Cybersecurity Where You Are (video)

Center for Internet Security
  • 5.0 (13)
  • Non-Profit
  • Updated Weekly

Welcome to video version of “Cybersecurity Where You Are,” the podcast of the Center for Internet Security® (CIS®). Cybersecurity affects us all, so join us on Wednesdays as Sean Atkinson, CISO at CIS; Tony Sager, SVP & Chief Evangelist at CIS; and Ed Skoudis, President of the SANS Technology Institute discuss trends and threats, explore security best practices, and interview experts in the industry. Together, we’ll clarify these issues, Creating Confidence in the Connected World®. Subscribe to the audio version of our podcast here: https://fast.wistia.net/embed/channel/wbyhaw35xf?wchannelid=wbyhaw35xf.

  1. 15h ago ·  Video

    Episode 201: The Evolution and AI Enablement of Pentesting

    In episode 201 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. Together, they reflect on the evolution of penetration testing, including the impact on pentesting from artificial intelligence (AI). Here are some highlights from our episode: 01:03. How things have changed since William's and Ed's first pentests09:02. Community: A defining element of Capture The Flag (CTF) events14:47. Industry concerns over the "death" of CTFs and "cheating" by artificial intelligence (AI)17:00. Opportunities to take CTFs to the next level in the age of AI20:18. Pentesting vs. vulnerability scanning: Why terminology matters25:43. The advent of autonomous AI tools and what they could mean for vulnerability scanning29:07. Why continuous improvement in cybersecurity doesn't always require AIResources Closed Door SecurityEpisode 189: The Present and Future of AI-enabled PentestingSANS Cyber RangesTop External Network Risks And How to Fix ThemPenetration TestingVulnerability AssessmentsIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 201: The Evolution and AI Enablement of Pentesting

  2. Aug 12 ·  Video

    Episode 200: Alan Paller's Vision and Our Next Chapter

    In episode 200 of Cybersecurity Where You Are, Sean Atkinson, Tony Sager, and Ed Skoudis sit down with Frank Reeder, Co-Founder and Founding Chair of the Center for Internet Security® (CIS®). Together, they reflect on how Alan Paller's vision continues to drive CIS forward. In the spirit of that vision, this milestone episode also marks a new chapter for the podcast: Ed Skoudis joins as co-host of Cybersecurity Where You Are. Here are some highlights from our episode: 01:09. The two complementary missions of CIS02:55. Three defining moments that have shaped CIS into the organization it is today08:10. The story of naming CIS10:31. How CIS and SANS advance Alan Paller's vision of bringing people together13:50. Personal anecdotes of Alan Paller as a connector of people15:45. "What would Alan do?" A question that continues to guide CIS and SANS22:00. How CIS security best practices are emblematic of helping others27:12. CIS's "secret sauce" as a trusted, neutral platform for cybersecurity collaboration29:53. How CIS can continue to embody Alan Paller's philosophy into the future37:47. A special announcement: Ed Skoudis as a new co-host on the podcastResources CIS Benchmarks® ListCIS Critical Security Controls®Multi-State Information Sharing and Analysis Center®Episode 114: 3 Board Chairs Reflect on 25 Years of CommunityAlan Paller Laureate ProgramSANS Difference Makers AwardsIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 200: Alan Paller's Vision and Our Next Chapter

  3. Aug 5 ·  Video

    Episode 199: Translating Cyber Risk into Business Decisions

    In episode 199 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Chris Painter, Chair of the Risk Committee and Board Member at the Center for Internet Security® (CIS®). Together, they discuss how chief information security officers (CISOs) can support the work of translating cyber risk into business decisions by Boards. Here are some highlights from our episode: 00:50. Introductions to Chris01:36. The single biggest translation error Chris has seen CISOs make07:38. Cyber risk quantification: An opportunity to go beyond translation for Boards09:25. How ransomware changed Boards' understanding of cyber risks' business impact10:45. The value of tabletop exercises (TTX) and other simulations in creating shared language13:26. Recommendations on how to make the most of a TTX18:37. Risk modeling and how artificial intelligence (AI) complicates probability estimations21:51. "Pressure" (2026) as an illustration of making good, not 100% accurate, estimations22:58. How growing public awareness of cyber is reshaping CISOs' conversations with Boards25:55. The importance of walking Boards through risk mitigation steps with AI as an example29:31. A recommendation for how CISOs can learn what directors care about30:15. From "wizardry" to familiarity: An ongoing generational shift around cyberResources Episode 183: The Role of CISO in Supporting Risk TranslationEpisode 187: The Role of a CISO as a Strategic StorytellerEpisode 192: How Leaders Balance Expertise and CommunicationHow Risk Quantification Tests Your Reasonable Cyber DefenseCIS RAM (Risk Assessment Method)Leveraging Generative Artificial Intelligence for Tabletop Exercise DevelopmentCIS Controls v8.1 Incident Response Policy TemplateYou Have a Cybersecurity Incident. Now What?Prompt Injections: The Inherent Threat to Generative AI"Pressure" | Official Website | 29 May 2026If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 199: Translating Cyber Risk into Business Decisions

