Trust.ID Talk: The Digital Certificate and Identity Security Podcast

In this special in-studio episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, hosts Michelle Davidson and Steve Hall sit down together to unpack three decades of technology evolution and what it means for businesses navigating today’s digital world. From the days when firewalls were a hard sell and Google was just a research project to a world where AI writes our emails, cars drive themselves, and TLS certificates need renewing every few days, the duo explore how security, identity, and trust have moved from afterthoughts to business-critical priorities.


What You’ll Learn:

• How the tech landscape has transformed since 1996
• What crypto agility really means for your business
• The countdown to 47-day TLS certificate validity
• The 10-80-10 rule for using AI in your workflows
• Why human error and credential compromise remain the #1 security risk
• The trade-offs of cloud vs. on-prem infrastructure
• Where technology is heading in the next 30 years
  
  

Michelle Davidson is the VP of Marketing West at GlobalSign and Co-host of Trust.ID Talk. She brings over a decade of marketing experience spanning architecture, insurance, and technology, with a current focus on cybersecurity, digital identity, and PKI. Michelle is passionate about telling GlobalSign's brand story through content that instills trust, and she coordinates the podcast to bring listeners actionable insights from industry pioneers and subject-matter experts.


Steve Hall is a Senior Product Marketing Manager at GlobalSign and Co-host of Trust.ID Talk. With nearly 30 years of experience across the IT industry, including software, networking, servers, security, cloud hosting, SaaS, and cybersecurity, Steve has a rare front-row perspective on how digital trust has evolved. Steve is dedicated to translating complex security solutions into clear, practical guidance that helps organizations navigate today's fast-changing PKI and compliance landscape.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.

Episode Resources:

• Michelle Davidson on LinkedIn
• Steve Hall on LinkedIn
• GlobalSign Website
• View and Integrate Website

Key Takeaways:

• [03:42] When the Internet Was Just Beginning
  
  

The web began as static corporate pages, dial-up modems, and virtually no security. The infrastructure we depend on today was never designed for the always-on digital economy it now powers, and that legacy still shapes today’s security challenges.

• [10:38] Why Crypto Agility Matters More Than Ever
  
  

SSL certificates once lasted five years and rarely needed a second thought. Today, crypto agility is what lets businesses adapt quickly to shrinking certificate lifespans, new algorithms, and evolving regulation, making it a business risk to ignore.

• [17:17] The 10-80-10 Rule
  
  

A practical framework for using AI: 10% human input, 80% AI execution, 10% human review. It’s a scalable way to bring AI into everyday workflows without losing the oversight that keeps you safe.

• [21:36] The Countdown to Shorter Certificate Lifespans
  
  

TLS certificate validity has dropped from five years to 398 days, then 199, and is heading to 47 days. At that rate, manual management is off the table, and the hardest part isn’t finding the tools; it’s building the internal buy-in and policies to use them.

• [30:43] Where Will Tech Be in Another 30 Years?
  
  

Laptops may disappear, AI will run more of the workload, and businesses will need expertise across an ever-growing web of connected devices. The organizations that win will be the ones investing in open source, crypto agility, and human oversight today.


Quotes:

• “It takes years to build that customer trust. Seconds to break it.” — Michelle Davidson
  
  
• “You're doing 10% of your work of input yourself, let AI do 80% of the work, and then 10% review.” — Michelle Davidson
  
  
• “Tech is gonna evolve. I think it's gonna put more pressure on businesses, but I don't think that should put businesses off. Because being agile now protects you for the future.” — Michelle Davidson
  
  
• “I remember trying to sell firewalls. People these days don't think anything of firewalls because they're automatically built into everything that you implement.” — Steve Hall
  
  
• “You can have the best security in place. But if you've got people coming and leaving with access, they can just log in on their personal account.” — Steve Hall
  
  
• “Everything these days can be enabled by the Internet, and they're all risks. And that's the biggest thing from thirty years. Thirty years ago, it was just some servers.” — Steve Hall
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Steve Hall is joined by Julian Weeber and Sarah Zügel from essendi it Group to decrypt the complexity surrounding post-quantum cryptography, the “harvest now, decrypt later” threat, and the concrete steps enterprises must take to ensure cryptographic resilience before quantum computers arrive.


