Distilled Security Podcast

Justin Leapline, Joe Wynn, and Rick Yocum
  • 5.0 (1)
  • Business
  • Updated Monthly

Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.

  1. Oct 5 ·  Video

    Episode 29: TRISS Pittsburgh, CMMC Update & Should We Be Pacing AI? — feat. Doug Salah

    In Episode 29, Doug Salah returns as DSP's first-ever repeat guest. We preview TRISS Pittsburgh 2026 (October 22nd, $118K+ in scholarships over 9 years), break down the real implications of the CMMC pause and class deviation, and debate whether pacing AI development makes any sense when adversaries won't slow down. Plus Angel's Envy Cask Strength 2026 and a surprise guest bottle.  🥃 ⏱️ TIMESTAMPS: 00:00 – Intro & Welcome Back Doug Salah 🎉02:32 – TRISS Pittsburgh 2026 Preview10:35 – Scholarships, Sponsors & How to Get Involved19:35 – CMMC Pause & Class Deviation Explained27:00 – NIST Rev 3, Post-Quantum & Self-Reporting Risk33:00 – Prime Supplier Readiness Programs45:00 – C3PAOs: Still Auditing55:56 – TPRM Is Dead — Teaser 👀1:03:00 – 🥃 Angel's Envy Cask Strength 20261:15:17 – Should We Be Pacing AI?1:23:10 – Pacing vs. Gating: What's the Right Move?1:36:00 – Small Models, Nation States & AI Weapons1:49:00 – Purpose Creep & Ungoverned Automation2:02:29 – Wrap-Up 🎙️ Hosts  Justin Leapline – @justinleapline Joe Wynn – @wynnjoe Rick Yocum – @rickyocum 🎤 Guest Doug Salah — linkedin.com/in/douglassalah 📬 Send Us Your Questions! ask@distilledsecuritypodcast.com 🌐 Connect with Us Website: distilledsecuritypodcast.com X: @DisSecPod Email: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for monthly security and compliance insights.

  2. Sep 10 ·  Video

    Episode 28: Flock Cameras & Privacy, Hacking Water Systems & How to Pick a Good Bourbon

    This episode covers the growing controversy around Flock cameras: what they are, how their centralized license plate reader network enables powerful searches across jurisdictions, the documented cases of abuse by law enforcement, and why the real problem isn't the technology itself but the lack of governance and oversight. We also explore the broader privacy implications of always-on surveillance in public spaces and where the line should be drawn. Then we break down a coordinated cyberattack that hit 30+ water systems across 12 states, exposing just how vulnerable US critical infrastructure really is. With 90% of community water systems having zero IT security budget, we discuss what basic OT hygiene should look like and spotlight the volunteer group Water Watch Center doing incredible work to fill the gap. And for something a little different we do a deep dive into how to actually pick a good bourbon. Red flags on the shelf, what terms like "small batch" and "handcrafted" really mean, why older isn't always better, the massive barrel surplus reshaping the industry, and the distillation process behind what's actually in your glass. 🥃 Spirit Review: Boondocks Port Finished Straight Bourbon Whiskey 6 years, finished in port wine barrels, picked up in Kentucky Takeaways Flock cameras raise concerns about privacy, abuse, and the need for oversightThe use of surveillance technology has broader ethical and societal implicationsSurveillance technology presents ethical and moral dilemmasThe need for checks and balances and governance in surveillance technologyMarketing gimmicks can influence consumer choicesProof and distillation process impact the quality of whiskeyThe whiskey industry is experiencing a surplus of barrelsWater utilities face cybersecurity challenges due to limited budgets and resourcesBasic cybersecurity measures, such as removing unnecessary internet access, replacing default credentials, and using multi-factor authentication, are crucial for protecting critical infrastructureChapters 00:00 Introduction to Flock Cameras03:00 Capabilities and Controversy08:12 Ethical Implications and Privacy Concerns16:00 Data Collection and Surveillance Technology30:36 Challenges of Surveillance Technology36:04 Ethical and Moral Considerations41:43 Governance and Oversight52:37 Privacy Concerns and Public Trust57:24 Impact of Marketing Gimmicks58:07 Significance of Proof and Distillation Process01:00:42 Surplus of Barrels in the Whiskey Industry01:07:11 Tasting Notes and Availability of Specific Bourbon01:25:27 Hacking of Utilities and Water Systems01:26:15 Challenges Faced by Water Utilities01:38:24 Implications of Compromised Water Systems01:43:17 Role of Volunteer Organizations and Basic Cybersecurity MeasuresHostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum Send Us Your Questions!ask@distilledsecuritypodcast.com Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com 👍 Subscribe for monthly security and compliance insights.

