SOCSoter Unfiltered

Nathan Ng

Cybersecurity unfiltered. Hosted by Melissa Kaiser of SOCSoter, this podcast cuts through the noise with real conversations about threats, compliance, and what it actually takes to defend a business in today's landscape. No fluff. Just the truth.

  1. 22h ago

    Most Companies Use Only Part of the ERP They Already Paid For, with Shawn Mayo - Ep 17

    "We get tons of people that will come to me and say, 'Hey, I want an AI platform.' And I say, okay, for what? Because it's a buzzword." Who They Brought In Shawn Mayo is the CTO of Hybrid Workforce and a fractional CTO of AI Workforce. He has about 20 years in technology and has implemented more than 40 platforms, mostly ERPs. He started as an accountant at New York Life, worked on bonds and investments, moved into real estate accounting, then landed at Apple, where he decided he liked the tech side. After grad school he became a consultant across banking, real estate, aviation, and healthcare. Hybrid Workforce builds automation and AI platforms. AI Workforce is focused strictly on healthcare. What Got Loud Clients say they want an AI platform, and Shawn's first question is "for what?" Many companies use only part of the ERP they already paid for. His goal is to get them to 90 percent of what they own, then build the last 10 percent. Before any build, his $5,000 assessment maps the tech stack, technical debt, and safeguards, and recommends pentesting and phishing protections. In healthcare, the platforms are HIPAA compliant, hospital data stays on the hospital's servers, and contracts bar selling the data or using it to train other models. He will walk away from a deal: "We will give you the best advice, even if it means not closing a deal." The Rundown Melissa asked what his job involves. Shawn described consulting across industries, which taught him how technology fits each one. A typical request starts with a client saying they have 20 accountants and want 10 while still growing. The answer can be AI agents or a full ERP platform. When a client says the ERP is not doing what it should, he says they are usually not using its full capabilities. Two similar companies next door to each other can run completely differently, so he works to use what they have before adding anything. On AI, he sits down with each department to look at its capabilities, its appetite for AI, and its technical debt. Many clients want AI but do not have the guardrails or security protocols for it. Melissa asked whether he finds weak security when he walks in. His answer is the $5,000 assessment, which covers what the client wants to build, which departments it touches, the IT team, the tools in use, and how to put safeguards around the build. He recommends pentesting and email phishing protections, and he works with three or four cybersecurity partners. Regional hospital CISOs do a great job, he said. The gaps show up at smaller B2B firms where nothing stops phishing and everything is open. "It's like building a house without a foundation. We want to make sure that foundation, which is security, is there first and we could build around it." Shawn's favorite industries are real estate, where multifamily ERPs often cover about 70 percent of what operators need, and healthcare. He also built a platform for a regional jet organization that had to account for fuel, food, and pilot hours. The healthcare platform handles revenue cycle management, credentialing, and scheduling. Agents work in the background to reconcile payments and check that doctors' and nurses' credentials stay current across 19 states. On data, his company owns the platforms and sells them as seats, subscriptions, or white label builds. For hospitals, the data stays on the hospital's own servers. Other clients get their own tenant with the data containerized. Contracts at the start of an engagement say the data is not sold and not used to train other models. Compliance, including HIPAA, PII, and GDPR, is part of the assessment. "We will give you the best advice, even if it means not closing a deal to make sure that our clients are getting exactly what they want." Melissa agreed that honest advice brings clients back. Shawn also described a CEO dashboard built from many disconnected systems, with a daily email tailored to what that executive cares about. His team is remote, spread across the US, El Salvador, India, and Colombia. He brings in graduates right after senior year, lets them shadow projects for months, and has them retool older projects with new ideas and AI tools. Real Talk The thread through this conversation is sequence. Understand the landscape, secure the foundation, then build. Shawn treats AI as a buzzword until it is tied to a goal and a safe starting point. His other point is practical: giving honest advice, even when it costs a deal, is how he builds referrals and long term clients. Catch It Watch the full conversation with Shawn Mayo on SOCSoter Unfiltered for more on AI strategy, healthcare platforms, data protection in contracts, and how his team trains new developers.

