Secure Talk Podcast

Every American has a Social Security number. Most assume it's protected. Chuck Borges was the person responsible for that protection at the SSA — and what he discovered from the inside is something every American deserves to know. Chuck is a combat veteran, MIT graduate, and the Social Security Administration's first dedicated Chief Data Officer. He arrived two weeks before the 2025 administration change, watched data governance requests get denied and sensitive work get siloed away from the officials responsible for protecting it, and when the risk became too great to ignore, he spoke up. It cost him his job. In this episode of SecureTalk, Chuck and host Justin Beals cover: - Why NUMIDENT data breach goes far beyond a typical data breach - How shadow IT and unchecked access created a governance nightmare inside the SSA - The national security implications of 550 million identity records at risk - What it actually takes to blow the whistle when the stakes are this high This is one of the most important cybersecurity conversations of 2025, not because of the technology involved, but because of what it reveals about the systems we trust to protect us. Chapters 00:00 From Dreams to Data: A Unique Journey 02:47 Navigating the Data Landscape: Challenges and Innovations 05:41 The Role of Governance in Data Management 08:20 Civil Service and the Mission Mindset 11:16 Chaos and Change: The Impact of Administration Shifts 13:52 Empathy in Leadership: The Human Element 16:51 Life Experience and Effective Governance 21:16 Siloing and Data Manipulation in Government 23:30 The Risks of Shadow IT and Data Security 27:39 The Dangers of Numident Data 30:08 The Nightmare of Data Exfiltration 31:52 The Courage to Blow the Whistle 36:19 Transitioning to Political Service 38:24 Challenges of Running for Office 41:36 Building Community Through Problem Solving 43:05 Introduction to Data Sensitivity and Governance 44:33 The Risks of Data Exposure 45:55 Chuck Borges: A Profile in Data Leadership 46:46 Introduction to SecureTalk and Data Security 47:37 The Role of the Social Security Administration 48:35 Chuck Borges: A Journey Through Data Governance 50:28 The Impact of Administration Changes on Governance 56:14 Challenges in Data Management and Governance 01:00:58 The Risks of Data Exposure and Mismanagement 01:05:37 Whistleblowing and Ethical Responsibilities 01:14:56 Running for Office: A New Chapter in Public Service Resources: Chuck Borges Website - https://chuck4md.com Twitter - https://twitter.com/Chuck4MD 🔔 Subscribe to SecureTalk for weekly conversations on cybersecurity, leadership, and the technology shaping our world. #SocialSecurity #DataGovernance #Cybersecurity #DataBreach #NationalSecurity #Whistleblower #FederalCybersecurity #IdentityTheft #SecureTalk #CDO

On the morning of September 11th, 2001, John Ackerly was briefing White House officials on federal privacy legislation. Hours later, everything changed — and those two realities, data that wasn't shared when it should have been, and data that was exposed when it shouldn't have been, became the founding idea behind Virtru. In this episode of SecureTalk, host Justin Beals sits down with John Ackerly, CEO and co-founder of Virtru and former White House technology policy adviser, to explore why perimeter security alone is broken — and what data-centric, cryptographic control means for the future of cybersecurity. They cover: 00:00 Introduction to SecureTalk and Data Security 02:28 John Ackerley's Experience and Insights on Privacy Legislation 05:05 The Dichotomy of Privacy and Security 09:12 Public-Private Partnerships in National Security 12:24 Navigating Compliance and Security in Business 15:26 The Role of Technology in Security Solutions 18:40 Family Ties and Military Background in Cybersecurity 20:41 Insider Threats and Data Security Innovations 23:29 The Importance of Data Management and Audits 26:12 Cultural Impact on Security Practices 29:19 Future Challenges: Quantum Computing and Security 32:52 The Evolution of AI and Data Science in Security Whether you work in cybersecurity, government, or technology policy, this conversation connects the policy decisions of the past 25 years to the architectural challenges we face today. 🔒 Learn more about Virtru: https://www.virtru.com 🎙️ Subscribe to SecureTalk for weekly conversations at the intersection of technology, security, and society.