  3. Jun 10

    Episode 25: AI, Vulnerability Management & The Future of GRC Engineering

    In this episode of the Distilled Security Podcast, we dive into AI-driven vulnerability management, a massive breach hitting 9,000 educational institutions, and the future of GRC engineering, including a live preview of what autonomous compliance agents actually look like in practice. 🔹 AI & Vulnerability Management — Why the next 6–18 months will be a patching crisis, how AI models are accelerating zero-day discovery, the operational reality of back-to-back criticals, surge scenario planning, burnout risk, and Microsoft's M-Dash orchestrated agent approach 🔹 The Canvas/Instructure Breach — 275 million records exposed, finals week disrupted across 9,000 universities, a rumored $10M ransom negotiated by the SaaS provider, the ShinyHunters connection, and what this means for critical infrastructure concentration risk 🔹 GRC Engineering Meets AI — Deterministic vs. non-deterministic testing explained, why auditors can't rely on AI-generated evidence, autonomous agents with segregation of duties, the episki 2.0 platform preview, and the emerging role of the "orchestration conductor" in security teams 🥃 Spirit Review: Heaven Hill Grain to Glass (DSP KY-1) ⏱️ Timestamps00:00 – Intro & Topics Overview01:27 – AI & The Coming Vulnerability Surge07:00 – Patching Windows, Burnout & Operational Reality16:40 – Surge Scenarios, Fix-It Weeks & Recommendations21:20 – Microsoft M-Dash: Orchestrated Agent Scanning25:56 – The Canvas/Instructure Breach Breakdown33:18 – Critical Infrastructure & Third-Party Concentration Risk47:00 – Black Kite 2026: Third-Party Breach Report53:11 – Spirit Review: Heaven Hill Grain to Glass57:07 – BSides Pittsburgh 2026 Update1:04:01 – GRC Engineering Meets AI1:19:00 – Deterministic vs. Non-Deterministic Testing Explained1:25:00 – episki 2.0 Platform Preview1:47:00 – AI Segregation of Duties & Three Lines of Defense1:53:00 – The Orchestration Conductor: A New Security Role2:02:31 – Outro & Wrap-Up 🎙️ Hosts Justin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum📬 Send Us Your Questions!ask@distilledsecuritypodcast.com 🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for monthly security and compliance insights.

  4. May 14

    Episode 24: 2 Years, 24 Episodes & The State of Security in the Age of AI

    In this episode, we celebrate our 2nd anniversary and Episode 24 of Distilled Security! We cover the Vercel breach, how a Roblox script led to compromised Google Workspace credentials via an unauthorized OAuth connection. Then we dive into HackerOne, pausing their own bug bounty program, overwhelmed by low-quality, AI-generated submissions. And we close out with the State of Vibe-Coded Security—4,783 AI-assisted apps scanned, 727 critical issues found, and the real question: are you vibe coding or vibe deploying? Plus, a quick look at Claude for Security dropping into public beta and what that means for the industry. All of that, and we crack open a Peerless Double Oak to toast two years of Distilled Security. 🥃 ⏱️ TIMESTAMPS: 00:00 – Intro & 2-Year Anniversary 🎉01:26 – Behind the Scenes & Favorite Moments08:26 – Podcast Metrics & Global Reach24:20 – BSides Pittsburgh 2025 Update 🛡️34:31 – The Vercel Breach & OAuth Risk58:57 – HackerOne Pauses Bug Bounty1:16:05 – Spirit: Peerless Double Oak 🥃1:20:27 – Vibe Coding vs. Vibe Deploying1:26:46 – Claude for Security & AI News1:41:27 – Cheers to Two Years! 🥃 🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum 📬 Send Us Your Questions!ask@distilledsecuritypodcast.com 🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for monthly security and compliance insights

  5. Apr 14

    Episode 23: Nobody read the report

    In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001. We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.  Topics Covered The Delve scandal—leaked reports, copy-pasted audits & pervasive deficienciesThe AICPA peer review process & AC Corp's adverse findingsSOC 2 vs ISO 27001—oversight models, witness audits & accreditationThe incentive structure driving compliance to the bottomCompliance automation — what works, what doesn't & AI's real roleWhat to ask your auditor before signing anythingTrust centers — done right vs. compliance theaterIs SOC 2 dead? What needs to change & who has to change it Hosts Justin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocumHosts Matthew J. Schiavone - (Sikich) Connect with Us Website: distilledsecuritypodcast.comX:  @DisSecPodEmail: hello@distilledsecuritypodcast.com

  6. Mar 9

    Episode 22: Is AI Good for Security, CIRCIA Starts the Clock, and the M&A Problem Nobody's Talking About