  2. Oct 19

    Customers Stopped Asking for Software and Started Asking for AI, with Dr. Yomi Odedeyi - Ep 16

    "The paradox for leaders is that in being task oriented, you're also aware of yourself as a human being and of the humanity of the team members." Who They Brought In Dr. Yomi Odedeyi is the CIO of Vennote Technologies LTD, a global technology firm with about 300 employees. He trained as a lawyer in Nigeria, practiced for five years, then followed his pull toward technology, teaching himself programming and working his way from database analyst to ERP project manager. He later earned an MBA and a doctorate in leadership and policy. The company he helped start in 2010 opened its US business in 2015. "Vennote" is an Afrikaans word for partners. What Got Loud Customer demand over about three years pushed Vennote into AI, and it now has about 30 developers building AI projects for enterprise customers. Many of those builds were made for one client. Vennote wants to commercialize them, but that means changing the architecture, hosting on its own hardware, and putting marketing money behind it. He tells people that attracting the attention of the bad guys is a matter of when, not if. His dissertation on paradoxical leadership found that women executives are held to different standards, so the same blunt words land differently coming from a woman. His leadership rule: stay task oriented and stay human, and know when to be driven and when to ease off. The Rundown Melissa opened by asking what he does at Vennote and about his ERP background. Dr. Odedeyi described a role that covers technology leadership, marketing support, and "anything that needs doing." That morning he had been on a call about a customer RFP for a learning management system. Vennote's plan has two phases: install the system, then use AI to build individual training plans from survey answers about each person's skill level, recommend courses, and administer the tests. Vennote is not a traditional MSP. He said the firm does not take service calls. It works with enterprises that have their own IT departments and want to outsource what they would rather not hire for. It resells enterprise software, including Medallia, and builds custom AI. Medallia was its first AI powered implementation, and customer conversations led to specialized builds, including an AI HR service that investigates when an employee says they did not get paid, and a self-service flow for telecom customers who bought airtime and cannot get online. Security came up in practical terms. He described jumping on a call over a GitHub access problem and working with cybersecurity on best practices. "I tell people it's a matter of when you're going to be attracting attention of the bad guys, not a matter of if." Melissa then asked why his dissertation focused on 22 women executives in Nigeria. He said the roots were his mother, a director in Nigeria's civil service who raised him as a single parent. His question was how leaders handle paradox, the idea that complex problems are not solved by picking one extreme, and that effective solutions integrate both sides. Two findings stood out. The first was support: an executive needs a team at home the way she has one at the office. The second was the double standard. "Where a man would say something very direct and blunt, same words from a woman are not received the same way." Melissa shared that her military background draws the same flak for being direct. Dr. Odedeyi said the lesson applies to men too, and that boys should be taught there are two sides to success, one driven and one communal. He practices it himself. When a deadline hits, the team works until 9 and orders dinner. After a hard week, they knock off at 2 on Friday. He also asks an AI assistant to adjust the tone of emails going to colleagues in other countries. Real Talk This is a leadership episode with a technology backbone. His AI story is demand led: customers asked, the team built, and now he wants to turn custom work into products. His research point is practical for anyone building a team: the people systems around a leader decide how well that leader can perform. On security, his message is short and direct. Assume attention is coming. Catch It Watch the full conversation with Dr. Yomi Odedeyi on SOCSoter Unfiltered for more on moving from ERP to AI builds, how Vennote works with enterprise customers, and what 22 women executives taught him about leading under pressure.

