app_store_button

google_play_button

Details page - Device banner - 894x1036

Step into an infinite world of stories

Listen and read

David Spark

Geoff Belknap

Steve Zalewski

Defense in Depth promises clear talk on cybersecurity's most controversial and confusing debates. Once a week we choose one controversial and popular cybersecurity debate and use the InfoSec community's insights to lead our discussion.

Defense in Depth

All links and images can be found on CISO Series.
 
Check out this post by Kevin Paige, CISO at ConductorOne, for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining them is Julie Tsai, CISO-in-Residence, Ballistic Ventures.
 
In this episode:
 
 • Is least privilege dead?
 • Modern tactics, timeless principle
 • Implementation over ideology
 • Pragmatism over purity
 
Huge thanks to our sponsor, Cyera
 

 AI is moving fast - can your security keep up? Join the leaders shaping the future of data and AI security at DataSecAI Conference 2025, hosted by Cyera, Nov 12–13 in Dallas. Register now at https://datasecai2025.com/did.

Is Least Privilege Dead?

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Mike Johnson, CISO, Rivian. Joining them is their sponsored guest Bobby Ford, chief strategy and experience officer, Doppel.
 
In this episode:
 
 • Beyond the click
 • High-risk users demand different metrics
 • Building engagement over punishment
 • Creating a security culture through community
 
Huge thanks to our sponsor, Doppel
 

 
Doppel is protecting the world's digital integrity. Impersonators adapt fast — but so does Doppel. By pairing AI with expert analysis, we don't just detect deception; we dismantle it. Our platform learns from every attack, expands its reach across digital channels, and disrupts threats before they cause harm. The result? Impersonators lose. Businesses become too costly to attack. And trust stays intact. Learn more at https://www.doppel.com/

How Do We Measure Our Defenses Against Social Engineering Attacks?

All links and images can be found on CISO Series.
 
Check out this post by Mike Gallardo for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Geoff Belknap. Joining them is Alex Guilday, BISO, Royal Caribbean Group.
 

 
In this episode:
 
 • Timing the approach
 • When persistence becomes harassment
 • Playing the long game
 • The necessity argument
 
Huge thanks to our sponsor, Cyera
 

 
AI is moving fast - can your security keep up? Join the leaders shaping the future of data and AI security at DataSecAI Conference 2025, hosted by Cyera, Nov 12–13 in Dallas. Register now at https://datasecai2025.com/did.

Sales Follow Up Sequences: What Works Best in Cyber?

All links and images can be found on CISO Series.
 
Check out this post by Evgeniy Kharam for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining them is Ryan Dunn, Leader of Product and Supply Chain Technology, Specialized Bicycle Components. 
 
And check out "Architecting Success: The Art of Soft Skills in Technical Sales: Connect to Sell More" by Evgeniy Kharam we referenced in this episode.
 
In this episode:
 
 • Beyond the technical playbook
 • Influencing without authority
 • Partnering, not just selling
 • The deliberate work of connection
 
Thanks to our sponsor, HackerOne
 

 
Built on 580,000+ validated vulnerabilities, $81M in payouts this year, and insights from 1,950 enterprise programs, the 2025 Hacker-Powered Security Report shows how leading organizations reduce risk and prove outcomes. Get practical guidance on attacker focus, response patterns, and board-ready metrics. Watch the Q&A, then download the report to operationalize what works for you.
 https://www.hackerone.com/report/future-of-ai?utm_medium=Paid-Newsletter&utm_source=cisoseries&utm_campaign=Parent-FY25-AIAwarenessCampaign-GL

What Soft Skills Do You Need in Cyber?

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Bil Harmer, security advisor, Craft Ventures. Joining them is James Bruce, business security services director, WPP.
 
In this episode:
 
 • Turning visibility into actionable intelligence
 • Pure visibility still provides an essential security foundation
 • Finding strategic value
 • The risk of gaps in identity management
 
Huge thanks to our sponsor, ThreatLocker
 Human error remains one of the top cybersecurity threats. Just one wrong click can open the door to ransomware or data loss. With ThreatLocker, unauthorized apps, scripts, and devices are blocked before they can ever run. See how ThreatLocker can help you gain more control over your environment. Threatlocker.com/CISO

What is the Visibility That Security Teams Need?

