CISO Stories Podcast (Video)

SC Media

SC Media and Horizon3.ai are proud to present this month's CISO Stories program, where CISOs share tales from the trenches and unpack leadership lessons learned along the way. Hosted by Jessica Hoffman.

  1. Aug 10 ·  Video

    Attack Surface Management - Matt Lea - CSP #227

    In this episode of CISO Stories, Jessica Hoffman sits down with Matt Lee to explore attack surface management, AWS security, and the cloud misconfigurations that can put organizations at risk. Matt shares lessons from his experience auditing cloud environments, including common AWS security gaps around identity and access management, exposed resources, security groups, and overly permissive access. The conversation also covers emerging challenges around AI agents, protecting production data, and balancing speed of innovation with security controls. From preventing cloud breaches to building stronger security practices, Matt breaks down what organizations should understand about reducing risk in today's evolving threat landscape. Segment Resources: https://schematical.com/techdebt https://www.oreilly.com/videos/zero-to-hero/0642572107789/ https://schematical.com/posts https://schematical.com/free https://schematical.com/speaking This segment is sponsored by Horizon3. Visit https://cisostoriespodcast.com/horizon3 to learn more about them! Show Notes: https://cisostoriespodcast.com/csp-227

    Attack Surface Management - Matt Lea - CSP #227

  2. Jul 13 ·  Video

    Cloud Security Meets AI: What CISOs Need to Govern Before They Scale - Brent Neal - CSP #226

    AI is changing cloud security fast, but the biggest challenge is not just adoption. It is governance. In this episode, Jess sits down with Brent Neil, CISO at RapidScale, to talk about what CISOs should be watching as AI becomes embedded in cloud environments, business workflows, and sensitive data systems. Brent shares practical insight on AI governance, identity and access, cloud security controls, and the risks that emerge when experimentation moves into production. The conversation explores how security leaders can support innovation without losing visibility, accountability, or trust. Brent also breaks down the questions CISOs should be asking before AI tools scale deeper into the enterprise. Because AI may be unavoidable, but unmanaged AI risk is optional. Segment Resources: RapidScale's IT Talent Gap Report: https://try.rapidscale.net/the-talent-gap/ This segment is sponsored by Arctic Wolf. Visit https://cisostoriespodcast.com/arcticwolf to learn more about them! Show Notes: https://cisostoriespodcast.com/csp-226

    Cloud Security Meets AI: What CISOs Need to Govern Before They Scale - Brent Neal - CSP #226

  3. Jun 8 ·  Video

    Critical Infrastructure: The Risk Hiding in Plain Sight - Jason Manar - CSP #225

    In this episode, former FBI cyber leader Jason Manar joins us to unpack the state of critical infrastructure security and why small and medium-sized businesses are more connected to it than they realize. From power, telecom, healthcare, finance, and supply chains, Jason explains how hidden dependencies can turn "not our problem" into a business-stopping event. With his FBI perspective and CISO experience, Jason shares what organizations should understand about risk, resilience, and protecting the systems we all quietly rely on. Show Notes: https://cisostoriespodcast.com/csp-225

    Critical Infrastructure: The Risk Hiding in Plain Sight - Jason Manar - CSP #225

  4. May 11 ·  Video

    IAM for MSSPs: The Hidden Risk of Blind Trust - Dustin Sachs - CSP #224

    Identity and access management is often sold as a technical problem, but real-world deployments tell a different story. For MSSPs managing access across multiple client environments, IAM becomes a test of trust, accountability, decision fatigue, and human behavior. In this episode of CISO Stories, we explore why access reviews become rubber stamps, why least privilege is harder than it sounds, and how cognitive bias can quietly shape security decisions. We also dig into the uncomfortable question: when organizations outsource IAM, are they outsourcing control — or just the labor? Because in the end, identity is not just about who gets access. It is about who owns the risk when access goes wrong. Show Notes: https://cisostoriespodcast.com/csp-224

    IAM for MSSPs: The Hidden Risk of Blind Trust - Dustin Sachs - CSP #224

  5. Apr 13 ·  Video

    From Compliance to Code: Rethinking Cloud Security - Richard Marcus - CSP #223

    Jess talks with Rich about what it takes to secure a cloud-first organization at scale. Rich explains how compliance as code helps teams build secure-by-default environments in AWS and Azure. He also shares why continuous monitoring gives organizations stronger visibility and a more reliable path to audit readiness. The episode closes with a look at how AI can help security teams work faster and focus on what matters most. Segment Resources: Optro Cyber Risk Playbook: https://optro.ai/resources/ebook/the-cyber-risk-playbook-for-the-ai-threat-era This segment is sponsored by BlinkOps. Blink Micro-Agents stop AI threats with agentic speed and precision — visit https://cisostoriespodcast.com/blinkops to see the Agentic SOC in action. Show Notes: https://cisostoriespodcast.com/csp-223

    From Compliance to Code: Rethinking Cloud Security - Richard Marcus - CSP #223

  6. Mar 9 ·  Video

    From Alerts to Action: Making Public–Private Threat Intel Actually Useful - Ian Washburn - CSP #222

    Threat intelligence too often arrives as a steady stream of alerts that don't translate into clear, timely decisions. This episode explores how public-sector intel flows today through channels like CISA, MS-ISAC, and CIS—and why changes in funding and distribution can reshape what organizations actually receive and when. We also imagine an all-in state approach, where states take a bigger role in getting actionable cyber intel to local businesses and organizations. From a higher-ed security leadership lens, we connect student data privacy and regulatory realities to the broader public–private challenge—and highlight community-driven efforts like the Redwood Project that strengthen trust-based, peer-to-peer intelligence sharing. This segment is sponsored by Arctic Wolf. Visit https://cisostoriespodcast.com/arcticwolf to learn more about them! Show Notes: https://cisostoriespodcast.com/csp-222

    From Alerts to Action: Making Public–Private Threat Intel Actually Useful - Ian Washburn - CSP #222

  7. Feb 9 ·  Video

    Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data - Jadee Hanson - CSP #221

    CISO Jadee Hanson shares how Vanta "drinks its own champagne," running on NIST CSF with quarterly baseline reviews and using Vanta's GRC platform to turn every release into live UAT for privacy, governance, and compliance. We rethink third-party management—why point-in-time risk scores are fading and how AI drives continuous monitoring and outcome-based assurance. Bottom line: don't just audit—instrument your controls and prove trust in real time. Show Notes: https://cisostoriespodcast.com/csp-221

    Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data - Jadee Hanson - CSP #221

  8. Jan 12 ·  Video

    Keys Without People — John Heasman on Cleaning Up Non-Human Access - John Heasman - CSP #220

    Title: Keys Without People" — John Heasman on Cleaning Up Non-Human Access Summary: John breaks today's non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what's truly critical, assign a clear owner, keep access minimal, and review it on a schedule. With AI spawning even more "non-human users," basics done well—prioritize, tighten, rotate, repeat—win the day. Show Notes: https://cisostoriespodcast.com/csp-220

    Keys Without People — John Heasman on Cleaning Up Non-Human Access - John Heasman - CSP #220
See All (87)

About

SC Media and Horizon3.ai are proud to present this month's CISO Stories program, where CISOs share tales from the trenches and unpack leadership lessons learned along the way. Hosted by Jessica Hoffman.

Information