  3. Oct 12

    We Block Unapproved AI at the DNS Level, with Lorenzo Toscano - Ep 15

    "I'm probably going to lose my job, but compared to the people above me, I'm probably losing the least. They're going to lose their fortune, their wealth." Who They Brought In Lorenzo Toscano is the Deputy CISO at MCPC, a company of nearly 500 employees across about six offices. His rise was fast. Several people above him left in a short window, with the security team already at a bare minimum, so after only three years in security he asked the CIO for a shot at the role and promised to go back where he came from if it did not work. It worked. He moved from information security officer to Deputy CISO within the past few months. He also earned a Master of Legal Studies, which pulled him into redlining customer contracts alongside the company's lawyer. This was his first podcast. What Got Loud Lorenzo believes the CISO should report to the CEO or president, not the CIO, because leadership owns the risk and security only manages it for them. A customer MSA that ran 40 pages about three and a half years ago, with roughly 15 pages of security and privacy terms, now carries about five more pages on AI. A SOC 2 report used to be the checkbox. Now customers copy the same controls into the contract and ask to audit the environment too. MCPC blocks unapproved AI tools at the DNS level and allows only paid enterprise accounts, but no control stops someone from taking a picture of their screen. On one contract under $50,000, a customer questionnaire cost his team 25 hours. The Rundown Lorenzo started with what MCPC does beyond the obvious. Data disposition is one of its offerings, and because many customers are uneasy about anyone disposing of their data, the company relies on independent audits that certify wiping, shredding, and recycling. SOC 2 is his bread and butter. As Deputy CISO, he now sits in the strategy room and helps shape the security side of the product, a change from being the person who "sits in a closed office, sees the alert, writes the report, and angrily emails the rest of the company." When Melissa asked whether the CISO should report to the CIO, Lorenzo said neither. His own CIO is a former security consultant and his IT manager is an all-star, so the relationship works. Still, he argued most compliance frameworks make leadership ultimately responsible for risk. Programs delegate the management of that risk to security, not the ownership, so security belongs under the CEO or president rather than under a middleman. His legal training shaped the next stretch. "Knowledge for the sake of knowledge means nothing," he said, which is why he started working with the company's lawyer on contracts where IT, security, and compliance were not being represented. The change he has watched since is the AI language: no AI use without consent, no training on customer data, and a definition of customer data broad enough to include a contact's name and email sitting in a vendor's ITSM tool. His redline approach is to stop the obligation at MCPC and add "commercially reasonable" safeguards for suppliers. "You can't be unreasonable. At the same time, it's a negotiation." On the control side, MCPC pairs training with AI gateway tools, DNS blocking, and enterprise accounts it pays for, and it does not let personnel use personal ChatGPT or Claude accounts. He gave the example of a new AI product that trains on user data by default and gets blocked with a warning splash screen. Beyond that, the acceptable use agreement and discipline do the rest, including when an employee posts a golf outing photo with a customer's representative. Customer diligence has also grown. A SOC 2 plus a bridge letter used to end the conversation. Now customers ask for policies, encryption configurations, and sometimes their own audit, and Lorenzo points them to the controls the SOC 2 already tested. Healthcare customers, many with HITRUST, are the most attentive. He tied the questionnaire problem to his earlier days, when a small contract cost 25 hours and the margin was gone, agreeing the juice was not worth the squeeze. From his previous SOC role, he described mid-market clients between 60 and 400 employees who came through incident response, and about one in three signed on for ongoing services. The pushback was a security manager worried about a job, or a belief they could do it cheaper. His answer is that a piece is always missing, specialized talent is hard to find, and an MSP gets better EDR licensing and real 24/7 coverage. He also described hiring an analyst from the automotive insurance-audit world who started 10 to 15 percent under market with room to grow. Real Talk Lorenzo is candid about where the pressure sits. The reporting line, the AI clauses, and the audit requests all come back to the same issue: customers want proof, and security leaders need leadership backing to deliver it. His point about "commercially reasonable" language is practical, because it keeps a contract's security demands in proportion to what the deal is worth. Catch It Watch the full conversation with Lorenzo Toscano on SOCSoter Unfiltered for more on where the CISO should sit, how AI is rewriting customer contracts, and why third party risk reviews keep getting heavier.