What You’ll Learn:

• How to distinguish between quantum computing, post-quantum cryptography, and quantum cryptography
• The three-step framework to quantum readiness
• How crypto agility enables quantum preparedness while solving current cryptographic challenges
• Why the 47-day certificate renewal mandate accelerates quantum readiness
  
  

Julian Weeber is Head of Professional Services and a cryptography and quantum security specialist at essendi it, known for his expertise in post-quantum cryptography (PQC) preparedness and secure communication strategies. With vast knowledge of cryptographic vulnerabilities and organizational readiness, Julian has contributed to developing best practices for transitioning enterprise systems to quantum-safe infrastructure.


Sarah Zügel is Managing Director at essendi it, specializing in post-quantum cryptography strategy and organizational security transformation. With a background in cryptographic system design and customer-centric security solutions, Sarah has led market research initiatives and developed awareness programs that bridge the gap between technical experts and enterprise stakeholders.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.

Episode Resources:

• Julian Weeber on LinkedIn
• Sarah Zügel on LinkedIn
• essendi it Group Website

Key Takeaways:

• [02:27] The Threat That’s Already Happening
  
  

Adversaries are already collecting encrypted data today, waiting for quantum computers to crack it open. Emails, phone calls, signed contracts, anything transmitted now can be stored and decrypted later. The threat is already underway, and the data being harvested today doesn’t expire.

• [06:06] The Three Types of Customers in the Market Today
  
  

Research shows three camps: the ‘wait and see’ majority holding out for regulations and best practices, a smaller group starting to gather information, and a tiny fraction actually running proof-of-concept projects. The gap between expert urgency and market action is significant, and closing it starts with putting PQC on the agenda now.

• [14:02] Three Steps to Quantum Readiness
  
  

Start now with three clear steps: build knowledge on post-quantum cryptography instead of waiting for final standards, use the transition as a chance to map your critical processes and understand where cryptography lives in your organization, and execute the migration when the technology and standards are ready. The groundwork you do today is what makes the actual shift manageable tomorrow.


Quotes:

• “We are really trying to set here a best practice on how to prepare for post-quantum cryptography and use this also as awareness, but also as a strategy which we can provide to the customers to be prepared.” — Julian Weeber
  
  
• “The first step is to collect knowledge. Get as much knowledge as you can get about post-quantum cryptography. Don't say we leave it up till the solution is there.” — Julian Weeber
  
  
• “Crypto agility means first having an inventory of your crypto assets. For example, know where all your certificates are, which kind of algorithms you're using, and then begin automating your processes around it.” — Sarah Zügel
  
  
• “We need to change as a user of cryptography and second we need to change our products as well. Then we have the product enhancements itself, and it begins with the new algorithms but then we go farther to database changes, to process changes.” — Julian Weeber
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Stefan Wenig, CEO and CTO at SignPath, to discuss why code signing must be treated as a complete business process, not simply a matter of managing keys and certificates.They explore how changing baseline requirements are reshaping code signing, why organizations need greater visibility into their certificate landscapes, and how centralized infrastructure can bring development, operations, and security teams into alignment.

What You’ll Learn:

• Why code signing is a wider security and operational process
• How evolving baseline requirements are changing code signing practices
• Why visibility into keys and certificates must come before greater control
• How centralized procurement and infrastructure reduce security gaps
• Why crypto agility is essential for post-quantum readiness
  
  

Stefan Wenig is the CEO and CTO of SignPath. He specializes in code signing, secure software development, certificate management and the infrastructure organizations need to protect their software supply chains. Through his work, Stefan helps organizations bring greater visibility, flexibility and centralized control to signing processes that often span development, security and operations teams. 

If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.
Episode Resources:

• Stefan Wenig on LinkedIn
• SignPath Website
• GlobalSign Website
• View and Integrate Website

Key Takeaways:

• [00:59] Code Signing Is a Complete Process

Code signing cannot be reduced to isolated key management or certificate management decisions. It sits inside a much larger system involving secure software development, DevOps, operations and multiple teams with different responsibilities. Security depends on those smaller practices working together rather than being handled independently.

• [02:17] Baseline Requirements Are Raising the Standard

Changes to FIPS requirements have strengthened expectations around how code signing keys are stored. Dedicated, certified devices make it harder for private keys to be copied or stolen. Certificate validity periods have also shortened, increasing the operational pressure on organizations that still manage certificates manually.