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Dan Walsh, CISO, Datavant. Joining them is their sponsored guest, Ash Hunt, vp, strategy, EMEA, Cyera.
 
In this episode:
 
 • The access creep challenge
 • Bridging intent and execution
 • Looking for integrity
 • Racing against exponential complexity
 
Huge thanks to our sponsor, Cyera
 
 
 

 
 
 AI is moving fast - can your security keep up? Join the leaders shaping the future of data and AI security at DataSecAI Conference 2025, hosted by Cyera, Nov 12–13 in Dallas. Register now at https://www.cyera.com/?utm_source=cisoseries

Data Governance in the Age of AI

All links and images can be found on CISO Series.
 
Check out this post by David Mundy of Tuskira for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining them is Jason Taule, CISO, Luminis Health.
 
In this episode:
 
 • ROI challenges 
 • Venture capital saturation
 • Risk aversion and organizational politics
 • A GTM transformation
 
Huge thanks to our sponsor, Doppel
 

 
Doppel is the first social engineering defense platform built to dismantle deception at the source. It uses AI and infrastructure correlation to detect, link, and disrupt impersonation campaigns before they spread - protecting brands, executives, and employees while turning every threat into action that strengthens defenses across a shared intelligence network. Learn more at https://www.doppel.com/platform

How Can Security Vendors Better Stand Out?

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Geoff Belknap. Joining us is our sponsored guest, Kara Sprague, CEO, HackerOne.
 
In this episode:
 
 • Shadow AI as a control problem
 • Rethinking identity for autonomous agents
 • When process meets momentum
 • Beyond blocking: channeling AI usage
 
Huge thanks to our sponsor, HackerOne
 

 
Built on 580,000+ validated vulnerabilities, $81M in payouts this year, and insights from 1,950 enterprise programs, the 2025 Hacker-Powered Security Report shows how leading organizations reduce risk and prove outcomes. Get practical guidance on attacker focus, response patterns, and board-ready metrics. Watch the Q&A, then download the report to operationalize what works for you.
 https://www.hackerone.com/report/hacker-powered-security

What New Risks Does AI Introduce?

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining us is CISO Series reporter and CISO herself, Hadas Cassorla.
 
In this episode:
 
 • Security poverty line excludes SMBs 
 • Skills gap and channel dynamics slow SMB security adoption
 • The startup disadvantage cycle
 • Technology adoption flows from enterprise complexity to market simplification
 
Huge thanks to our sponsor, ThreatLocker
 

 
ThreatLocker® is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero-day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit ThreatLocker.com.

The Pattern of Early Adoption of Security Tools

All links and images can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark, the producer of CISO Series, and Geoff Belknap. Joining us is our sponsored guest Mokhtar Bacha, founder and CEO, Formal.
 
In this episode:
 
 • Access management faces transformation 
 • AI agents demand new authentication paradigms
 • AI complexity demands simplified governance approaches
 • Data-centric identity management replaces role-based approaches
 
Huge thanks to our sponsor, Formal
 

 
Formal secures humans, AI agent's access to MCP servers, infrastructure, and data stores by monitoring and controlling data flows in real time. Using a protocol-aware reverse proxy, Formal enforces least-privilege access to sensitive data and APIs, ensuring AI behavior stays predictable and secure. Visit joinformal.com to learn more or schedule a demo.

How Are You Managing the Flow of AI Data

All links and images for this episode can be found on CISO Series
 
For four years in a row, Verizon's DBIR, has touted compromised credentials as the top cause of data breaches. That means bad people are getting in yet appearing to be legitimate users. What are these malignant users doing inside our network? What are the techniques to both understand and allow for good yet thwart bad lateral movement?
 
Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host Steve Zalewski, and our sponsored guest Sandy Wenzel (@malwaremama), cybersecurity transformation engineer, VMware.
 
Thanks to our podcast sponsor, VMware
 
 
 
In this episode: 
 
 • Why are bad people getting inside our networks?
 • Can machine learning help find them?
 • How can we separate lateral movement from credential stuffing?
 • Would using threat modeling and going passwordless help?

Managing Lateral Movement

Listen and read

Other podcasts you might like ...