Cybersecurity Where You Are (audio)

In episode 211 of Cybersecurity Where You Are, Sean Atkinson speaks with Joshua Palsgraf, Sr. Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Kyle Leonard, Cyber Threat Intelligence Analyst at CIS, about the scariest malware of 2026. From an infostealer that hides its command infrastructure on the Ethereum blockchain to artificial intelligence (AI) agents running chunks of intrusions, they break down what makes malware “terrifying,” why takedowns are getting harder, and what defenders can still do about it.

Here are some highlights from our episode:

• 02:08. The three factors that make malware strains "terrifying"
• 03:39. How the expansion of "as a Service" offerings complicates malware investigations
• 05:10. How member reporting helps to link the stages of an investigation
• 06:31. A move to more automation: Threat actors' use of AI to run chunks of the kill chain
• 07:38. Abuse of trusted applications and services over the development of customized tools
• 10:04. The single scariest malware strain of 2026 and the techniques it uses to earn that title
• 14:45. How an emerging technique calls traditional malware takedown playbooks into question
• 16:21. The challenging, never-ending, and even fun effort of keeping up with new malware
• 22:19. The cost of running a cybercrime operation: “A couple hundred dollars a month”
• 23:38. Real-world examples of threat actors giving more operational control to AI agents
• 26:31. Why essential cyber hygiene still holds sway in defending against the scariest malware
• 29:05. Recommendations for defending against clever malware evasion techniques
• 30:33. The Thing and Facehugger: How these malware names capture today's threat landscape
• 32:48. Looking ahead to 2027: AI as an assistant and infrastructure beyond seizure

Resources

• Multi-State Information Sharing and Analysis Center®
• CIS Cyber Threat Intelligence Team
• Episode 159: The Scariest Malware of 2025
• SLTT C2 Traffic Tied to Remus Malware Distribution Operation
• ClickFix: An Adaptive Social Engineering Technique
• Episode 124: The Many Layers of a Malware Takedown Operation
• Disrupting the first reported AI-orchestrated cyber espionage campaign
• Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia
• Taiwan says it was targeted last month in AI-driven hacking campaign
• Cloudflare deploys protections against php2shell vulnerability
• Real-Time Indicator Feeds
• Living off the Land: Threats Looming From Within

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 210 of Cybersecurity Where You Are, Sean Atkinson speaks with Patrick Cooper, Security Operations Center (SOC) Analyst II at the Center for Internet Security® (CIS®), and Nathaniel Ludke, SOC Analyst II at CIS. Together, they take listeners inside the 24x7x365 CIS SOC, from alert prioritization and severity-based escalation to member reporting and the use of artificial intelligence (AI) for open-source intelligence, packet analysis, and SQL querying. They explain why AI is the tool and the human is the loop for U.S. State, Local, Tribal, and Territorial (SLTT) government members of the Multi-State Information Sharing and Analysis Center® (MS-ISAC®).

Here are some highlights from our episode:

• 01:20. What a typical shift for a CIS SOC analyst looks like
• 03:29. Challenge: Supporting members while minimizing overwhelm and stress
• 06:25. Common indicators of compromise (IOCs) as impetus to take a deeper look
• 07:01. Prioritization: First in first out with a few noteworthy exceptions
• 07:41. How severity of an alert affects the CIS SOC's communication with members
• 08:51. The typical path of escalation for alerts
• 09:36. Hot IP entries and agency notes inform false-positive judgments
• 10:42. Designating the severity of false positives
• 14:09. Automated (monthly), manual, historical, and other types of reports from the CIS SOC
• 17:01. No news is good news? Why MS-ISAC members both welcome and worry about silence from the CIS SOC
• 18:01. The CIS SOC's use of AI for open-source intelligence and information gathering
• 20:07. Human is the loop: How AI supports packet analysis, SQL querying, and more
• 22:20. AI enablement, not replacement: Keeping security operations human
• 23:42. How AI can function as an additional security threat
• 25:23. Hallucination risk and the SOC analyst “spidey sense”
• 26:25. Relationships with MS-ISAC members: The "lost art" of knowing when something's off

Resources

• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• CIS Cyber Incident Response Team
• CIS Cyber Threat Intelligence Team
• Cybersecurity Services
• You Have a Cybersecurity Incident. Now What?
• Episode 190: Separating Mythos AI Fact from Fiction
• CIS Controls v8.1 Incident Response Policy Template

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 209 of Cybersecurity Where You Are, Sean Atkinson argues that most organizations prepare for operational failure like they're bracing for a hurricane while most adversaries are playing chess. Drawing on security chaos engineering and game theory, he walks through a structured approach that blends threat modeling, internal red teaming, and constructive disagreement to empirically test and strengthen a defensive posture.

