The Art of Security

Fortra

Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries. In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape. While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment. Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.

  1. 2d ago

    AI Governance in Action: How to Secure AI Without Slowing Innovation

    Your AI has access. But does It have too much? AI can help organizations move faster, automate work, and unlock new opportunities. But when AI systems can access sensitive data, connect to business tools, or take actions on a user's behalf, governance becomes an operational security priority. In this episode of The Art of Security, co-host Josh Davies speaks with Gina Cardelli, Principal Security Strategist at Fortra, about how organizations can adopt AI without losing visibility or control. They examine what recent AI security incidents can teach businesses about excessive permissions, exposed infrastructure, third-party tools, shadow AI, and the risks of moving too quickly. Gina also explains how threat modeling, continuous monitoring, least privilege, and cross-functional AI councils can help organizations understand an AI system's potential blast radius and manage risk as its capabilities evolve. Listen to learn: Why AI governance cannot be treated as a one-time policy exercise How to threat model AI use cases before deployment Why continuous monitoring is essential for AI systems and agents How third-party AI tools can introduce data and supply chain risks What organizations can do about shadow AI Why many AI security failures still begin with familiar vulnerabilities How to introduce practical controls without bringing AI innovation to a halt AI governance doesn't have to be perfect on day one. But organizations need to understand how AI is being used, what it can access, and what could happen if something goes wrong. AI security is evolving quickly. Subscribe to The Art of Security for more conversations that help you keep pace.

  2. Jul 8

    Not Curious? Cybersecurity Isn't the Career for You — A Student's Honest Take

    Is cybersecurity really facing a skills shortage or are businesses just unwilling to train the next generation? In episode 10 of The Art of Security, Josh Davies and Tyler Reguly are joined by Dema Gorkun, cybersecurity student at MacEwan University, leader of the Student Ethical Hacking Club, and OWASP collaborator. Dema shares a candid student's-eye view of what today's cybersecurity education gets right, where it falls short, and how curiosity, home labs, and community involvement matter more than any resume. From vibe coding pitfalls to phishing projects that triggered emergency CEO meetings, this conversation explores the future of cybersecurity talent — and how to stand out in an AI-driven hiring landscape. Whether you're a student, a hiring manager, or a seasoned practitioner wondering how to mentor the next wave of talent, this episode offers a refreshing, unfiltered look at how we create the security artists of the future. 🎧 Don't miss an episode — subscribe to The Art of Security today

  3. Jul 1 ·  Bonus Video

    What Canada's Bill C-8 Means for Cybersecurity

    Canada's Bill C-8 has received Royal Assent. But what does that actually mean for cybersecurity teams, critical infrastructure operators, telecommunications providers, and vendors selling into Canadian organizations? In this bonus episode of The Art of Security, Brent Arnold of INQ Law about the impact of Bill C-8, also known as An Act Respecting Cyber Security. They discuss the law's focus on telecommunications security, critical cyber systems, minimum cybersecurity requirements, incident preparedness, and the growing importance of supply chain risk. This bonus conversation follows episode 9, After the Breach: Ransomware, Data Loss, and the Legal Fallout. Subscribe to The Art of Security so you don't miss future episodes on cybersecurity, data breaches, legal risk, and incident response.

  4. Jun 24

    After the Breach: Ransomware, Data Loss, and the Legal Fallout

    What really happens after a data breach? In this episode of The Art of Security, hosts Josh Davies and Tyler Reguly are joined by Brent Arnold of INQ Law to unpack the legal, operational, and business fallout that follows a breach. From ransomware negotiations and breach reporting obligations to data loss, regulatory risk, and recovery planning, Brent shares what organizations need to know when a cyber incident becomes a legal crisis. The conversation also explores why preparation matters, how process failures often matter as much as technical ones, and why knowing where your sensitive data lives is critical before an incident happens. If you work in cybersecurity, risk, compliance, or business leadership, this episode offers a practical look at what comes next when data is exposed, stolen, or held hostage. Listen now for practical insights on ransomware response, legal risk, and recovery.