• [03:45] Crypto Agility Cannot Wait for Quantum Computing

Nobody knows exactly when quantum computers will be capable of breaking today’s cryptographic algorithms. That uncertainty does not remove the need to prepare. Organizations need signing infrastructure that can switch algorithms quickly and support the move toward quantum-safe standards as platforms adopt them.

• [07:32] Centralization Reduces Hidden Security Gaps

Certificate procurement, key issuance, and signing access should flow through a centralized process. Without it, development teams may create direct arrangements with operations teams or purchase certificates from providers without the security team knowing. Centralized infrastructure creates a clear source of truth and makes access easier to audit.


Quotes:

• “Code signing is a process much more than any isolated key management or certificate management issue.”
• “It’s important to lay it out for everybody who’s involved and make sure that all the little practices really work together to achieve the ultimate goal of security.”
• “We don’t know when quantum computers will be able to actually break codes, but we have to prepare.”
• “Every organization should prepare in every aspect of their crypto procedures to be able to switch to quantum-safe algorithms.”
• “If you don’t know where your keys are, if you don’t know what certificates have been issued in your organization’s name, then you’re basically sitting ducks.”
• “Whenever somebody needs a key or certificate, it has to go through some kind of central infrastructure and some kind of centralized process.”
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

Got a question? Send us an email at [email protected]

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Steve Hall is joined by Brian Westnedge, VP of Alliances & Partnerships at Red Sift, to unpack the fundamentals of email authentication, from SPF, DKIM, and DMARC to the visual trust indicators offered by BIMI, VMCs, and CMCs.

What You’ll Learn:

• How to implement the email authentication stack

• Why DMARC enforcement is your gateway to brand protection and inbox placement

• The difference between Verified Mark Certificates (VMCs) and Common Mark Certificates (CMCs)

• How BIMI and visual trust indicators combat AI-generated phishing

• Why email remains the primary attack vector despite being decades old
  
  

Brian Westnedge is an email security expert and VP of Alliances & Partnerships at Red Sift, specializing in email authentication protocols and domain security. With extensive knowledge of SPF, DKIM, DMARC, and BIMI implementations, Brian brings practical expertise in helping organizations of all sizes strengthen their email security posture.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


Episode Chapters:

• [00:00] Intro

• [00:54] Email's Biggest Blind Spot

• [01:57] Email Authentication 101

• [03:21] From Best Practice to Mandate

• [04:43] AI Is Making Phishing Emails Almost Impossible to Spot

• [07:15] VMC vs. CMC

• [08:39] Email Security for Every Organization

• [11:13] The Future of Email Security

• [13:37] The One Piece of Tech Brian Can't Live Without
  
  

Episode Resources:

• Brian Westnedge on LinkedIn

• Red Sift Website

• GlobalSign Website

• View and Integrate Website

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

This episode is sponsored by Keeper Security, the #1-rated password manager that is easy to use and protects every user on every device from cybercriminals. To receive 50% off personal and family plans visit https://keepersecurity.partnerlinks.io/kem9pq2bma2t


In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson welcomes back Arvid Vermote, Chief Information Security Officer (CISO) at GlobalSign, to discuss Google’s groundbreaking announcement on Merkle Tree Certificates for post-quantum cryptography and why your organization needs to start preparing now.


What You’ll Learn:

• How Merkle Tree certificates solve the 14-kilobyte TLS handshake problem

• Why crypto agility and automation are non-negotiable survival skills

• How to build a complete cryptographic bill of materials

• The critical gap in non-browser TLS tooling

• How CAs are preparing with new hierarchies and technical overhauls

Arvid Vermote is the Chief Information Security Officer (CISO) at GlobalSign, where he leads the company’s global security, compliance, governance, and privacy strategy, ensuring that products and operations meet industry and regulatory standards while aligning with business objectives. Before joining GlobalSign, Arvid served as a Senior Manager at EY, where he delivered cybersecurity advisory services across EMEIA, co-led the Belgian Cybersecurity and Privacy practice, and was recognized as a global expert in PKI ecosystems and risk management.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro

