CISO Stories Podcast (Audio)

SC Media

SC Media is proud to present this month's CISO Stories program, where CISOs share tales from the trenches and unpack leadership lessons learned along the way. Hosted by Jessica Hoffman.

  1. Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data - Jadee Hanson - CSP #221

    FEB 9

    Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data - Jadee Hanson - CSP #221

    CISO Jadee Hanson shares how Vanta "drinks its own champagne," running on NIST CSF with quarterly baseline reviews and using Vanta's GRC platform to turn every release into live UAT for privacy, governance, and compliance. We rethink third-party management—why point-in-time risk scores are fading and how AI drives continuous monitoring and outcome-based assurance. Bottom line: don't just audit—instrument your controls and prove trust in real time. Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-221

    27 min
  2. Keys Without People — John Heasman on Cleaning Up Non-Human Access - John Heasman - CSP #220

    JAN 12

    Keys Without People — John Heasman on Cleaning Up Non-Human Access - John Heasman - CSP #220

    Title: Keys Without People" — John Heasman on Cleaning Up Non-Human Access Summary: John breaks today's non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what's truly critical, assign a clear owner, keep access minimal, and review it on a schedule. With AI spawning even more "non-human users," basics done well—prioritize, tighten, rotate, repeat—win the day. This segment is sponsored by Saviynt. Visit https://cisostoriespodcast.com/saviynt to learn more about them! Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-220

    26 min
  3. Agents at the Door: Vetting Non-Human Identities in External IAM - Rakesh Soni - CSP #219

    12/08/2025

    Agents at the Door: Vetting Non-Human Identities in External IAM - Rakesh Soni - CSP #219

    This episode was about agentic IAM—what it is and the risks that come with letting non-human agents act for customers. We defined external IAM, then traced how the industry moved from basic login and MFA to consent, delegation, and now agent-to-agent interactions. Along the way we unpacked key risks for CISOs and practitioners to consider. Segment Resources: https://www.loginradius.com/ https://customeriambook.com/ Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-219

    29 min
  4. ATT&CK → ATLAS: A CISO's Blueprint for AI Governance - Sandy Dunn - CSP #218

    11/10/2025

    ATT&CK → ATLAS: A CISO's Blueprint for AI Governance - Sandy Dunn - CSP #218

    CISO Sandy Dunn breaks down her blueprint for AI-ready defense—pairing MITRE ATT&CK v18 with MITRE ATLAS to move from policy to behavior-based detections. We hit practical AI governance, her early focus on defending and understanding AI, and how OWASP GenAI tools turn checklists into action. Segment Resources: Article: https://www.linkedin.com/pulse/attck-v18-atlas-blueprint-ai-ready-defense-sandy-dunn-mafoc  AI Cheat Sheet:  https://www.linkedin.com/feed/update/urn:li:activity:7388688396166238208/ OWASP LLM Governance Checklist: https://genai.owasp.org/resource/llm-applications-cybersecurity-and-governance-checklist-english/ OWASP Threat Defense COMPASS: https://genai.owasp.org/resource/owasp-genai-security-project-threat-defense-compass-1-0/ Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-218

    28 min
  5. Security Awareness Through Trust and Influence - Jennifer Selby Long - CSP #217

    10/13/2025

    Security Awareness Through Trust and Influence - Jennifer Selby Long - CSP #217

    Jennifer Selby Long reframes security awareness as more than training—it's about earning trust and influence with executives and security teams. She shares leadership lessons on how to build stronger alignment and support for security initiatives. Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-217

    36 min
  6. OT on the Frontlines: Threat Intelligence You Can't Ignore - Dawn Cappelli - CSP #216

    09/08/2025

    OT on the Frontlines: Threat Intelligence You Can't Ignore - Dawn Cappelli - CSP #216

    Dawn Capelli, Head of OT-CERT at Dragos, unpacks the evolving risks to Operational Technology. From nation-state attacks on Ukraine's infrastructure to hacktivists targeting U.S. water systems, she explains the PIPEDREAM malware, the top five SANS critical OT controls, and how Dragos' OT-CERT program offers free resources to help organizations defend critical infrastructure now. Segment Resources: https://www.dragos.com/community/ This segment is sponsored by NowSecure. Visit https://cisostoriespodcast.com/nowsecure to learn more about them! Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-216

    33 min
  7. Reimagining Security Operations: SOC as a Service and the Role of AI - Kevin Nikkhoo - CSP #215

    08/11/2025

    Reimagining Security Operations: SOC as a Service and the Role of AI - Kevin Nikkhoo - CSP #215

    Kevin Nikkhoo joins the show to explore Security Operations Center as a Service (SOCaaS) and how it compares to traditional SOC models. He breaks down which organizations benefit most from this approach and how AI is reshaping modern SOC operations. Listeners will gain a clear understanding of how SOCaaS can enhance detection and response capabilities—and why embracing AI is key to the future of security operations. Segment Resources: https://www.xenexsoc.com/ https://www.xenexsoc.com/blog https://www.xenexsoc.com/ebooks This segment is sponsored by Tines. Tines' AI-enabled, secure workflow platform empowers your whole team regardless of their coding abilities, environment complexities, or tech stack. Learn more at https://cisostoriespodcast.com/tines Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-215

    28 min
  8. From Diagram to Cloud: Rethinking Cloud Security in an Age of Uncertainty - Yogita Parulekar - CSP #214

    07/14/2025

    From Diagram to Cloud: Rethinking Cloud Security in an Age of Uncertainty - Yogita Parulekar - CSP #214

    From Diagram to Cloud: Rethinking Cloud Security in an Age of Uncertainty Episode Summary: In this month's episode of CISO Stories, we dive deep into cloud security with cybersecurity veteran and cloud innovator Yogi Parulekar, founder of InviGrid. Against a backdrop of rising geopolitical tensions and tightening budgets, we explore how organizations can move from reactive security to proactive resilience. Yogi introduces the concept of "diagram to cloud" as a smarter, more efficient alternative to traditional "shift left" approaches, emphasizing secure-by-design principles powered by automation. We also unpack how governance, agility, and cost efficiency play a critical role in cloud strategy—especially when business survival is on the line. Visit https://cisostoriespodcast.com for all the latest episodes! Show Notes: https://cisostoriespodcast.com/csp-214

    35 min
See All (222)

4.7
out of 5
13 Ratings

About

SC Media is proud to present this month's CISO Stories program, where CISOs share tales from the trenches and unpack leadership lessons learned along the way. Hosted by Jessica Hoffman.

Information