Musings from the Cyber Trench

Vishal Masih
  • 5.0 (1)
  • Technology
  • Weekly

Musings from the Cyber Trench Podcast is where cybersecurity gets real. It’s for leaders battling red tape, tech debt, and chaos, looking for straight answers, not vendor fluff. Each episode goes deep with people solving the hard problems others avoid.The vision? Bring clarity to complex, high-risk environments. Guests are sharp thinkers and operators from agencies, universities, nonprofits, and regulated industries. This is not selling; This is sharing what it actually takes to protect systems that matter.

  1. Oct 19

    Cybersecurity Skills Are Changing Faster Than Our Hiring Models | Anil Saxena | Episode 116

    Send us Fan Mail AI is changing cybersecurity work. But the bigger challenge for leaders may be whether their talent strategy is changing fast enough to keep up. The organizations that succeed will not simply hire more experienced people. They will need to identify potential earlier, develop talent internally, create room for continuous learning, and rethink what entry-level cybersecurity work should look like in an AI-enabled environment. In this episode of Musings from the Cyber Trench, I sit down with Anil Saxena, a workforce development and platform-driven learning leader at ServiceNow, to discuss what is broken in the way organizations hire, train, and develop cybersecurity talent. We explore how AI is changing cybersecurity roles, why credentials and years of experience are incomplete measures of potential, how simulation-based learning could improve technical hiring, and why organizations need to treat cybersecurity talent as a long-term system rather than a series of positions to fill. Anil shares practical insights on: Why organizations need to develop cybersecurity talent internally instead of relying primarily on experienced external hiresWhy analytical thinking, pattern recognition, curiosity, and stakeholder management become more valuable as AI automates routine workHow leaders can evaluate cybersecurity potential beyond certifications and years of experienceWhy simulation-based exercises may provide a better way to assess how candidates solve real problemsHow AI can eliminate low-value administrative work without eliminating the need for meaningful entry-level rolesWhy cybersecurity training fails when organizations use one-size-fits-all programs without follow-up or hands-on applicationHow organizations can build a cybersecurity talent pipeline around future business needs instead of reacting to vacanciesWhy mid-career cybersecurity professionals should learn to work with AI rather than compete against itHow strong technical teams depend on leadership, shared working norms, and a common objectiveThe central takeaway is that cybersecurity workforce development cannot remain reactive. Organizations need to think several years ahead, identify people with the right underlying capabilities, give them meaningful opportunities to learn, and deliberately build the bench before the talent is urgently needed. ABOUT ANIL SAXENA Anil Saxena works in workforce development and platform-driven learning at ServiceNow, including work with ServiceNow University. His background spans engineering, organizational design, enablement, and the development of technical teams. His work focuses on how organizations build skills, develop people, and create learning systems that can scale as technology and workforce requirements change. ZERO TRUST READINESS ASSESSMENT Responsible for ICAM, Zero Trust, or identity security within a federal agency, prime contractor, or large regulated enterprise? If you are trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: https://zephon.tech/zt Questions or guest suggestions? defend@zephon.tech Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

