The Art of Cybersecurity

Cheri Hotman
  • 4.7 (3)
  • Technology

Cybersecurity is as much art as science. The hard part is not knowing another framework or buying another tool. It is figuring out what actually matters, making good tradeoffs, and building security that works with real-world limits on time, budget, people, and technology. On The Art of Cybersecurity, Cheri Hotman explores the judgment, creativity, leadership, and practical problem-solving behind cybersecurity that actually protects the business. Expect candid conversations about cyber risk, Cyber GRC, governance, compliance, technology, audits, AI, leadership, and the messy reality of making

  1. 2d ago

    GRC Is Cybersecurity: Why Compliance Alone Isn’t Enough with Mea Clift

    What happens when organizations start treating compliance as the goal instead of using it as one piece of a stronger cybersecurity program? In this episode of The Art of Cybersecurity, Hotman Group CEO Cheri Hotman sits down with GRC leader and educator Mea Clift for a candid conversation about what governance, risk, and compliance (GRC) should actually look like in practice. Cheri and Mea dig into why passing an audit doesn’t necessarily mean an organization is secure, how risk should drive cybersecurity priorities, and why frameworks, tools, and maturity scores can create a false sense of security when they become the objective instead of the input. They also explore cybersecurity budgeting and return on security investment, vendor and technology decisions, what effective cyber leadership really requires, and the importance of trust, integrity, mentorship, and continuous learning in the profession. In this episode:• Why GRC is part of cybersecurity — not just compliance documentation• Compliance vs. actual security• Using risk to prioritize cybersecurity investments• Why “cheap, fast, and easy” doesn’t work in cyber• Communicating cybersecurity risk to business and financial leaders• What makes an effective cybersecurity leader• Building trust and integrity into cybersecurity programs• Developing the next generation of GRC professionals At its core, the conversation comes back to one idea: cybersecurity isn’t about checking the final box. It’s about continuously making better, risk-informed decisions and moving the organization forward. Learn more about Hotman Group at hotmangroup.com

  2. Jun 12

    AI Is Still Just a System: A Practical Approach to Governance

    In this episode, Cheri Hotman sits down with Diane Jones to explore the intersection of cybersecurity, engineering, and artificial intelligence. Drawing on her background in systems engineering and security, Diane shares her journey into AI governance and discusses how organizations can move beyond the hype and fear surrounding AI to focus on practical, actionable risk management. From NIST and ISO frameworks to developing her own AI admissibility framework, Diane offers valuable insights into building trustworthy, governable AI systems that deliver real business value.

  3. Mar 16

    The Art of Cybersecurity: Why Governance Is More Than Checklists

    In this episode of The Art of Cybersecurity, Cheri Hotman sits down with GRC leader Jerry Koshy for an honest, practitioner-to-practitioner conversation about what it really takes to build effective cybersecurity and risk programs. While compliance and risk management often get framed as rigid processes or box-checking exercises, Cheri and Jerry explore why the most impactful work in GRC is actually an art form—one that requires leadership, communication, and the ability to align people across an organization. Together they discuss: Why governance is often the most overlooked part of GRC How cybersecurity professionals must act as business enablers, not roadblocks The role of culture, buy-in, and relationship building in successful security programs Why many organizations struggle with audits and third-party risk management How strong GRC programs focus on continuous improvement, not just passing audits They also dig into the realities of burnout in the field, the importance of emotional intelligence in leadership, and why the best cybersecurity programs succeed because of people—not just technology. This episode is a candid look at the human side of cybersecurity, and why building secure organizations requires both science and art.

  4. Feb 20

    AI Without the Hype: People First, Governance Always

    AI is not the boogeyman. It is not a magic fix either. In this episode of The Art of Cybersecurity, Cheri Hotman sits down with Erica Shoemate (former FBI and U.S. intelligence community, now working across tech policy, trust and safety, and AI literacy) to talk about what most AI conversations miss: the human stakes. They dig into why “we passed the audit” is not the same as being secure, why integrity has to show up in daily decisions and not just on a values page, and how companies can adopt AI without sacrificing governance. Erica shares a practical example of using internal GenAI to speed up regulatory readiness and control mapping while keeping human review and accountability front and center. The takeaway is simple. Use AI to reduce friction and busywork, so people can focus on judgment, risk, and critical thinking.