Here are some highlights from our episode:

• 00:33. The RSA Conference 2025 presentation behind this episode
• 00:48. How artificial intelligence (AI) is only accelerating adversaries' evolution
• 01:23. Hurricanes and chess: Analogies for different types of disaster preparedness
• 04:03. Overview of chaos engineering and game theory
• 05:01. Understanding threat vectors in our environment and how MITRE ATT&CK can help
• 05:50. Why adversaries "need a vote" when planning for failure
• 07:03. Red teaming and the need for penetration testing as part of an internal process
• 07:50. Going beyond technology to understand business objectives and strategy
• 08:51. Continuity as a consideration for continually adapting and updating controls
• 10:12. Transition from three separate threat silos to multidimensional threats
• 10:45. Game theory: It's not just a tabletop exercise (TTX)
• 12:15. Goalkeeper: An analogy for addressing "predictability of weakness"
• 13:52. Testing where our weaknesses are: An important element of chaos engineering
• 14:58. Accounting for biases and finite resources when evaluating strengths and weaknesses
• 17:56. Vulnerability identification: An example of how a strength can become a weakness
• 22:25. The need to resist getting too sophisticated with internal red teaming too quickly
• 24:23. Rigor for pushing back against tired adages like "it's never happened to us before"
• 26:22. An implementation strategy focused on communication
• 27:00. Dr. Tyler Moore's Return on Security Investment and the consequences of doing nothing
• 28:03. Debate and commit: A leadership principle for getting the most out of disagreement
• 30:42. Start small, provide notice to those affected, and consider a "surprise audit"
• 32:12. Minimize the blast radius, build hypotheses, balance bias, and other best practices
• 37:38. Parting thoughts of how to break down this approach

Resources

• Episode 208: Secure Harness Engineering for Agentic AI
• Game Theory Informed Security Chaos
• Book - Security Chaos Engineering: Sustaining Resilience in Software and Systems
• CIS Community Defense Model v3.0: Turning Threat Intelligence Into Action
• CIS Red Team Services and Exploit Demo
• Penetration Testing
• CIS Critical Security Control 18: Penetration Testing
• MS-ISAC Guide to DDoS Attacks
• Episode 121: The Economics of Cybersecurity Decision-Making
• Episode 166: Foundations of Actuarial Science in Cyber Risk
• CIS Leadership Principles
• Netflix TechBlog

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 208 of Cybersecurity Where You Are, Sean Atkinson breaks down secure harness engineering for agentic artificial intelligence (AI). Noting the risks posed by AI agents acting without oversight, he highlights "episodes" as auditable elements that help to provide feedback, and he walks through 15 controls spread across five stages as a way to engineer an AI harness with security in mind. He also differentiates secure harness engineering from prompt engineering, guardrails, frameworks, logs, and universal wrappers for AI agents.

Here are some highlights from our episode:

• 01:23. The need for a control system in light of agent escape incidents
• 02:19. Analogy of a financial analyst to understand why separation of duties is important
• 02:57. Revolution and then evolution: How AI models have changed exponentially since 2022
• 04:54. Where secure harness engineering has a capability
• 05:42. Making decisions traceable: The need for an evidence chain to build controls effectively
• 07:15. Smartphones: A parallel for understanding the value of each new AI model
• 11:20. Engineering controls, not standard policies for all models
• 12:22. Secure harness engineering vs. prompt engineering
• 12:51. Models' evolving role: How it invites new security questions to be posed
• 15:16. AI agents without oversight: The insider persona with which defenders need to contend
• 16:02. The need for determinism and an effective diagram to build for it
• 18:22. Definition of secure harness engineering
• 19:36. Episodes and the importance of log assessment in mediating model capability
• 20:42. Reality verification: A feedback loop that gets into the concept of forensic assessment
• 21:27. Questions to ask as you get into an AI agent's evidence chain
• 22:56. Moving through intent, authority, reasoning, synthesis, decision, and enforcement
• 25:38. Side effects: What they are and how they actualize risk
• 27:16. Verification and audit: How they empower you to look at control opportunities
• 28:49. Five stages and 15 controls for secure harness engineering
• 29:47. What secure harness engineering is and is not
• 32:11. Three questions to help you get started
• 32:52. An important question for the future

