Trust and Turbulence

Josh Brickman
  • 5.0 (1)
  • Technology

Joshua Brickman spent more than 20 years working in cybersecurity certifications, government assurance, and global security regulation. This podcast explores the intersection of security, AI, regulation, and trust — from Common Criteria and FIPS 140 to post-quantum cryptography, supply chain security, cloud assurance, and the EU Cyber Resilience Act. The show turns complex technical and policy issues into practical conversations for businesses, policymakers, technologists, and consumers.

Episodes

  1. 9h ago

    Beyond the Certificate: Live from ICCC Rome

    Can security certifications keep pace with the products they’re meant to assure?Recorded live at the International Common Criteria Conference (ICCC) in Rome, this special edition of Trust & Turbulence brings Ashit Vora and Shawn Geddis back for a candid conversation about the future of security certification.We explore what happens when products evolve faster than their certificates, where AI and automation can help, and which decisions still need human judgment. We also tackle a potentially disruptive question: could vendors eventually conduct their own Common Criteria testing using scheme-approved tools—and what would that mean for evaluation labs?This episode continues a conversation that began on the ICT Compliance Podcast. Start with Part 1, then join us here for the rest of the discussion, including a question from our live audience. Listen to Part 1 on ICT Compliance: https://open.spotify.com/episode/76WhS7i1SVA7QjNUaOInGK?si=mvzFr6h5QBivbgnDHbxL9A What would you automate first—and what would you always keep in human hands? Share your thoughts in the comments. Audio note: This conversation was recorded live at a conference. Audio quality varies; on-screen captions are included to help you follow along. Subscribe to Trust & Turbulence for more conversations about security, compliance, technology and leadership. #CommonCriteria #Cybersecurity #TrustAndTurbulence 00:00 — Live from Rome: Can Certification Keep Up?06:10 — AI and Automation: What Should Stay Human?10:35 — Who Has to Change? Vendors, Labs and Schemes14:45 — Could Vendors Test Their Own Products?

  2. Oct 9

    Trust, Accountability, and AI Avatars with Dr Angela C. Meyers

    What happens when an AI speaks in a living expert’s voice, and who are we actually trusting? In the latest episode of Trust and Turbulence, Josh Brickman talks with  @AngelaCMeyers  author of Versatile: Human Intelligence in an Artificial Age, about meeting futurist Ray Kurzweil, talking with his AI avatar “Rai,” and why polymathic thinking matters more as AI takes over specialized work.In this episode: • What polymathy is, and how a polymath differs from a dilettante • Lunch with Ray Kurzweil and his view of AI’s promise and risks • What it’s like to talk with Rai, Kurzweil’s AI avatar • How to think about trust, authority and accountability when AI speaks for a real person • Why organizations still need specialists, and why AI makes integrators more valuable • The Knower Learner Assessment (26 questions, about 10 minutes) About the Guest:Dr. Angela C. Meyers is an organizational development expert and published author specializing in human intelligence, adaptive leadership and integrative thinking in the age of AI. She wrote the first doctoral dissertation devoted to modern polymathy, later published as In Pursuit of Polymaths, and is the author of Versatile: Human Intelligence in an Artificial Age and creator of the Polymathic Method.00:00 Dr. Angela Meyers–Trust, Accountability, and AI Avatars01:54 What Is Polymathy?06:55 Meeting Ray Kurzweil and Rai22:43 Trust and the Human Advantage in an AI WorldMentioned in this episodeDr. Angela C. MeyersWebsite: https://www.drangelameyers.comVersatile: Human Intelligence in an Artificial Age: https://a.co/d/05Kq494fKnower-Learner Assessment: https://www.drangelameyers.com/knowerlearnerCollective Intelligence Labs: https://www.drangelameyers.com/collectiveintelligencelabVersatile Leadership Training: https://www.drangelameyers.com/versatileleadershiptrainingPolymath Unleashed (online course): https://www.drangelameyers.com/polymath-unleashed-course Youtube channel: https://www.youtube.com/@AngelaCMeyersFacebook: https://www.facebook.com/groups/polymathsplace Producer: M. Gillan RitchieMusic by Mikhail Smusev from PixabayAnimation and Logo by Edith Brickman

  3. Sep 12

    From Q-Day to SolarWinds: Can Security Certification Keep Up?

