TopPodcast.com
Menu
  • Home
  • Top Charts
  • Top Networks
  • Top Apps
  • Top Independents
  • Top Podfluencers
  • Top Picks
    • Top Business Podcasts
    • Top True Crime Podcasts
    • Top Finance Podcasts
    • Top Comedy Podcasts
    • Top Music Podcasts
    • Top Womens Podcasts
    • Top Kids Podcasts
    • Top Sports Podcasts
    • Top News Podcasts
    • Top Tech Podcasts
    • Top Crypto Podcasts
    • Top Entrepreneurial Podcasts
    • Top Fantasy Sports Podcasts
    • Top Political Podcasts
    • Top Science Podcasts
    • Top Self Help Podcasts
    • Top Sports Betting Podcasts
    • Top Stocks Podcasts
  • Podcast News
  • About Us
  • Podcast Advertising
  • Contact
Not in our directory?
Add Show Here
Podcast Equipment
Center

toppodcastlogoOur TOPPODCAST Picks

  • Comedy
  • Crypto
  • Sports
  • News
  • Politics
  • True Crime
  • Business
  • Finance

Follow Us

toppodcastlogoStay Connected

    View Top 200 Chart
    Back to Rankings Page
    Technology

    The ITSPmagazine Podcast

    Founded in 2015, ITSPmagazine began as a vision for a publication positioned at the critical intersection of technology, cybersecurity, and society. What started as a written publication has evolved into a comprehensive repository for all their content—podcasts, articles, event coverage, interviews, videos, panels, and everything they create.
    This is where Sean Martin and Marco Ciappelli talk about cybersecurity, technology, society, music, storytelling, branding, conference coverage, and whatever else catches their attention. Over a decade of conversations exploring how these worlds collide, influence each other, and shape the human experience.
    This is where you’ll find it all.

    Advertise

    Copyright: ITSPmagazine is an imsmartin publication © Copyright 2015-2020 imsmartin, LLC, All Rights Reserved

    • Apple Podcasts
    • Google Play
    • Spotify

    Latest Episodes:
    You Don't Have to Touch the Candle | The Preventioneers Diseases, Disasters, and the Discoveries That Changed Our World - With Author Barry Davis Nov 08, 2026
    Show notes

    You Don't Have to Touch the Candle

    On prevention, invisible harm, and the beep we stopped hearing

    Confession first: I recorded this conversation a while ago, and it waited in line far longer than it deserved. Too many conversations, one analog brain. It's a big part of why I mostly record on my own these days. Apologies to my guest, and thanks for the patience.

    This writing is inspired by my conversation with Barry Davis on An Analog Brain In A Digital Age — watch the episode. His book: The Preventioneers: Diseases, Disasters, and the Discoveries That Changed Our World. Inspiring stories of individuals who shaped prevention as a public good.

    I put my seat belt on without thinking about it. Door closes, hand reaches, click. Somewhere along the way it stopped being a decision and became part of the car, like the steering wheel.

    It wasn't always like that. For years the belt was there and almost nobody wore it. Then the car started beeping. Then came the fines. Then, slowly, the click moved from the law into the hand, and from the hand into a habit nobody notices anymore.

    That's the strange thing about prevention when it works. It disappears.

    Barry calls it a victim of its own success. Measles leaves the country, and the reason to vaccinate leaves with it. The thing that kept the danger away becomes the argument for letting our guard down.

    Nobody throws a party for the fire that didn't happen.

    But fire, at least, is visible. When Ben Franklin wrote that an ounce of prevention is worth a pound of cure, he wasn't talking about medicine. He was talking about fire. Smoke, flames, a street where houses used to stand. Nobody needs a statistic to believe in it.

    Car crashes are visible too. Doctors see them every day in the emergency room, and we see them in the news and in the streets.

    Floods are visible too. We watch the water rise, live, on every screen.

    Other harms are not as visible as these.

