The ITSPmagazine Podcast

ITSPmagazine Podcasts
ITSPmagazine Podcasts

Founded in 2015, ITSPmagazine began as a vision for a publication positioned at the critical intersection of technology, cybersecurity, and society. What started as a written publication has evolved into a comprehensive repository for all their content—podcasts, articles, event coverage, interviews, videos, panels, and everything they create. This is where Sean Martin and Marco Ciappelli talk about cybersecurity, technology, society, music, storytelling, branding, conference coverage, and whatever else catches their attention. Over a decade of conversations exploring how these worlds collide, influence each other, and shape the human experience. This is where you'll find it all.

  1. 3h ago

    You Don't Have to Touch the Candle | The Preventioneers Diseases, Disasters, and the Discoveries That Changed Our World - With Author Barry Davis

    You Don't Have to Touch the Candle On prevention, invisible harm, and the beep we stopped hearing Confession first: I recorded this conversation a while ago, and it waited in line far longer than it deserved. Too many conversations, one analog brain. It's a big part of why I mostly record on my own these days. Apologies to my guest, and thanks for the patience. This writing is inspired by my conversation with Barry Davis on An Analog Brain In A Digital Age — watch the episode. His book: The Preventioneers: Diseases, Disasters, and the Discoveries That Changed Our World. Inspiring stories of individuals who shaped prevention as a public good. I put my seat belt on without thinking about it. Door closes, hand reaches, click. Somewhere along the way it stopped being a decision and became part of the car, like the steering wheel. It wasn't always like that. For years the belt was there and almost nobody wore it. Then the car started beeping. Then came the fines. Then, slowly, the click moved from the law into the hand, and from the hand into a habit nobody notices anymore. That's the strange thing about prevention when it works. It disappears. Barry calls it a victim of its own success. Measles leaves the country, and the reason to vaccinate leaves with it. The thing that kept the danger away becomes the argument for letting our guard down. Nobody throws a party for the fire that didn't happen. But fire, at least, is visible. When Ben Franklin wrote that an ounce of prevention is worth a pound of cure, he wasn't talking about medicine. He was talking about fire. Smoke, flames, a street where houses used to stand. Nobody needs a statistic to believe in it. Car crashes are visible too. Doctors see them every day in the emergency room, and we see them in the news and in the streets. Floods are visible too. We watch the water rise, live, on every screen. Other harms are not as visible as these. A disease you've never seen becomes an abstraction, then a rumor, then something your neighbor isn't sure is real. A cyberattack makes no smoke. I've spent more than a decade around cybersecurity, and most of the damage there is invisible. Data walking out the door. Identities stolen and used somewhere far away. Companies compromised for months before anyone notices. We sweep it under the rug and wait for the big one, the event so dramatic it will finally change us. Barry isn't sure even that would work. People move on. And now AI, where the harm won't even look like harm. It will look like a decision. A mortgage denied for reasons nobody can explain. A diagnosis checked by a machine, or not. A video of someone saying something they never said. No smoke, no flood, nothing on the news. Just an outcome that seems perfectly normal, until you ask who decided, and nobody quite knows. The technology world has a name for getting ahead of this: security by design. It's a good idea with an old soul. It's prevention. Franklin would have recognized it in a second. It also carries the same curse. If it works, nothing happens. And nothing is very hard to defend in a room full of people who want to ship. That makes the job harder. Prevention has always started from what we can see. For these harms, it has to start from what we can imagine. That's a different muscle. It's the one we use for stories, not statistics. Science fiction has always done this kind of work, rehearsing disasters so we don't have to live them. Kim Stanley Robinson opens The Ministry for the Future with a heat wave that takes twenty million lives, because that's what it takes to get the world in his novel to move. Fiction can afford that kind of catastrophe to make its point. We can't. Maybe that's what the beep has been all along. Not a sensor. A story, repeated until we believe it without needing the crash. When we're kids, someone tells us not to touch the candle. We touch it anyway, just to be sure. We have always learned faster from the burn than from the warning. More and more of the burns are invisible. You don't have to touch the candle. — Marco Ciappelli marcociappelli.com_________________________About the hostMarco Ciappelli is a branding advisor, journalist and writer, and the host of An Analog Brain In A Digital Age. He works one-on-one with professionals building their personal brand and advises companies on positioning and storytelling, in English and Italian. In 2015 he co-founded ITSPmagazine, where he covers technology, cybersecurity and society. Branding advisory & coaching: https://marcociappelli.com/book-consultation/Writing: https://marcociappelli.com/writing/Journalism, ITSPmagazine: https://www.itspmagazine.com/about-usFor cybersecurity and technology companies, Studio C60: https://www.studioc60.comWebsite: https://marcociappelli.comLinkedIn: https://www.linkedin.com/in/marco-ciappelli/

