The Brief on Cybersecurity, Compliance, Risk, AI

Charles Denyer
Charles Denyer

The Brief with Charles Denyer is your guide to cybersecurity, AI, compliance, risk, and data privacy. Each week, Charles brings sharp insights and practical strategies to help you reduce risk, cut costs, and protect what matters most. From regulatory chaos to AI uncertainty, Charles breaks down the issues leaders face today — with real answers and real solutions. Listen on Apple, Spotify & more. Learn more: charlesdenyer.com Contact: info@charlesdenyer.com

  1. 3d ago

    Is Security Awareness Training a Waste of Money? What a 20,000-Person Study Found | EP 36

    In this episode of The Brief, Charles Denyer challenges a ritual nearly every organization in America performs without question — the annual security awareness training — and asks whether the billions spent on it actually make anyone safer. He opens with the ritual everyone recognizes: the yearly email, the cartoon villain in a hoodie, a few slides, a short quiz, and a certificate declaring the employee a “human firewall.” Hospitals, banks, and police departments all run some version of it, in part because regulations like HIPAA, PCI DSS, and the FBI’s CJIS policy require it. The promise underneath is simple — train the human, and you close the hole. Then Charles turns to the evidence. Researchers at the University of California, San Diego ran one of the most rigorous tests ever attempted: a randomized controlled trial across nearly 20,000 employees of a major health system, over eight months, with ten real phishing campaigns. The findings are sobering. The training delivered right after someone failed a simulated phishing test reduced future clicking by about 2 percent — a rounding error. Whether an employee had recently completed their mandatory annual training had no meaningful relationship with whether they fell for a phishing email at all. And when researchers looked at how people actually engaged, roughly 75 percent spent a minute or less on the material, and a third closed it immediately without reading a word. But he raises the deeper, more uncomfortable question: if the training barely works, why does every organization keep buying it? Part of the answer, Charles argues, is that much of it isn’t really purchased to change behavior — it’s purchased to transfer liability, so that when an employee inevitably clicks, the organization can point to the training records and say the fault was theirs. Over the full eight months of the study, more than half of the workforce clicked at least one phishing link. The lesson isn’t that people are careless; it’s that humans are human, and an attacker only has to win once. He’s careful to be fair — teaching people to report a suspicious email genuinely helps, and the rules still require awareness training — but “required to do it” and “allowed to rely on it” are two very different things. His message is clear, and it’s the same one the researchers reached: stop trying to turn your people into a firewall, and start building systems that survive them being human. The controls that actually move the needle are technical — multi-factor authentication so a stolen password alone can’t open the door, and password managers that fill credentials only on the real website and stay silent on the fake one. Keep the training lean and honest for compliance; put the real money where the evidence points. Stop trying to win the argument with your own employees. Start building a system that doesn’t need to. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer.Learn More: charlesdenyer.com | Instagram: @denyer.charles | LinkedIn: https://www.linkedin.com/in/charlesdenyerQuestions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  2. 3d ago

    Why HIPAA Can’t Protect Your Medical Records — a Billion Breached and Counting | EP 35

