The Cyber Business Podcast

Matthew Connor

Welcome to The Cyber Business Podcast where we feature top founders and entrepreneurs and share their inspiring stories.

  1. 1d ago

    Start Small, Scale Smart, Govern Carefully: A CISO's AI Mantra with Adam Palmer - Ep 246

    Guest Introduction Adam Palmer is the CISO of First Hawaiian Bank, the largest bank in the state of Hawaii, with almost $30 billion in assets and operations across Hawaii, Guam, and Saipan. With 25 years in cybersecurity, he began as a U.S. military officer, worked on both the vendor and operational sides of the industry, and spent ten years in cybersecurity roles in Europe before taking on his current role just under six years ago. Adam leads the bank's technical security, governance, operational management, and risk reduction efforts, and he thrives on transformation work, building programs and operating models from the ground up. He joins the show to talk about the advantages of a mid sized bank, why he insists on a human in the lead of AI driven decisions, how he vets vendors in a regulated environment, and why he believes fighting AI with AI is the only way to keep pace. Here's a Glimpse of What You'll Learn Why Adam says a mid sized bank's agility can be a real advantage over a larger institution Why Adam counsels patience and planning, including months of assessment, over chasing a quick win How start small, scale smart, govern carefully shapes an AI committee that reviews every use case Why Adam refuses to be the department of no, and how he presents trade-offs so leaders decide with eyes open What human in the lead, not human in the loop, means for a regulated security operations center Why Adam wants vendors to prove transparency instead of wrapping an AI buzzword around a traditional tool Why Adam argues cyber risk should be quantified in business terms instead of red, yellow, and green heat maps Why Adam believes security leaders must fight AI with AI, and why crisis mode is the wrong response In This Episode Adam opens by explaining why working at a mid sized bank has real advantages. Having worked at a global bank where the budget was larger but a large ship turned slower, he says First Hawaiian Bank's agility lets his team adopt more advanced tools and move faster, and that smaller does not mean less advanced, since the bank carries the same programs and similar risks at a different scale. His advice to new CISOs is patience and planning: when he arrived in early 2021, he resisted the pressure for a quick win, spent the first several months carefully assessing the program's maturity, built a multi year plan, and then executed on it, which he says produced better effectiveness. He enjoys stepping into roles where he is the first person in the job, and likes building his own operating model while still aligning to frameworks and holding himself accountable to industry standards. The center of the conversation is how Adam approaches AI, which he sums up as start small, scale smart, govern carefully. He sits on the bank's AI committee, which carefully reviews every use case, and he wants AI implemented only when it has a legitimate, clearly articulated business value, with his team designing the guardrails. He insists security cannot be the department of no, because saying no only drives shadow IT, so he lets the business identify where it sees value and then presents the trade-offs, risks, and costs so leadership decides with eyes open. On the security side, he sees AI improving mean time to detect and mean time to resolve, an idea central to a presentation he gave on transforming the bank's security operations center to build board and executive confidence, provided tools stay auditable and transparent. That is where his distinction comes in: not human in the loop, but human in the lead, with AI prioritizing incidents and consolidating information, and an analyst making the final call on critical decisions. Adam is just as direct about vendors and metrics. He calls the AI security space a bit of the Wild West and says the vendors that stand out show transparency, prove their tools are truly better than what he can achieve without them, and do not simply wrap a traditional tool in an AI buzzword, since auditors and regulators demand to see what the AI is doing. He is open to smaller companies that prove themselves and avoids depending on a single platform as a single point of failure. He presses for cyber risk quantification in business terms, noting that every other part of the business presents priorities in dollars, and calls identity the perimeter, with human and non human identities needing strong control because authorized activity can still be malicious. The danger, he says, is moving too fast, yet the only answer to machine speed offense is equally strong AI on defense, and he is surprised when security leaders act in crisis mode, since his bank has planned for years to move at machine speed. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  2. 2d ago

    $20 a Seat Snuck In on Us: The Hidden Budget Problem of AI with Michael McAndrews - Ep 245