Resources

• Artificial Intelligence (AI) Agents Companion Guide
• The Secure Harness: A Governance Architecture for Agentic AI
• When Agent Capability Outruns Control: Lessons from the July 2026 OpenAI and Hugging Face Incident
• Episode 202: Delineating AI Security and Cybersecurity
• Harness Engineering & Agent Orchestration
• OWASP Top 10 for Large Language Model Applications

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 207 of Cybersecurity Where You Are, Sean Atkinson makes the case for treating artificial intelligence (AI) not as software but as an ongoing trust relationship. He highlights the value of integrating best practices from regulations like the EU AI Act, walks through the three stages of an AI governance lifecycle, and explains how AI risk management fits into organizational governance, change management, and other business processes.

Here are some highlights from our episode:

• 01:16. The trust component of AI governance
• 02:02. A need to align to regulatory best practices and bring them into AI risk management
• 03:47. Advice: Contextualize, don't generalize, your risks associated with AI use
• 04:40. Common questions that lead to AI governance as a requirement
• 06:59. Grounding an agile AI governance process on foundational principles
• 07:46. How the "fortress" approach overlooks the relationship element of AI security
• 09:51. A direct invitation: Listener feedback on AI governance thinking
• 11:44. Evaluating trust and relationship in machine learning and generative AI
• 14:04. The role of human oversight in realizing AI as a method that gets to a solution quicker
• 14:53. AI governance boards: A potential solution to elevating AI literacy internally
• 16:00. AI governance lifecycle: Three phases from current business processes to value generation
• 18:55. Overview of the future of AI security
• 23:16. The need for foundational security controls and AI-specific controls
• 25:00. AI governance assessment: Why it needs to happen across the organization
• 26:28. How AI governance ties into organizational governance
• 29:49. Ethics and responsible AI practice
• 29:57. Change management considerations with AI deployment
• 30:35. A concluding call to action to get stronger together

Resources

• CIS Critical Security Controls®
• Episode 198: AI Privacy from a Risk-Based Perspective
• Episode 122: DeepSeek AI Security and Utility Considerations
• Episode 120: How Contextual Awareness Drives AI Governance
• AI Playbooks for SLTT Cybersecurity Leaders
• CIS Controls v8.1.2 AI Security Guidance Workbook
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• Mapping and Compliance with the CIS Controls

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 206 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager speak with Julie Morris, Founder and Head of Thought Leadership at Persona Media, about why trust and influence have become survival skills for today's CISOs. Julie breaks down three types of organizational power, explains why the "good guys" resist the language of influence, and offers a practical starting point for anyone who's ever felt like PowerShell was the only power they understood.

Here are some highlights from our episode:

• 02:13. From old to new: A shift in how trust and influence factor into organizational structures
• 04:24. The three kinds of power in an organization: hard, soft, and network
• 09:59. Wise advice: Build your personal and professional network first
• 11:07. How influence multiplies confidence with network power
• 12:03. Inertia, fear, and status quo: overcoming the emotional reactions that oppose change
• 18:12. How Sean uses the power of "slow down," not "no," to support AI transformation
• 20:49. Why good thought leadership starts with empathy and self awareness
• 24:32. Building organizational processes that "trigger" a change in CISOs' trust and influence
• 26:30. Hugging Face as an example of how triggering moments become lessons
• 27:42. What Tony Soprano has to do with measuring trust and influence
• 30:47. Reality check: Every information gap gets filled one way or another
• 32:15. The power of community and shared ideas in figuring out thought leadership together
• 36:09: Advice: Be in the "river" of your network to go where you want to go
• 37:34. How understanding of shared values helps to overcome imposter's syndrome