    Cybersecurity threats are evolving faster than the certification programs designed to provide assurance. So can programs like Common Criteria and FIPS keep pace?In this episode of Trust and Turbulence, I’m joined by Alicia Squires, Industry Principal for FIPS at AWS, and Kevin Micciche, Chief Technologist at HPE, two long-time practitioners in security certification and cryptography. We start with SolarWinds and a deceptively simple question: could a security evaluation have caught it? From there, the conversation moves to the tension between rigorous assurance and getting products to market, and why developing the next generation of security evaluators matters.Then we turn to Q-Day and post-quantum cryptography: crypto inventories, cryptographic agility, migration challenges, and what vendors and governments should be doing now. We also explore an increasingly important wildcard: AI. Could AI change the cryptographic threat? Can it find vulnerabilities that previously weren't practical to exploit? And can the same technology be used to make security certification faster without sacrificing trust?Finally, we look ahead at a world where security requirements are multiplying rather than converging—and ask whether AI, automation, and better reuse of security evidence can help certification keep up.Disclaimer: Views expressed are the guests' own and do not represent their employers.About the GuestsKevin Micciche is Chief Technologist for HPE Networking Platform Trust, where he leads work in cryptography, platform security, and the transition to post-quantum cryptography. A longtime security certification practitioner, Kevin has certified more than 150 products spanning 16 years against Common Criteria and FIPS requirements. https://www.linkedin.com/in/micciche/Alicia Squires is the FIPS Security Industry Principal on AWS's Cryptography team, with more than 25 years of experience in security certification, cryptography, and international compliance. Previously, she spent 15 years at Cisco, including leading its Global Certifications Team. Alicia is also a founding member of the Common Criteria Users Forum and served as its Chair for seven years. https://www.linkedin.com/in/alicia-squires/Title Chapters and Timestamps00:00 Kevin Micciche and Alicia Squires00:53 Can Security Certification Prevent the Next SolarWinds?13:52 Who Will Be the Next Generation of Security Evaluators?19:51 PQC, Q-Day and the AI Wild Card33:49 Can AI Fix Security Certification?40:17 The Future of Security CertificationMentioned in this EpisodeAWS CMVP queue-time dashboards, posted via the Cryptographic Module User Forum — https://cmuf-workspace.org/Products/Projects/Messages.aspx?prjID=17&id=622#ICT Compliance Podcast with Matt Campagna on post-quantum cryptography — https://youtu.be/oaZmlzcHrmc?si=709A7zkiLIfF2XHnICT Compliance Podcast with Dr. Lily Chen (NIST) — https://youtu.be/oaZmlzcHrmc?si=709A7zkiLIfF2XHnFilippo Valsorda on AES-128 and Grover's algorithm — https://words.filippo.io/128-bits/NIST CSWP 39, on cryptographic agility — https://csrc.nist.gov/pubs/cswp/39/considerations-for-achieving-cryptographic-agility/ipdExecutive Order 14028 (software supply chain and SBOMs) and Executive Order 14412, Section 6(b) (CMVP acceleration)-- https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurityOMB M-21-07, the phased IPv6 mandate Kevin offers as a model for PQC migration– https://www.gsa.gov/directives-library/internet-protocol-version-6-ipv6-policy-1Cryptographic Module User Forum (CMUF) — free to join — https://www.cmuf.org/Music by Mikhail Smusev from PixabayAnimation and Logo by Edith Brickman