    Guest Introduction Michael McAndrews is the CISO of Archwell Capital, a family of companies working primarily in financial services, with a focus on mortgages, insurance, and the technology behind them. Its largest organization, Motor, is a business process outsourcing group and an AI development group, and Michael secures a globally distributed workforce with very few brick and mortar offices. A hands on engineer who spent years in incident response, he brings pragmatism to the tension between AI efficiency and risk. He joins the show to talk about governing AI development in a regulated industry, why he tells his team to treat AI like an intern, how small per seat AI spending slips past traditional budget scrutiny, and why he relies on carefully chosen partners to counter AI powered threats he does not have the in house defenses to meet alone.   Here's a Glimpse of What You'll Learn Why Michael says AI can flag a missed signature on a mortgage application but should never make the decision How Michael separates two AI risks: employee usage that leaks data and governance of AI development Why Michael tells his team to treat AI like an intern, with a specific task and a checked result How $20 per seat spread over six to nine months can quietly add up to a $200,000 software purchase Why renting private AI infrastructure from a provider can beat owning it, and why accountability matters How Michael relies on partner and tool selection to counter AI powered attacks Why Michael turned the tables and asked the host about CISO tenure and the pressure of the job   In This Episode Michael opens by describing Archwell as a family of companies built around financial services, with Motor as its largest organization, and by drawing a clear line between the two AI problems he manages. The first is employee usage, where he worries about data leaking to third parties through the growing number of tools that are building in AI, and is putting controls in place. The second is governance of AI development, where Archwell is setting standards so its products avoid bias and never let AI make the actual decision. In mortgage lending, he explains, AI can flag that an applicant forgot to sign a field or check a box before the file moves through the process, while the decision itself stays with underwriters and humans. That philosophy carries into a favorite instruction for his team: treat AI like an intern, give it a specific task, always check the work, and remember it will not replace you, even as developers who hit their token limits react as if someone took their lollipop away. The conversation then turns to the economics of AI, where Michael sees an unexpected check on the replacement narrative. A $200,000 software request would draw tough questions from leadership, he says, but $20 per seat across a whole workforce over six or nine months reaches the same total and slips by unnoticed, which is why he is building governance around consumption versus time based models. Asked whether organizations will bring AI in house, Michael says Archwell has tried and found larger partners with more infrastructure to be more efficient and cost effective, and notes that in house does not have to mean on premises, since a private cloud rented from a provider can keep data private without the burden of owning hardware. For now, contracts are his main control with frontier model providers, covering no training on Archwell data, retention, and how quickly they must notify him of an incident, and he prefers a provider who is accountable if something goes wrong over holding the patching risk himself. In the back half, Michael turns to people and the road ahead. A hands on engineer who admits the move into leadership has been a challenge, he describes pulling his hands back from the keyboard, begrudgingly, in exchange for control over tools, training, and budget that lets him help the whole team, and he tells a younger teammate who never wants to lead that his skills will eventually outgrow individual tools. He calls this the most exciting shift he has seen in quite some time, not a scary one, while still preferring a human voice to an AI agent on the phone. On defense, he explains that because AI lowers the barrier to entry for attackers, he reached a clear conclusion after asking a CISO group that included Glasswing companies what a smaller company should do: partner and tool selection matter most, and he becomes a spectator watching two robots fight it out with his own money on the line. He closes with a candid conversation about unplugging, noting that not every problem needs solving immediately, and in a rare role reversal asks the host about CISO tenure and the pressure of the job, which he says leaders mostly put on themselves.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  3. 4d ago

    Air Gaps Just Don't Exist Anymore: Securing Critical Infrastructure with Tony Bryson - Ep 244