Resources

• CIS Critical Security Controls®
• Episode 183: The Role of CISO in Supporting Risk Translation
• Episode 187: The Role of a CISO as a Strategic Storyteller
• Episode 192: How Leaders Balance Expertise and Communication
• Episode 199: Translating Cyber Risk into Business Decisions
• The Myth of Mythos: What It Means For Information Security
• Episode 202: Delineating AI Security and Cybersecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 205 of Cybersecurity Where You Are, Tony Sager speaks with Phyllis Lee, VP of SBP Content Development at the Center for Internet Security®(CIS®), and Steve Lipner, Executive Director of SAFECode. Together, they discuss how an updated document from CIS and SAFECode gives concrete guidance on what artificial intelligence (AI) means for your Secure by Design process.

Here are some highlights from our episode:

• 02:17. A refresher on making Secure by Design digestible for end organizations
• 02:57. Distillation and prescriptive guidance: The value provided by CIS
• 06:53. An overview of Butler Lampson's "Gold Standard of Security"
• 07:03. How a shift in approach to Secure by Design led to the founding of SAFECode
• 09:42. The importance of verification requirements for what developers have done
• 12:54. A product of CIS pragmatism: Prioritization relative to the development environment
• 20:06. Artifacts as evidence of secure software development at work
• 30:15. How the updated document provides guidance around AI
• 30:45. What AI creates instead of new classes of vulnerabilities

Resources

• CIS Critical Security Controls® (CIS Controls®)
• Secure by Design
• Secure by Design v1.1 A Guide to Assessing Software Security Practices
• Turning Secure Software Development into a Measurable Practice
• CIS and SAFECode Release Secure by Design v1.1: A Guide to Assessing Software Security Practices
• Episode 164: Secure by Design in Software Development
• CIS Critical Security Control 16: Application Software Security
• Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1
• Episode 200: Alan Paller's Vision and Our Next Chapter
• From Prompts to Protocols: The Security Blueprint for Enterprise AI
• Mythos AI: What Actually Matters for Cybersecurity Leaders

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 204 of Cybersecurity Where You Are, Sean Atkinson speaks with Ryan Winmill, Chief Security Officer and Vice President of FIFA World Cup Boston, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how FIFA World Cup 2026 (FWC26) — secured through an unprecedented tripartite governance framework, $625 million in U.S. Congressional funding, and real-time intelligence that stopped a swatting attempt at the finals — set a new standard for proactive event security worldwide.

Here are some highlights from our episode:

• 01:18. The "unprecedented" governance framework created for FWC26
• 03:53. The role of CIS as a force multiplier for FIFA, host regions, and other partners
• 11:00. Why you can't trust the person with an ego in large-scale event security planning
• 13:23. How the threat environment evolved over the previous three World Cup tournaments
• 17:23. A new bar for proactive event security going forward
• 18:43. How CIS provided quality control that helped to mitigate swatting calls during FWC26
• 21:55. Unique approaches used by host regions to better understand the World Cup fanbase
• 23:15. How counterfeit FIFA volunteer uniforms triggered a cross-city credentialing response
• 26:46. Recommendations for future large-scale event host cities
• 30:19. Ryan's recommendation to future host cities: "Call CIS before you get started"

Resources

• Special Event Risk Analysis & Advisory Services
• Episode 196: Securing FIFA World Cup 2026 Collaboratively
• Inside the Security Operation Behind the 2026 FIFA World Cup
• 3 Lessons for Securing Large-Scale Events: Inside FIFA World Cup 2026
• Securing FIFA World Cup 2026 With a Collective Defense Approach

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 203 of Cybersecurity Where You Are, Sean Atkinson speaks with Pavlina Pavlova, Founder of Critical Cyber. Together, they discuss how Pavlina started Critical Cyber to go beyond the data and give voice to the human impact of cyber attacks, from ransomware hitting hospitals to cyber tactics targeting civilians in active conflict zones.

