The ITSPmagazine Podcast

Founded in 2015, ITSPmagazine began as a vision for a publication positioned at the critical intersection of technology, cybersecurity, and society. What started as a written publication has evolved into a comprehensive repository for all their content—podcasts, articles, event coverage, interviews, videos, panels, and everything they create. This is where Sean Martin and Marco Ciappelli talk about cybersecurity, technology, society, music, storytelling, branding, conference coverage, and whatever else catches their attention. Over a decade of conversations exploring how these worlds collide, influence each other, and shape the human experience. This is where you'll find it all.

  1. 3d ago

    SOC 2 Type 1 First: Steel Patriot Partners on Sequencing a Compliance Project | A Brand Spotlight Conversation with Amy Ford, Chief Operations Officer and President at Steel Patriot Partners | Hosted by Sean Martin

    Amy Ford, Chief Operations Officer and President at Steel Patriot Partners, joins Sean Martin to talk about the moment after a company commits to compliance and nobody is sure what happens first. Sean frames the conversation around sequencing the first ninety days: what to do first, what can wait, and where people go wrong. Ford describes how Steel Patriot Partners helps companies through their compliance engineering journey, from start to finish or in the pieces in between. Customers arrive for different reasons, from contractual obligations to a federal contract. Ford says the team starts by asking why the company is doing this and whether its leadership is on the same page. Sean asks what happens when teams start with the technical controls. Ford says that puts the cart before the horse, and that scope and boundary come first so engineers do not do work an auditor will never look at. She also shares what she sees when companies move from the commercial space into FedRAMP or CMMC, and why she recommends a greenfield build. The conversation closes with a customer story. The customer asked for SOC 2 Type 2 in 12 months. A gap analysis showed it was not ready, so Ford recommended a Type 1 first, plus a letter to the customer's own customer describing the plan. Per Ford, the company went that way, was educated rather than ripped and replaced, and came through a successful Type 2 with rave reviews. Sean describes the outcome as a business decision driven by a specific deal, with a path matched to the customer's environment, team and infrastructure. Ford adds that other customers choose to rip and replace, and the team follows their lead. If you are weighing a compliance deadline set by a deal, this episode shows how a gap analysis can change the plan before the work begins. This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight GUEST Amy Ford, Chief Operations Officer and President at Steel Patriot PartnersOn LinkedIn: https://www.linkedin.com/in/amylfordcoo/ RESOURCES Find Your Path – Steel Patriot Partners | https://www.steelpatriotpartners.com/find-your-path Learn more about Steel Patriot Partners: https://www.steelpatriotpartners.com/ ▶︎ Want your brand on ITSPmagazine? Explore all of the options here: https://www.itspmagazine.com/advertise KEYWORDS Amy Ford, Steel Patriot Partners, Sean Martin, brand story, brand marketing, marketing podcast, brand spotlight, SOC 2, SOC 2 Type 1, SOC 2 Type 2, gap analysis, compliance engineering, FedRAMP, CMMC, ISO 27001, compliance scoping, greenfield build Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-soc-2-type-1-and-a-letter-moved-a-customer-toward-type-2 More from Steel Patriot Partners on ITSPmagazine: https://www.itspmagazine.com/blog?brand=steel-patriot-partners

    SOC 2 Type 1 First: Steel Patriot Partners on Sequencing a Compliance Project | A Brand Spotlight Conversation with Amy Ford, Chief Operations Officer and President at Steel Patriot Partners | Hosted by Sean Martin
  2. 5d ago

    You Don't Have to Touch the Candle | The Preventioneers Diseases, Disasters, and the Discoveries That Changed Our World - With Author Barry Davis