    A disease you've never seen becomes an abstraction, then a rumor, then something your neighbor isn't sure is real. A cyberattack makes no smoke. I've spent more than a decade around cybersecurity, and most of the damage there is invisible. Data walking out the door. Identities stolen and used somewhere far away. Companies compromised for months before anyone notices. We sweep it under the rug and wait for the big one, the event so dramatic it will finally change us. Barry isn't sure even that would work. People move on.

    And now AI, where the harm won't even look like harm. It will look like a decision. A mortgage denied for reasons nobody can explain. A diagnosis checked by a machine, or not. A video of someone saying something they never said. No smoke, no flood, nothing on the news. Just an outcome that seems perfectly normal, until you ask who decided, and nobody quite knows.

    The technology world has a name for getting ahead of this: security by design. It's a good idea with an old soul. It's prevention. Franklin would have recognized it in a second.

    It also carries the same curse. If it works, nothing happens. And nothing is very hard to defend in a room full of people who want to ship.

    That makes the job harder. Prevention has always started from what we can see. For these harms, it has to start from what we can imagine.

    That's a different muscle. It's the one we use for stories, not statistics. Science fiction has always done this kind of work, rehearsing disasters so we don't have to live them. Kim Stanley Robinson opens The Ministry for the Future with a heat wave that takes twenty million lives, because that's what it takes to get the world in his novel to move. Fiction can afford that kind of catastrophe to make its point.

    We can't.

    Maybe that's what the beep has been all along. Not a sensor. A story, repeated until we believe it without needing the crash.

    When we're kids, someone tells us not to touch the candle. We touch it anyway, just to be sure.

    We have always learned faster from the burn than from the warning. More and more of the burns are invisible.

    You don't have to touch the candle.

    — Marco Ciappelli

    marcociappelli.com
    _________________________
    About the host
    Marco Ciappelli is a branding advisor, journalist and writer, and the host of An Analog Brain In A Digital Age. He works one-on-one with professionals building their personal brand and advises companies on positioning and storytelling, in English and Italian. In 2015 he co-founded ITSPmagazine, where he covers technology, cybersecurity and society.

    Branding advisory & coaching: https://marcociappelli.com/book-consultation/
    Writing: https://marcociappelli.com/writing/
    Journalism, ITSPmagazine: https://www.itspmagazine.com/about-us
    For cybersecurity and technology companies, Studio C60: https://www.studioc60.com
    Website: https://marcociappelli.com
    LinkedIn: https://www.linkedin.com/in/marco-ciappelli/


    Insider Threat Detection: Why Employee Reporting Beats Tools | An On Location Conversation at ISC2 Security Congress with Collin Sampson, VP, Infrastructure and CISO Nov 05, 2026
    Show notes

    Your tools see an authorized user doing their job. That is the gap Collin Sampson, VP, Infrastructure and CISO at Expion Health, describes when he talks insider threat with Sean Martin at ISC2 Security Congress in Denver.

    Sampson opens with a case from his session: a system administrator logged into an HR system and wrote employees' personal information on paper. He says none of the company's technology would have caught it, and the company learned of it only when law enforcement made contact.

    Sean asks what else gets an organization's attention. Sampson says that in a lot of cases the best detection he has found is an employee reporting it, or a supervisor noticing a change in tone, attitude or personality. The security team then looks back at that person's access.

    The conversation moves to why tools stall, since the person is authorized, and to where AI might help filter log volume down to the unusual, with some false positives along the way.

    Sampson also covers why reporting a colleague goes against the grain, and a company where a manager wanted to hear everything first. That company had to launch new training saying anyone can report anything at any time to compliance and security. Sean closes by asking about AI agents as insiders.

    Sampson's account comes from cases and companies he has worked at. Listen for what you can change this quarter: where reports go, who sees them, and whether people feel safe making them.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=the-best-insider-detection-is-an-employee-who-can-report-safely


    Tabletop Exercises That Test Security Analysts, Not the Compliance Box | An On Location Conversation at ISC2 Security Congress with Aaron Bond and Ruben Perales III Nov 05, 2026
    Show notes

    Traditional incident response tabletops often check a compliance box without telling you much about the people who have to respond. What would it take to test the analysts and engineers themselves, and to do it more than once in a while?