• [00:25] The Size Problem with Post-Quantum Certificates

• [02:23] A Clear Vision for the Future of TLS

• [03:23] 2027 Root Program, 2028 Production Certificates

• [04:55] The Cryptographic Bill of Materials

• [06:22] Proof of Concept Already Underway

• [07:37] Automation Is Non-Negotiable

• [09:35] Non-Browser Tools and IoT

• [11:27] The CA/Browser Forum’s Role

Episode Resources:

• Arvid Vermote on LinkedIn

• GlobalSign Website

• View and Integrate Website

Key Takeaways:

• [00:25] The Size Problem with Post-Quantum Certificates
  
  

Post-quantum cryptography algorithms inflate TLS certificate exchanges from one kilobyte to 14, making it untenable for billions of daily transactions. Google, Cloudflare, and others have proposed Merkle Tree Certificates (MTCs), which replace traditional full chain-of-trust exchanges with verification against a CA-signed Merkle tree, dramatically cutting payload size and removing the biggest barrier to deploying post-quantum certificates at scale.

• [03:23] 2027 Root Program, 2028 Production Certificates
  
  

Google plans to launch its ML-KEM-based root program by 2027, with post-quantum certificates expected in production by 2028. For organizations, this doesn’t change planning timelines, but it does replace uncertainty with clarity. The certificate of the future is no longer a question mark; the direction is becoming concrete. Over the next two years, organizations should ensure their web server infrastructure can support post-quantum certificates. The stakes are straightforward: once browsers begin enforcing these standards, sites that can't serve compatible certificates will fail to establish secure connections, effectively losing visitors.

• [07:37] Automation Is Non-Negotiable

The transition to Multi-Trust Certificates demands major preparation. CAs must build and audit new trust hierarchies while adapting to a fundamentally different technical approach to validation and signing. For businesses, the message is simple: automation is no longer optional. Google’s proposed MTC root program will only accept ACME-based issuance with short-lived certificates of ten days or less. Organizations without internal automation should partner with a provider that can ensure timely certificate replacement at scale.


Quotes:

• “Rather than building the chain to the root, it will check whether it's embedded into a Merkle Tree that is signed by the CA itself. And doing it that way, it strongly reduces not only the size of the CA part and the certificate part on the TLS handshake, but it also improves the performance.”
  
  
• “It will be in the sense that it will allow people to use quantum resistance certificates in a production ready state because nobody really knows how it was going to work because of the TLS change size that I just explained that would be too big.”
  
  
• “Google is looking to operate its real MTC based route program, which would be a different route program compared to traditional TLS certificates by 2027. By 2028, we will already be seeing these certificates in production and actually customers being able to configure those types of certificates being searched from that web service.”
  
  
• “What we will likely see now is that if the standards will evolve, the TLS baseline requirements will be adopted to make sure that this new type of certificate and all the requirements around it will be captured within so that CAs can be audited against it.”

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this special episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson hands the mic to Matthew Dorrington and John Murray as they roam the RSA Conference show floor, capturing insights on email security, certificate lifecycle management, and code signing with security leaders from Red Sift, AppViewX, Thinkst Canary, Pangolin, and SignPath.


What You’ll Learn:

• How to transition email security from perimeter defense to identity-centric strategy

• Why certificate lifetime compression demands immediate automation

• How post-quantum cryptography readiness begins today

• The critical relationship between code signing and supply chain security

• Why AI introduces both trust and uncertainty in security operations
  
  

If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro

• [00:39] Email as a Zero-Trust Channel

• [02:48] Automating Thousands of Certificates

• [04:02] Getting Started with ACME

• [04:41] Shrinking Certificate Lifetimes

• [06:31] Preparing Infrastructure for Post-Quantum

• [07:14] Code Signing in the Supply Chain Era

• [08:21] Michelle’s Closing Thoughts
  
  

Episode Resources:

• Matthew Dorrington on LinkedIn

• John Murray on LinkedIn

• Red Sift Website

• Thinkst Canary Website

• AppViewX Website

• ACME Website

• Pangolin Website

• SignPath Website

• Michelle Davidson on LinkedIn

• GlobalSign Website

Key Takeaways:

• [00:39] Email as a Zero-Trust Channel

Email has fundamentally evolved, and security leaders can no longer treat it as a filtering problem solved at the network edge. It’s now core to identity and zero-trust strategy, backed by modern standards that hyperscalers, regulators, and thousands of organizations have already adopted, bringing visible benefits like verified logos in consumer inboxes. Leaders who haven’t benchmarked themselves against their peers or kept up with current email standards should act now, because most real-world breaches still begin with a phishing email that escalates into lateral movement.

