Cybersecurity Where You Are (video)

Latest Episodes:

Episode 171: Securing CNI in U.S. SLTTs through AI Adoption Jan 21, 2026

Show notes

In episode 171 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Soledad Antelada Toledano, Security Advisor, Office of the CISO, Google Cloud at Google. Together, they discuss securing critical national infrastructure (CNI) in U.S. State, Local, Tribal, and Territorial (SLTT) government organizations through artificial intelligence (AI) adoption.

Here are some highlights from our episode:

00:50. Introduction to Soledad
02:48. How the convergence of informational technology (IT) and operational technology (OT) has created bigger attack surfaces
04:10. The proliferation of threat actors targeting critical infrastructure sectors
07:24. The challenge of legacy systems for U.S. SLTT owners of CNI
08:13. Alert fatigue, limited visibility, and other challenges facing OT networks
13:22. The value of automated cyber threat intelligence (CTI)
24:46. Building strategic AI implementation around human in the loop (HITL)
33:17. U.S. SLTTs' use of the cloud to test and build trust for securing CNI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 170: Visibility for SLTTs in Blocking Typhoon APTs Jan 14, 2026

Show notes

In Episode 170 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Douglas Holland, Senior Solutions Engineer at Akamai Technologies. Together, they discuss how U.S. State, Local, Tribal, and Territorial (SLTT) government organizations can increase their visibility to obstruct the attack attempts of Typhoon advanced persistent threat (APT) groups.

Here are some highlights from our episode:

00:49. Introduction to Douglas
02:16. How Typhoon APTs are using trusted tools to target critical infrastructure
08:30. Professionalism as a tell of sophisticated nation-state threat actors
09:15. How U.S. SLTTs come up with creative solutions despite budgeting and staffing limits
14:14. The "big credential playground" that is U.S. SLTTs' expanded attack surface
16:46. Visibility into network activity as a way to continuously build defensive capability
19:11. The use of context to connect technical visibility to defensive action
23:20. Identity as the new perimeter, cloud and SaaS posture, and micro-segmentation
29:18. One piece of advice: assume an attacker is already in the network or will be

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 169: 2026 Cybersecurity Predictions from CIS — Pt 1 Jan 07, 2026

Show notes

In Episode 169 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager begin their discussion of 2026 cybersecurity predictions from seven experts at the Center for Internet Security® (CIS®), as shared on the CIS website.

Here are some highlights from our episode:

01:05. The impact and promise of artificial intelligence on cyber defense
05:37. Collective action as an answer to the constraints facing the "cyber-underserved"
12:52. Zero trust and security best practices as functions of managing cycles of time
21:22. How tailored threat intelligence can help to frame cybersecurity around mission
31:18. The convergence of cybersecurity and privacy as a necessity for governance

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 168: Institutionalizing Good Cybersecurity Ideas Dec 31, 2025

Show notes

In Episode 168 of Cybersecurity Where You Are, Tony Sager sits down with Tony Rutkowski, one of the CIS Critical Security Controls® (CIS Controls®) Ambassadors of the Center for Internet Security® (CIS®). Together, they discuss what Tony Rutkowski has learned in his efforts to institutionalize good cybersecurity ideas like the CIS Controls.

Here are some highlights from our episode:

01:48. Introductions to Tony Rutkowski and his career in technology
06:06. The evolution of the CIS Controls and how Tony Rutkowski came to advocate for them
12:50. The "Fog of More" as a metaphor to focus attention, not create new solutions
17:50. How institutionalizing good cybersecurity ideas is like conducting an orchestra
21:44. The use of timing and the right security content to help people clarify their intentions
24:25. The value of industry mappings in reducing duplicate implementation efforts
26:41. Secure by design: a 2025 example of creating a new formal global technical standard

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 167: Volunteers as a Critical Cybersecurity Resource Dec 24, 2025

Show notes

In Episode 167 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Kelley Misata, Ph.D., Chief Trailblazer and Founder at Sightline Security. Together, they discuss how volunteers constitute a critical cybersecurity resource for the Center for Internet Security® (CIS®). Along the way, they explore the nature of volunteerism, the role of volunteers at CIS, and how CIS is looking to mature its engagement with volunteers going forward.

Here are some highlights from our episode:

01:37. Introductions to Kelley and her experience with cybersecurity volunteers
03:09. Kelley's use of research, expertise, and an open mind to check in with CIS volunteers
04:50. How volunteers have deepened their passion and dedication with CIS for 25 years
06:55. Volunteers as a critical cybersecurity resource for "One CIS" going forward
10:51. Commitment, conflict resolution, and openness to formal process in CIS Communities
14:39. The use of directionality and accolades to encourage different types of contributors
19:43. The importance of flexibility in management to meet volunteers where they are
20:30. Leadership, storytelling, and recruitment as opportunities for volunteerism at CIS
24:37. The risk of volunteer burnout and how to protect against it
26:00. Collaboration with employers to treat volunteerism as a growth experience
30:09. A balancing act of making volunteers useful without depleting the mission
34:51. Sean's take: volunteer management as the original Large Language Model (LLM)
38:32. Other observations and final thoughts

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 166: Foundations of Actuarial Science in Cyber Risk Dec 17, 2025

Show notes

In Episode 166 of Cybersecurity Where You Are, Sean Atkinson sits down with Tyler Moore, Ph.D., Chair of Cyber Studies at the University of Tulsa, and Daniel Woods, Lecturer at the University of Edinburgh. Together, they review the foundations of actuarial science in cyber risk.