    Guest Introduction Tony Bryson is the CISO of the Town of Gilbert, Arizona, and returns to the show to talk about the risk he named when his CTO asked him, six years ago, what the town's greatest risk was: critical infrastructure. Gilbert runs water, wastewater, water collection, and traffic operation systems, the same kinds of operational technology that municipalities and private operators across the country depend on every day. Tony has taken his message on IT and OT convergence to utility audiences and has built a partnership model with his town's public works teams that brings in trusted outside experts. He joins the show to explain what has changed about the threat, how a town can respond without taking on SCADA itself, and why telling residents the whole story matters as much as any technical control.   Here's a Glimpse of What You'll Learn Why Tony says the air gap that once protected operational technology no longer exists How vendor remote access for support and patching quietly defeats the old air gap mentality Why attacks on critical infrastructure are often first noticed by a plant worker, not by security tools Why OT's focus on availability, six nines instead of five, changes how patching and monitoring get done How Gilbert partnered with public works and brought in trusted third parties who speak the plant's language Why Tony argues for a federal minimum standard for securing critical infrastructure How honest conversations with residents about water rates built understanding and trust   In This Episode Tony opens with the question his CTO asked him when he first joined Gilbert six years ago, what is the town's greatest risk, and his immediate answer: critical infrastructure. He explains that these operational technology systems were never built with the same security assumptions as IT, and that while they once sat in environments that were not noteworthy targets, nation-state actors, hacktivist collectives, and cyber syndicates now treat them as low hanging fruit, partly because intrusion detection and system monitoring rarely exist on the OT side. He notes that attacks have often been discovered by a plant worker who spotted something odd on a SCADA screen, and that the old air gap defense has been undone by service and subscription models in which vendors require remote access for support and patching. The result is what he calls a convergence between IT and OT that forces plants to adopt IT best practices. The middle of the conversation is a clear-eyed look at why OT security lags and what actually works. Tony explains that plants have traditionally avoided antivirus because scans can knock over sensitive systems like historians, rely on SCADA monitoring that watches the process rather than the network, and sometimes run default logins, thin segregation of duties, and weak backups. He adds that critical infrastructure leans hard on availability, targeting six nines where IT balances confidentiality, integrity, and availability, which he describes as a scalene triangle with availability stretched out. He recalls presenting on IT and OT convergence at a Southwest utilities seminar in Las Vegas in 2023, where the room looked at him like he had four heads, and he was then swarmed with questions in the hallway for up to two hours. Gilbert's answer has been partnership: educating public works, being candid that his team knows nothing about SCADA, and bringing in the best vendors in the marketplace as trusted third parties who speak the language of the plant, covering network segregation, asset and supply chain management, ongoing vulnerability assessment, and full time system monitoring. The final stretch moves from technology to policy and public trust. Tony makes the case that critical infrastructure needs a federal minimum standard, noting that water and wastewater operators work from IEC 62443 and the Purdue model while each industry follows its own frameworks, and he explains why states push back on unfunded mandates. He argues that a million dollars of security spending is small next to the billions of dollars of buried infrastructure and the public trust at stake. He then brings it home with Gilbert's own story: aging infrastructure in acidic soil forced a dramatic water rate increase, and when a resident raised it at an AI symposium in downtown Phoenix, Tony chose to explain exactly what the town was facing and how smart meters might someday help residents find leaks. Afterward, the resident thanked him and said he now understood why the increase was required, even though he was still not happy about it. Tony closes by honoring plant operators as rock stars who keep the water flowing, and urging them to bring in experts for what they do not know they do not know.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  4. Oct 7

    Human or Agent? Eight Identity Scenarios to Test Any AI Vendor with Marina Kelly - Ep 243