  4. Aug 13

    Can We Automate Trust? The Future of FIPS 140 and Common Criteria

    Can we automate trust? And if we can, what happens to cybersecurity certification as we know it?In this episode of Trust & Turbulence, I’m joined by longtime colleagues Ashit Vora and Shawn Geddis, who are both building technologies designed to rethink how security certification gets done — but they’re approaching the problem in very different ways.Ashit is using AI to automate Common Criteria certification, with an eye toward expanding into areas such as the EU Cyber Resilience Act. Shawn is taking an intelligent automation (IA) approach to FIPS 140 and other assurance processes, emphasizing deterministic testing, standardized data, and machine-to-machine evidence exchange.We dig into some big questions:• What’s actually broken in today’s FIPS 140 and Common Criteria processes? • What’s the difference between AI and intelligent automation — and where does each belong? • Can automated testing and evidence ever earn the same trust as traditional human-driven evaluation? • What happens to certification labs as more of the work becomes automated? • Could continuous certification replace today’s point-in-time model? • Will the EU Cyber Resilience Act (CRA) accelerate automation simply because traditional compliance cannot scale? • How should Common Criteria and the broader standards community deal with AI? • And what happens when increasingly fragmented global requirements undermine the old goal of “evaluate once, sell everywhere”? This is also a conversation among three people who have worked together in the FIPS and Common Criteria community for well over a decade, so we get into some history, war stories, disagreements, and more than a few analogies — including teddy bears, taxes, Britney Spears and building a house.Can we really automate trust? Or does human judgment always have to remain at the center of cybersecurity assurance?That’s what we explore in this episode.If you enjoy Trust & Turbulence, please like, subscribe, and share your thoughts in the comments — particularly where you think AI and automation belong in the future of cybersecurity certification.About the GuestsShawn GeddisShawn Geddis spent more than 25 years at Apple, where he built the first Apple Platform Security Certifications Program and led engineering work for global platform certifications. He also built Apple’s SECLAB, its NVLAP-accredited first-party cryptographic laboratory, serving as lab manager, tooling developer, and—in his words—“evidence whisperer.” Shawn has since founded Katalyst LLC, focused on developing approachable automation and tooling for security certification.Ashit VoraAshit Vora is Co-Founder of Autonomi, an AI-enabled automation platform focused on transforming standards-based product security certification. Previously, Ashit co-founded Acumen Security, which grew into a leading product security certification provider before being acquired by Intertek. Earlier, he led Cisco’s U.S. government certification business supporting programs enabling approximately $1.5 billion in annual revenue. His work spans more than two decades of product security, certification, testing, standards, and commercialization. Music by Mikhail Smusev from PixabayLogo

  5. Jul 26

    When Security Gets in the Way: A Conversation with Debra Woog

    Security isn't just about stopping hackers—it also has to work for the people using it.In this episode of Trust and Turbulence, I sit down with Debra Woog, Founder & CEO of Connect Two, to explore the human side of cybersecurity. From ordering a pizza to helping aging parents navigate digital accounts, we discuss why trust, usability, and accessibility matter just as much as technology.In this episode:Why security often creates unnecessary frictionHelping aging parents navigate today's digital worldAI, trust, and human connectionDesigning systems that real people can actually useWhy usability is a cybersecurity issueIf you enjoyed this conversation, please like, subscribe, and share it with someone who cares about building technology people can trust.#TrustandTurbulence #Cybersecurity #DigitalTrust #UserExperience #AI #Leadership00:00 Intro00:10 Meet Debra Woog: From Leadership to Crisis Navigation08:33 Trust, AI, and the Growing Cost of Security20:52 When Security Gets in the Way of Helping People30:46 Designing Better Security for Real Life

  6. Jul 3

    The Perpetual Student with Jim West

    In this episode of Trust and Turbulence, I sit down with cybersecurity leader, author, podcaster, and lifelong learner Jim West. From his early days repairing computers at CompUSA to advising senior government leaders on cybersecurity, quantum computing, and national security, Jim's career has been anything but ordinary.We discuss cybersecurity, AI, quantum computing, the future of digital trust, life in the Middle East, career development, and why Jim proudly calls himself a "perpetual student."Whether you're a cybersecurity professional, technology enthusiast, or simply curious about how today's leaders navigate a rapidly changing world, this conversation offers valuable insights and plenty of memorable stories.Topics Discussed• Lifelong learning and professional growth• Cybersecurity leadership and national security• Commercial Solutions for Classified (CSfC)• Quantum computing and post-quantum cryptography• Artificial intelligence and deepfakes• International travel and cultural perspectives• Movies, creativity, and thinking differentlyGuest: Jim West, Author, Podcaster, Cybersecurity ExpertHosted by: Joshua Brickman 00:17 Meet Jim West02:14 The Perpetual Student Mindset13:25 Jim's Origin Story in IT & Cyber14:26 Iraq & Working Near the President17:18 25+ Years Living Overseas19:49 CSfC & Common Criteria Deep Dive38:32 Cybersecurity for Everyday Life46:00 The Quantum Threat & Post-Quantum Crypto56:27 Movie Review Wrongs01:05:32 Where to Find Jim WestMusic by Mikhail Smusev from PixabaySocials:LinkedIn: https://www.linkedin.com/in/jimwest1/https://jimwestauthor.com/https://topcyberpro.com/