    In this episode of The Brief, Charles Denyer takes on one of the most trusted names in American law — HIPAA — and asks an uncomfortable question: how did the law written to protect your medical records end up presiding over the largest leak of them in history? He opens with a number that is hard to believe. Since 2009, when the federal government first began keeping count, more than one billion health records have been exposed in large breaches in the United States — nearly three times the country’s population. The law most Americans assume is guarding that data, the Health Insurance Portability and Accountability Act, was passed in 1996, and its Security Rule — the part meant to force hospitals to actually protect electronic records — has not had a serious update since 2013. Charles breaks down three failures hiding behind the acronym. The scale: 2024 was the worst year on record, with more than 240 million health records exposed — a single attack on a little-known claims processor, Change Healthcare, accounted for roughly 192.7 million of them, nearly two-thirds of the country. The enforcement: in that same record-breaking year, federal regulators imposed their most penalties ever and collected about $10 million — roughly four cents for every person exposed — while HIPAA gives individuals no right to sue on their own behalf. And the coverage gap: HIPAA governs doctors, hospitals, and insurers, but not the mental-health apps, fertility trackers, prescription-discount services, and DNA-testing companies where an estimated 160 million Americans now pour their most intimate information. But he raises the harder point: the data HIPAA doesn’t touch is often the most sensitive of all. Federal regulators caught two major health platforms — the prescription-savings service GoodRx and the online therapy company BetterHelp — sharing users’ health information with advertisers, conduct HIPAA had nothing to say about because the law drew its boundary in 1996, for a world without smartphones. A long-promised overhaul of the Security Rule — mandatory encryption, multi-factor authentication, real recovery testing — has been proposed, but as of late 2026 it remains only a proposal, with the deadline to finalize it already slipped to 2027. His message is clear: HIPAA did real good — it gave patients rights they never had and dragged breaches into the daylight — but on both its reach and its teeth, it has fallen behind the threat it was built to stop. The organizations that leaked a billion records mostly had the paperwork. And a credit card can be reissued; a medical history cannot. “HIPAA compliant” was never the same thing as safe. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com | Instagram: @denyer.charles | LinkedIn: https://www.linkedin.com/in/charlesdenyerQuestions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  3. Oct 21

    Inside the FBI CJIS Security Policy — the Biggest Overhaul in a Decade | EP 33

    In this episode of The Brief, Charles Denyer takes listeners inside one of America's most powerful and least understood information systems — the FBI's Criminal Justice Information Services (CJIS) — and the sweeping security overhaul changing how the nation's most sensitive criminal justice data is protected. He opens in 1967, when a New York City police officer ran a stolen license plate through the brand-new National Crime Information Center (NCIC). Nearly sixty years later, that system and the databases surrounding it handle approximately 14 million queries a day, connecting more than 90,000 agencies to criminal histories, warrants, missing-person records, and other sensitive information. Charles breaks down the FBI's CJIS Security Policy Version 6.0, its expansion from 13 to 20 policy areas, new authentication requirements, and the September 2027 implementation deadline. But he raises a more troubling question: what happens when the greatest threat isn't a hacker trying to break in, but someone who already has authorized access? Drawing on an Associated Press investigation documenting hundreds of cases of law enforcement personnel misusing criminal justice databases, Charles exposes the uncomfortable reality that stronger passwords, encryption, and multi-factor authentication cannot prevent an authorized insider from abusing the system. He's careful to distinguish the overwhelming majority of officers who use these tools responsibly from those who exploit them. His message is clear: modernizing the rulebook is essential, but without meaningful oversight, continuous auditing, and accountability, even the strongest security policy is little more than paper. The rulebook is the floor. Public trust is what you're actually protecting. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com | Instagram: @denyer.charles | LinkedIn: https://www.linkedin.com/in/charlesdenyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  4. Oct 20

    The Grand Illusion of "Hey, We’re Compliant so We're Secure!" | EP 32

    In this episode of The Brief, Charles Denyer says the quiet part of his own industry out loud: most compliance isn’t security — it’s theater. He opens on Target, certified PCI compliant in September 2013 and breached weeks later, and Equifax, which had the compliance programs and still lost 147 million people’s data to a patch it never installed. Building on the idea of “security theater” coined by Bruce Schneier, Charles explains the snapshot problem — only about 29% of companies stay compliant a year after passing their audit — and why the incentives of the whole ecosystem point at the certificate instead of the protection. He’s careful to be fair: the frameworks aren’t the villain; the problem is everyone who lip-syncs them. The hard truth for leaders is that the certificate on your wall might be the most dangerous thing you own, because it lets you stop looking — and the attacker shows up on day 200, not on audit day. Compliance is a floor, not a ceiling. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com | Instagram: @denyer.charles | LinkedIn: https://www.linkedin.com/in/charlesdenyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  5. Oct 20