    Guest Introduction Marina Kelly is the CISO for the City of Raleigh, North Carolina, the state capital and, as she points out, the 39th largest city in the country, home to a thriving Research Triangle tech community, several universities, and roughly two dozen city departments that she describes as separate business verticals. Her team is responsible for cybersecurity across that entire stack, from planning and development to the 911 team to Raleigh Water. Marina's path into the role is anything but typical: she spent 10 years as a classroom teacher before earning a master's degree in computer science at UNC Greensboro, then built a career through business analysis, application development, and database administration across public and private sectors on the way to CTO and CISO roles. She joins the show to share four principles for leading security in the age of AI, how she vets vendors in a market moving faster than contracts can, and why she counts all 4,500 city employees as members of her security team.   Here's a Glimpse of What You'll Learn Why Marina says security governance must now move at the speed of AI change, with incident response plans reviewed quarterly Marina's four principles for leading a security program through the AI era Why Marina believes AI will neither save us nor kill us, and how that shapes Raleigh's approach The eight identity scenarios Marina asks vendors about to tell human actions from agent actions Why Marina wants a partner, not a vendor, and why she advises holding out for one year contracts How Raleigh is switching to an awareness platform that builds customized training content with AI Why Marina counts all 4,500 city employees as members of her information security team   In This Episode Marina opens with what makes municipal security distinctive. Raleigh's team secures roughly two dozen departments, each with different services, regulatory requirements, and workforce realities, including seasonal staff, part time staff, and workers under 16. Her calendar might move from planning and development to emergency communications to Raleigh Water in consecutive hours, which she loves, because understanding how the city serves residents is how her team gives departments the risk information they need to make good decisions as stewards of taxpayer dollars. She describes a shift over the past year and a half toward desiloing critical infrastructure, pointing to the water system attacks she says were widely publicized in late July, and the collaborative network she has built: one of her first calls goes to the Wake County CISO, with close ties to state IT and to CISA, the FBI, and DHS. She stresses helping smaller towns where one person may also sit on the council or serve as the weekend janitor, because as she puts it, we can't be in the basement with our hoodies on. The center of the conversation is how Marina leads through AI-driven change. She shares four principles: govern at the speed of change, which means her team moved incident response plan reviews to quarterly; read the adversary and use AI to defend; institutionalize the middle, since AI is not going to save us or kill us; and prepare for drift, with quantum already bearing down. She notes her security team has had a seat at the table from the start of Raleigh's AI work, testing frontier models and guardrails before enterprise rollout. On vendors, she asks existing providers about AI observability first, then talks to startups, wanting a partner rather than a vendor. She quizzes vendors with eight identity scenarios, such as telling a human using their own credentials from an agent using delegated ones, noting that identity was always the real perimeter. She notes two of five AI governance vendors she was monitoring got acquired within six weeks, and advises holding out for one year contracts when possible, citing Gartner's guidance. The back half turns to people. Raleigh is switching awareness training partners to one that generates customized content with AI, because generic vendor content can't keep up with what employees face. She shares a favorite story from new employee onboarding, when an HR colleague described the best feeling in the job: reporting a phishing simulation and getting the congratulations email back. Marina also shares her own path, from a decade of teaching to breaking into development in the early 2000s through business analysis, and offers mentoring advice for women in cybersecurity: bring your own folding chair, be your own best advocate, and learn to tell the story that wins budget in finance's language. She closes by keeping human beings at the center of everything her program does.   Sponsor for this episode... This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  5. Oct 2

    Why You Can't Commit to One AI Provider Anymore with Matthew Sanders - Ep 242

    Guest Introduction Matthew Sanders is the CISO at Slingshot Aerospace, a company that combines a global sensor network with AI and advanced analytics to help government and commercial customers understand what's happening in space and operate safely. Because of the nature of Slingshot's work, Matthew's biggest concern isn't financially motivated criminals, it's patient nation-state actors willing to linger inside a system undetected for extended periods. He joins the show to talk through prompt injection and model poisoning risk, a striking recent Anthropic threat intelligence report on real world misuse of its own models, and why depending on a single AI provider has become a genuine supply chain risk for organizations in the defense industrial base.   Here's a Glimpse of What You'll Learn Why Matthew says nation-state actors, not financially motivated criminals, are his top concern at Slingshot How a recent Anthropic security report revealed threat actors building entire phishing campaigns with minimal prompting Why Matthew believes patching no longer means what it used to against AI-discovered zero days How Matthew uses Claude daily as a second opinion to catch his own team's missed security settings Why defense industrial base policy shifts are forcing security teams away from single-provider AI lock-in How Matthew thinks AI assisted testing could finally solve the oldest blocker in patch management Why Matthew believes the tide in the AI arms race may finally be shifting toward defenders   In This Episode Matthew opens by laying out just how much AI has reshaped the security conversation at a company built entirely around AI-driven space intelligence. He walks through the layered risk: prompt injection and model poisoning inside Slingshot's own products, attackers using AI to iterate on attacks faster than ever, and a governance challenge every security leader now faces, trying to understand what tools employees are actually using without slowing the business down. He references a security report Anthropic published just before the recording, detailing how threat actors, including a Russian group targeting Ukraine-based companies, used Claude with only basic instructions to build complete phishing campaigns, compromise hotel Wi-Fi, and create malware targeting iOS, all capability that would have required far more sophistication just a year earlier. He also points back to the MGM breach as a reminder that attackers don't need to target end users at all, since in that case it was a sophisticated IT team itself that got socially engineered. The conversation turns to where Matthew sees real opportunity rather than just risk. He's candid that watching Darktrace's Secure AI product gives him a genuine glimpse of the future, tools that let security professionals finally see what their own organization is doing with AI in real time, the same visibility advantage attackers have enjoyed for longer than defenders have. He argues the fundamentals, zero trust, least privilege, patching, matter more than ever precisely because AI defense tools don't replace them, and describes using Claude personally as a daily second opinion, feeding in his own SSP and compliance documentation to check whether his team is actually doing what they claim to be doing, catching missed settings in minutes rather than letting them slip through unnoticed. He also sees a major unsolved opportunity in AI-assisted testing, arguing the oldest blocker in patch management, the fear that an update will quietly break something else, could finally be addressed if AI could validate changes before they ship rather than after. The back half of the episode gets into the operational realities of running security in the defense industrial base during a moment of real policy upheaval. Matthew describes watching organizations get caught flat-footed when a model provider gets restricted for supply chain reasons overnight, forcing a scramble to alternative tools like Cursor or Codex, and argues this volatility means security leaders can no longer commit to a single AI provider the way they once committed to a single cloud vendor. He connects this to the ongoing pause on CMMC Level 2 requirements and the broader shift toward FedRamp's newer, more automation-driven approach, predicting that continuous AI monitoring will eventually replace much of the paperwork-heavy compliance process entirely. He closes on what he calls a genuinely exciting use case: feeding a full SSP into Claude to get instant gap analysis and self-auditing that used to take a human auditor a full week, compressed down to hours.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  6. Sep 30