  4. Oct 5

    Each Company Is a Fingerprint, So Stop Treating Compliance Like a Template - Ep 14

    "We are a revenue protector. If you go down due to this, think about how many thousands of dollars every minute you are losing." Who They Brought In Kevin Neureuter, Jr. is the President and Owner of AXE Computers USA, an MSSP he has run for 12 years, operating alongside his wife, who is a 50 percent owner of the business. Kevin spent 17 years in federal contracting and logistics before an unexpected opening pulled him into IT, and he later served as Director of IT for Orleans County, New York, before building AXE Computers into a company focused on compliance, hardware inventory discipline, and federal contracting support. What Got Loud Kevin's business philosophy in one line: an IT function is not a cost center, it is a revenue protector, and every minute of downtime has a real dollar cost attached to it. His biggest, most overlooked compliance gap: companies have no idea what hardware is actually sitting on their network, sometimes hundreds of thousands of dollars worth of it. His hard line with customers: patching is non-negotiable and part of the package, even when a prospect pushes back. His read on AI tools like Copilot: an 80 percent solution for policy writing and proposal drafting, but a human always has to tweak the last 20 percent for that specific company. His read on risk appetite: some MSPs will not take a customer who refuses baseline security, others will, and both can build a profitable business, just with very different books. The Rundown Kevin runs AXE Computers USA the way he says every good MSP should, by starting with customer service rather than sales. He and his wife describe themselves as stewards rather than owners of the business, a mindset Kevin credits to something he heard from the owner of Hobby Lobby and adopted for his own company. His path into IT was not planned. He was working in logistics and supply chain for a federal contractor when the vice president and program manager both died the same year, leaving the organization without anyone managing its technology. As the youngest person in the office and the only one comfortable with computers, Kevin was handed the job. He rebuilt the company's IT from pirated software and Windows XP machines, and that experience, plus a home repair project on an old Dell laptop, became the start of his business. Hardware inventory is where Kevin's compliance work actually begins, and he was direct about why most companies fail at it. "They only know what they tell you, right? There could be a bunch somewhere else, or they're using something that you're unaware of because you just don't know, and they don't know either." He walked through examples from his own client visits, including a warehouse where he found laptops nobody on site knew existed, and a building where an employee of 20 years insisted there was no window in a room until Kevin asked them to go look again. His approach is to physically walk the site rather than rely on what a customer reports, a habit he traces back to military property accountability, where he had to personally verify every asset at least once a year. On patching, Kevin draws a clear line. He will build a custom solution around a client's budget and risk tolerance in almost every other area, but patching stays non-negotiable because the business carries risk along with the customer when something goes wrong. He contrasted his own middle-ground risk appetite with two of his peers: one who refuses any customer that will not commit to MFA, SIEM, and SOC coverage, and another who still struggles to get basic patching approved. Kevin sees both as viable businesses with different pricing and different risk profiles, not one right answer. On AI, Kevin uses Copilot for policy writing, proposal drafting, and decision support, but is clear about where it stops being useful on its own. "I find that it's an 80 percent solution, but that human needs to be in there to tweak it and get the nuance type of things that it won't fit or it won't work. That's where I come in, that 20 percent." He described reviewing AI-written security policies from other companies and testing them by asking specific follow-up questions, often finding the policy referenced tools or controls the business did not actually have in place. For Kevin, every policy still has to be rebuilt around the specific company, because no two clients run the same environment or face the same risk. Real Talk Kevin's framing of IT as a revenue protector rather than a cost center is a useful reframe for any MSP trying to get budget approved by a business owner instead of an IT director. But the sharper point in this conversation is his insistence on physically verifying what is actually on a network before trusting any report of what is supposed to be there. Catch It Watch the full conversation with Kevin Neureuter, Jr. on SOCSoter Unfiltered for more on hardware inventory discipline, federal contracting and property management as MSP verticals, and where AI is actually earning its place in day-to-day IT operations.