Here are some highlights from our episode:

• 00:44. How Pavlina's work covering the impact of cyber attacks on Ukrainian critical infrastructure led to Critical Cyber
• 03:13. How Critical Cyber works with cyber attack victims, responders, and other audiences
• 04:08. Countering the tendency, even among cybersecurity experts, to sanitize cyber attacks' human impact
• 08:57. The use of storytelling with those impacted by cyber attacks to drive policy changes
• 15:02. Why cyber attacks in some sectors are underreported
• 19:01. Critical Cyber's mission of combining testimony, research, and expert collaboration
• 24:51. Where Critical Cyber is and where it's looking to go

Resources

• Critical Cyber
• Cybersecurity for Critical Infrastructure
• Episode 202: Delineating AI Security and Cybersecurity
• Recent Water Utility Attacks Offer a Blueprint for Resilience

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 202 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute. Together, they explore how the implications of multiple 2026 sandbox escapes of artificial intelligence (AI) models are starting to delineate AI security and cybersecurity.

Here are some highlights from our episode:

• 02:00. The historical context of one AI model's 2026 sandbox escape
• 03:26. The impact of ethics, guardrails, and misconfigurations in an AI containment breach
• 06:08. Why context matters when talk of AI models "going rogue" surfaces
• 11:49. How history helps us to delineate AI security and cybersecurity
• 13:47. A new skill and mindset to match our refined AI risk understanding
• 15:43. Rules and cybersecurity implementation as a possible way forward
• 19:04. The double-edged sword of restricting access to open-weight models
• 23:25. Recommendations for keeping up with what's changing in the AI security space
• 25:51. Rob's advice: To learn how to defend a thing, try learning how to build it first
• 28:23. AI governance and seeing through the "slop" to informed conversation
• 29:54. The use of AI to learn more about and discuss AI security for years to come

Resources

• OpenAI says its AI technology acted on its own in an ‘unprecedented’ hack of another company
• Pacing model development in an era of cyber-critical capabilities
• Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident
• Episode 193: AI Security and Responsibility in EO 14409
• The AI Daily Brief — Daily AI News & Analysis
• AI Playbooks for SLTT Cybersecurity Leaders
• SANS Cybersecurity Summits
• SANS NewsBites

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 201 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. Together, they reflect on the evolution of penetration testing, including the impact on pentesting from artificial intelligence (AI).

Here are some highlights from our episode:

• 01:03. How things have changed since William's and Ed's first pentests
• 09:02. Community: A defining element of Capture The Flag (CTF) events
• 14:47. Industry concerns over the "death" of CTFs and "cheating" by artificial intelligence (AI)
• 17:00. Opportunities to take CTFs to the next level in the age of AI
• 20:18. Pentesting vs. vulnerability scanning: Why terminology matters
• 25:43. The advent of autonomous AI tools and what they could mean for vulnerability scanning
• 29:07. Why continuous improvement in cybersecurity doesn't always require AI

Resources

• Closed Door Security
• Episode 189: The Present and Future of AI-enabled Pentesting
• SANS Cyber Ranges
• Top External Network Risks And How to Fix Them
• Penetration Testing
• Vulnerability Assessments

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 200 of Cybersecurity Where You Are, Sean Atkinson, Tony Sager, and Ed Skoudis sit down with Frank Reeder, Co-Founder and Founding Chair of the Center for Internet Security® (CIS®). Together, they reflect on how Alan Paller's vision continues to drive CIS forward. In the spirit of that vision, this milestone episode also marks a new chapter for the podcast: Ed Skoudis joins as co-host of Cybersecurity Where You Are.

Here are some highlights from our episode:

• 01:09. The two complementary missions of CIS
• 02:55. Three defining moments that have shaped CIS into the organization it is today
• 08:10. The story of naming CIS
• 10:31. How CIS and SANS advance Alan Paller's vision of bringing people together
• 13:50. Personal anecdotes of Alan Paller as a connector of people
• 15:45. "What would Alan do?" A question that continues to guide CIS and SANS
• 22:00. How CIS security best practices are emblematic of helping others
• 27:12. CIS's "secret sauce" as a trusted, neutral platform for cybersecurity collaboration
• 29:53. How CIS can continue to embody Alan Paller's philosophy into the future
• 37:47. A special announcement: Ed Skoudis as a new co-host on the podcast

Resources

• CIS Benchmarks® List
• CIS Critical Security Controls®
• Multi-State Information Sharing and Analysis Center®
• Episode 114: 3 Board Chairs Reflect on 25 Years of Community
• Alan Paller Laureate Program
• SANS Difference Makers Awards

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 199 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chris Painter, Chair of the Risk Committee and Board Member at the Center for Internet Security® (CIS®). Together, they discuss how chief information security officers (CISOs) can support the work of translating cyber risk into business decisions by Boards.