    Your Internal Network Is No Longer Trusted with Michael Foster - Ep 241

    Guest Introduction Michael Foster is the CISO for the Wisconsin Department of Revenue, an agency he describes as functioning much like the IRS for the state, but with a scope that extends well beyond taxes into the Wisconsin State Lottery and three separate police forces covering everything from lottery fraud to alcohol and tobacco enforcement. His purview covers information security alongside portions of physical security, managing what stays inside the agency and what limited access outside entities are allowed. He joins the show to talk candidly about zero trust architecture, why he's skeptical of pure fight-fire-with-fire thinking, why security has to be sold internally as a business enabler rather than a cost center, and a genuinely unsettling real world story about how a single social media post led directly to a home invasion.   Here's a Glimpse of What You'll Learn Why Michael says attackers no longer need a skilled hacker, just a purchased tool set to run on autopilot How Michael's least access philosophy extends zero trust to internal networks, not just external threats Why Michael is cautious about a pure fight-fire-with-fire approach to AI powered attacks How Michael reframes security spending as a business enabler instead of a cost center to get buy-in Why Michael still runs security awareness training even if workplace tools eventually make it obsolete Michael's explanation for why AI hallucinations often come from an organization's own bad data, not the model itself The real story from Michael's own community about a funeral post on social media leading to a home invasion   In This Episode Michael opens by describing the unusual breadth of his role, protecting an agency that handles business taxes, the state lottery, and three distinct law enforcement divisions, all of which face constant daily attacks. He's direct that the nature of those attacks has changed fundamentally: attackers no longer need to be skilled, since AI agents can now be set up once and left running indefinitely to probe for openings, discovering the kind of zero day exploits that used to require deep technical expertise. When asked whether fighting AI with AI is simply the obvious answer, Michael pushes back with more nuance than that framing usually gets, warning that an arms race mentality can leave everyone burned, and that the real fix is architectural. He describes a least access philosophy that extends zero trust internally, treating even an organization's own network as untrusted, requiring every user and every AI agent employees build to be segmented down to only the specific applications and data they actually need, monitored the same way a service account would be. The conversation turns to the practical challenge of getting organizations to actually fund this kind of security, and Michael is clear that the winning argument isn't fear, it's framing security spending as a business enabler rather than a cost center, forcing leadership to weigh what could be lost in time, money, and trust against the investment required to prevent it. He's candid that responsibility for security can no longer sit only with IT, and that everyone in an organization has to own some piece of it. On the question of whether AI will eventually make user security awareness training obsolete entirely, Michael offers a genuinely distinct perspective from the more optimistic take Matthew proposes: even if workplace tools someday catch everything automatically, employees still won't have those same protections at home, and Michael continues training specifically to close that gap, since an employee who gets hit personally often ends up missing work to recover from it. The back half of the episode covers two threads that stick with the listener. First, Michael explains that many of the AI hallucinations organizations blame on the model are actually a symptom of poor internal data, meaning the fix is rewriting and cleaning up an organization's own source material before feeding it into any system, not distrusting the AI itself. Second, he shares a story from his own small community of roughly 4,000 people: after a local fire captain passed away, someone used the publicly posted funeral details to determine exactly when his house would be empty and broke in, only to be caught waiting by police, the intruder turning out to be a deputy sheriff. Michael uses the story to make a simple, memorable point about privacy: any piece of information posted publicly will eventually be used by someone, for something, and understanding that risk is now as much a part of the job as any technical control.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  7. Sep 28