  2. Sep 30

    Have We Shifted Cybersecurity Too Far Left? | Rick Clark | Episode 115

    Send us Fan Mail Moving security left was supposed to reduce risk. Instead, many organizations have made developers responsible for hundreds of controls they cannot realistically understand, manage, or consistently enforce. In this episode of Musings from the Cyber Trench, I sit down with Rick Clark, a cloud, open-source, Linux, and platform engineering leader with three decades of experience, to discuss whether cybersecurity has shifted too far left. We examine how organizations can build security controls directly into their platforms, reduce control sprawl, respond faster to vulnerabilities, and measure software delivery based on business and security outcomes, not deployment speed alone. Rick shares practical insights on:  Embedding security controls into CI/CD platforms so they are applied automatically  Keeping control ownership with information security while reducing the burden on developers  Restoring architectural oversight without unnecessarily slowing delivery  Reviewing legacy controls instead of carrying them unchanged from on-premises environments into the cloud  Using AI to enforce security controls rather than simply producing code faster  Measuring software delivery against business value, compliance, and risk  Recovering from zero-day vulnerabilities through standardized containers and centralized platform control  Using mutual TLS and end-to-end identity tracking to secure platform communications  Protecting sensitive data, private keys, and certificates from immature AI agents The central takeaway is straightforward: developers should write secure code, but they cannot carry the organization’s entire cybersecurity, operations, compliance, and cost-management burden. Security teams must define the controls, and platform teams must make those controls consistent, automatic, and easier to use. ABOUT RICK CLARK Rick Clark has 30 years of experience across cloud computing, open source, Linux, platform engineering, and security. He led the development of Ubuntu Server, led engineering for the Rackspace Cloud and helped found OpenStack, worked in the CTO’s office at Cisco Systems, and helped build the Reliance Jio cloud infrastructure in India. ZERO TRUST READINESS ASSESSMENT Responsible for ICAM, Zero Trust, or identity security within a federal agency, prime contractor, or large regulated enterprise? If you are trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: https://zephon.tech/zt Questions or guest suggestions? defend@zephon.tech Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

  3. Sep 14

    Prompt Injection Is a Data Access Problem | Sundar Krishnamurthy | EP 114

    Send us Fan Mail You cannot secure AI by filtering prompts alone. If an AI agent can retrieve sensitive data or execute actions, prompt injection becomes an identity, authorization, and architecture problem. In this episode of Musings from the Cyber Trench, I sit down with Sundar Krishnamurthy, Senior Security Architect at Expedia Group, to discuss how organizations can secure AI in real enterprise environments. We examine why prompt-level guardrails are not enough, how non-human identities should remain connected to the people they represent, and why security controls must be enforced close to the data and action being requested. Sundar shares practical insights on: Turning security assumptions into automated testsUsing LLMs to support code reviews and threat modelingHow indirect prompts can bypass basic guardrailsEnforcing authorization at the point of data retrievalMaintaining human and non-human identity contextIsolating vector stores to reduce cross-tenant exposureAvoiding security shortcuts during MVP developmentProtecting private data when using AI modelsThe central message is simple: AI security cannot depend on trusting the model or recognizing every malicious prompt. Identity, authorization, data isolation, logging, and defense in depth must be built into the underlying architecture. ABOUT SUNDAR KRISHNAMURTHY Sundar Krishnamurthy is a Senior Security Architect at Expedia Group. He conducts architecture reviews across applications, cloud, networks, infrastructure, and AI and machine learning security. His background includes work with AWS, SAP Concur, and Microsoft. Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

  4. May 31

    Compliance, GRC, cybersecurity maturity, audit readiness, AI, CMMC, and continuous security

    Send us Fan Mail Too many organizations still treat compliance as a one-time audit exercise: get the certification, satisfy the customer, and move on. In this episode of Musings from the Cyber Trench, I sit down with Sarah Lynn, a seasoned IT, cybersecurity, GRC, advisory, and audit preparation leader, to discuss why that mindset breaks down fast. We talk about what happens when compliance is treated as “paperwork,” where programs usually fail first, and why people, process, and technology all have to work together for compliance to become part of daily operations. Sarah also shares practical insights on:  Why undocumented processes are a major red flag  How leaders can move from checklist compliance to security maturity  Where organizations underinvest and overspend in compliance programs  Why buying a tool before understanding the process usually backfires  AI’s role in compliance, automation, meeting notes, artifact collection, and risk  Why CMMC, SOC 2, ISO, FedRAMP, and other frameworks require continuous effort  How trusted advisors and peer groups can help leaders avoid reinventing the wheel The core message: compliance is not something you “get through.” Done right, it becomes a habit, a management discipline, and a foundation for stronger security. Guest: Sarah Lynn brings 25+ years across IT, cybersecurity, GRC, audit readiness, risk, continuity, and technology operations, helping SaaS/IaaS-driven organizations turn compliance into practical, business-aligned security. Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