• [02:48] Automating Thousands of Certificates
  
  

As SSL certificate lifespans shrink, dropping from 200 days in 2026 to just 47 days by 2028, manual management has become untenable. Industry leaders managing thousands of certificates are unanimous: automation via protocols like ACME is the only viable path forward. With renewal frequency set to increase nearly eightfold and machine identities growing exponentially, spreadsheet-based tracking invites the kind of systemic failures that bring entire systems down from a single missed renewal. Businesses should rethink certificate management holistically, adopt ACME-compatible tooling, and begin preparing for post-quantum cryptography now, as quantum-relevant threats to RSA and ECC move from theoretical to imminent.

• [07:14] Code Signing in the Supply Chain Era
  
  

The code signing industry faces two converging pressures: the probabilistic nature of AI-driven security, which undermines the deterministic guarantees enterprises depend on, and the looming transition to post-quantum cryptography. Equally critical is a mindset shift. Incidents like SolarWinds showed that a compromised signature amplifies rather than contains damage, making it essential to position code signing within a holistic view of the entire software development and delivery pipeline as one piece of a broader supply chain security strategy.


Quotes:

• “Email security's transitioning from this filtering black box set at the edge of the network to something that's quite fundamental to their identity and zero trust plus strategy.”
  
  
• “Certificates validity is growing shorter year over year, with public CA vendors forced to issue 200-day certificates in 2026, going down to 100 days in 2027, and 47 days in the following year.”
  
  
• “You want to reimagine the way that you are doing certificate management across your landscape. The number of machine identities using certificates and keys are growing exponentially. With new compliance mandated, you cannot truly grow this manually, The only way to innovate and scale to these newer standards is to basically automate.”
  
  
• “The biggest challenge to everything right now seems to be AI. It's helping a lot, but it's also worrying people a lot. One of the challenges is to get deterministic security over all the heuristics that AI basically makes us face.”
  
  
• “Code signing is no longer an isolated thing that everybody is considering in isolation. It's part of a larger supply chain problem and solution.”
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Jeffrey Brown, Chief Security Advisor for Financial Services at Microsoft, to discuss why tailored messaging across organizational levels is critical, how AI can simplify complex security concepts, and the key strategies to build genuine understanding among employees, executives, and boards.


What You’ll Learn:

• Why CISOs must speak multiple ‘languages’ across an organization

• How to eliminate complexity without sacrificing accuracy

• The inventory-first approach to post-quantum readiness

• How AI can act as a powerful communication partner

• Why relevance drives engagement and security compliance
  
  

Jeffrey Brown is a Chief Security Advisor for Financial Services at Microsoft, an Author, and NACD-certified boardroom director, recognized for his expertise in cybersecurity communication, risk management, and organizational security strategy. With a background in application security and project management, Jeffrey brings a unique perspective on translating complex security concepts for diverse stakeholder audiences, from frontline employees to C-suite executives and board members.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro

• [00:59] The Communication Challenge in Cybersecurity

• [03:18] Resource Constraints vs. Resourcefulness in Security Teams

• [06:11] How AI Can Help Improve Cybersecurity Communication

• [09:14] Preparing for the Quantum Computing Security Era

• [11:21] Why Cybersecurity Always Starts with Inventory

• [12:23] The Right Way to Educate Employees About Cybersecurity

• [14:34] The One Tech Jeffrey Can’t Live Without
  
  

Episode Resources:

• Jeffrey Brown on LinkedIn

• Microsoft Website

• The Security Leader’s Communication Playbook

• Leading the Digital Workforce Book

• Michelle Davidson on LinkedIn

• GlobalSign Website

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Sophie Creese, Founder of MotherBoard and Co-founder of HeyFlow, to tackle one of tech’s most urgent and misunderstood challenges: why are 50% of women leaving the industry by age 35?