    You Don't Have to Touch the Candle On prevention, invisible harm, and the beep we stopped hearing Confession first: I recorded this conversation a while ago, and it waited in line far longer than it deserved. Too many conversations, one analog brain. It's a big part of why I mostly record on my own these days. Apologies to my guest, and thanks for the patience. This writing is inspired by my conversation with Barry Davis on An Analog Brain In A Digital Age — watch the episode. His book: The Preventioneers: Diseases, Disasters, and the Discoveries That Changed Our World. Inspiring stories of individuals who shaped prevention as a public good. I put my seat belt on without thinking about it. Door closes, hand reaches, click. Somewhere along the way it stopped being a decision and became part of the car, like the steering wheel. It wasn't always like that. For years the belt was there and almost nobody wore it. Then the car started beeping. Then came the fines. Then, slowly, the click moved from the law into the hand, and from the hand into a habit nobody notices anymore. That's the strange thing about prevention when it works. It disappears. Barry calls it a victim of its own success. Measles leaves the country, and the reason to vaccinate leaves with it. The thing that kept the danger away becomes the argument for letting our guard down. Nobody throws a party for the fire that didn't happen. But fire, at least, is visible. When Ben Franklin wrote that an ounce of prevention is worth a pound of cure, he wasn't talking about medicine. He was talking about fire. Smoke, flames, a street where houses used to stand. Nobody needs a statistic to believe in it. Car crashes are visible too. Doctors see them every day in the emergency room, and we see them in the news and in the streets. Floods are visible too. We watch the water rise, live, on every screen. Other harms are not as visible as these. A disease you've never seen becomes an abstraction, then a rumor, then something your neighbor isn't sure is real. A cyberattack makes no smoke. I've spent more than a decade around cybersecurity, and most of the damage there is invisible. Data walking out the door. Identities stolen and used somewhere far away. Companies compromised for months before anyone notices. We sweep it under the rug and wait for the big one, the event so dramatic it will finally change us. Barry isn't sure even that would work. People move on. And now AI, where the harm won't even look like harm. It will look like a decision. A mortgage denied for reasons nobody can explain. A diagnosis checked by a machine, or not. A video of someone saying something they never said. No smoke, no flood, nothing on the news. Just an outcome that seems perfectly normal, until you ask who decided, and nobody quite knows. The technology world has a name for getting ahead of this: security by design. It's a good idea with an old soul. It's prevention. Franklin would have recognized it in a second. It also carries the same curse. If it works, nothing happens. And nothing is very hard to defend in a room full of people who want to ship. That makes the job harder. Prevention has always started from what we can see. For these harms, it has to start from what we can imagine. That's a different muscle. It's the one we use for stories, not statistics. Science fiction has always done this kind of work, rehearsing disasters so we don't have to live them. Kim Stanley Robinson opens The Ministry for the Future with a heat wave that takes twenty million lives, because that's what it takes to get the world in his novel to move. Fiction can afford that kind of catastrophe to make its point. We can't. Maybe that's what the beep has been all along. Not a sensor. A story, repeated until we believe it without needing the crash. When we're kids, someone tells us not to touch the candle. We touch it anyway, just to be sure. We have always learned faster from the burn than from the warning. More and more of the burns are invisible. You don't have to touch the candle. — Marco Ciappelli marcociappelli.com_________________________About the hostMarco Ciappelli is a branding advisor, journalist and writer, and the host of An Analog Brain In A Digital Age. He works one-on-one with professionals building their personal brand and advises companies on positioning and storytelling, in English and Italian. In 2015 he co-founded ITSPmagazine, where he covers technology, cybersecurity and society. Branding advisory & coaching: https://marcociappelli.com/book-consultation/Writing: https://marcociappelli.com/writing/Journalism, ITSPmagazine: https://www.itspmagazine.com/about-usFor cybersecurity and technology companies, Studio C60: https://www.studioc60.comWebsite: https://marcociappelli.comLinkedIn: https://www.linkedin.com/in/marco-ciappelli/

    You Don't Have to Touch the Candle | The Preventioneers Diseases, Disasters, and the Discoveries That Changed Our World - With Author Barry Davis
  3. Nov 5

    Insider Threat Detection: Why Employee Reporting Beats Tools | An On Location Conversation at ISC2 Security Congress with Collin Sampson, VP, Infrastructure and CISO

    Your tools see an authorized user doing their job. That is the gap Collin Sampson, VP, Infrastructure and CISO at Expion Health, describes when he talks insider threat with Sean Martin at ISC2 Security Congress in Denver. Sampson opens with a case from his session: a system administrator logged into an HR system and wrote employees' personal information on paper. He says none of the company's technology would have caught it, and the company learned of it only when law enforcement made contact. Sean asks what else gets an organization's attention. Sampson says that in a lot of cases the best detection he has found is an employee reporting it, or a supervisor noticing a change in tone, attitude or personality. The security team then looks back at that person's access. The conversation moves to why tools stall, since the person is authorized, and to where AI might help filter log volume down to the unusual, with some false positives along the way. Sampson also covers why reporting a colleague goes against the grain, and a company where a manager wanted to hear everything first. That company had to launch new training saying anyone can report anything at any time to compliance and security. Sean closes by asking about AI agents as insiders. Sampson's account comes from cases and companies he has worked at. Listen for what you can change this quarter: where reports go, who sees them, and whether people feel safe making them. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=the-best-insider-detection-is-an-employee-who-can-report-safely

    Insider Threat Detection: Why Employee Reporting Beats Tools | An On Location Conversation at ISC2 Security Congress with Collin Sampson, VP, Infrastructure and CISO
  4. Nov 5

    Tabletop Exercises That Test Security Analysts, Not the Compliance Box | An On Location Conversation at ISC2 Security Congress with Aaron Bond and Ruben Perales III