    Sean Martin talks with Aaron Bond, Cybersecurity Senior Manager - Defensive Security at The Home Depot, and Ruben Perales III, Incident Commander at The Home Depot, at ISC2 Security Congress in Denver. They had both taken part in traditional tabletops and wanted an iterative exercise that runs more often.

    The conversation starts with the format. Bond says an analyst's decision has a consequence, good or bad, that reshapes the investigation, a goal he describes as making it somewhat like Dungeons & Dragons. Perales describes a session of about an hour with analysts, sometimes engineers, incident commanders and a game master, and an ending that is left open.

    They then cover how an AI-built narrative earned management buy-in, since Bond says it cuts days, weeks or months of scenario writing to about an hour. They also discuss what the exercise surfaces: interactions with other teams that were needed but never documented. Perales says, "I feel like in every organization there are gaps between documentation and operation."

    Bond explains how an in-house tool tracks timing, resolution and flags captured, which frees the game master to watch communication between teams. The episode closes with a look at a second session, a roundtable on how practitioners and leaders use AI in the security operations center, and Sean's point that it has to be done responsibly.

    For security leaders, this is a practical look at testing people and process, not paperwork.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=tabletops-test-the-analysts-who-respond-not-the-compliance-box


    Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson Nov 05, 2026
    Show notes

    Threat intelligence, red team results and purple team exercises can be rich and practical, yet hard to turn into strategy. The risk register often swallows what teams find. Sean Martin talks with two practitioners who built a way around that.

    Sarah Bryson, Senior SRC Advisor at Kudelski Security, and Desta Bailey, Cyber Threat Intelligence Analyst at Southwest Airlines, presented their session at ISC2 Security Congress. They worked together at Southwest Airlines, and Bryson has since moved to the advisory side.

    The conversation starts with a number. When Bryson's team overlaid threats, tactics and controls on anomalous event and incident data, she says, about half of the findings were control gaps that should have been in place for policy. From there, Bryson and Bailey describe the intel pipeline they built to feed the intelligence program into governance, risk and compliance (GRC).

    Bailey walks through how an executive's headline question gets answered: pull the intelligence, map it to NIST Cybersecurity Framework (CSF) 2.0 outcomes and the company's control set, then pass it to GRC partners. Bryson explains what owning the control lifecycle allows, and what the finding meant for an incident response team she describes as among the most overworked in cyber.

    They also cover tying a patch request to a specific threat, documenting the process so it runs the same way whoever does it, and where audits fit alongside a threat-driven approach.

    For security leaders, the takeaway is practical: bring gaps to the risk committee before they become incidents, and get intelligence and GRC teams talking first.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=about-half-of-the-anomalous-incident-findings-were-policy-violations

    Resources

    The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20


    Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security Nov 05, 2026
    Show notes

    A security program built on enforcement and fear creates friction, and people stop paying attention. At ISC2 Security Congress in Denver, Joseph Carson, Chief Security Evangelist & Advisory CISO at Segura, tells Sean Martin what happened when his team at a large transportation car manufacturer admitted its approach was not working.

    Carson describes the team putting enforcements and policies in place, then realizing a couple of months in that the program rested on fear: you need to patch, reboot, update, take this course. Noise from the next conference room turned out to be a bring-your-kid-to-the-office day, and the team sat with the children for an hour, an hour and a half, asking what they would suggest.

    Two ideas came out of that room. One child asked about comic books, which meant less text and fewer translations. Another suggested bathroom doors, because everyone goes at least once a day. Each quarter the awareness training now carries a new four-panel message on not plugging in USBs, using multi-factor authentication and patching systems, posted on bathroom doors, in elevators and at the canteens.

    Carson calls it a redefining moment in his career. It changed how he views security: be an enabler and a promoter, so people see it as a good thing. That is why he prefers zero friction to zero trust, meaning security that just works and helps people meet the metrics they are measured on.