You consider yourself pretty tech-savvy. You know not to click suspicious links. You've heard the warnings. So why are more people losing more money to online scams than ever before? Robert Siciliano has spent 30 years as a private investigator, appearing on CNN, The Today Show, and Fox News to explain exactly how con artists and cybercriminals think — and why your brain is actually working against you. In this eye-opening conversation with SecureTalk host Justin Beals, Robert reveals: - The psychological reason almost everyone falls for scams eventually - How criminals use loneliness to build fake relationships and drain bank accounts - Why your parents are the #1 target for the $124 trillion wealth transfer underway - What a deepfake video call cost one company $25 million — in a single afternoon - The one habit that would protect 80% of people — and almost nobody does it This isn't a tech talk. It's a human talk. And it might be the most important conversation you have about your money, your family, and your identity this year. Chapters 00:00 Introduction to Cybersecurity Challenges 02:44 The Human Blind Spot in Cybersecurity 05:30 Engaging Employees in Security Practices 08:44 Understanding Cybercrime Trends 11:30 The Psychological Aspects of Trust and Security 14:03 Personalizing Security Awareness Training 17:01 The Role of AI in Cybersecurity Threats 23:46 The Dark Reality of Human Trafficking and Cyber Crime 25:55 The Evolution of Cyber Crime Tactics 27:37 Understanding Human Behavior in Cybersecurity 29:54 The Impact of Loneliness on Cyber Vulnerability 31:58 The Kitchen Table Effect in Security Training 34:20 The Importance of Human Connection in Security Awareness 37:40 Empathy and Responsibility in Cybersecurity 39:47 Personal Stories Shaping a Security Perspective 🔔 Subscribe to SecureTalk — new episodes every week. #ScamAlert #OnlineScams #IdentityTheft #CyberSafety #DeepFake #FinancialSecurity #PersonalFinance #TechForEveryone #StayProtected #CyberAware

What happens when federal law enforcement refuses to follow court orders? In Minneapolis, ICE agents denied state investigators access to crime scenes despite court-issued warrants—a breakdown that national security experts had been warning about for months. Dr. Claire Finkelstein, Professor of Law at University of Pennsylvania and Director of the Center for Ethics and the Rule of Law, saw this coming. In October 2024, she ran a tabletop exercise with over 30 retired military leaders simulating exactly this scenario: federal forces confronting state National Guard during civil unrest. The simulation escalated to violence faster than anyone expected, with few off-ramps once momentum built. Now that simulation is playing out in real time. Dr. Finkelstein has been on the legal front lines, representing 155 members of Congress before the Supreme Court. When the Court ruled the administration couldn't use National Guard troops as they intended, ICE agents surged instead—creating the confrontation we're seeing today. The questions are urgent: Can states prosecute federal agents who commit crimes in their jurisdiction? What happens when federal authorities claim immunity? How do soldiers follow orders when they can't trust those orders are lawful? The Supreme Court's immunity decision has made these questions harder to answer. This conversation explores what happens when rule of law meets political will, and what remains when the institutions designed to protect democracy face their greatest test. #CyberSecurity #NationalSecurity #Democracy #RuleOfLaw #Minnesota #Minneapolis Resources: Finkelstein, Claire. (2026, January 21). We ran high-level US civil war simulations. Minessota is exactly how they start. The Guardian. https://www.theguardian.com/commentisfree/2026/jan/21/ice-minnesota-trump