    How the Pentagon Suspended CMMC — and What It Really Means | EP 30

    In this episode of The Brief, Charles Denyer tackles the July 2026 suspension of CMMC — and the three words that tore across the defense world: “CMMC is dead.” It isn’t, and the gap between what people think happened and what actually happened is where the danger lives. Charles walks through what the Department of War actually suspended, what remains legally binding right now — DFARS 7012, NIST 800-171, SPRS scores, and annual affirmations — and why the 100,000-companies-to-100-assessors bottleneck forced the pause. He makes the case that removing the third-party auditor doesn’t lower a contractor’s risk; it moves that risk onto whoever signs the self-assessment, and even revives False Claims Act exposure. The honest bottom line: the certificate got suspended, but the responsibility did not — and the smart move is to keep building to the standard, because the threat that justified CMMC was never on a government timeline. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com | Instagram: @denyer.charles | LinkedIn: https://www.linkedin.com/in/charlesdenyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  6. Jul 1

    CMMC Section 4: The CUI Storage Workbook — Every Place CUI Lives at REST in your Environment | EP 29

    In this episode of The Brief, Charles Denyer continues his 8-part CMMC series with Step 4: CUI Storage — where Controlled Unclassified Information lives at rest in your environment, and why this is where compliance scope explodes most unexpectedly. Building on the processing framework from Episode 28, Charles explains that CUI does not disappear once work is finished. It persists — in primary repositories, collaboration platforms, application databases, endpoint profiles, backup vaults, archives, and email tenants — often long after the people who put it there have stopped thinking about it. He walks through a structured, workbook-driven methodology covering three matrices and a supporting gaps log designed to make every CUI storage location visible, classified, evidenced, and defensible. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn more at charlesdenyer.com | Instagram: @denyer.charles | Facebook: @charles.denyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  7. Jun 4

    CMMC Section 3: The CUI Processing & Transformation Workbook — What Happens to CUI AFTER It Enters Your Environment | EP 28

    In this episode of The Brief, Charles Denyer continues his 8-part CMMC series with Step 3: CUI Processing and Transformation — what actually happens to Controlled Unclassified Information after it enters your environment, and why this is where risk concentrates and assessors probe hardest. Building on the ingestion framework established in Episode 27, Charles explains that CUI rarely stays static after arrival. It gets viewed, edited, analyzed, exported, annotated, and transformed through the normal course of engineering, proposals, testing, and program execution — and every one of those activities creates artifacts. Drafts, working files, autosave copies, intermediate outputs, cached downloads, and derivative reports are where CUI quietly spreads, where scope silently expands, and where compliance programs that looked solid on paper begin to break down under real assessment conditions. He walks through a structured, workbook-driven methodology covering three matrices and two supporting logs designed to make CUI processing visible, mapped, and defensible The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn more at charlesdenyer.com | Instagram: @denyer.charles | Facebook: @charles.denyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

  8. Apr 26

    CMMC Section 2: The CUI Ingestion & Entry Points Workbook — Documenting How CUI Enters Your Environment | EP 27

    In this episode of The Brief, Charles Denyer continues his 8-part CMMC series by breaking down Step 2: CUI Ingestion—how Controlled Unclassified Information actually enters your environment and why this is where most organizations lose control of their compliance scope. Building on the foundation established in Episode 26, Charles explains that defining CUI is only the beginning. The real challenge lies in controlling how that data flows into your systems through contracts, vendors, email, file transfers, and internal processes. He walks through a structured, workbook-driven methodology for identifying ingestion points, validating incoming data, restricting approved channels, and aligning all entry points to your system boundary. This episode makes one thing clear: if you cannot control how CUI enters your environment, your scope is already compromised. And if your scope is not controlled, your compliance program will not withstand assessment. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn more at charlesdenyer.com | Instagram: @denyer.charles | Facebook: @charles.denyer Questions/Topics/Advertising: info@charlesdenyer.com Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

See All (35)

Trailer

Ratings & Reviews

5
out of 5
2 Ratings

About

The Brief with Charles Denyer is your guide to cybersecurity, AI, compliance, risk, and data privacy. Each week, Charles brings sharp insights and practical strategies to help you reduce risk, cut costs, and protect what matters most. From regulatory chaos to AI uncertainty, Charles breaks down the issues leaders face today — with real answers and real solutions. Listen on Apple, Spotify & more. Learn more: charlesdenyer.com Contact: info@charlesdenyer.com

Information

More From Charles Denyer