    The conversation also touches on career disruption, internal security evangelists and using AI with guardrails, and it matters for anyone whose awareness program is being ignored.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-security-program-built-on-fear-failed-until-children-redesigned-it-as-comics

    Resources

    Cybersecurity Courses on Udemy | https://www.udemy.com/topic/cyber-security/?p=28

    AI Act | Shaping Europe's digital future | https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

    The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20


    Women in Cybersecurity: Why the 50x50 Goal for 2050 Is Built Slowly | An On Location Conversation at ISC2 Security Congress with Dhriti P. Stocks Nov 05, 2026
    Show notes

    A goal set for 2050 sounds slow. Dhriti P. Stocks says that is the point: quick interventions in cybersecurity careers will not last.

    Dhriti P. Stocks, Executive Director at the Center for Cyber Safety and Education, joins Sean Martin at ISC2 Security Congress in Denver. She explains the Global 50x50 Initiative, which aims to put 50% women in cybersecurity by the year 2050, and why it was the first thing she was told when invited to join the mission.

    The conversation opens with Stocks's 20 years uplifting women and girls in STEM and her work with populations that have historically faced barriers. She then lays out why the plan covers a full career, from K to 12 to senior leaders, across eight action areas, and why the aim is women who can speak into decisions, lead and advance, not only enter the field. She warns about a leaky bucket, where burnout drives women out at a higher rate.

    Stocks and Sean also cover the Center's three focus areas: scholarships, Cybersecurity Health Check for small businesses and nonprofits, and 50x50. She describes how volunteers join, including an advisory council assembled roughly every four months around one action area, and shares the story of a scholarship recipient from Ghana who went on to a CISO role and the Center's board.

    Her closing asks are to invest, engage and advocate. For listeners who work in security, it is a practical look at how a long-term workforce goal gets built, and where their own time and expertise can help.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-2050-goal-for-women-in-cybersecurity-built-slowly-so-it-lasts

    Resources

    Cybersecurity Health Check | https://www.iamcybersafe.org/s/cyberhealthcheck

    Center for Cyber Safety and Education Launches Global 50x50 Initiative to Achieve Gender Parity in Cybersecurity by 2050 | https://www.isc2.org/Insights/2025/10/Gender-Parity-in-Cybersecurity

    Academic Scholarships - Center for Cyber Safety and Education | https://www.iamcybersafe.org/s/academic-scholarships


    Why Waiting for Q Day Fails: Quantum, AI and Getting Security Done Now | An On Location Conversation at ISC2 Security Congress with Jaya Baloo, COO & CISO Nov 05, 2026
    Show notes

    Everyone wants a date. If quantum computing is far enough away, the quantum work can wait, along with the backlog and the outdated asset inventory. Jaya Baloo says that comfort is the problem.

    Sean Martin talks with Jaya Baloo, COO & CISO at AISLE, after her afternoon keynote at ISC2 Security Congress in Denver. Baloo has worked on quantum for years, including the EU Quantum Flagship, which organizes the field into four pillars: computing, communication, simulation, and sensing and metrology.

    The conversation turns to her keynote message: stop fixating on numbers and artificial boundaries, and do not say you have until 2029. Baloo says AI is an accelerant to a potential break of RSA, which is why she urges people to keep marching forward, potentially at a faster clip. Sean raises the usual excuses, a backlog of old systems and a configuration management database that is not current. Baloo's reply is that ignoring them will not bring the database up to date.

    They also cover why teams put the urgent ahead of the important, and whether not understanding AI or quantum excuses inaction. Baloo says it does not, and offers starting points: security protections on open-weight models, knowing what a frontier large language model is authorized to do, hunting shadow AI usage, an AI asset register, and visibility into third-party suppliers already using AI. She also says waiting for governments will be too little, too late, and closes on observability for AI systems.