Most AI discourse swings between paradise and doom—but the real question is how we architect these systems to enhance human understanding rather than replace decision-making. MIT Professor Alex "Sandy" Pentland reveals why treating AI as an information tool instead of an authority is critical for cybersecurity teams, business leaders, and anyone navigating the intersection of technology and culture. The math is stark: 90% of social media users are represented by only 3% of tweets. We're making decisions based on algorithmic extremes, not community wisdom. Pentland shows how Taiwan used the Polis platform to restore government trust from 7% to 70% by eliminating follower counts and visualizing the full spectrum of opinion—proving most people agree more than they think. For security professionals, the implications are profound: culture drives security outcomes more than controls. The stories your team shares about breaches, vulnerabilities, and response protocols create the shared wisdom that determines whether you're actually secure. AI can help synthesize context and surface patterns across distributed organizations, but cannot replace the human judgment needed when edge cases and outliers occur. Drawing parallels to the Enlightenment—when letter-writing networks sparked unprecedented collaboration among scholars—Pentland argues we stand at a similar inflection point. We have tools that let us share information at unprecedented scale, yet our digital systems amplify loud voices and create echo chambers instead of fostering collective wisdom. His book "Shared Wisdom" offers a pragmatic framework for cultural evolution in the age of AI, recognizing we'll take steps forward, make mistakes, and need to choose our direction deliberately. Key insights include understanding AI as a statistical repackaging of human stories, recognizing how four waves of AI development have each failed in predictable ways, and learning why loyal agents—systems legally bound to serve your interests like doctors and lawyers—represent the future of trustworthy AI. Pentland also explains why audit trails and liability matter more than premature regulation, and how communities need local governance that's interoperable but not uniform. Alex "Sandy" Pentland is Stanford HAI Fellow, MIT Toshiba Professor, and member of the US National Academy of Engineering. Named one of "100 People to Watch This Century" by Newsweek and one of "seven most powerful data scientists in the world" by Forbes, his work established authentication standards for digital networks and contributed to pioneering EU privacy law. Episode Resources: Pentland, Alex. (2025). Shared Wisdom: Cultural Evolution in the Age of AI. The MIT Press. https://mitpress.mit.edu/9780262050999/shared-wisdom/

While most organizations treat security as a cost center, a select group is using it to win enterprise deals, open new markets, and outpace competitors. The difference? They've stopped asking "how much does security cost?" and started asking "how much value does security create?" This strategic edition synthesizes lessons from security leaders at Walmart, PayPal, Postman, and the defense industrial base to reveal the playbook for 2026: treating security as a business function that enables velocity, builds trust, and creates competitive moats. Five Strategic Imperatives for 2026: 1. Architect for the AI Identity Explosion When AI agents access your CRM, email, and databases on behalf of humans, who's accountable? Walmart's 10,000+ developers faced this at scale. Learn how to govern probabilistic, non-deterministic systems before deployment breaks. 2. Turn Supply Chain Security Into Competitive Advantage CMMC enforcement is here—Raytheon paid $8.4M, Penn State $1.25M. But smart contractors are leading with certification to win contracts. See how quantitative security standards are reshaping business relationships between primes and subs. 3. Extract Intelligence From Your Own Logs One organization prevented $3M in fraud using internal threat intelligence. Learn why focused AI models that analyze your specific environment outperform generic vendor feeds. 4. Make Security Your Primary Differentiator When SOC 2 Type II certification wins you three enterprise customers worth $2M ARR, security spending looks very different to the CFO. Discover how to position security as the reason customers choose you. 5. Build Culture, Not Tool Stacks The oil & gas industry made safety everyone's responsibility through culture, not technology. Apply the same principles to solve cybersecurity's 65% turnover crisis. Expert Insights From: Rishi Bhargava (Descope) | Tobias Yergin (Walmart) | Bob Kolasky (Exiger) | Chris Wysopal (Veracode) | Bill Anderson (Mattermost) | Satyam Patel (Kandji) | Sam Chehab (Postman) | Brian Wagner | Dimitry Shvartsman (PayPal) The Meta-Pattern: Organizations winning in 2026 measure security in business terms—revenue enabled, customers won, time to market reduced. They're not the "department of no" blocking progress—they're the team enabling fast, safe movement. 🎙️ SecureTalk: Strategic conversations with security leaders, hosted by Justin Beals 🔔 Subscribe for insights on AI security, CMMC, threat intelligence & security ROI

