Cybersecurity Where You Are (video)

Latest Episodes:

Episode 201: The Evolution and AI Enablement of Pentesting Aug 19, 2026

Show notes

In episode 201 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. Together, they reflect on the evolution of penetration testing, including the impact on pentesting from artificial intelligence (AI).

Here are some highlights from our episode:

01:03. How things have changed since William's and Ed's first pentests
09:02. Community: A defining element of Capture The Flag (CTF) events
14:47. Industry concerns over the "death" of CTFs and "cheating" by artificial intelligence (AI)
17:00. Opportunities to take CTFs to the next level in the age of AI
20:18. Pentesting vs. vulnerability scanning: Why terminology matters
25:43. The advent of autonomous AI tools and what they could mean for vulnerability scanning
29:07. Why continuous improvement in cybersecurity doesn't always require AI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 200: Alan Paller's Vision and Our Next Chapter Aug 12, 2026

Show notes

In episode 200 of Cybersecurity Where You Are, Sean Atkinson, Tony Sager, and Ed Skoudis sit down with Frank Reeder, Co-Founder and Founding Chair of the Center for Internet Security® (CIS®). Together, they reflect on how Alan Paller's vision continues to drive CIS forward. In the spirit of that vision, this milestone episode also marks a new chapter for the podcast: Ed Skoudis joins as co-host of Cybersecurity Where You Are.

Here are some highlights from our episode:

01:09. The two complementary missions of CIS
02:55. Three defining moments that have shaped CIS into the organization it is today
08:10. The story of naming CIS
10:31. How CIS and SANS advance Alan Paller's vision of bringing people together
13:50. Personal anecdotes of Alan Paller as a connector of people
15:45. "What would Alan do?" A question that continues to guide CIS and SANS
22:00. How CIS security best practices are emblematic of helping others
27:12. CIS's "secret sauce" as a trusted, neutral platform for cybersecurity collaboration
29:53. How CIS can continue to embody Alan Paller's philosophy into the future
37:47. A special announcement: Ed Skoudis as a new co-host on the podcast

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 199: Translating Cyber Risk into Business Decisions Aug 05, 2026

Show notes

In episode 199 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chris Painter, Chair of the Risk Committee and Board Member at the Center for Internet Security® (CIS®). Together, they discuss how chief information security officers (CISOs) can support the work of translating cyber risk into business decisions by Boards.

Here are some highlights from our episode:

00:50. Introductions to Chris
01:36. The single biggest translation error Chris has seen CISOs make
07:38. Cyber risk quantification: An opportunity to go beyond translation for Boards
09:25. How ransomware changed Boards' understanding of cyber risks' business impact
10:45. The value of tabletop exercises (TTX) and other simulations in creating shared language
13:26. Recommendations on how to make the most of a TTX
18:37. Risk modeling and how artificial intelligence (AI) complicates probability estimations
21:51. "Pressure" (2026) as an illustration of making good, not 100% accurate, estimations
22:58. How growing public awareness of cyber is reshaping CISOs' conversations with Boards
25:55. The importance of walking Boards through risk mitigation steps with AI as an example
29:31. A recommendation for how CISOs can learn what directors care about
30:15. From "wizardry" to familiarity: An ongoing generational shift around cyber

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 198: AI Privacy from a Risk-Based Perspective Jul 29, 2026

Show notes

In episode 198 of Cybersecurity Where You Are, Sean Atkinson discusses artificial intelligence (AI) and privacy from a risk-based cybersecurity perspective. Together, he explores how organizations and individuals can assess AI risk, apply governance frameworks, evaluate third-party AI services, and balance innovation with due diligence.

Here are some highlights from our episode:

00:41. Framing the conversation around AI, privacy, and risk-based controls
02:22. Due diligence and ethical considerations around AI products and services
03:14. Data minimization and transparency as foundations for AI privacy
04:46. Privacy impact assessments as a way to understand AI data collection and use
05:42. AI governance and the tension between implementation velocity and risk management
10:08. The use of existing data flows and controls in AI assessments
11:57. Algorithmic transparency and the challenge of understanding AI decision making
13:47. Standards, frameworks, and data sovereignty in AI privacy governance
15:12. Encryption, anonymization, tokenization, and federated learning as privacy safeguards
16:40. The need to shift stakeholder input left in AI development and deployment lifecycles
19:13. Building literacy around security, data management, privacy, and AI risk
23:40. The value of cross-functional and written assessment criteria for AI risk
26:21. A call to action for keeping pace with AI privacy and and innovation risk

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 197: AI-ready OT Data Begins with Understanding Jul 22, 2026

Show notes

In episode 197 of Cybersecurity Where You Are, Sean Atkinson sits down with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch; and Ed Skoudis, President of SANS Technology Institute. Together, they discuss artificial intelligence (AI), operational technology (OT) data, and how understanding creates the foundation for AI-ready OT data.

Here are some highlights from our episode:

00:54. Introductions to Ben and Ed
02:16. How we understand and integrate AI into OT environments
04:30. How OT diverges from information technology (IT) in data responsibilities
05:23. Opportunities for AI to assist OT
06:33. The importance of meeting OT systems where they are
08:10. A passive and incremental approach that respects the operations machines are doing
12:29. Efficiency gains, public safety improvements, and other benefits of AI-ready OT data
17:47. What lifecycle management, asset hierarchies, and governance look like for OT data
22:14. The promise of AI to help to make OT environments understandable
23:19. A team sport: How IT and OT can work together to understand assets and data
28:38. The need for translation in IT-OT communication
29:01. Recommendations for how to make OT data AI ready

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 196: Securing FIFA World Cup 2026 Collaboratively Jul 15, 2026

Show notes

In episode 196 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how CIS, FIFA, and FIFA World Cup 2026 host cities started collaborating in 2025 on cybersecurity, public safety, intelligence, and information-sharing efforts supporting the largest sporting event in the world.