    Shared Governance in the Age of AI: Keeping the Institution Safe with Bill Guerrero - Ep 240

    Guest Introduction Bill Guerrero is the VP of IT at Sacred Heart University, a private, faith-based, residential institution in Fairfield, Connecticut with roughly 10,000 students, 50 buildings, and nearly 2,000 cameras across campus. A proud alum who earned his master's there in 1999, Bill brings an unusual dual background to the role, having started his career at Gartner before spending years as a CFO, a financial lens he now applies directly to how the university budgets for AI. He joins the show during the first week of a new semester to talk through a live third-party security incident his team resolved in real time, why token and credit costs deserve the same budget scrutiny as any other line item, and why he believes the new professional standard is AI-assisted work refined by a human, not work produced by a human alone.   Here's a Glimpse of What You'll Learn How Bill's team resolved a third-party zero-day breach affecting a campus vendor in just 24 hours Why Bill treats tokens and credits as a budget item universities can't afford to leave unaccounted for How Bill uses Claude with read-only access to run low-cost internal pen tests against the university's own framework Why Bill believes the new professional standard is AI-assisted work with a human review layer on top How Sacred Heart's shared governance model keeps AI adoption fast without letting any department run rogue Why Bill still uses AI for the small, personal tasks in his life outside the office, including coaching baseball How a real, current incident at a major learning management system provider shaped Bill's own continuity planning   In This Episode Bill opens during the exact week cybersecurity pressure peaks for any university, the first week of a new semester, when thousands of students and their devices hit the network at once across a campus with door access systems, high end classroom technology, and nearly 2,000 cameras. He describes a proactive approach built around education before problems start, emailing students, faculty, and staff ahead of time with what to expect and what scams to watch for, while his cybersecurity team, led by his own CISO, works to keep pace with a threat landscape he compares to a constant game of ping pong against attackers who are also upgrading every day. He's candid that Sacred Heart isn't trying to be a bleeding edge leader, running as a Copilot enterprise shop for the past three years, but that shared governance lets academic leaders, faculty, and cybersecurity students get meaningful access without compromising the institution's data. The conversation turns sharply concrete when Bill describes a live incident from the exact weekend of the interview: a third-party vendor supporting the university's mobile credential printing system was hit by a zero-day exploit. Because of layered security defenses including CrowdStrike, Bill's team caught and remedied the breach within 24 hours, and in a notable twist, it was Sacred Heart's own team that first alerted the vendor to the intrusion. He connects this to a broader shift he's watched happen in real time, referencing a recent incident at a major learning management system provider that affected 900 universities, one Sacred Heart avoided, as a reminder that continuity plans written months ago need to be revisited constantly rather than treated as a one-time compliance exercise. The back half of the episode gets into how Bill actually manages AI adoption without letting cost or fear derail it. Drawing on his background as a recovering CFO, he explains why tokens and credits function like a printing budget that can quietly run out, an unbudgeted surprise if leadership isn't paying attention, and why total cost of ownership needs to include this line item explicitly. He describes using Claude with carefully scoped, read-only access to walk through the university's own firewall and network settings, comparing it against Sacred Heart's existing framework to run what amounts to a no-cost internal pen test rather than paying six figures for an external one. He closes on a personal note entirely outside of IT, describing how he used AI to rebuild a baseball practice schedule for a coaching role he's returning to after years away, tweaking the output himself rather than accepting it wholesale, a small example of the exact philosophy he argues the whole university should adopt: let AI produce the polished first draft, then apply the human judgment that makes it genuinely yours. SPONSOR FOR THIS EPISODE: This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