Here are some highlights from our episode:

• 00:50. Introductions to Chris
• 01:36. The single biggest translation error Chris has seen CISOs make
• 07:38. Cyber risk quantification: An opportunity to go beyond translation for Boards
• 09:25. How ransomware changed Boards' understanding of cyber risks' business impact
• 10:45. The value of tabletop exercises (TTX) and other simulations in creating shared language
• 13:26. Recommendations on how to make the most of a TTX
• 18:37. Risk modeling and how artificial intelligence (AI) complicates probability estimations
• 21:51. "Pressure" (2026) as an illustration of making good, not 100% accurate, estimations
• 22:58. How growing public awareness of cyber is reshaping CISOs' conversations with Boards
• 25:55. The importance of walking Boards through risk mitigation steps with AI as an example
• 29:31. A recommendation for how CISOs can learn what directors care about
• 30:15. From "wizardry" to familiarity: An ongoing generational shift around cyber

Resources

• Episode 183: The Role of CISO in Supporting Risk Translation
• Episode 187: The Role of a CISO as a Strategic Storyteller
• Episode 192: How Leaders Balance Expertise and Communication
• How Risk Quantification Tests Your Reasonable Cyber Defense
• CIS RAM (Risk Assessment Method)
• Leveraging Generative Artificial Intelligence for Tabletop Exercise Development
• CIS Controls v8.1 Incident Response Policy Template
• You Have a Cybersecurity Incident. Now What?
• Prompt Injections: The Inherent Threat to Generative AI
• "Pressure" | Official Website | 29 May 2026

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 198 of Cybersecurity Where You Are, Sean Atkinson discusses artificial intelligence (AI) and privacy from a risk-based cybersecurity perspective. Together, he explores how organizations and individuals can assess AI risk, apply governance frameworks, evaluate third-party AI services, and balance innovation with due diligence.

Here are some highlights from our episode:

• 00:41. Framing the conversation around AI, privacy, and risk-based controls
• 02:22. Due diligence and ethical considerations around AI products and services
• 03:14. Data minimization and transparency as foundations for AI privacy
• 04:46. Privacy impact assessments as a way to understand AI data collection and use
• 05:42. AI governance and the tension between implementation velocity and risk management
• 10:08. The use of existing data flows and controls in AI assessments
• 11:57. Algorithmic transparency and the challenge of understanding AI decision making
• 13:47. Standards, frameworks, and data sovereignty in AI privacy governance
• 15:12. Encryption, anonymization, tokenization, and federated learning as privacy safeguards
• 16:40. The need to shift stakeholder input left in AI development and deployment lifecycles
• 19:13. Building literacy around security, data management, privacy, and AI risk
• 23:40. The value of cross-functional and written assessment criteria for AI risk
• 26:21. A call to action for keeping pace with AI privacy and and innovation risk

Resources

• CIS Controls v8.1.2 AI Security Guidance Workbook
• Episode 105: Context in Cyber Risk Quantification
• Service Provider Management Policy Template for CIS Control 15
• EU AI Act: first regulation on artificial intelligence
• AI Risk Management Framework
• IAPP AI Governance Center
• Episode 120: How Contextual Awareness Drives AI Governance
• Secure by Design v1.1 A Guide to Assessing Software Security Practices
• Reasonable Cybersecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 197 of Cybersecurity Where You Are, Sean Atkinson sits down with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch; and Ed Skoudis, President of SANS Technology Institute. Together, they discuss artificial intelligence (AI), operational technology (OT) data, and how understanding creates the foundation for AI-ready OT data.