What You’ll Learn:

• Why the 50% attrition rate is a business problem

• How to diagnose blind spots in your female talent lifecycle

• The critical role the manager's life experience plays in employee support

• Why the return-to-work period is a make-or-break moment

• How to shift from reactive support to proactive planning

Sophie Creese is the Founder of MotherBoard and Co-founder of HeyFlow, known for her expertise in gender diversity, talent retention, and organizational culture within the tech industry. With a background in scaling technology businesses, she has identified and addressed critical gaps in how organizations support female talent across their lifecycle, particularly during reproductive life moments.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro

• [00:54] The 50% Drop-Off by Age 35

• [02:09] The Hidden Career Lag

• [03:34] Culture vs. Policy

• [05:36] The £3 Billion Productivity Gap

• [08:14] Post-Maternity: The Hardest Time to Advocate for Yourself

• [11:00] The Importance of Re-Onboarding

• [13:01] The Tech Sophie Can’t Live Without

Episode Resources:

• Sophie Creese on LinkedIn

• HeyFlow Website

• MotherBoard Website

• Michelle Davidson on LinkedIn

• GlobalSign Website

Key Takeaways:

• [00:42] The 50% Drop-Off by Age 35
  
  

Nearly 50% of women leave the tech industry by age 35, a trend that reveals a systemic business failure, not a personal choice. Sophie launched MotherBoard in 2020 to spotlight this overlooked crisis and reframe it as a commercial risk impacting innovation, security, and long-term growth. Building on that mission, she later founded HeyFlow, a startup that partners with large organizations to address the structural blind spots in the female talent lifecycle.

• [08:21] Post-Maternity: The Hardest Time to Advocate for Yourself
  
  

Returning from maternity leave is one of the most underestimated career inflection points, and too often, the burden is placed solely on mothers to figure it out. While women should absolutely pursue opportunities that energize them and ignore external judgment, the real responsibility sits with organizations. It is not enough to ask, ‘What do you need?’ when many returning mothers are still navigating new identities and may not yet know the answer. Employers must proactively design structured support, offer clear options, plan before leave begins, and remove systemic barriers that affect reintegration and growth.

• [11:12] The Importance of Re-Onboarding
  
  

Too many senior women return from maternity leave to find their confidence shaken, their roles reshaped, and their value quietly questioned. The issue is poor reintegration. In fast-moving organizations, six to twelve months away can mean new leadership, new priorities, and new teams. Expecting women to simply ‘slot back in’ is unrealistic and damaging. They need intentional re-onboarding, clear role planning, visible support, and growth opportunities. Research consistently shows women aren’t leaving because they became mothers; they’re leaving because their organizations failed to support them.


Quotes:

• “Businesses need to look at everything from an entire talent life cycle perspective and really understand where these bottlenecks are. If they're wanting to improve the attraction, then there needs to be fundamentals improved within the business.”
  
  
• “One of my bugbears, I really feel that this responsibility is on the organization, not just on the individuals. So although for moms, I would say go for it. If you've got an opportunity and you feel you're ready to be able to dive back in, dive back in. And don't worry about what other people think.”
  
  
• “It is the most difficult thing to advocate for yourself post maternity and to state what you need when you don't know yourself at that point what you need. So as an employer, it's your responsibility to be able to offer options.”
  
  
• “I set up MotherBoard as an answer to a problem that wasn't being discussed, which is why are so many women leaving the tech industry by age 35? Statistically, it's around fifty percent, and that's a global problem.”
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson welcomes back Arvid Vermote, Chief Information Security Officer (CISO) at GlobalSign, to break down what post-quantum computing really means for organizations today.


What You’ll Learn:

• How post-quantum cryptography affects TLS in two very different ways
  
  
• What ‘harvest now, decrypt later’ means and why it creates immediate risk

• The critical role of TLS 1.3 in enabling post-quantum readiness
  
  
• Why certificate agility is becoming essential as certificate lifetime shrinks and cryptographic change accelerates

• What challenges post-quantum certificates introduce
  
  
• 
  

Arvid Vermote is the Chief Information Security Officer (CISO) at GlobalSign, where he leads the company’s global security, compliance, governance, and privacy strategy, ensuring that products and operations meet industry and regulatory standards while aligning with business objectives. Before joining GlobalSign, Arvid served as a Senior Manager at EY, where he delivered cybersecurity advisory services across EMEIA, co-led the Belgian Cybersecurity and Privacy practice, and was recognized as a global expert in PKI ecosystems and risk management.