"In 20 years, we transformed food allergy awareness from nonexistent to universal—no law required. What if we could do the same for data security and AI governance?" This special episode reveals how grassroots cultural shifts create lasting change, and why 2026 might be the year cybersecurity professionals become architects of something bigger than defenses. We've distilled 2025's conversations with experts from Harvard, MIT, NYU, Brown, and the AI development frontlines into seven actionable lessons that reframe security from technical problem to human opportunity. From understanding the 800 billion AI agents already in our systems, to recognizing why your most valuable threat intelligence is already in your logs, to building the communities that make external defenses less necessary. Here's what successful security leaders are realizing: The organizations thriving in 2026 aren't just protecting systems—they're creating conditions where humans and AI can flourish together. THE SEVEN LESSONS: • Social division is our greatest vulnerability (and connection is our strength) • Technology won't save us from ourselves (but we can) • Real change happens through grassroots cultural shifts • AI demands fundamentally different thinking (here's how) • Our values can blind us (when to trust them, when not to) • The weakest links are often invisible (where to look) • Context matters more than technology (your advantage is closer than you think) FEATURING INSIGHTS FROM: Dr. Claire Robertson (NYU) | Greg Epstein (Harvard/MIT) | Dr. De Kai | Rishi Bhargava (Descope) | Tobias Yergin (Walmart AI) | Prof. Steven Sloman (Brown) | Lars Kruse | Brian Wagner | Dr. Aram Sinnreich | Jesse Gilbert PERFECT FOR: Security leaders building resilient organizations | Professionals navigating AI transformation | Anyone ready to move beyond purely technical solutions 🔗 StrikeGraph: https://strikegraph.com Which lesson will change how you approach security in 2026? #Cybersecurity #AIGovernance #SecurityLeadership #CyberResilience #AIEthics #CISO #ThreatIntelligence #FutureOfWork

The mistakes we made building the internet don't have to be repeated in the metaverse—if we act now. Join SecureTalk host Justin Beals for an essential conversation with Dr. Paola Cecchi-Dimeglio about building secure, ethical virtual worlds. Dr. Cecchi-Dimeglio brings 25 years of experience advising governments, Fortune 500 companies, and global institutions on AI ethics and technology governance. Her new book "Building a Thriving Future: Metaverse and Multiverse" (MIT Press, 2025) provides frameworks for building virtual spaces that serve humanity rather than exploit it. CORE THEMES: • Security by design vs. security bolted on after problems emerge • How biases get encoded into AI systems—and prevention strategies • The critical role of "human in the loop" for AI oversight • Why good regulation creates business stability • Digital identity systems for global inclusion • Authentication and verification in virtual spaces • Cross-border legal frameworks for technology governance REAL-WORLD IMPACT: Over 1 billion people globally lack legal identification—virtual worlds could solve this through blockchain-based digital identity, or create new exclusions if built poorly. The standards we set now for authentication, verification, and identity control will determine whether these spaces become tools for human flourishing or mechanisms for surveillance. WHY THIS MATTERS NOW: SURPRISING INSIGHTS: → Children currently detect deepfakes better than adults (but not for long) → Major consulting firms have sold governments expensive reports full of AI errors → Voice recognition systems historically failed on non-Western accents due to training data bias → Email autocorrect defaults "Paola" to "Paolo" because datasets contained more men than women ABOUT THE GUEST: Dr. Paola Cecchi-Dimeglio is a globally recognized expert in AI, big data, and behavioral science. She holds dual appointments at Harvard Law School and Kennedy School of Government, co-chairs the UN ITU Global Initiative on AI and Virtual Worlds, and has authored 70+ peer-reviewed publications. Her work advises the World Bank, European Commission, and Fortune 500 executives on ethical AI implementation. THE OPTIMISTIC VISION: Virtual worlds can tap talent anywhere, breaking geographic barriers. They can connect separated families, provide legal identity to excluded populations, and create opportunities we can't yet imagine—but only if we build them with security, ethics, and human values as foundational requirements. ABOUT SECURETALK: SecureTalk ranks in the top 2.5% of podcasts globally, making cybersecurity and compliance topics accessible to business leaders. Hosted by Justin Beals, CEO of Strike Graph and former network security engineer. Perfect for: Security professionals, technology leaders, business executives, policy makers, anyone concerned about building ethical AI systems and secure virtual worlds. 📚 "Building a Thriving Future: Metaverse and Multiverse" by Dr. Paola Cecchi-Dimeglio (MIT Press, 2025) #AIEthics #Cybersecurity #VirtualWorlds #TechnologyGovernance #MetaverseSecurity #DigitalEthics #AIRegulation #SecureByDesign