Here are some highlights from our episode:

00:48. Introductions to Tyler and Daniel
01:22. How actuarial science fits into a traditional approach of risk modeling
02:20. Why cyber risk has historically been difficult to quantify
04:01. How data sources available to insurers and individual organizations have evolved
07:21. Adaptability as a key principle to model risk for an evolving cyber threat landscape
08:58. Loss distribution modeling for different types of cyber threats
11:38. Similarities and differences between how actuaries and frameworks view risks
13:10. Quantifying severity, frequency, and resilience to different cyber risks
14:31. How insurers differ from underwriters in their view of risk
17:43. Ransomware as a case study where actuarial modeling improved risk management
22:30. The value of translating cyber risk to business risk for CISOs like Sean
26:20. Why data on which security controls matter most remains elusive
32:33. The biggest misconceptions of using actuarial models in cybersecurity
36:09. How cyber actuarial science can help to determine what works in cybersecurity

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 165: An In-Depth Look at CIS Controls Implementation Dec 10, 2025

Show notes

In Episode 165 of Cybersecurity Where You Are, Tony Sager sits down with Valecia Stocchetti, Senior Cybersecurity Engineer at the Center for Internet Security® (CIS®), and Charity Otwell, Director of Critical Security Controls at CIS. Together, they take an in-depth look at implementing the CIS Critical Security Controls® (CIS Controls®), including what you need to know to begin your own CIS Controls implementation efforts.

Here are some highlights from our episode:

00:53. Introductions to Valecia and Charity
02:48. How the CIS Controls ecosystem answers the deeper question of how to implement
06:42. The importance of clear strategy, business priorities, and a realistic timeline
09:56. How the CIS Community Defense Model (CDM) clarifies cyber defense priorities
13:01. The use of calculations around costing to make a security program achievable
15:31. Bringing IT and the Board of Directors together through governance
20:36. "Herding cats" as a metaphor for navigating different compliance frameworks
23:17. Why one prescriptive ask per CIS Safeguard starts cybersecurity workflows
25:30. "Why" vs. "how" communication, accountability, staffing, budget, and continuous improvement as keys to success for CIS Controls implementation
42:03. CIS Controls Assessment Specification as an answer to implementation subjectivity
47:21. Parting thoughts around team effort, change, and CIS Controls Accreditation

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 164: Secure by Design in Software Development Dec 03, 2025

Show notes

In Episode 164 of Cybersecurity Where You Are, Tony Sager sits down with Curt Dukes, EVP and General Manager of Security Best Practices at the Center for Internet Security® (CIS®), and Steve Lipner, Executive Director of SAFECode.org. Together, they explore the evolution of secure software development and why secure by design is critical for reducing risk in today’s complex environments.

Here are some highlights from our episode:

01:08. Introductions to Curt and Steve
04.01. The historical challenge of implementation errors in software security
08:41. The emergence of secure by design and the need to measure against specified criteria
14:39. The value of artifacts as evidence of secure software development
28:52: How the CIS Critical Security Controls® (CIS Controls®) support secure software
39:59. The use of community projects to address challenges like secure by design

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 163: K-12 Cybersecurity Made Practical Nov 26, 2025

Show notes

In Episode 163 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Brock Boggs, Director of Technology at Cityscape Schools, and Maureen Kunac, Senior Product Manager at the Center for Internet Security® (CIS®). They dive into the realities and challenges of K-12 cybersecurity, including limited budgets, small teams, and growing threats.

Brock shares how a ransomware incident at a neighboring school district and new state requirements pushed his district to take K-12 cybersecurity more seriously. He explains how CIS SecureSuite® tools gave him a clear starting point and helped him transform panic into progress. Maureen highlights how CIS continues to adapt its cybersecurity solutions for K-12 schools and why simplicity matters when resources are tight.

Here are some highlights from our episode:

00:47. Introductions to Brock and Maureen
02:50. What prompted Cityscape Schools to prioritize cybersecurity and how Brock found CIS
11:50. The importance of simplicity in making K-12 cybersecurity practical
12:39. A collaborative journey of helping Brock get comfortable learning about cybersecurity
22:52. A look back at Cityscape Schools pivoted to remote education during COVID-19
34:20. Brock's advice for other school districts to get started with a cybersecurity program

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 162: A Managed Approach to a Managed Attack Surface Nov 19, 2025

Show notes

In Episode 162 of Cybersecurity Where You Are, Tony Sager sits down with Tina Williams-Koroma, Founder and CEO of TCecure, LLC and CyDeploy, Inc. Together, they discuss why "cyber insecurity is not inevitable" and how organizations can take a managed approach to attack surface management.

Along the way, Tina shares her journey from software development to cybersecurity entrepreneurship and explains why proactive measures like hardening systems and automating patching are critical for reducing risk. Here are some highlights from our episode:

00:50. Introductions to Tina, her career pivot, and her entrepreneurial path
03:35. The value of the secure configuration guidance provided by the CIS Benchmarks®
07:35. Why a well-managed system makes for a hard target
11:00. Marketing against “magic” in a hype-driven cybersecurity market
13:44. The translative work of moving well-managed infrastructure beyond "mere hygiene"
19:14. Tina's faith-based inspiration for helping others get as far as she's gotten
27:23. Soccer analogies for a managed attack surface
33:54. Tina's pep talk: "Why cyber insecurity is not inevitable"
38:38. Free cybersecurity resources for small businesses

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cybersecurity Where You Are (video)

Related Podcasts

Links

Stay Connected