  8. Sep 23

    Playing With Fire: Securing AI Without Shutting Off the Stove with Nakeea Neischer - Ep 239

    Guest Introduction Nakeea Neischer is the Director of IT and CISO at RxVantage, a healthcare SaaS platform that serves as a bridge between medical providers and life science companies. With more than 10 years in security, Nakeea has built her approach around a philosophy she describes through baking, gathering the right ingredients of people, process, and tools, then figuring out how those pieces combine into something the whole business can actually use. She joins the show to talk candidly about blast radius risk with AI agents, why she believes the industry has quietly shifted from prevention to recovery as the true measure of a security program, and why she thinks fear, not the technology itself, is security's biggest obstacle right now.   Here's a Glimpse of What You'll Learn Why Nakeea compares building a security program to being the chef who has to bake a cake everyone enjoys How Nakeea thinks about blast radius as her single biggest concern with deploying AI agents Why Nakeea uses fire as her central analogy for AI, dangerous, necessary, and not something you can simply avoid How third party vendor risk has quietly gotten worse as vendors move faster on AI than the organizations that use them Why Nakeea argues patching alone is already too late against machine speed zero day exploits Why Nakeea believes the industry has shifted from asking can we prevent a breach to asking how fast can we recover Nakeea's take on why security teams need to extend AI the same grace they've started giving breached organizations   In This Episode Nakeea opens by describing the core tension every SaaS security leader faces, protecting an organization internally while also defending an entire platform full of client data, all while AI reshapes both sides of that equation at once. She leans on her baking analogy to explain why security can't be only about tools, arguing that leadership habits, employee behavior, and business priorities all have to be understood before any framework or technical control gets layered on top, and that a security leader's real job is producing an outcome the whole business can live with, not simply locking everything down. She's candid that this balance is uncomfortable by design, since being too secure creates the same kind of failure as being too loose. The conversation turns to where Nakeea sees the sharpest risk in AI adoption, and she keeps returning to a single word, blast radius. She argues that comfort is the real danger, the same way a homeowner who has never been robbed eventually forgets to lock the back door, and that once an AI agent has access inside a network, the questions that matter are how much segmentation exists and what is truly off limits to it. She uses fire as her governing metaphor throughout, arguing that AI is exactly like fire in a home: genuinely dangerous, capable of burning everything down, and yet not something any household actually gives up, because the answer is learning to use it correctly rather than refusing to use it at all. She connects this to the Hugging Face sandbox incident as a preview of the test-and-learn process the industry is now going through, and argues that fighting AI with AI, rather than trying to out-work it manually, is the only realistic path forward. She also floats a concrete use case, feeding an organization's SSPs and frameworks into an AI system with carefully scoped, read only access to audit compliance gaps far faster than a manual review, while cautioning that the right approach is feeding in pieces at a time rather than dumping a sensitive document in all at once. The back half of the episode gets pointed about how fast organizations actually need to move. Nakeea explains that third party vendor risk has quietly gotten worse, since a company that is behind on AI internally is still relying on vendors who are moving fast on AI regardless, and that bureaucratic approval timelines that once felt normal are now themselves a security liability given how quickly zero day exploits move. She argues patching can no longer be treated as sufficient on its own, and that organizations need AI actively watching their own networks for abnormal behavior in real time, catching an intrusion the moment it happens rather than waiting for a SOC analyst to notice hours later. Drawing a comparison to her own daughters navigating early adulthood after years of academic perfectionism, she argues mistakes are only failures when people stop trying to learn from them, a lesson she believes applies just as much to AI vendors as to young adults. She closes with a broader argument that the industry has shifted from asking whether a breach can be prevented to asking how well an organization recovers from one, and makes the case that AI, like human security teams, deserves the same grace to learn through mistakes the industry has already extended to breached organizations.   This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

See All (244)

5
out of 5
4 Ratings

About

Welcome to The Cyber Business Podcast where we feature top founders and entrepreneurs and share their inspiring stories.

Information

  • Creator
    Matthew Connor
  • Years Active
    2022 - 2026
  • Episodes
    244
  • Rating
    Explicit
  • Copyright
    © The Cyber Business Podcast (c) 2022
  • Show Website
    The Cyber Business Podcast