  5. Sep 28

    Training AI Agents What Not to Do 80 Percent of the Time, with Sinan Al Taie - Ep 13

    "The attack is not done by humans. So why are we still defending with human capability? That has put us really behind."   Who They Brought In Sinan Al Taie is the Cybersecurity Manager at Master Electronics, a global electronic component distributor headquartered in Phoenix, Arizona with offices across California, Florida, Canada, and overseas. Master Electronics is family owned, serves the aerospace supply chain, and is CMMC Level One compliant and ISO 9001 certified, with ISO 27001 and SOC 2 underway. Sinan runs incident response, threat detection, and compliance for the company, and outside of his day job he researches and writes about securing AI agents, a topic that has become the center of his work.   What Got Loud Gartner expects 80 percent of enterprises to have AI agents in production by the end of this year, but only 29 percent of those organizations report having security guardrails in place for them. Average breakout time dropped from 48 minutes in 2025 to 29 minutes now, and Sinan has seen an AI-driven incident break out in 27 seconds. Sinan spends 80 percent of his time training his AI agents on what not to do, and only 20 percent of the time letting them act, calling it a reverse mindset compared to how most AI tools get deployed. He pushed back hard on the industry's obsession with a single pane of glass, arguing that a dashboard that still requires a human to click the final action cannot outrun a 27 second attack. His prediction for the field: "AI will not replace people. People who use AI will replace people who don't."   The Rundown Sinan opened by walking through Master Electronics itself: a global distributor of electronic components built around aerospace customers, compliant at CMMC Level One, certified to ISO 9001, and now working through ISO 27001 and SOC 2 in parallel using an automated GRC platform that maps controls, flags gaps, and helps draft policy language for the team. From there the conversation moved to the problem he has been researching. He laid out the Gartner numbers on AI agent adoption and the security gap behind them, then connected it to what he sees every day running incident response: attackers using AI to move faster than a human analyst can react. That gap is what pushed him to design what he calls an agentic defense pipeline, an autonomous system that investigates, triages, analyzes, and responds without waiting on a person for every step. "It's beyond the human capability because it's the AI attack path. It's not done by humans. So why are we staying defending with the human capability? It has put us really behind." He was careful to draw a line around what he is not proposing. Traditional security tools and SOC processes stay in place. What he wants alongside them is a system that can act at the same speed as the threat, with guardrails tight enough that it does not become its own liability. That is the 80 percent of time spent teaching the agent what not to do before it is trusted to act on the remaining 20 percent. Sinan also addressed the idea, one he has heard repeatedly, that AI will replace tier one analysts outright. His answer was that AI will not replace people, but people who use AI will replace people who don't, and that the goal of his work is to move analysts from the front of the pipeline, where alert fatigue and burnout live, to the end of it, where they review automated decisions and correct the ones that need it. Those corrections train the system to do better the next time, which is why he insists a human in the loop is not going away, only shifting position. He pointed to identity-based detections as the clearest proof this works today: disabling an account, resetting MFA, revoking a session, and forcing a password reset are consistent enough responses that a machine can already handle them, freeing analysts to focus on the detections that actually need judgment. The conversation closed on where AI security is headed next: agentic identity and permission inheritance between agents and their sub-agents, the difference between a personal ChatGPT account and an enterprise one with data protections built in, and AI security tooling that behaves like an email security gateway, screening prompts for PII and intellectual property before they leave the environment. Sinan's read on where this leaves the profession: security is shifting to become data security, because once an agent is compromised, the real exposure is whatever data it had access to. "A tier one analyst can produce tier three analyst outcomes with the AI assist."   Real Talk What stands out about this conversation is how specific Sinan's timeline is. He is not speculating about AI risk in the abstract. He is watching breakout time compress in his own environment and building a response system to match it, while being honest that the guardrails have to come first or the system becomes the threat. His one-three-one rule, one problem, three possible solutions, one recommendation, is a small habit worth stealing regardless of whether AI agents are anywhere near your environment yet.   Catch It Watch the full conversation with Sinan Al Taie on SOCSoter Unfiltered for the complete breakdown of agentic defense pipelines, where human judgment still belongs in an automated SOC, and what he thinks security teams should actually be building toward.