Here are some highlights from our episode:

• 00:54. Introductions to Ben and Ed
• 02:16. How we understand and integrate AI into OT environments
• 04:30. How OT diverges from information technology (IT) in data responsibilities
• 05:23. Opportunities for AI to assist OT
• 06:33. The importance of meeting OT systems where they are
• 08:10. A passive and incremental approach that respects the operations machines are doing
• 12:29. Efficiency gains, public safety improvements, and other benefits of AI-ready OT data
• 17:47. What lifecycle management, asset hierarchies, and governance look like for OT data
• 22:14. The promise of AI to help to make OT environments understandable
• 23:19. A team sport: How IT and OT can work together to understand assets and data
• 28:38. The need for translation in IT-OT communication
• 29:01. Recommendations for how to make OT data AI ready

Resources

• CIS Critical Security Controls®
• CIS Controls version 8.1 ICS Workbook
• Artificial Intelligence and Large Language Models Companion Guide
• CIS Controls v8.1 Enterprise Asset Management Policy Template
• CIS Controls v8.1 Software Asset Management Policy Template
• CIS Controls v8.1 Data Management Policy Template
• CIS Controls v8.1 Account & Credential Management Policy Template
• Establishing Essential Cyber Hygiene
• ProArch
• Cybersecurity for Critical Infrastructure
• Episode 77: Data's Value to Decision-Making in Cybersecurity
• Episode 183: The Role of CISO in Supporting Risk Translation

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 196 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how CIS, FIFA, and FIFA World Cup 2026 host cities started collaborating in 2025 on cybersecurity, public safety, intelligence, and information-sharing efforts supporting the largest sporting event in the world.

Here are some highlights from our episode:

• 00:40. Introductions to Sasha and John
• 02:07. Overview of one of the most complex public safety efforts assembled for a sporting event
• 05:52. Consistency: A standard for preventing and deterring threats at FIFA World Cup 2026
• 10:30. The impact of relationships in shaping FIFA's security ops and information sharing
• 11:53. Effective communication: The key to cross-functional collaboration in support of the tournament
• 18:07. The importance of information that guides operations
• 20:35. Education as a way to inform stakeholders and deploy resources
• 26:19. A deliberate effort to look at unanticipated threats and plan for them
• 29:14. Examples of messaging synchronization in support of FIFA World Cup 2026
• 32:37. An all-hands-on-deck support campaign from CIS
• 33:29. Parting thoughts around large-scale event support in the future

Resources

• An Examination of Generative AI and Physical Threat Planning
• An Examination of AI-Enabled Threats to Event and Stadium Security
• Multidimensional Threats
• 5 Major Emerging Risks to Large-Scale Events
• Illicit Sports Betting and Match Integrity Risks to Large-Scale Events
• Deepfakes and Synthetic Media: The Emerging Threat to Large-Scale Public Gatherings
• Growing Risks to Digital Ticketing Platforms for Large-Scale Events
• Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings
• Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings Cyber Risks Companion Guide
• 5 Steps to Help Secure Your City before a Large-Scale Event

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 195 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute, and Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss Enigma machines, their history, and their security lessons for today.

Here are some highlights from our episode:

• 00:56. Introductions to Ed and Marc
• 01:32. What Enigma machines are and why cybersecurity folks still care about them today
• 06:10. Enigma machines as a symbol for how we can use hacking for noble purposes
• 07:18. How the human mind and the need for ease of use can undermine security
• 15:59. The importance of testing when designing and maintaining a security system
• 20:45. Why "security through obscurity" isn't actually true
• 22:58. Curiosity, logic, and a wide range of knowledge: Essential traits for getting hired in cybersecurity today
• 30:57. The impact of culture in shaping security policy and priorities
• 35:09. Why artificial intelligence (AI) is the Enigma machine of 2026
• 36:11. How to learn more about Enigma machines

Resources

• Episode 189: The Present and Future of AI-enabled Pentesting
• A Short Guide for Spotting Phishing Attempts
• Penetration Testing
• Vulnerability Assessments
• Episode 192: How Leaders Balance Expertise and Communication
• Episode 193: AI Security and Responsibility in EO 14409
• The Myth of Mythos: What It Means For Information Security
• National Cryptologic Museum
• Enigma Replica: The Enigma touch

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 194 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute. Together, they conduct a mid-year review of 2026 cybersecurity predictions from seven Center for Internet Security® (CIS®) experts, as shared on the CIS website.