  5. Apr 22

    Energy Is the Upstream Cyber Risk in Power Infrastructure | Bethun Bhowmik | EP 112

    Send us Fan Mail Energy is the upstream of everything In this episode we explore how energy infrastructure has become one of the most critical and vulnerable systems in the modern world From power grid attacks to systemic risks this conversation reveals why cyber threats to energy impact entire nations Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

    Energy Is the Upstream Cyber Risk in Power Infrastructure | Bethun Bhowmik | EP 112

  6. Apr 8

    The Leadership Mistake That Breaks Security Systems | Morgan Reed | EP 111

    Send us Fan Mail This episode explores the leadership and design challenges behind modern cybersecurity failures. Morgan Reed, CTO of Transbridge, shares how traditional approaches to security focused on controls, compliance, and restriction often ignore the most critical variable: human behavior. The discussion reframes cybersecurity as a design and leadership problem, where usability, context, and adaptability determine effectiveness. You’ll learn: - Why leadership decisions shape security outcomes - How excessive controls create friction and risk - The gap between security policy and real world behavior - Why human centered design is critical in cybersecurity - How AI can support adaptive, context aware systems - What leaders must change to build resilient security environments This episode is ideal for executives, CISOs, and technology leaders focused on improving security, reducing risk, and building systems that actually work in practice. Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

    The Leadership Mistake That Breaks Security Systems | Morgan Reed | EP 111

  7. Mar 25

    Cyber Risk Quantification Explained: How to Turn Security into Business Decisions | Edwin Covert | EP 110

    Send us Fan Mail  In this episode of Musings From the Cyber Trench, Vishal Masih speaks with cybersecurity expert Edwin Covert about the evolution of cyber risk management. Edwin explains why traditional qualitative risk models fail to support business decision making and how organizations can adopt risk quantification to measure probability and financial impact. The conversation explores how cybersecurity teams can better communicate with business leaders, align with enterprise risk management, and make more effective decisions based on data. Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

    Cyber Risk Quantification Explained: How to Turn Security into Business Decisions | Edwin Covert | EP 110

  8. Mar 11

    The Mindset Shift That Makes Cybersecurity Personal | Robert Siciliano | EP 109

    Send us Fan Mail Cybersecurity expert Robert Siciliano joins Vishal Masih on Musings from the Cyber Trench to discuss why cybersecurity is ultimately a human behavior challenge. Robert explains why traditional compliance training often fails, how cybercriminals exploit human trust, and why organizations must focus on building a human firewall rather than relying solely on technology. Robert Siciliano is a private investigator, Certified Speaking Professional (CSP), CEO of Protect Now, LLC, and creator of The Strategic Human Firewall™. He is widely recognized as one of the leading experts on cybercrime and identity theft, with more than 500 television appearances, 1,000 radio contributions, and 3,000+ media features. The conversation explores how companies can build stronger cybersecurity cultures by helping employees understand that protecting company data also protects their own identity and security. Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise? If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt Questions or guest ideas? Email defend@zephon.tech

    The Mindset Shift That Makes Cybersecurity Personal | Robert Siciliano | EP 109
See All (16)

About

Musings from the Cyber Trench Podcast is where cybersecurity gets real. It’s for leaders battling red tape, tech debt, and chaos, looking for straight answers, not vendor fluff. Each episode goes deep with people solving the hard problems others avoid.The vision? Bring clarity to complex, high-risk environments. Guests are sharp thinkers and operators from agencies, universities, nonprofits, and regulated industries. This is not selling; This is sharing what it actually takes to protect systems that matter.

Information

  • Creator
    Vishal Masih
  • Years Active
    2025 - 2026
  • Episodes
    16
  • Rating
    Clean
  • Copyright
    © 2026 Musings from the Cyber Trench
  • Show Website
    Musings from the Cyber Trench