    For security leaders, the takeaway is a place to start now rather than a year to wait for.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=waiting-for-q-day-is-the-wrong-plan-and-ai-removes-the-date

    Resources

    ISO/IEC 42001:2023 - AI management systems | https://www.iso.org/standard/42001

    Quantum Flagship (EU) | https://qt.eu/


    Certified to Learn AI but Blocked from Using It: The Access Gap in Security | An On Location Conversation at ISC2 Security Congress with Casey Marks, Chief Operating Officer Nov 05, 2026
    Show notes

    Employers send people to conferences and through certification exams, then limit what they can do with the result. With AI, that can mean staff may use it for certain tasks but are not allowed to code, build agents or connect systems.

    Sean Martin raises that gap with Casey Marks, Chief Operating Officer at ISC2, at ISC2 Security Congress in Denver. Marks says there is a superficiality in learning something you cannot apply, and calls it a fundamental question for the individual and the environment they work in.

    The conversation moves to why certification exists. Marks describes it as scalable opportunity for people who cannot spend 20 years in formal education, and says most ISC2 certifications require work experience, with the Certified in Cybersecurity (CC) as the exception.

    Sean describes having access to tools and a supportive company earlier in his career, and wonders about people without that access now. Marks says he wishes he had better answers and that "I think that opportunity is gate kept," a matter of genuine concern and of economics. Sean adds that tokens cost money too. Marks offers a conjecture: given the risks, environments will have to move toward permissive ones, and those that do not "probably won't be around."

    They close on the AI security certification ISC2 announced that day. Marks describes it as AI first, not AI added to the CISSP domains, and says the beta test is expected for candidates globally in December. His participation figures are his own.

    For security leaders, the conversation asks whether the people you train can practice what they learn.

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=certified-to-learn-ai-not-allowed-to-use-it-the-access-gap

    Resources

    ISC2 Releases AI Security Certification Pilot Exam Outline | https://www.isc2.org/Insights/2026/10/isc2-releases-ai-security-certification-pilot-exam-outline

    Code of Professional Conduct in Practice (ISC2 Express Course) | https://www.isc2.org/Insights/2026/08/new-isc2-express-course

    Certified in Cybersecurity Certification Exam Outline | https://www.isc2.org/certifications/cc/cc-certification-exam-outline


    Assail Puts Its Own AI Model on Customer Hardware, Keeping Vulnerability Data Local | A Brand Story Conversation with Alissa Knight, CEO & Chief AI Officer at Assail | Hosted by Sean Martin Nov 04, 2026
    Show notes

    Alissa Knight, CEO & Chief AI Officer at Assail, says federal, military and large enterprise buyers raise two worries about running offensive cyber operations in the cloud: the cost of tokens and where vulnerability data ends up. Assail does not sell to small and midsize businesses.

    Knight says Assail is the only adversarial exposure validation platform that gives the customer the entire application stack, including the AI model. She says it is a small language model, about 60 gigabytes with 31 billion parameters, that can run on hardware such as the RTX 6000 Pro, and that it now runs on both x86 and ARM. She also says competing wrappers around frontier models can report clean results when the real cause is a high rejection rate behind the scenes. These are her claims.

    Sean asked for scenarios where the model needs to sit on premises. Knight says running disconnected has let Assail serve federal and military users in contested areas, and gives customers AI sovereignty and data sovereignty. Sean also asked what comes out the other side: she describes an interactive report in plain English with exploit evidence, a video of the attack, and patches.

    The conversation matters for any team weighing offensive security tools: ask where the model runs, where findings go, and what a clean report actually means.

    This is a Brand Highlight. A Brand Highlight is a ~5 minute introductory conversation designed to put a spotlight on the guest and their company. Learn more: https://www.studioc60.com/creation#highlight

    GUEST

    Alissa Knight, CEO & Chief AI Officer at Assail
    On LinkedIn: https://www.linkedin.com/in/alissaknight/

    More from Assail on ITSPmagazine: https://www.itspmagazine.com/blog?brand=assail

    RESOURCES

    Learn more about Assail: https://www.assailai.com/

    Learn more about Assail Federal: https://assailfederal.com

    ▶︎ Want your brand on ITSPmagazine? Explore all of the options here: https://www.itspmagazine.com/advertise