  7. Jun 10

    Technical Competence Requirements For CRA Notified Bodies Quick Summary

    This is a short pod about the release by ENISA entitled "Technical Competence Requirements for CRA Notified Bodies." You can access the document directly here: https://www.enisa.europa.eu/publications/technical-competence-requirements-for-cra-notified-bodies

  8. May 30

    Trust, Resilience & the Future of Cybersecurity | Mary Ann Davidson & Edna Conway

    In this episode of Trust & Turbulence, Joshua Brickman sits down with two of the most influential voices in cybersecurity leadership: Mary Ann Davidson, former Chief Security Officer of Oracle, and Edna Conway, former Chief Security & Risk Officer at Cisco and Microsoft. Drawing on decades of experience in product security, risk management, supply chain assurance, and cybersecurity policy, they discuss how organizations can build trust and resilience in an increasingly complex digital world. Topics include: • The origins of supply chain security• Lessons from the SolarWinds attack• CISO accountability and cyber resilience• The EU Cyber Resilience Act and global regulation• Software Bills of Materials (SBOMs)• AI and product security• Building a culture of trust and security Rather than focusing on headlines, this conversation examines the deeper challenges facing technology providers, governments, and security leaders as they navigate an evolving threat landscape. Guests:Mary Ann Davidson – Former Chief Security Officer, Oracle Edna Conway – Former Chief Security & Risk Officer, Cisco and Microsoft Hosted by Joshua Brickman Chapters 00:00 Introduction 03:26 Supply Chain Security Origins 18:33 Lessons from SolarWinds 35:47 How the EU Is Reshaping Cybersecurity 45:20 Can AI Make Software More Secure?

  9. May 19

    EU Cyber Resilience Act Explained

    In this walkthrough of the EU Cyber Acts Conference focused on the EU Cyber Resilience Act, Joshua Brickman explains what the EUCRA is all about to the Common Criteria Users Forum virtual spring workshop. This was recorded on April 1, 2026. 00:00 Conference Recap00:23 Cybersecurity Act Basics02:20 CRA Marketplace Rules03:43 Scope Digital Products04:18 Penalties And Deadlines06:03 Vulnerability Reporting Duties09:05 CRA Is Law Now09:38 Product Classes Overview11:27 Standards And Gray Areas13:41 Nokia Program Timeline14:57 Support Period Liability16:50 Q&A Product Families19:30 Reporting Portal Uncertainty21:24 Vertical Standards Trouble22:37 Crypto Requirements24:14 Worst Case Scenario26:30 Conformity Modules And Labs28:50 Liability And Resourcing Gaps31:11 Call To Organize31:55 Skills Needed and Conclusion

  • 9 Episodes

About

Joshua Brickman spent more than 20 years working in cybersecurity certifications, government assurance, and global security regulation. This podcast explores the intersection of security, AI, regulation, and trust — from Common Criteria and FIPS 140 to post-quantum cryptography, supply chain security, cloud assurance, and the EU Cyber Resilience Act. The show turns complex technical and policy issues into practical conversations for businesses, policymakers, technologists, and consumers.

Information

  • Creator
    Josh Brickman
  • Years Active
    2026
  • Episodes
    9
  • Rating
    Clean
  • Copyright
    © Josh Brickman
  • Show Website
    Trust and Turbulence

You Might Also Like