Signal Podcast.

As AI rapidly reshapes the cybersecurity landscape, both attackers and defenders are beginning to automate their operations in ways that were not possible just a few years ago. Conor explains how threat actors are already using AI driven techniques to accelerate attacks and why traditional security operating models are starting to struggle to keep up.

The conversation explores how defenders should rethink security strategy in a world where attacks can move from discovery to exploitation in minutes. Nate and Conor discuss autonomous defense, the limits of human driven response models, and why security teams must begin designing systems that can react at machine speed.

They also examine the role of the modern CISO, the importance of resilience over perfection, and how security leaders can help their organizations adopt AI safely while still moving fast enough to stay competitive.

This episode is essential listening for CISOs, security leaders, and practitioners navigating AI driven threats, modern cloud security, and the evolving role of security leadership.

Listen and Subscribe

Spotify
https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=1c7d77143ad7424a

Apple Podcasts
https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699

YouTube
https://youtube.com/@TPRMPodcast

Episode Sponsor

This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.

TrustMind uses AI to automatically complete security questionnaires using your existing documentation, policies, and prior responses so security teams can spend less time copying and pasting and more time securing their platforms.

Learn more at
https://trustmind.com

About the Guest

Conor Sherman is the CISO in Residence at Sysdig and the host of the Zero Signal Podcast. In his role he works closely with security leaders and organizations navigating modern cloud threats and the rapidly evolving AI powered threat landscape.

Conor advises companies on building resilient security programs, adapting defenses to emerging attack techniques, and helping security teams operate effectively as both attackers and defenders begin using AI driven tools.

About the Host

Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai and TrustMind. He works with SaaS companies to build business aligned security programs that increase developer velocity, strengthen customer trust, and support rapid growth.

About the Show

The TPRM Podcast features real world conversations with security leaders who are reshaping how we think about cybersecurity and risk.

Each episode explores the threats, pitfalls, and risk myths behind modern security programs and what it actually takes to protect organizations operating at scale.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee sits down with Jacob DePriest, Chief Information Security Officer at 1Password.

As AI adoption accelerates across enterprises, security leaders are facing a new tension. Move too fast, and you increase exposure. Move too slow and teams find their own tools, bypassing controls entirely.

Jacob shares how security teams should think about enabling innovation without sacrificing visibility. The conversation explores agent security, auditability challenges, identity and authorization concerns, and why traditional controls like least privilege still matter in an AI-driven world.

They also discuss the operational reality of agents acting on behalf of users, how security teams can maintain traceability, and why the business risk of under-adoption may be just as serious as the technical risk of over-adoption.

This episode is essential listening for CISOs, security leaders, and practitioners navigating AI adoption, enterprise risk, and modern identity security.

Listen and Subscribe
Spotify → https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=ef91ded2b8ac4eef
Apple Podcasts → https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699
YouTube → https://www.youtube.com/@TPRMPodcast

Episode Sponsor
This episode features a message from TrustMind, a security questionnaire automation platform designed to help teams respond more quickly and consistently to vendor security reviews.
Learn more at → https://trustmind.com

About the Guest
Jacob DePriest is the Chief Information Security Officer at 1Password. He leads security strategy and operations, focusing on balancing innovation, usability, and strong enterprise-grade controls in a rapidly evolving AI landscape.

About the Host
Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai & TrustMind, helping SaaS companies build business-aligned security programs that increase developer velocity, strengthen trust, and support rapid growth.

About the Show
The TPRM Podcast features real-world conversations with security leaders reshaping how we think about risk, uncovering the threats, pitfalls, and myths behind modern cybersecurity programs.

In this episode of the TPRM Podcast, Threats, Pitfalls & Risk Myths, Nate Lee talks with Jake Bernardes, Chief Information Security Officer at Anecdotes and former CISO at Whistic, known for his candid, data-first approach to GRC and third-party risk.

Jake brings deep experience across GRC, TPRM, and security leadership, and is an outspoken voice on why traditional compliance frameworks like SOC 2 have become procurement shortcuts rather than meaningful security signals. He shares a pragmatic view on what is broken in modern GRC and what it will take to fix it.

They explore what agentic GRC actually means beyond the marketing hype, why data quality and completeness are foundational for AI-driven security workflows, and how treating GRC as an engineering problem can fundamentally change how risk is assessed. The conversation also covers trust centers, machine-readable evidence, the future of audits and certifications, and how real security data could replace checkbox-based assessments.

Jake also shares direct career advice for security and GRC professionals, including why networking matters more than certifications, what it really means to be an effective CISO, and why security leaders should be driving business outcomes rather than positioning themselves as cost centers.

This episode is packed with insight for CISOs, security leaders, GRC and TPRM practitioners, and anyone thinking seriously about the future of compliance, trust, and risk.

Listen and Subscribe
- Spotify → https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA?si=bf17a655fc0049f9
- Apple Podcasts → https://podcasts.apple.com/us/podcast/the-tprm-podcast/id1848217699
- YouTube → @TPRMPodcast

About the Guest
Jake Bernardes is the Chief Information Security Officer at Anecdotes and former CISO at Whistic. He has extensive experience leading GRC, TPRM, and security programs and is a strong advocate for transparency, data-driven risk assessment, and treating GRC as an engineering discipline.

About the Host
Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai, helping SaaS companies build business-aligned security programs that increase developer velocity, strengthen trust, and support rapid growth.

About the Show
The TPRM Podcast explores real-world conversations with security leaders reshaping how we think about risk, uncovering the threats, pitfalls, and myths behind today’s cybersecurity challenges.

Nate’s LinkedIn → /natetrustmind
TPRM Podcast LinkedIn → /tprm-podcast
Website → https://tprmpodcast.com
Instagram → @TPRMPodcast
TikTok → @tprmpodcast