  4. Jul 29 ·  Video

    Episode 198: AI Privacy from a Risk-Based Perspective

    In episode 198 of Cybersecurity Where You Are, Sean Atkinson discusses artificial intelligence (AI) and privacy from a risk-based cybersecurity perspective. Together, he explores how organizations and individuals can assess AI risk, apply governance frameworks, evaluate third-party AI services, and balance innovation with due diligence. Here are some highlights from our episode: 00:41. Framing the conversation around AI, privacy, and risk-based controls02:22. Due diligence and ethical considerations around AI products and services03:14. Data minimization and transparency as foundations for AI privacy04:46. Privacy impact assessments as a way to understand AI data collection and use05:42. AI governance and the tension between implementation velocity and risk management10:08. The use of existing data flows and controls in AI assessments11:57. Algorithmic transparency and the challenge of understanding AI decision making13:47. Standards, frameworks, and data sovereignty in AI privacy governance15:12. Encryption, anonymization, tokenization, and federated learning as privacy safeguards16:40. The need to shift stakeholder input left in AI development and deployment lifecycles19:13. Building literacy around security, data management, privacy, and AI risk23:40. The value of cross-functional and written assessment criteria for AI risk26:21. A call to action for keeping pace with AI privacy and and innovation riskResources CIS Controls v8.1.2 AI Security Guidance WorkbookEpisode 105: Context in Cyber Risk QuantificationService Provider Management Policy Template for CIS Control 15EU AI Act: first regulation on artificial intelligenceAI Risk Management FrameworkIAPP AI Governance CenterEpisode 120: How Contextual Awareness Drives AI GovernanceSecure by Design v1.1 A Guide to Assessing Software Security PracticesReasonable CybersecurityIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 198: AI Privacy from a Risk-Based Perspective

  5. Jul 22 ·  Video

    Episode 197: AI-ready OT Data Begins with Understanding

    In episode 197 of Cybersecurity Where You Are, Sean Atkinson sits down with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch; and Ed Skoudis, President of SANS Technology Institute. Together, they discuss artificial intelligence (AI), operational technology (OT) data, and how understanding creates the foundation for AI-ready OT data. Here are some highlights from our episode: 00:54. Introductions to Ben and Ed02:16. How we understand and integrate AI into OT environments04:30. How OT diverges from information technology (IT) in data responsibilities05:23. Opportunities for AI to assist OT06:33. The importance of meeting OT systems where they are08:10. A passive and incremental approach that respects the operations machines are doing12:29. Efficiency gains, public safety improvements, and other benefits of AI-ready OT data17:47. What lifecycle management, asset hierarchies, and governance look like for OT data22:14. The promise of AI to help to make OT environments understandable23:19. A team sport: How IT and OT can work together to understand assets and data28:38. The need for translation in IT-OT communication29:01. Recommendations for how to make OT data AI readyResources CIS Critical Security Controls®CIS Controls version 8.1 ICS WorkbookArtificial Intelligence and Large Language Models Companion GuideCIS Controls v8.1 Enterprise Asset Management Policy TemplateCIS Controls v8.1 Software Asset Management Policy TemplateCIS Controls v8.1 Data Management Policy TemplateCIS Controls v8.1 Account & Credential Management Policy TemplateEstablishing Essential Cyber HygieneProArchCybersecurity for Critical InfrastructureEpisode 77: Data's Value to Decision-Making in CybersecurityEpisode 183: The Role of CISO in Supporting Risk TranslationIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 197: AI-ready OT Data Begins with Understanding

  6. Jul 15 ·  Video

    Episode 196: Securing FIFA World Cup 2026 Collaboratively

    In episode 196 of Cybersecurity Where You Are, Sean Atkinson sits down with Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026, and John Cohen, Executive Director of the Office of Strategic Programs and Initiatives at the Center for Internet Security® (CIS®). Together, they discuss how CIS, FIFA, and FIFA World Cup 2026 host cities started collaborating in 2025 on cybersecurity, public safety, intelligence, and information-sharing efforts supporting the largest sporting event in the world. Here are some highlights from our episode: 00:40. Introductions to Sasha and John02:07. Overview of one of the most complex public safety efforts assembled for a sporting event05:52. Consistency: A standard for preventing and deterring threats at FIFA World Cup 202610:30. The impact of relationships in shaping FIFA's security ops and information sharing11:53. Effective communication: The key to cross-functional collaboration in support of the tournament18:07. The importance of information that guides operations20:35. Education as a way to inform stakeholders and deploy resources26:19. A deliberate effort to look at unanticipated threats and plan for them29:14. Examples of messaging synchronization in support of FIFA World Cup 202632:37. An all-hands-on-deck support campaign from CIS33:29. Parting thoughts around large-scale event support in the futureResources An Examination of Generative AI and Physical Threat PlanningAn Examination of AI-Enabled Threats to Event and Stadium SecurityMultidimensional Threats5 Major Emerging Risks to Large-Scale EventsIllicit Sports Betting and Match Integrity Risks to Large-Scale EventsDeepfakes and Synthetic Media: The Emerging Threat to Large-Scale Public GatheringsGrowing Risks to Digital Ticketing Platforms for Large-Scale EventsUnmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public GatheringsUnmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings Cyber Risks Companion Guide5 Steps to Help Secure Your City before a Large-Scale EventIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 196: Securing FIFA World Cup 2026 Collaboratively