Here are some highlights from our episode:

• 01:50. Ongoing conversations about improving defense with artificial intelligence (AI)
• 05:19. A trap to avoid: Automating things with AI because we can regardless of utility
• 06:54. Ed's prediction about a near-term transition for AI-enabled vulnerability discovery
• 09:27. How AI agents change the economics around conducting a penetration test
• 11:26. Adversary emulation: A blurry proposition when threat actors use AI to look like anybody
• 14:02. Ed's prediction about threat actors shifting APT profiles within a single attack campaign
• 17:00. The need to systematically rethink cyber defense to support state and local cybersecurity
• 23:34. How adversaries are pivoting to the "authorization sprawl" in light of zero trust efforts
• 29:20. Industry-specific threat intelligence as a way to keep organizations informed
• 32:10. Why a policy isn't the same as security control for operational technology (OT)
• 33:55. Social expectations and public policy objectives around holistic OT security
• 39:52. Compliance as a floor, not a ceiling, that results as a byproduct of continuous security
• 43:43. The need for oversight and confidence in technology as distinct from the "Fog of More"

Resources

• Episode 169: 2026 Cybersecurity Predictions from CIS — Pt 1
• Episode 174: 2026 Cybersecurity Predictions from CIS — Pt 2
• Episode 179: 2026 Cybersecurity Predictions from CIS — Pt 3
• The Myth of Mythos: What It Means For Information Security
• Episode 189: The Present and Future of AI-enabled Pentesting
• Authorization Sprawl: The Vulnerability Reshaping Modern Attacks
• Episode 188: DBIR 2026 Insights and Collaboration with CIS
• Mapping and Compliance with the CIS Controls
• Mapping and Compliance with the CIS Benchmarks

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 193 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute, and Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they discuss AI security and the responsibility of the U.S. government in creating confidence around it, as represented in Executive Order (EO) 14409, "Promoting Advanced Artificial Intelligence Innovation and Security."

Here are some highlights from our episode:

• 00:50. Introductions to Rob and Brian
• 02:32. How to conceptualize confidence around something as complex as AI security
• 04:32. The U.S. government's responsibility to set AI security guardrails as clear expectations
• 08:12. The use of "voluntary" participation to create confidence in the context of EO 14409
• 14:38. How Mythos AI and similar developments affect assessment of frontier AI models
• 17:11. Airport security as an analogy for understanding AI security and privacy concerns
• 18:41. Why cybersecurity is a hard sell until an incident occurs
• 20:50. How AI is quickly becoming critical infrastructure
• 22:53. Furbies as reference for a flexible, iterative benchmarking process for AI security
• 25:50. The need for technical folks to translate AI risks into something understandable
• 28:21. Balancing encouragement of AI innovation with mindfulness of risk
• 31:24. The basics as a foundation for building shared responsibility around AI security

Resources

• Promoting Advanced Artificial Intelligence Innovation and Security
• The Myth of Mythos: What It Means For Information Security
• Episode 190: Separating Mythos AI Fact from Fiction
• The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program
• Anthropic says it has taken its latest AI models offline to comply with new export controls
• Establishing Essential Cyber Hygiene
• Episode 187: The Role of a CISO as a Strategic Storyteller

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 192 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss how leaders, including those in cybersecurity, balance their technical expertise with mastery of communication strategies.

Here are some highlights from our episode:

• 00:51. Introductions to Marcus
• 02:04. How Marcus found value in using analogies to communicate complex topics
• 08:40. Coordination with non-technical folks as a sign of leadership maturity
• 14:03. The wisdom in knowing what to say and what not to say when managing up
• 17:31. The need to balance technical skills with team resourcing in a way that's imitable
• 21:07. The challenge of leaders learning by proximity in hybrid and remote environments
• 24:16. "Classic" engineering vs. "new" engineering
• 25:13. Lessons from Boards in applying discipline, rigor, and order to software engineering
• 28:23. The value in leaders continuously learning how businesses work

Resources

• Episode 183: The Role of CISO in Supporting Risk Translation
• Episode 187: The Role of a CISO as a Strategic Storyteller
• Episode 99: How Cyber-Informed Engineering Builds Resilience
• 7 CIS Experts' 2026 Cybersecurity Predictions

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.