    Traditional incident response tabletops often check a compliance box without telling you much about the people who have to respond. What would it take to test the analysts and engineers themselves, and to do it more than once in a while? Sean Martin talks with Aaron Bond, Cybersecurity Senior Manager - Defensive Security at The Home Depot, and Ruben Perales III, Incident Commander at The Home Depot, at ISC2 Security Congress in Denver. They had both taken part in traditional tabletops and wanted an iterative exercise that runs more often. The conversation starts with the format. Bond says an analyst's decision has a consequence, good or bad, that reshapes the investigation, a goal he describes as making it somewhat like Dungeons & Dragons. Perales describes a session of about an hour with analysts, sometimes engineers, incident commanders and a game master, and an ending that is left open. They then cover how an AI-built narrative earned management buy-in, since Bond says it cuts days, weeks or months of scenario writing to about an hour. They also discuss what the exercise surfaces: interactions with other teams that were needed but never documented. Perales says, "I feel like in every organization there are gaps between documentation and operation." Bond explains how an in-house tool tracks timing, resolution and flags captured, which frees the game master to watch communication between teams. The episode closes with a look at a second session, a roundtable on how practitioners and leaders use AI in the security operations center, and Sean's point that it has to be done responsibly. For security leaders, this is a practical look at testing people and process, not paperwork. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=tabletops-test-the-analysts-who-respond-not-the-compliance-box

    Tabletop Exercises That Test Security Analysts, Not the Compliance Box | An On Location Conversation at ISC2 Security Congress with Aaron Bond and Ruben Perales III
  5. Nov 5

    Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson

    Threat intelligence, red team results and purple team exercises can be rich and practical, yet hard to turn into strategy. The risk register often swallows what teams find. Sean Martin talks with two practitioners who built a way around that. Sarah Bryson, Senior SRC Advisor at Kudelski Security, and Desta Bailey, Cyber Threat Intelligence Analyst at Southwest Airlines, presented their session at ISC2 Security Congress. They worked together at Southwest Airlines, and Bryson has since moved to the advisory side. The conversation starts with a number. When Bryson's team overlaid threats, tactics and controls on anomalous event and incident data, she says, about half of the findings were control gaps that should have been in place for policy. From there, Bryson and Bailey describe the intel pipeline they built to feed the intelligence program into governance, risk and compliance (GRC). Bailey walks through how an executive's headline question gets answered: pull the intelligence, map it to NIST Cybersecurity Framework (CSF) 2.0 outcomes and the company's control set, then pass it to GRC partners. Bryson explains what owning the control lifecycle allows, and what the finding meant for an incident response team she describes as among the most overworked in cyber. They also cover tying a patch request to a specific threat, documenting the process so it runs the same way whoever does it, and where audits fit alongside a threat-driven approach. For security leaders, the takeaway is practical: bring gaps to the risk committee before they become incidents, and get intelligence and GRC teams talking first. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=about-half-of-the-anomalous-incident-findings-were-policy-violations ResourcesThe NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20

    Threat Intelligence Meets GRC: Why Half the Findings Were Control Gaps | An On Location Conversation at ISC2 Security Congress with Desta Bailey and Sarah Bryson
  6. Nov 5

    Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security

    A security program built on enforcement and fear creates friction, and people stop paying attention. At ISC2 Security Congress in Denver, Joseph Carson, Chief Security Evangelist & Advisory CISO at Segura, tells Sean Martin what happened when his team at a large transportation car manufacturer admitted its approach was not working. Carson describes the team putting enforcements and policies in place, then realizing a couple of months in that the program rested on fear: you need to patch, reboot, update, take this course. Noise from the next conference room turned out to be a bring-your-kid-to-the-office day, and the team sat with the children for an hour, an hour and a half, asking what they would suggest. Two ideas came out of that room. One child asked about comic books, which meant less text and fewer translations. Another suggested bathroom doors, because everyone goes at least once a day. Each quarter the awareness training now carries a new four-panel message on not plugging in USBs, using multi-factor authentication and patching systems, posted on bathroom doors, in elevators and at the canteens. Carson calls it a redefining moment in his career. It changed how he views security: be an enabler and a promoter, so people see it as a good thing. That is why he prefers zero friction to zero trust, meaning security that just works and helps people meet the metrics they are measured on. The conversation also touches on career disruption, internal security evangelists and using AI with guardrails, and it matters for anyone whose awareness program is being ignored. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-security-program-built-on-fear-failed-until-children-redesigned-it-as-comics ResourcesCybersecurity Courses on Udemy | https://www.udemy.com/topic/cyber-security/?p=28 AI Act | Shaping Europe's digital future | https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai The NIST Cybersecurity Framework (CSF) 2.0 | https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20