    You Don't Have to Touch the Candle | The Preventioneers Diseases, Disasters, and the Discoveries That Changed Our World - With Author Barry Davis

  2. 3d ago

    Insider Threat Detection: Why Employee Reporting Beats Tools | An On Location Conversation at ISC2 Security Congress with Collin Sampson, VP, Infrastructure and CISO

    Your tools see an authorized user doing their job. That is the gap Collin Sampson, VP, Infrastructure and CISO at Expion Health, describes when he talks insider threat with Sean Martin at ISC2 Security Congress in Denver. Sampson opens with a case from his session: a system administrator logged into an HR system and wrote employees' personal information on paper. He says none of the company's technology would have caught it, and the company learned of it only when law enforcement made contact. Sean asks what else gets an organization's attention. Sampson says that in a lot of cases the best detection he has found is an employee reporting it, or a supervisor noticing a change in tone, attitude or personality. The security team then looks back at that person's access. The conversation moves to why tools stall, since the person is authorized, and to where AI might help filter log volume down to the unusual, with some false positives along the way. Sampson also covers why reporting a colleague goes against the grain, and a company where a manager wanted to hear everything first. That company had to launch new training saying anyone can report anything at any time to compliance and security. Sean closes by asking about AI agents as insiders. Sampson's account comes from cases and companies he has worked at. Listen for what you can change this quarter: where reports go, who sees them, and whether people feel safe making them. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=the-best-insider-detection-is-an-employee-who-can-report-safely

    Insider Threat Detection: Why Employee Reporting Beats Tools | An On Location Conversation at ISC2 Security Congress with Collin Sampson, VP, Infrastructure and CISO

  3. 3d ago

    Tabletop Exercises That Test Security Analysts, Not the Compliance Box | An On Location Conversation at ISC2 Security Congress with Aaron Bond and Ruben Perales III

    Traditional incident response tabletops often check a compliance box without telling you much about the people who have to respond. What would it take to test the analysts and engineers themselves, and to do it more than once in a while? Sean Martin talks with Aaron Bond, Cybersecurity Senior Manager - Defensive Security at The Home Depot, and Ruben Perales III, Incident Commander at The Home Depot, at ISC2 Security Congress in Denver. They had both taken part in traditional tabletops and wanted an iterative exercise that runs more often. The conversation starts with the format. Bond says an analyst's decision has a consequence, good or bad, that reshapes the investigation, a goal he describes as making it somewhat like Dungeons & Dragons. Perales describes a session of about an hour with analysts, sometimes engineers, incident commanders and a game master, and an ending that is left open. They then cover how an AI-built narrative earned management buy-in, since Bond says it cuts days, weeks or months of scenario writing to about an hour. They also discuss what the exercise surfaces: interactions with other teams that were needed but never documented. Perales says, "I feel like in every organization there are gaps between documentation and operation." Bond explains how an in-house tool tracks timing, resolution and flags captured, which frees the game master to watch communication between teams. The episode closes with a look at a second session, a roundtable on how practitioners and leaders use AI in the security operations center, and Sean's point that it has to be done responsibly. For security leaders, this is a practical look at testing people and process, not paperwork. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=tabletops-test-the-analysts-who-respond-not-the-compliance-box

    Tabletop Exercises That Test Security Analysts, Not the Compliance Box | An On Location Conversation at ISC2 Security Congress with Aaron Bond and Ruben Perales III

  4. 3d ago

    Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson

    Threat intelligence, red team results and purple team exercises can be rich and practical, yet hard to turn into strategy. The risk register often swallows what teams find. Sean Martin talks with two practitioners who built a way around that. Sarah Bryson, Senior SRC Advisor at Kudelski Security, and Desta Bailey, Cyber Threat Intelligence Analyst at Southwest Airlines, presented their session at ISC2 Security Congress. They worked together at Southwest Airlines, and Bryson has since moved to the advisory side. The conversation starts with a number. When Bryson's team overlaid threats, tactics and controls on anomalous event and incident data, she says, about half of the findings were control gaps that should have been in place for policy. From there, Bryson and Bailey describe the intel pipeline they built to feed the intelligence program into governance, risk and compliance (GRC). Bailey walks through how an executive's headline question gets answered: pull the intelligence, map it to NIST Cybersecurity Framework (CSF) 2.0 outcomes and the company's control set, then pass it to GRC partners. Bryson explains what owning the control lifecycle allows, and what the finding meant for an incident response team she describes as among the most overworked in cyber. They also cover tying a patch request to a specific threat, documenting the process so it runs the same way whoever does it, and where audits fit alongside a threat-driven approach. For security leaders, the takeaway is practical: bring gaps to the risk committee before they become incidents, and get intelligence and GRC teams talking first. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=about-half-of-the-anomalous-incident-findings-were-policy-violations ResourcesThe NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20

    Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson

  5. 3d ago

    Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security

    A security program built on enforcement and fear creates friction, and people stop paying attention. At ISC2 Security Congress in Denver, Joseph Carson, Chief Security Evangelist & Advisory CISO at Segura, tells Sean Martin what happened when his team at a large transportation car manufacturer admitted its approach was not working. Carson describes the team putting enforcements and policies in place, then realizing a couple of months in that the program rested on fear: you need to patch, reboot, update, take this course. Noise from the next conference room turned out to be a bring-your-kid-to-the-office day, and the team sat with the children for an hour, an hour and a half, asking what they would suggest. Two ideas came out of that room. One child asked about comic books, which meant less text and fewer translations. Another suggested bathroom doors, because everyone goes at least once a day. Each quarter the awareness training now carries a new four-panel message on not plugging in USBs, using multi-factor authentication and patching systems, posted on bathroom doors, in elevators and at the canteens. Carson calls it a redefining moment in his career. It changed how he views security: be an enabler and a promoter, so people see it as a good thing. That is why he prefers zero friction to zero trust, meaning security that just works and helps people meet the metrics they are measured on. The conversation also touches on career disruption, internal security evangelists and using AI with guardrails, and it matters for anyone whose awareness program is being ignored. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-security-program-built-on-fear-failed-until-children-redesigned-it-as-comics ResourcesCybersecurity Courses on Udemy | https://www.udemy.com/topic/cyber-security/?p=28 AI Act | Shaping Europe's digital future | https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20

    Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security

  6. 3d ago

    Women in Cybersecurity: Why the 50x50 Goal for 2050 Is Built Slowly | An On Location Conversation at ISC2 Security Congress with Dhriti P. Stocks

    A goal set for 2050 sounds slow. Dhriti P. Stocks says that is the point: quick interventions in cybersecurity careers will not last. Dhriti P. Stocks, Executive Director at the Center for Cyber Safety and Education, joins Sean Martin at ISC2 Security Congress in Denver. She explains the Global 50x50 Initiative, which aims to put 50% women in cybersecurity by the year 2050, and why it was the first thing she was told when invited to join the mission. The conversation opens with Stocks's 20 years uplifting women and girls in STEM and her work with populations that have historically faced barriers. She then lays out why the plan covers a full career, from K to 12 to senior leaders, across eight action areas, and why the aim is women who can speak into decisions, lead and advance, not only enter the field. She warns about a leaky bucket, where burnout drives women out at a higher rate. Stocks and Sean also cover the Center's three focus areas: scholarships, Cybersecurity Health Check for small businesses and nonprofits, and 50x50. She describes how volunteers join, including an advisory council assembled roughly every four months around one action area, and shares the story of a scholarship recipient from Ghana who went on to a CISO role and the Center's board. Her closing asks are to invest, engage and advocate. For listeners who work in security, it is a practical look at how a long-term workforce goal gets built, and where their own time and expertise can help. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-2050-goal-for-women-in-cybersecurity-built-slowly-so-it-lasts ResourcesCybersecurity Health Check | https://www.iamcybersafe.org/s/cyberhealthcheck Center for Cyber Safety and Education Launches Global 50x50 Initiative to Achieve Gender Parity in Cybersecurity by 2050 | https://www.isc2.org/Insights/2025/10/Gender-Parity-in-Cybersecurity Academic Scholarships - Center for Cyber Safety and Education | https://www.iamcybersafe.org/s/academic-scholarships

    Women in Cybersecurity: Why the 50x50 Goal for 2050 Is Built Slowly | An On Location Conversation at ISC2 Security Congress with Dhriti P. Stocks

  7. 3d ago

    Why Waiting for Q Day Fails: Quantum, AI and Getting Security Done Now | An On Location Conversation at ISC2 Security Congress with Jaya Baloo, COO & CISO