    In this episode of the Distilled Security Podcast, we tackle four topics shaping the cybersecurity landscape — from AI's real impact on defense to a wave of regulatory and market changes every security team needs to be tracking. 🔹 Is AI Good for Security? — Anthropic's model finding hundreds of zero days, stock market panic after Claude Code's launch (CrowdStrike down 11%), the "hard things easy, easy things hard" reality of AI, why human-out-of-the-loop isn't ready yet, the coming spike in vulnerability disclosures, and how defenders should be using AI for better hygiene 🔹 CIRCIA Final Rule (May 2026) — The federal incident reporting law hitting critical infrastructure, 72-hour incident and 24-hour ransom payment notification clocks, how "substantial cyber incident" triggers differ from materiality, mid-market companies falling in scope, overlapping timelines with HIPAA/SEC/state breach laws, and building your incident response playbook now 🔹 Protecting Yourself Against a Changing Compliance Landscape — CMMC Phase 2, HIPAA overhaul, CCPA audits all converging, why a unified security program beats framework-by-framework chasing, evidence over policy in audits, engineering continuous compliance through automation, and the reality of doing this without dedicated staff 🔹 Cybersecurity M&A / Consolidation Problem — Google acquiring Wiz for $32B, 10% of the cybersecurity industry changing hands, operational benefits of fewer vendors vs. pricing pressure and talent drain, the OneTrust "sticker on the side" integration warning, Cisco's Startup Studios model, and why consolidation only works if they don't break what made the acquisition special 🥃 Spirit Review: WhistlePig 12 Year Old World Rye PA Fine Wine & Good Spirits Select — Finished in Madeira, Sauternes & Port barrels, 86 proof https://www.whistlepigwhiskey.com/ 📬 Send Us Your Questions! ask@distilledsecuritypodcast.com 🎙️ Hosts Justin Leapline – @justinleapline Joe Wynn – @wynnjoe Rick Yocum – @rickyocum 🌐 Connect with Us Website: distilledsecuritypodcast.com X: @DisSecPod Email: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for weekly security and compliance insights.

  7. Feb 18

    Episode 21: AI Notetakers Are Illegal, GRC Tools Are Lying, and ISO 42001 Changes Everything

    In this episode of the Distilled Security Podcast, we break down three converging forces reshaping how organizations manage AI risk — and what you need to do about it now. 🔹 BIPA + AI Notetakers — A class action lawsuit exposes unauthorized biometric data collection, why a single Illinois meeting participant creates liability, the Shopify wiretapping dismissal, and the steps you should take today to audit your AI tools🔹 GRC Engineering Meets AI — Real AI compliance tools vs. vaporware, using LLMs for policy drafting and control mapping, the hallucination accountability problem, building AI guardrails as code, and the NIST RFI on AI Agent Security (comments due March 9, 2026)🔹 ISO 42001 Deep Dive — The first AI Management System standard, how it differs from ISO 27001, AI Impact Assessments vs. traditional risk assessments, stakeholder engagement requirements, and why certification is becoming essential for EU AI Act compliance 🥃 Spirit Review: Redbreast 12 Cask Strengthhttps://www.redbreastwhiskey.com/en-us/whiskey-collections/redbreast-cask-strength-whiskey/ ⏱️ Timestamps 0:00 Intro & Episode Overview2:04 BIPA & AI Notetakers25:08 GRC Engineering Meets AI1:07:15 🥃 Spirit Review: Redbreast 12 Cask Strength (Irish Whiskey)1:11:17 ISO 420011:49:30 Outro & wrap-up 🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum 🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for weekly security and compliance insights.

  8. Jan 26

    Episode 20 : 2026 Kickoff: Security Resolutions, Key Deadlines, and Don’t Mislead the Feds

    In the first episode of 2026, the Distilled Security team kicks off the year with a practical discussion on security priorities, key compliance dates to watch in 2026, and why misleading the government on cybersecurity compliance can have serious consequences. The conversation focuses on simplifying security programs, returning to core fundamentals, and learning from real-world enforcement and regulatory cases. The episode closes with a holiday pour and a preview of format changes coming next. ⏱️ Timestamps 0:00 Intro & episode overview0:33 2026 security resolutions: simplify & back to basics5:45 “Science projects”: removing emotion from decisions8:36 Justin’s goals: family, travel, business & AI workflows17:52 EOS + Atomic Habits workbook (goal planning)23:54 Key compliance dates to watch in 202631:45 California privacy updates & risk assessments (CCPA)35:39 EU AI Act + NIS2 enforcement ramp-up42:48 Drink break: High West “A Midwinter Night’s Dram.”45:04 Don’t mislead the feds: FedRAMP, SolarWinds, CMMC—wrap-up to 1:20:12 🎙️ Hosts Justin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum🌐 Connect with Us Website: distilledsecuritypodcast.comX:  @DisSecPodEmail: hello@distilledsecuritypodcast.com🥃 Drink of the episode: High West A Midwinter Night’s Dram

See All (28)

Trailer

About

Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.

Information

  • Creator
    Justin Leapline, Joe Wynn, and Rick Yocum
  • Years Active
    2024 - 2026
  • Episodes
    28
  • Rating
    Clean
  • Copyright
    © 2025 Distilled Security Podcast
  • Show Website
    Distilled Security Podcast