Here are some highlights from our episode:

00:40. Introductions to Sasha and John
02:07. Overview of one of the most complex public safety efforts assembled for a sporting event
05:52. Consistency: A standard for preventing and deterring threats at FIFA World Cup 2026
10:30. The impact of relationships in shaping FIFA's security ops and information sharing
11:53. Effective communication: The key to cross-functional collaboration in support of the tournament
18:07. The importance of information that guides operations
20:35. Education as a way to inform stakeholders and deploy resources
26:19. A deliberate effort to look at unanticipated threats and plan for them
29:14. Examples of messaging synchronization in support of FIFA World Cup 2026
32:37. An all-hands-on-deck support campaign from CIS
33:29. Parting thoughts around large-scale event support in the future

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 195: Enigma Machines’ Security Lessons for Today Jul 08, 2026

Show notes

In episode 195 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute, and Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss Enigma machines, their history, and their security lessons for today.

Here are some highlights from our episode:

00:56. Introductions to Ed and Marc
01:32. What Enigma machines are and why cybersecurity folks still care about them today
06:10. Enigma machines as a symbol for how we can use hacking for noble purposes
07:18. How the human mind and the need for ease of use can undermine security
15:59. The importance of testing when designing and maintaining a security system
20:45. Why "security through obscurity" isn't actually true
22:58. Curiosity, logic, and a wide range of knowledge: Essential traits for getting hired in cybersecurity today
30:57. The impact of culture in shaping security policy and priorities
35:09. Why artificial intelligence (AI) is the Enigma machine of 2026
36:11. How to learn more about Enigma machines

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 194: 2026 Cybersecurity Predictions Mid-Year Review Jul 01, 2026

Show notes

In episode 194 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute. Together, they conduct a mid-year review of 2026 cybersecurity predictions from seven Center for Internet Security® (CIS®) experts, as shared on the CIS website.

Here are some highlights from our episode:

01:50. Ongoing conversations about improving defense with artificial intelligence (AI)
05:19. A trap to avoid: Automating things with AI because we can regardless of utility
06:54. Ed's prediction about a near-term transition for AI-enabled vulnerability discovery
09:27. How AI agents change the economics around conducting a penetration test
11:26. Adversary emulation: A blurry proposition when threat actors use AI to look like anybody
14:02. Ed's prediction about threat actors shifting APT profiles within a single attack campaign
17:00. The need to systematically rethink cyber defense to support state and local cybersecurity
23:34. How adversaries are pivoting to the "authorization sprawl" in light of zero trust efforts
29:20. Industry-specific threat intelligence as a way to keep organizations informed
32:10. Why a policy isn't the same as security control for operational technology (OT)
33:55. Social expectations and public policy objectives around holistic OT security
39:52. Compliance as a floor, not a ceiling, that results as a byproduct of continuous security
43:43. The need for oversight and confidence in technology as distinct from the "Fog of More"

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 193: AI Security and Responsibility in EO 14409 Jun 24, 2026

Show notes

In episode 193 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Rob T. Lee, Chief of Research & Chief AI Officer at the SANS Institute, and Brian Calkin, Chief Technology and Innovation Officer at the Center for Internet Security® (CIS®). Together, they discuss AI security and the responsibility of the U.S. government in creating confidence around it, as represented in Executive Order (EO) 14409, "Promoting Advanced Artificial Intelligence Innovation and Security."

Here are some highlights from our episode:

00:50. Introductions to Rob and Brian
02:32. How to conceptualize confidence around something as complex as AI security
04:32. The U.S. government's responsibility to set AI security guardrails as clear expectations
08:12. The use of "voluntary" participation to create confidence in the context of EO 14409
14:38. How Mythos AI and similar developments affect assessment of frontier AI models
17:11. Airport security as an analogy for understanding AI security and privacy concerns
18:41. Why cybersecurity is a hard sell until an incident occurs
20:50. How AI is quickly becoming critical infrastructure
22:53. Furbies as reference for a flexible, iterative benchmarking process for AI security
25:50. The need for technical folks to translate AI risks into something understandable
28:21. Balancing encouragement of AI innovation with mindfulness of risk
31:24. The basics as a foundation for building shared responsibility around AI security

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 192: How Leaders Balance Expertise and Communication Jun 17, 2026

Show notes

In episode 192 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss how leaders, including those in cybersecurity, balance their technical expertise with mastery of communication strategies.

Here are some highlights from our episode:

00:51. Introductions to Marcus
02:04. How Marcus found value in using analogies to communicate complex topics
08:40. Coordination with non-technical folks as a sign of leadership maturity
14:03. The wisdom in knowing what to say and what not to say when managing up
17:31. The need to balance technical skills with team resourcing in a way that's imitable
21:07. The challenge of leaders learning by proximity in hybrid and remote environments
24:16. "Classic" engineering vs. "new" engineering
25:13. Lessons from Boards in applying discipline, rigor, and order to software engineering
28:23. The value in leaders continuously learning how businesses work

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cybersecurity Where You Are (video)

Related Podcasts

Links

Stay Connected