    Everyone wants a date. If quantum computing is far enough away, the quantum work can wait, along with the backlog and the outdated asset inventory. Jaya Baloo says that comfort is the problem. Sean Martin talks with Jaya Baloo, COO & CISO at AISLE, after her afternoon keynote at ISC2 Security Congress in Denver. Baloo has worked on quantum for years, including the EU Quantum Flagship, which organizes the field into four pillars: computing, communication, simulation, and sensing and metrology. The conversation turns to her keynote message: stop fixating on numbers and artificial boundaries, and do not say you have until 2029. Baloo says AI is an accelerant to a potential break of RSA, which is why she urges people to keep marching forward, potentially at a faster clip. Sean raises the usual excuses, a backlog of old systems and a configuration management database that is not current. Baloo's reply is that ignoring them will not bring the database up to date. They also cover why teams put the urgent ahead of the important, and whether not understanding AI or quantum excuses inaction. Baloo says it does not, and offers starting points: security protections on open-weight models, knowing what a frontier large language model is authorized to do, hunting shadow AI usage, an AI asset register, and visibility into third-party suppliers already using AI. She also says waiting for governments will be too little, too late, and closes on observability for AI systems. For security leaders, the takeaway is a place to start now rather than a year to wait for. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=waiting-for-q-day-is-the-wrong-plan-and-ai-removes-the-date ResourcesISO/IEC 42001:2023 - AI management systems | https://www.iso.org/standard/42001 Quantum Flagship (EU) | https://qt.eu/

    Why Waiting for Q Day Fails: Quantum, AI and Getting Security Done Now | An On Location Conversation at ISC2 Security Congress with Jaya Baloo, COO & CISO

  8. 3d ago

    Certified to Learn AI but Blocked from Using It: The Access Gap in Security | An On Location Conversation at ISC2 Security Congress with Casey Marks, Chief Operating Officer

    Employers send people to conferences and through certification exams, then limit what they can do with the result. With AI, that can mean staff may use it for certain tasks but are not allowed to code, build agents or connect systems. Sean Martin raises that gap with Casey Marks, Chief Operating Officer at ISC2, at ISC2 Security Congress in Denver. Marks says there is a superficiality in learning something you cannot apply, and calls it a fundamental question for the individual and the environment they work in. The conversation moves to why certification exists. Marks describes it as scalable opportunity for people who cannot spend 20 years in formal education, and says most ISC2 certifications require work experience, with the Certified in Cybersecurity (CC) as the exception. Sean describes having access to tools and a supportive company earlier in his career, and wonders about people without that access now. Marks says he wishes he had better answers and that "I think that opportunity is gate kept," a matter of genuine concern and of economics. Sean adds that tokens cost money too. Marks offers a conjecture: given the risks, environments will have to move toward permissive ones, and those that do not "probably won't be around." They close on the AI security certification ISC2 announced that day. Marks describes it as AI first, not AI added to the CISSP domains, and says the beta test is expected for candidates globally in December. His participation figures are his own. For security leaders, the conversation asks whether the people you train can practice what they learn. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=certified-to-learn-ai-not-allowed-to-use-it-the-access-gap ResourcesISC2 Releases AI Security Certification Pilot Exam Outline | https://www.isc2.org/Insights/2026/10/isc2-releases-ai-security-certification-pilot-exam-outline Code of Professional Conduct in Practice (ISC2 Express Course) | https://www.isc2.org/Insights/2026/08/new-isc2-express-course Certified in Cybersecurity Certification Exam Outline | https://www.isc2.org/certifications/cc/cc-certification-exam-outline

    Certified to Learn AI but Blocked from Using It: The Access Gap in Security | An On Location Conversation at ISC2 Security Congress with Casey Marks, Chief Operating Officer
See All (2K)

5
out of 5
30 Ratings

About

Founded in 2015, ITSPmagazine began as a vision for a publication positioned at the critical intersection of technology, cybersecurity, and society. What started as a written publication has evolved into a comprehensive repository for all their content—podcasts, articles, event coverage, interviews, videos, panels, and everything they create. This is where Sean Martin and Marco Ciappelli talk about cybersecurity, technology, society, music, storytelling, branding, conference coverage, and whatever else catches their attention. Over a decade of conversations exploring how these worlds collide, influence each other, and shape the human experience. This is where you'll find it all.

Information

  • Channel
    ITSPmagazine Podcasts
  • Creator
    ITSPmagazine, Sean Martin, Marco Ciappelli
  • Years Active
    2017 - 2026
  • Episodes
    2K
  • Rating
    Clean
  • Copyright
    © Copyright 2015-2026 ITSPmagazine, Inc. All Rights Reserved
  • Show Website
    The ITSPmagazine Podcast

More From ITSPmagazine Podcasts