  5. Jun 10

    Learning Cybersecurity: Education, Experience, and AI

    Cybersecurity is one of the few professions where the learning never stops. New technologies, evolving threats, and the rapid rise of AI constantly reshape what security professionals need to know. In this episode of The Art of Security, Josh Davies and Tyler Reguly sit down with Dr. Mansour Alqarni of Fanshawe College to explore the current state of cybersecurity education and what it takes to build the next generation of security professionals. They discuss the cybersecurity skills gap, the role of colleges and universities in preparing students for the workforce, the balance between theory and hands-on experience, and whether cybersecurity should be considered an entry-level career path. The conversation also dives into the impact of AI on security operations, hiring, and education and why critical thinking and continuous learning may be more important than ever. Whether you're a student considering a career in cybersecurity, a hiring manager evaluating talent, or a seasoned practitioner looking to stay ahead of industry changes, this episode offers valuable insights into how cybersecurity professionals are trained, developed, and prepared for the challenges ahead. Topics covered: • The different paths to a cybersecurity career • Teaching security in the age of AI • Practical experience vs academic theory • AI's impact on SOC analysts and security teams • The importance of soft skills and trust Subscribe now for more expert insights and security conversations.

  6. May 27

    Named Vulnerabilities, CVEs & the Problem With Security Hype

    Why do vulnerabilities like Heartbleed, PrintNightmare, and Log4Shell get memorable names while thousands of other CVEs go unnoticed? In this episode of The Art of Security, Josh Davies and Tyler Reguly debate whether named vulnerabilities help cybersecurity awareness or create dangerous hype cycles. From CVE identifiers and responsible disclosure to media sensationalism and "boy who cried wolf" fatigue, the conversation explores how branding vulnerabilities impacts SOC teams, executives, researchers, and the wider industry. A must-watch for SOC analysts, threat researchers, vulnerability management teams, CISOs, business leaders, and cybersecurity practitioners who want to understand how vulnerability naming and security hype shape real-world response, risk perception, incident prioritization, and executive decision-making.

  7. May 13

    Supply Chain Compromise: Trust Is the Target

    We're told to patch fast, trust updates, and rely on the software ecosystems that power modern business. But what happens when that trust becomes the attack vector itself? In this episode of The Art of Security, Josh Davies and Tyler Reguly dive into the growing world of software supply chain compromise — from malicious open source packages and compromised dependencies to sleeper-agent style attacks that quietly infiltrate trusted projects for years before striking at scale. Josh and Tyler unpack how attackers are weaponizing trust, automation, and AI-assisted development to spread compromise at scale, while exploring practical defenses and why today's "patch immediately" mindset may no longer be enough. When trust is the delivery mechanism, every dependency becomes part of your attack surface. Make sure to subscribe to the podcast!

  8. Apr 29

    The Art of Collective Defense

    When one organization gets breached, attackers don't just win — they get better. In this episode of The Art of Security, we explore a powerful idea: Cybersecurity isn't a solo fight but a shared one. And when defenders collaborate, everyone gets stronger. Josh Davies and Tyler Reguly are joined by Jennifer Quaid and Bob Gordon from the Canadian Cyber Threat Exchange (CCTX) to break down what effective collaboration really looks like in practice. From real-world intelligence sharing to cross-industry cooperation, they unpack how organizations can turn threat data into actionable defense and why keeping insights siloed only benefits attackers. You'll learn: Why "when one wins, we all win" is more than just a slogan How intelligence sharing improves detection, response, and resilience The role of trust, community, and diverse perspectives in cybersecurity If you think cybersecurity is just about tools and technology, this conversation will challenge that assumption. Because in today's threat landscape, defense is a team sport. Subscribe for more real-world insights on cybersecurity, threat intelligence, and the decisions that shape effective defense.

See All (17)

Trailers

5
out of 5
4 Ratings

About

Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries. In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape. While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment. Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.

Information

  • Creator
    Fortra
  • Years Active
    2026
  • Episodes
    17
  • Rating
    Clean
  • Copyright
    © 2026
  • Show Website
    The Art of Security

You Might Also Like