  6. Sep 21

    Compliance Is Not Security But It Is a Start with Bobby Barts - Ep 12

    "Compliance isn't security. But for people who have nothing, it's a start." Who They Brought In Bobby Barts is the CIO of VTG, a defense contractor he has been with since 2018. VTG runs the full spectrum of government work: defense programs, Intelligence Community contracts, a fabrication shop in Virginia Beach that builds physical targets, and high-end software development for systems including submarines. With around 1,700 employees nationwide and an office in Guam, VTG is the kind of prime contractor that sits in the middle of the CMMC ecosystem, taking requirements from the government and pushing them down through a supply chain that ranges from sophisticated software houses to one-person shops doing specialized fabrication work. Bobby's perspective in this episode is rare: he is not a consultant working up from the sub level. He is the prime, managing both directions at once, and he has the institutional weight and operational scale to say what the rest of the industry is thinking but might not be willing to put on record.   What Got Loud The certification pause does not change your obligations under the False Claims Act. If you self-certify that you are compliant and you are not, the teeth are still there. People have gone to jail for this There are roughly 100,000 vendors in the defense industrial base that need CMMC certification. Fewer than 300 have achieved it. That math does not work on any timeline the DoD has proposed Bobby's audit story: four of five auditors were collaborative and reasonable. The fifth rejected a business continuity plan because a specific scenario was not listed by name, despite a catchall clause covering all unlisted scenarios FedRAMP equivalent versus GCC High is a risk conversation the government needs to have honestly. The actual delta in security between the two is minimal and the cost difference is enormous CUI labeling is so inconsistently applied that even the government is marking publicly available newsletters as CUI. The category is too broad to be actionable   The Rundown Bobby's most important point comes early and he returns to it throughout the episode. The CMMC certification pause that hit in mid-2025 changed the timeline for third-party assessments. It did not change anything else. DFARS 7012 still applies. NIST SP 800-171 still applies. And the False Claims Act, which carries criminal liability for self-certifying compliance you do not actually have, still applies in full. His position is that the industry interpreting the pause as permission to slow down is a dangerous misread. The obligation to be a good steward of controlled unclassified information has not moved. Only the audit schedule has. The supply chain problem is where the episode gets most practically instructive for anyone doing CMMC consultant work from the sub side. Bobby describes the math problem clearly: you cannot certify 100,000 vendors when fewer than 300 have been through the process and the assessor ecosystem is still immature. His expectation, shared with Melissa, is another year of self-certification followed by a phased rollout. But the flow-down obligation from primes to subs is not paused. What VTG asks its suppliers is straightforward: how are you being a good steward of the data? The documentation and questionnaire process continues regardless of where the certification requirement lands. The CUI labeling conversation is one of the most honest moments in the episode. Bobby describes a newsletter he received that was marked CUI but was publicly available on the government's own website. Melissa shares her experience with Army training materials that were mislabeled. Bobby's framework for handling this within VTG distinguishes between CUI basic, which covers FCI and lower-sensitivity information, and CUI specified, which covers more sensitive categories like nuclear drawings or other legacy designations. Getting his own workforce to understand that distinction, across a company that spans both blue-collar fabrication work and classified software development, is an ongoing training challenge. The audit story is the most practically useful section for anyone preparing for a C3PAO assessment. Bobby had five auditors over the course of one engagement. Four were collaborative, curious, and willing to work through how VTG was solving problems. The fifth rejected policy coverage because a specific listed scenario was not called out by name in the business continuity plan, despite a catchall clause that explicitly covered all unlisted scenarios. Bobby's point is not that assessors are the enemy. It is that the personality and interpretation style of one individual auditor can have a material impact on your assessment outcome, and that the industry needs more grace in how it evaluates whether the spirit of a control is being met, not just the letter.   Real Talk If you are treating the certification pause as a reason to slow down, you are accepting risk that has not actually been reduced. The False Claims Act does not pause. Keep moving.   Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

  7. Sep 14

    The Foundation Has to Be Strong Before You Add the Fancy Tools with Garrett Ragland-Helf - Ep 11