  5. Jan 2

    Continuous Improvement in Cyber: Findings Are the Point

    In this episode, Cheri Hotman sits down with long-time colleague and GRC leader Peter Spier for a candid, no-nonsense conversation about what actually keeps organizations secure and what quietly puts them at risk. Peter brings more than two decades of experience across PCI, audits, and enterprise risk to unpack a topic most teams avoid. Integrity in GRC. Together, they challenge the obsession with green checkmarks, clean audit reports, and “passing” frameworks while ignoring what really matters. Reducing real risk. This conversation cuts straight through common myths: Why a report with zero findings should make you nervous, not confident How audits differ fundamentally from running a security program The danger of scoping games and checkbox compliance Why continuous improvement requires uncomfortable conversations How ego, incentives, and fear quietly undermine security decisions Cheri and Peter also explore the human side of cybersecurity. Coachability, transparency, and the willingness to surface problems early before attackers do. This episode is for leaders, practitioners, and auditors who care less about appearances and more about building programs that actually protect the business. If you have ever felt uneasy about a “perfect” audit, struggled to push bad news up the chain, or wondered whether your compliance program is giving you a false sense of security, this conversation will resonate.

  6. 12/12/2025

    From CPA to Cyber Leader: Seeing the Whole Business

    In this episode, Cheri Hotman sits down with Joe Kodali, a fellow CPA turned cybersecurity and GRC leader, to have a blunt, practitioner-level conversation about what is actually broken in modern cybersecurity programs and why compliance theater is making organizations less secure, not more. They unpack the unique value CPAs bring to cybersecurity, not because of accounting, but because of how auditors are trained to understand entire businesses, ask uncomfortable questions, and tie controls back to real risk and return on investment. From there, the discussion goes deep into the widening gap between executives and cyber teams, the failure of checkbox audits, and how GRC tools and low-quality SOC 2 practices have created a dangerous false sense of security. Cheri and Joe challenge the industry’s obsession with compliance over governance and risk, calling out poor scoping, copy-paste controls, and the misuse of frameworks that were never meant to be treated as templates. They also address the hard truth that tools do not fix broken programs, people and discipline do. The conversation closes with a candid discussion on why governance is the most overlooked and undervalued part of GRC, how boards should be asking better questions, and what it actually takes to build a cyber program that protects the business rather than just passing audits. This episode is required listening for CISOs, security leaders, GRC practitioners, auditors, and executives who want real security outcomes instead of green checkmarks.

  7. 12/11/2025

    Inside CMMC: The Real Challenges, the Real Stakes, and the Real Work

    In this episode, Cheri Hotman sits down with CMMC expert and strategist Linda Rust for a direct, unscripted conversation about what CMMC really means for defense contractors, why so many organizations get it wrong, and how leaders can approach compliance with clarity instead of chaos. Linda brings more than 25 years of engineering and mission-critical technology leadership to the table. She breaks down why CMMC is fundamentally a business issue rather than an IT project, why third-party accountability is often the only thing that finally moves organizations to action, and why “cheap” approaches end up being the most expensive mistakes companies make. Cheri and Linda dig into:• What CMMC is (and isn’t)• Why scoping and understanding your data matters more than any technical control• Why leadership, not IT, must own the strategy• The real cost drivers behind CMMC and why labor—not tools—is the biggest factor• How small companies get themselves into false-claims trouble without realizing it• What’s coming next with FAR CUI and NIST 800-171 Revision 3• How organizations can right-size their efforts instead of chasing shortcuts If you want a frank, practical explanation of CMMC from two people who have lived it for years, this episode will help you understand the landscape, avoid costly pitfalls, and build a program that leaders can actually sustain.

  8. 09/24/2025

    Beyond the Checklist CMMC with Integrity

    In this episode, Cheri Hotman unpacks the real story behind CMMC—and why it’s far more than a compliance checklist. Drawing on highlights from her recent Dallas talk, Cheri emphasizes that passing an audit is never the end goal. Instead, CMMC is about protecting sensitive government data, earning customer trust, and building integrity into every layer of your security program. Cheri breaks down the biggest pitfalls she sees—like over- or under-scoping, documentation theater, and trying to “DIY” without the right expertise. She shares why companies must approach CMMC as an ongoing cycle of protection, monitoring, and improvement—not a one-time project. If you’re navigating CMMC, you’ll walk away with: Clear insight into what the DoD really expects (hint: it’s not just a perfect score). Strategies to scope effectively and avoid wasted effort. How to balance third-party support with true internal ownership. The importance of building trust and integrity over “just passing.” CMMC is a chance to strengthen your security posture and stand out in the market—don’t miss it.

See All (32)

Ratings & Reviews

4.7
out of 5
3 Ratings

About

Cybersecurity is as much art as science. The hard part is not knowing another framework or buying another tool. It is figuring out what actually matters, making good tradeoffs, and building security that works with real-world limits on time, budget, people, and technology. On The Art of Cybersecurity, Cheri Hotman explores the judgment, creativity, leadership, and practical problem-solving behind cybersecurity that actually protects the business. Expect candid conversations about cyber risk, Cyber GRC, governance, compliance, technology, audits, AI, leadership, and the messy reality of making

Information

  • Creator
    Cheri Hotman
  • Years Active
    2022 - 2026
  • Episodes
    32
  • Rating
    Clean
  • Copyright
    © Cheri Hotman
  • Show Website
    The Art of Cybersecurity