    Security Built on Fear Failed Until Children Redesigned It as Comics | An On Location Conversation at ISC2 Security Congress with Joseph Carson, James McQuiggan and vCISO and Human Risk Management advisor at Apparent Security
  7. Nov 5

    Women in Cybersecurity: Why the 50x50 Goal for 2050 Is Built Slowly | An On Location Conversation at ISC2 Security Congress with Dhriti P. Stocks

    A goal set for 2050 sounds slow. Dhriti P. Stocks says that is the point: quick interventions in cybersecurity careers will not last. Dhriti P. Stocks, Executive Director at the Center for Cyber Safety and Education, joins Sean Martin at ISC2 Security Congress in Denver. She explains the Global 50x50 Initiative, which aims to put 50% women in cybersecurity by the year 2050, and why it was the first thing she was told when invited to join the mission. The conversation opens with Stocks's 20 years uplifting women and girls in STEM and her work with populations that have historically faced barriers. She then lays out why the plan covers a full career, from K to 12 to senior leaders, across eight action areas, and why the aim is women who can speak into decisions, lead and advance, not only enter the field. She warns about a leaky bucket, where burnout drives women out at a higher rate. Stocks and Sean also cover the Center's three focus areas: scholarships, Cybersecurity Health Check for small businesses and nonprofits, and 50x50. She describes how volunteers join, including an advisory council assembled roughly every four months around one action area, and shares the story of a scholarship recipient from Ghana who went on to a CISO role and the Center's board. Her closing asks are to invest, engage and advocate. For listeners who work in security, it is a practical look at how a long-term workforce goal gets built, and where their own time and expertise can help. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=a-2050-goal-for-women-in-cybersecurity-built-slowly-so-it-lasts ResourcesCybersecurity Health Check | https://www.iamcybersafe.org/s/cyberhealthcheck Center for Cyber Safety and Education Launches Global 50x50 Initiative to Achieve Gender Parity in Cybersecurity by 2050 | https://www.isc2.org/Insights/2025/10/Gender-Parity-in-Cybersecurity Academic Scholarships - Center for Cyber Safety and Education | https://www.iamcybersafe.org/s/academic-scholarships

    Women in Cybersecurity: Why the 50x50 Goal for 2050 Is Built Slowly | An On Location Conversation at ISC2 Security Congress with Dhriti P. Stocks
  8. Nov 5

    Why Waiting for Q Day Fails: Quantum, AI and Getting Security Done Now | An On Location Conversation at ISC2 Security Congress with Jaya Baloo, COO & CISO

    Everyone wants a date. If quantum computing is far enough away, the quantum work can wait, along with the backlog and the outdated asset inventory. Jaya Baloo says that comfort is the problem. Sean Martin talks with Jaya Baloo, COO & CISO at AISLE, after her afternoon keynote at ISC2 Security Congress in Denver. Baloo has worked on quantum for years, including the EU Quantum Flagship, which organizes the field into four pillars: computing, communication, simulation, and sensing and metrology. The conversation turns to her keynote message: stop fixating on numbers and artificial boundaries, and do not say you have until 2029. Baloo says AI is an accelerant to a potential break of RSA, which is why she urges people to keep marching forward, potentially at a faster clip. Sean raises the usual excuses, a backlog of old systems and a configuration management database that is not current. Baloo's reply is that ignoring them will not bring the database up to date. They also cover why teams put the urgent ahead of the important, and whether not understanding AI or quantum excuses inaction. Baloo says it does not, and offers starting points: security protections on open-weight models, knowing what a frontier large language model is authorized to do, hunting shadow AI usage, an AI asset register, and visibility into third-party suppliers already using AI. She also says waiting for governments will be too little, too late, and closes on observability for AI systems. For security leaders, the takeaway is a place to start now rather than a year to wait for. Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=waiting-for-q-day-is-the-wrong-plan-and-ai-removes-the-date ResourcesISO/IEC 42001:2023 - AI management systems | https://www.iso.org/standard/42001 Quantum Flagship (EU) | https://qt.eu/

    Why Waiting for Q Day Fails: Quantum, AI and Getting Security Done Now | An On Location Conversation at ISC2 Security Congress with Jaya Baloo, COO & CISO
5
out of 5
30 Ratings

About

Founded in 2015, ITSPmagazine began as a vision for a publication positioned at the critical intersection of technology, cybersecurity, and society. What started as a written publication has evolved into a comprehensive repository for all their content—podcasts, articles, event coverage, interviews, videos, panels, and everything they create. This is where Sean Martin and Marco Ciappelli talk about cybersecurity, technology, society, music, storytelling, branding, conference coverage, and whatever else catches their attention. Over a decade of conversations exploring how these worlds collide, influence each other, and shape the human experience. This is where you'll find it all.

More From ITSPmagazine Podcasts