    "Small wins accumulate to one massive win. You look back down the mountain and realize you made it to the peak."   Who They Brought In At the time of this recording, Garrett Ragland-Helf was serving as a CISO Advisory Analyst at Apollo Information Systems, working primarily with public sector organizations across state, local, and education sectors to mature their security postures, build roadmaps, and navigate the unique resource constraints that come with operating in environments where budgets are thin and staff wear many hats. He also volunteers with the Center for Internet Security's Leadership Mentor Program, connecting cybersecurity leaders across the northeast to collaborate, share challenges, and help each other grow. He serves in the military at the Army War College at Carlisle Barracks, which gives him a front row seat to how national security thinking is evolving alongside the civilian cybersecurity landscape. His approach throughout this episode is less about tools and more about the discipline, mindset, and foundational work that makes any tool actually useful.   What Got Loud Why tackling a 1,200-page CIS benchmark is exactly like climbing Mount Everest, and why the only way to do it without breaking everything is to go modular, one small section at a time The most dangerous thing you can do with a SIEM is deploy it out of the box with zero tuning, zero baseline, and nobody who knows how to read it AI is a force multiplier for resource-constrained public sector organizations, but only if you stay within governance guardrails and treat it as a starting point, not a finished product If your foundation is made of sand, any shift in the threat landscape will bring the whole castle down. The basics have to be strong before the fancy tools mean anything Collaboration is the actual force multiplier. Siloed organizations in the same sector are making themselves collectively easier to attack   The Rundown Garrett's Mount Everest framework is the throughline for the entire episode. When you look at a 1,200-page CIS benchmark or a full CMMC implementation and try to do it all at once, the size of the task creates paralysis. His answer is the same answer that applies to every large security initiative: break it into modular chunks, start with a small subset of controls, get comfortable with those, and then move to the next section. The small wins accumulate. The progress compounds. And when you look back after a year of doing it that way, the distance covered is significant in a way that a sprint never produces. Melissa's experience confirmed it directly. She tried to implement the Windows Server 2022 CIS benchmark in a couple of days and had to roll everything back. The mountain does not care how fast you want to climb it. The foundation conversation is where Garrett gets most direct. He is not against advanced tools. He is against organizations acquiring advanced tools before they have the basics locked down. A next-generation SIEM deployed out of the box with no tuning, no baseline, and no one who knows how to operate it is not a security asset. It is noise. Or silence. Neither helps. Garrett's framework is to start with what you have, squeeze every bit of value out of it, make sure it is fine-tuned to your environment, and only then add the next layer. That sequencing, basics first, tools second, is what separates organizations that survive incidents from the ones that do not. The public sector resource problem runs through the entire episode. These organizations are not failing because they do not care. They are failing because they are understaffed, underfunded, and often operating with IT people who have cybersecurity added to a job description that already had no room for it. Garrett's answer is sweat equity: use every free or state-subsidized resource available, use AI to generate documentation starting points and then finish them properly, use community and peer networks to share knowledge and compress learning curves. The creativity required to do security well with almost nothing is its own skill set, and Garrett treats it as such rather than dismissing it. The collaboration section lands the hardest at the end of the episode. If one organization in a sector gets compromised, the attacker is now knocking on the doors of every similar organization nearby. Siloed security in interconnected sectors is not just a local problem. It is a collective vulnerability. Garrett's answer is community: ISACs, peer groups, word of mouth, conferences, virtual or otherwise. The organizations that share knowledge and learn from each other's incidents are harder to attack collectively than the ones that treat security as something they figure out alone.   Real Talk If you are waiting until you have the perfect stack before you start securing your environment, you are already behind. Start where you are with what you have. Tune it. Baseline it. Understand it. Then add the next piece.   Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

  8. Sep 7

    Every Identity in Your Environment Is an Attack Surface with Jason Lawrence - Ep 10