  7. Jul 8 ·  Video

    Episode 195: Enigma Machines’ Security Lessons for Today

    In episode 195 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute, and Marcus Sachs, Senior Vice President and Chief Engineer at the Center for Internet Security® (CIS®). Together, they discuss Enigma machines, their history, and their security lessons for today. Here are some highlights from our episode: 00:56. Introductions to Ed and Marc01:32. What Enigma machines are and why cybersecurity folks still care about them today06:10. Enigma machines as a symbol for how we can use hacking for noble purposes07:18. How the human mind and the need for ease of use can undermine security15:59. The importance of testing when designing and maintaining a security system20:45. Why "security through obscurity" isn't actually true22:58. Curiosity, logic, and a wide range of knowledge: Essential traits for getting hired in cybersecurity today30:57. The impact of culture in shaping security policy and priorities35:09. Why artificial intelligence (AI) is the Enigma machine of 202636:11. How to learn more about Enigma machinesResources Episode 189: The Present and Future of AI-enabled PentestingA Short Guide for Spotting Phishing AttemptsPenetration TestingVulnerability AssessmentsEpisode 192: How Leaders Balance Expertise and CommunicationEpisode 193: AI Security and Responsibility in EO 14409The Myth of Mythos: What It Means For Information SecurityNational Cryptologic MuseumEnigma Replica: The Enigma touchIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 195: Enigma Machines’ Security Lessons for Today

  8. Jul 1 ·  Video

    Episode 194: 2026 Cybersecurity Predictions Mid-Year Review

    In episode 194 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager sit down with Ed Skoudis, President of SANS Technology Institute. Together, they conduct a mid-year review of 2026 cybersecurity predictions from seven Center for Internet Security® (CIS®) experts, as shared on the CIS website. Here are some highlights from our episode: 01:50. Ongoing conversations about improving defense with artificial intelligence (AI)05:19. A trap to avoid: Automating things with AI because we can regardless of utility06:54. Ed's prediction about a near-term transition for AI-enabled vulnerability discovery09:27. How AI agents change the economics around conducting a penetration test11:26. Adversary emulation: A blurry proposition when threat actors use AI to look like anybody14:02. Ed's prediction about threat actors shifting APT profiles within a single attack campaign17:00. The need to systematically rethink cyber defense to support state and local cybersecurity23:34. How adversaries are pivoting to the "authorization sprawl" in light of zero trust efforts29:20. Industry-specific threat intelligence as a way to keep organizations informed32:10. Why a policy isn't the same as security control for operational technology (OT)33:55. Social expectations and public policy objectives around holistic OT security39:52. Compliance as a floor, not a ceiling, that results as a byproduct of continuous security43:43. The need for oversight and confidence in technology as distinct from the "Fog of More"Resources Episode 169: 2026 Cybersecurity Predictions from CIS — Pt 1Episode 174: 2026 Cybersecurity Predictions from CIS — Pt 2Episode 179: 2026 Cybersecurity Predictions from CIS — Pt 3The Myth of Mythos: What It Means For Information SecurityEpisode 189: The Present and Future of AI-enabled PentestingAuthorization Sprawl: The Vulnerability Reshaping Modern AttacksEpisode 188: DBIR 2026 Insights and Collaboration with CISMapping and Compliance with the CIS ControlsMapping and Compliance with the CIS BenchmarksIf you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

    Episode 194: 2026 Cybersecurity Predictions Mid-Year Review
See All (201)

Ratings & Reviews

5
out of 5
13 Ratings

About

Welcome to video version of “Cybersecurity Where You Are,” the podcast of the Center for Internet Security® (CIS®). Cybersecurity affects us all, so join us on Wednesdays as Sean Atkinson, CISO at CIS; Tony Sager, SVP & Chief Evangelist at CIS; and Ed Skoudis, President of the SANS Technology Institute discuss trends and threats, explore security best practices, and interview experts in the industry. Together, we’ll clarify these issues, Creating Confidence in the Connected World®. Subscribe to the audio version of our podcast here: https://fast.wistia.net/embed/channel/wbyhaw35xf?wchannelid=wbyhaw35xf.

Information