    KEYWORDS

    Alissa Knight, Assail, Sean Martin, brand story, brand marketing, marketing podcast, brand highlight, Recorded On Location at ISC2 Security Congress, adversarial exposure validation, autonomous offensive security, small language model, on-premises AI, AI sovereignty, data sovereignty, disconnected environments, federal and military cybersecurity, offensive cyber operations

    Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=assail-ships-its-own-ai-model-to-customers-keeping-vulnerability-data-out-of-the-cloud


    How to Talk About AI Risk Without Scaring People | An On Location Conversation at ISC2 Security Congress with Dr. Jessica Barker, MBE and FC Nov 03, 2026
    Show notes

    ⬥EPISODE NOTES⬥

    Telling people how frightening the threat is does not make them safer. Dr. Jessica Barker, MBE says that when people are scared, they either feel they cannot use the technology or decide the threat is being overblown. Both outcomes are bad.

    Sean Martin talks with Dr. Jessica Barker, MBE and FC, her co-founder at Cygenta, live at ISC2 Security Congress in Denver, about how to communicate AI risk without frightening people away from it.

    Jessica tells of a man who, after being told about cybersecurity, was so scared that he basically did not use the internet. He went to buy his son a Christmas gift from a shop in person in London and refused to buy it online. She says it summed it all up for her. FC says that when he and Jessica first met, he was very much trying to scare people. She pointed out that fear works only in the short term, and he says he instantly changed how he presented threats.

    On AI, Jessica says you cannot talk about it without talking about the threat, and that it is important to honor the fact that it is real. Their focus is on empowering people through stories. The conversation also covers what happens when organizations ban AI, why people can use AI with no malicious intent and still end up with malicious results, and why fundamentals like patching still matter. FC compares AI to cars, which he says everyone once called the most dangerous thing ever, and says the net benefit of AI to the world is positive.

    For security leaders, the point is practical: the way a risk is told shapes whether people use technology well, avoid it entirely, or work around the rules.

    ⬥HOST⬥

    Sean Martin, Co-Founder and CTO at ITSPmagazine

    ⬥GUESTS⬥

    Dr. Jessica Barker, MBE, Co-Founder and co-CEO at Cygenta

    FC, Co-CEO and Co-Founder, Head of Ethical Hacking at Cygenta

    ⬥RESOURCES⬥

    ISC2 Security Congress coverage: https://www.itspmagazine.com/blog?p=isc2-security-congress-2026-on-location

    Malicious AI Assistant Extensions Harvest LLM Chat Histories: https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/

    Cygenta: https://www.cygenta.co.uk

    ISC2 Security Congress: https://www.isc2.org/Congress

    The Future of Cybersecurity Newsletter: https://www.linkedin.com/newsletters/7108625890296614912/

    On Location: https://www.itspmagazine.com/on-location

    ⬥KEYWORDS⬥

    sean martin, dr. jessica barker, fc, freakyclown, cygenta, isc2 security congress, ai risk communication, security awareness, security culture, empowerment through stories, ai browser extensions, patching, ethical hacking, on location, itspmagazine

    For all of the content in this series, have a look at the main series post, Sean Martin is Live from ISC2 Security Congress 2026: https://www.itspmagazine.com/blog?p=isc2-security-congress-2026-on-location


    1 2 3 203 Next

    Related Podcasts

    Reply All

    1

    Reply All Games & Hobbies
    Inside VR & AR

    2

    Inside VR & AR Gadgets
    Note to Self

    3

    Note to Self News
    BrainStuff

    4

    BrainStuff Natural Sciences
    This Week in Tech (Audio)

    5

    This Week in Tech (Audio) News
    Hands-On Tech (Audio)

    6

    Hands-On Tech (Audio) Technology
    footer-logo

    Contact Us

    Toll Free: 844-670-7747

    Links

    • Home
    • Top Charts
    • Networks
    • Apps
    • Independents Podcasts
    • Podcast Advertising
    • Podcast News
    • Contact Us
    • About Us
    • Analytics & Insights

    Stay Connected

      Privacy, Terms of Use & Our Code of Ethics Protecting Content Creators Copyrights