Cybersecurity Where You Are (video)

Latest Episodes:

Episode 181: Supply and Demand of Cybersecurity Ecosystems Apr 01, 2026

Show notes

In episode 181 of Cybersecurity Where You Are, Tony Sager sits down with Vilius Benetis, Director of NRD Cyber Security. Together, they discuss how Vilius applies his expertise as a CIS Critical Security Controls® (CIS Controls®) Ambassador to help to cultivate supply and demand for growing cybersecurity ecosystems around the world.

Here are some highlights from our episode:

01:11. Introductions to Vilius and recollections of how he met Tony for the first time
02:06. The CIS Controls as a reasonable, logical approach that avoids generic language
04:11. How the CIS Controls shaped Vilius' cybersecurity conversations with the World Bank
05:26. A clear connection between knowing what you have and recovering from an incident
07:55. A strategic look at how to build cybersecurity programs that will grow and evolve
12:18. How the CIS Controls help to clarify reasonable cybersecurity and avoid victim blaming
18:07. An encouraging sign: Governments enabling businesses, not competing with them
21:13. Transportation: A lens for understanding how security culture and expectations change
28:11. A brief look at how to make progress on operationalizing security
31:54. The supply and demand forces that help to create cybersecurity ecosystems
38:13. An opportunity for helping organizations to simplify governance
42:02. Parting thoughts and thanks

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 180: Secure by Design Fused to Operational Practices Mar 25, 2026

Show notes

In episode 180 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Stephen Thomas, SVP of Sales and Business Services at the Center for Internet Security® (CIS®), and Nick Rust, Director of Distribution at CIS. Together, they discuss how CIS supports secure by design by integrating it into operational practices.

Here are some highlights from our episode:

00:48. Introductions to Stephen and Nick
02:20. The need to connect development and operational environments
07:31. How CIS security best practices make cybersecurity standard and repeatable
09:19. Navigating the complexity the cloud adds to secure by design
11:44. The importance of removing guesswork for operating partners and development teams
14:21. How CIS provides the professional infrastructure for collective action in cybersecurity
16:00. Good configuration management: The bedrock of every successful security program
17:29. The use of a common language to communicate security across an organization
23:59. Shared responsibility, not shared accountability, in the cloud
27:21. A look back at how CIS did secure by design using a projectized approach
32:21. Conveying confidence around cybersecurity and compliance in the connected world
36:16. Parting pieces of advice for organizations just getting started

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 179: 2026 Cybersecurity Predictions from CIS — Pt 3 Mar 18, 2026

Show notes

In episode 179 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager conclude their discussion of 2026 cybersecurity predictions from seven CIS experts, as shared on the CIS website.

Here are some highlights from our episode:

01:09. How threat actors' adoption of Agentic AI is reshaping the defender's dilemma
06:28. Public confidence: The primary focus for attackers seeking to undermine U.S. elections
10:43. The surge in threat actors targeting operational technology and critical infrastructure
12:29. Responsibility and the cost of fixing flawed things instead of secure by design
16:29. Secure by design: An invitation to rethink architecture and plan for future adaptability
17:24. Meeting cloud service prioritization with a foundation of defense for all things
25:44. Supporting state and local cybersecurity maturity with both competence and character
41:00. Feedback: The key to adapting security controls to evolving threats and technology use
50:23. Embedding security into the heart of a business

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 178: Appropriate Defense to Iranian Threat Activity Mar 11, 2026

Show notes

In episode 178 of Cybersecurity Where You Are, Sean Atkinson sits down with Theodore "TJ" Sayers, Senior Director of Threat Intelligence at the Center for Internet Security® (CIS®). Together, they discuss how to mount an appropriate defense to Iranian threat activity observed in February and March 2026.

Here are some highlights from our episode:

00:58. Iran's historical tit-for-tat style of cyber operations
02:50. Regional targets: A primary focus of Iran's state-sponsored threat actors
04:05. What the CIS Cyber Threat Intelligence (CTI) team is watching for
05:19. Contextualizing a drop in precursor-related threat activity from Iran
06:59. Sectors directly and indirectly affected by observed Iranian threat activity
09:12. Password spraying, data wipers, and more: Common TTPs of Iranian threat groups
11:50. The importance of cybersecurity awareness training in countering TTPs that still work
16:07. Advice to SOC managers: How to detect what CIS CTI is expecting the most
21:25. NASCIO's Top 10 Priorities as a guide for framing strategic risk of Iran's threat activity
26:39. What an effective threat intel team does and does not do
29:29. Community defense for U.S. State, Local, Tribal, and Territorial (SLTT) organizations

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 177: Power of Community-Developed Security Content Mar 04, 2026

Show notes

In episode 177 of Cybersecurity Where You Are, Tony Sager sits down with Bob Gendler, IT Specialist at the National Institute of Standards and Technology (NIST), and Edward Byrd, Senior Cybersecurity Engineer of the CIS Benchmarks® at the Center for Internet Security® (CIS®). Together, they use the open-source macOS Security Compliance Project to discuss the power of community-developed security content.