    "Attackers no longer break in. They log in. That is the entry point for every attack." Who They Brought In Jason Lawrence is the Cybersecurity Director at Yancey Bros. Co., the nation's oldest Caterpillar dealer, a 112-year-old Georgia institution serving the construction, roadbuilding, mining, and agricultural communities. He is also the co-founder of Security Reimagined, a community-focused advisory operation built to help small businesses and mom-and-pop shops become more cyber resilient with as little friction as possible. Jason started in cybersecurity in the mid-90s before the term cybersecurity widely existed, served in the Israeli Defense Forces, and has spent roughly 30 years building and leading security operations across some of the most recognizable names in the industry, including Ernst and Young, SunTrust Bank, LinkedIn, Silicon Valley Bank, and AT&T Managed Detection and Response where he led threat hunting. He is one of the more technically deep guests the show has had, and he brings that depth without once losing the thread back to practical application. What Got Loud Attackers no longer break in. They log in. Identity is the entry point for every attack and most organizations cannot tell you what all of their identities even are Agentic AI inside your environment is not just a productivity tool. It is an operational identity. If it is compromised, your entire operation can be compromised with it The most dangerous phrase in cybersecurity is "we've always done it that way." Jason has the IDS audit story to back that up Security should be the Department of Yes. Not the Department of No. Here is what that actually looks like in practice The Equifax breach came down to two things: an unpatched vulnerability and an exposed admin account on a website that nobody was managing The Rundown Jason's framing for how security should engage with a business is the most useful reset in the series for anyone who has ever been told security is a hindrance. His position is direct: if security is slowing the business down, security is not doing its job. His alternative is what he calls the Department of Yes. Not a blanket yes to everything, but a yes paired with a how. Yes, you can do that, and here is how to do it securely. That reframe changes the entire dynamic of the relationship between security and the rest of the organization, and it starts with understanding the business before making a single recommendation. The identity conversation is where the episode reaches its highest technical altitude and stays most accessible at the same time. Jason's definition of identity is broader than most security conversations allow. It is not just usernames and passwords. It is everything in a digitized environment: service accounts, API keys, AI agents, data itself. His central question to every organization is the same: do you have a complete inventory of all of your identities? The answer is almost always no. They point at Active Directory and call it done. Jason's follow-up is the one that lands hardest: do you have an identity in Active Directory for each agentic AI running in your environment? For every API key? For every service principle? The answer is always no. And that gap is exactly where attackers go. The Equifax breach is the case study Jason uses to make the identity argument concrete. Two entry points. One was the Apache Struts vulnerability, a known unpatched flaw. The other was an exposed admin account on a web portal that nobody had inventoried, nobody had managed, and nobody had questioned. It was just there. Logged in and accessible. Jason's point is not that the breach was inevitable. It is that both entry points were identities, one human and one not, that fell outside the scope of what the organization thought it needed to protect. That scope problem is still the most common gap he finds 30 years into doing this work. The agentic AI section is where the episode shifts from identity management into something more urgent. Jason describes a named autonomous attack from earlier this year that adjusted its behavior in real time based on the outcomes of its own actions. The defense implications are significant. But the internal risk he is more focused on is the one organizations are introducing themselves. Every AI agent deployed internally needs permissions to operate. Most organizations are overprovisioning those permissions without thinking through what happens if the agent is compromised. A sufficiently privileged AI agent is no longer just a non-human identity. It is an operational identity. Its compromise is not a credential problem. It is a business continuity problem. Real Talk If you cannot answer the question of what identities exist in your environment, who created them, why they were created, and when they were last used, you are not managing your attack surface. You are hoping nobody notices the gaps. Start the inventory. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

See All (17)

About

Cybersecurity unfiltered. Hosted by Melissa Kaiser of SOCSoter, this podcast cuts through the noise with real conversations about threats, compliance, and what it actually takes to defend a business in today's landscape. No fluff. Just the truth.

Information

  • Creator
    Nathan Ng
  • Years Active
    2026
  • Episodes
    17
  • Rating
    Explicit
  • Copyright
    © 2026
  • Show Website
    SOCSoter Unfiltered