If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro

• [00:51] Why Quantum Readiness Starts with TLS 1.3
  
  
• [06:53] What Organizations Can Do Right Now

• [09:38] Shorter Certificate Lifetimes and Crypto Agility

• [11:07] The Role of NIST and the CA/Browser Forum

• [13:28] Hybrid Certificates as a Bridge Strategy

Episode Resources:

• Arvid Vermote on LinkedIn
  
  
• GlobalSign Website

• View and Integrate Website
  
  

Key Takeaways:

• [00:51] Why Quantum Readiness Starts with TLS 1.3
  
  

The most urgent quantum risk today is key exchange. Post-quantum cryptography matters first in the TLS handshake, where “harvest now, decrypt later” attacks put long-lived data at risk, and the only viable path forward is TLS 1.3. Yet roughly 40% of internet traffic still isn’t there, creating a real readiness gap. By contrast, post-quantum certificates and PKI are a longer-term challenge: they require new standards, browser support, HSM certification, and solutions to a major size problem that could strain the internet itself. Enterprises should prioritize migrating to TLS 1.3 now, while the ecosystem works through the heavy lifting needed to make certificates quantum-safe later.

• [06:53] What Organizations Can Do Right Now
  
  

Preparing for “harvest now, decrypt later” threats starts with getting the fundamentals right today. Organizations should already be running TLS 1.3 across all exposed services, but that alone isn’t enough. True readiness requires cryptographic visibility and agility: a complete cryptographic bill of materials that inventories certificates, TLS versions, algorithms, endpoints, and the underlying software stack. Post-quantum security is a two-part problem. Both the certificate layer and the TLS handshake/key exchange must support post-quantum algorithms.

• [09:38] Shorter Certificate Lifetimes and Crypto Agility
  
  

Shortening certificate lifespans, CA distrust incidents, and the accelerating threat of post-quantum cryptography all point to the same conclusion: crypto agility is no longer optional. Organizations that failed to automate and modernize certificate management have already paid the price when mass revocations hit, and replacements couldn’t happen fast enough. This moment should give CISOs and CIOs the leverage they need to secure board support, move beyond reactive firefighting, and invest in systems that enable fast certificate rotation, seamless cryptographic change, and long-term resilience.


Quotes:

• “I think the certificate agility should have been done a few years ago. I just hope that this combination of recent incidents, the certificate reduction, and the looming threat of the post quantum encryption or the post quantum computers will be enough for CISOs and CIOs to go to the board and finally get that funding to invest into crypto agility.”
  
  
• “First of all, we need to untangle first or first related to post-quantum cryptography and quantum computing. Everyone seems to toss or coin that term to everything that relates to cryptography. But actually, there are two separate areas of it. And depending on that, the timing is more pressing, and the risks are bigger for enterprises.”
  
  
• “Before the certificate authorities like GlobalSign can actually issue certificates that are post quantum resistant, there's a lot of work that needs to be done.”
  
  

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so

In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, hosts Michelle Davidson and Steve Hall, reflect on 2025’s biggest cybersecurity shifts and what these changes mean for organizations in 2026. Alexander Byrne, Director of Compliance at Thrive, Olivier Ruff, Cyber Security Lead and CTO at RNTrust Group, and Jane Frankland, CEO of KnewStart also make a reappearance to discuss their top predictions and insights for 2026.


What You’ll Learn:

• Why March 2026 is your critical inflection point
• How Harvest now, decrypt later attacks create urgency around post-quantum cryptography
• The competitive imperative of AI adoption in 2026
• Third-party risk and availability resilience emerge as the overlooked pillar of security
• The practical cost-benefit framework for security investment

If you enjoyed this episode, make sure to subscribe, rate and review on Apple Podcasts, Spotify and YouTube Podcasts, instructions on how to do this are here.


YouTube Chapters:

• [00:00] Intro
• [01:09] The Countdown is On
• [03:17] Why Agility in Certificate Management Starts Now
• [07:53] Digital Identity in Focus
• [12:25] Predictions for 2026
• [17:04] The Cost of Complacency
• [19:49] The Trust Equation
• [21:52] Favorite Gadgets of 2025
• [22:50] 2026 Expert Forecasts
• [31:14] Closing Thoughts

Episode Resources:

• Michelle Davidson on LinkedIn
• Steve Hall on LinkedIn
• Jane Frankland’s Website
• Alexander Byrne on LinkedIn
• Olivier Ruff on LinkedIn
• GlobalSign Website

Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so