Here are some highlights from our episode:

01:15. Introductions to Bob and Edward along with their first Mac devices
03:24. Why CIS Benchmarks are needed for macOS
05:49. The need to make security guidance a collaborative, ongoing exercise
11:06. Inside the expanding community supporting the macOS Security Compliance Project
16:59. A practical win: making daily security operations easier to manage
21:40. An operational feedback loop of improving the CIS Benchmarks
25:25. The implications of compliance pointing to assurance, not security
30:53. Advice on how to prepare for an audit using the CIS Benchmarks
34:18. The importance of rationale in defining reasonable cybersecurity behavior
35:30. A teaser of upcoming changes and how to get involved

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 176: A Cybersecurity Journey of Incremental Wins Feb 25, 2026

Show notes

In episode 176 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brock Boggs, Director of Technology at Cityscape Schools and Multi-State Information Sharing and Analysis Center® (MS-ISAC®) member, and Maureen Kunac, Senior Product Manager at the Center for Internet Security® (CIS®). Together, they discuss Brock's story of using incremental wins to advance his organization on its cybersecurity journey.

Here are some highlights from our episode:

02:10. Getting started making the largest measurable impact with CIS-CAT® Pro Assessor
03:52. Implementation Group 1: A filter for prioritizing secure configuration management efforts
09:16. The use of essential cyber hygiene to build an on-ramp to a security controls program
11:18. Navigating breakage, dependency, and other principles of change management
13:37. Lessons learned from beta testing and enterprise rollout of security changes
22:24. Advice: How to start on a journey of system hardening with measurable impact

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 175: Practically Solving Cyber Problems at Scale Feb 18, 2026

Show notes

In episode 175 of Cybersecurity Where You Are, Tony Sager sits down with Phil Reitinger, Chair and Senior Advisor of Global Cyber Alliance. Together, they look back on Phil's career and his dedication to exploring how to practically solve cyber problems at scale.

Here are some highlights from our episode:

00:57. How Phil got started in cybersecurity during the "infosec" era
04:51. Old wine in new bottles: trust exploitation, authentication failures, and update challenges
06:14. The lack of political will, not technology, in solving fundamental cyber problems
07:33. How industry and government share similar challenges in cybersecurity
10:09. The importance of metrics in incentivizing the right actions
12:33. Scale: the biggest obstacle to collective cyber defense there ever was or will be
22:50. The Global Cyber Alliance and a focus on practically solving cyber problems at scale

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 174: 2026 Cybersecurity Predictions from CIS — Pt 2 Feb 11, 2026

Show notes

In episode 174 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Kyle Leonard, Cyber Threat Intelligence Analyst at the Center for Internet Security® (CIS®), and Randy Rose, VP of Security Operations & Intelligence at CIS. Together, they continue their discussion of 2026 cybersecurity predictions from seven CIS experts, as shared on the CIS website.

Here are some highlights from our episode:

02:00. How cross-platform campaigns are becoming the norm
03:09. Threat actors' use of generative artificial intelligence (GenAI) to expand their attacks and gain efficiencies
05:08. The blurring line of what separates today's script kiddies from nation-state threat actors
07:47. Fully autonomous malware: in the realm of possibility but not here yet
13:19. How specialization in the criminal ecosystem requires us to rethink analysis itself
16:07. Shrinking dwell time: a product of the democratization of complex tools' availability
18:02. The effective use of social engineering to lower threat actors' operational costs
19:20. Malware's increasing use of trusted infrastructure to thwart cyber defenses
20:25. The use of behavioral analysis to apply bottleneck security mechanisms
22:40. Evolving threat actors' tradecraft: pseudo-random subdomains, GenAI models, and SEO poisoning
26:39. What trust looks like today: something that's dynamic and negotiated at a moment's notice
31:25. Supply chain attackers' pivot to edge device vendors and security appliance makers
33:43. The ongoing work of CIS to support state and local governments' cybersecurity efforts

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 173: Scammer Jousting as Human Risk Management Feb 04, 2026

Show notes

In episode 173 of Cybersecurity Where You Are, Sean Atkinson is joined by Roger Grimes, CISO Advisor at KnowBe4. Together, they discuss "scammer jousting," a term coined by Tony Sager which describes empowering organizations to manage human risk using simulated phishing.

Here are some highlights from our episode:

01:05. How simulated phishing and scammer jousting manage human risk
03:48. The shift in perception of security awareness training over the past 20 years
06:19. The need for testing to build capability and resiliency amongst employees
09:27. The many faces of phishing attacks and the impact of generative artificial intelligence
15:00. How gamification is proven to help users learn more in their cybersecurity training
16:57. How data empowers organizations to communicate the potential impact of a phish
19:57. The use of behavior engineering to foster a stronger security culture
23:56. The value of customer feedback in continuously enhancing phishing training
29:52. Continuous and hyper-personalized training as the future of spammer jousting

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 172: Helping CISOs as a CIS Controls Ambassador Jan 28, 2026

Show notes

In episode 172 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chirag Arora, Cyber Security Executive Advisor and CISO at Dorf Nelson & Zauderer LLP. Together, they discuss how Chirag draws upon his experience as a CISO and his community work as a CIS Critical Security Controls® (CIS Controls®) Ambassador to help other CISOs with their cybersecurity programs.

Here are some highlights from our episode:

00:51. Introduction to Chirag and the early years of his work as a CIS Controls Ambassador
06:03. The value of measurement and psychology when discussing assessments with CISOs
09:00. Chirag's work on a CISO certification and vision for aligning it to the CIS Controls
12:31. How open sharing of wisdom between CISOs makes the world more secure
20:57. The importance of storytelling for CISOs, CIS Controls Ambassadors, and other leaders
24:29. Chirag's use of law school to take his understanding of reasonableness up a level
28:13. Regular opportunities for CIS Controls Ambassadors to discuss universal issues
31:08. The heightened importance of nonprofit organizations bringing people together

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cybersecurity Where You Are (video)

Related Podcasts

Links

Stay Connected