Brown University cognitive scientist Steven Sloman reveals the hidden mechanism driving cultural division—and why it matters for security leadership. In this wide-ranging conversation, Sloman explains the fundamental tension between sacred values and consequentialist thinking, and how understanding this dynamic transforms how leaders communicate risk and build organizational culture. Justin Beals opens with a personal story about leaving a religious environment defined by absolute values, setting the stage for an exploration of how cognitive science explains why extremists control discourse, why outrage dominates social media, and why having strong values might actually be essential for good decision-making. KEY TOPICS: • The two systems humans use for decision-making and why both matter • Why simplified positions dominate complex policy debates • How humor breaks through absolutist thinking • The critical difference between AI association and human deliberation • Why communities radicalize when they become too insular • Practical frameworks for leadership teams navigating value conflicts Sloman, author of "The Cost of Conviction: How Our Deepest Values Lead Us Astray," shares insights from decades of research on cognition, reasoning, and collective thinking. The conversation moves from abstract cognitive science to immediate applications for security professionals operating in organizations where tribal loyalties threaten evidence-based decision-making. Whether you're presenting risk assessments to boards, building security culture, or helping organizations function during divisive times, this episode offers frameworks for understanding when values serve us and when consequentialist analysis becomes essential. Resources: Sloman, S. (2025). The cost of conviction: How our deepest values lead us astray. MIT Press. (https://mitpress.mit.edu/9780262049825/the-cost-of-conviction/)

Most threat intelligence programs can't prove their value. Joe Rossi's team at Zions Bank did the opposite—preventing $3 million in fraud annually while actually attracting new customers to the bank. In this episode, former punk rock kid turned threat intelligence leader Joe Rossi reveals why your most valuable security intelligence isn't from expensive vendor feeds—it's sitting in your own logs right now. He shares the hard lessons learned building CTI programs from scratch, why most organizations focus on the wrong threats, and how to make security a competitive advantage instead of just a cost center. Key insights: • Why your firewall logs are more valuable than threat intelligence feeds • The cultural mindset required before you invest in CTI • How to quantify security program ROI in terms leadership actually cares about • Dark web monitoring: reality vs. Hollywood expectations • When your organization is actually ready for threat intelligence Whether you're a CISO considering a CTI program or a security professional trying to prove value, this conversation offers practical frameworks for building security capabilities that directly impact the bottom line.

Bob Kolasky walked the halls where CMMC was built. As founding director of CISA's National Risk Management Center, he watched this policy evolve from concept to pilot program to federal law—surviving three presidential administrations because the need never changed. On November 10, 2025, that policy becomes mandatory reality for every defense contractor pursuing new DoD solicitations. Self-certification ends. Independent verification begins. And the defense industrial base faces its most significant security transformation in a generation. In this conversation with Justin Beals, Bob explains what contractors need to understand about the deadline—and what recent enforcement actions reveal about gaps that have existed all along. From Honor System to Accountability: For years, defense contractors self-certified compliance with NIST 800-171 cybersecurity requirements. The system worked on trust. Contractors checked boxes, DoD accepted attestations, and controlled unclassified information flowed through supply chains with security gaps nobody was measuring. Then came the settlements. Raytheon paid $8.4 million for failing basic security controls—no antivirus software on systems handling defense information, no system security plans, missing access controls. Penn State settled $1.25 million across 15 contracts. Georgia Tech paid $875,000 in the first DOJ intervention in a cybersecurity False Claims Act case. These weren't breaches. These were preventable failures that contractors had certified didn't exist. Katie Arrington's warning to the industry has been consistent: "If you go on LinkedIn one more time and tell me how hard CMMC is, I'm going to beat you. That ship sailed in 2014." Translation: adversaries are watching, and contractors broadcasting difficulties are revealing exactly where vulnerabilities exist. The November 10th Framework: After this deadline, every new contract solicitation includes CMMC requirements matched to data sensitivity: Level 1 handles federal contract information through annual self-assessment with SPRS score reporting. Level 2 manages controlled unclassified information and requires independent C3PAO assessor validation—affecting approximately 35% of DoD's contractor base. Level 3 involves breakthrough technology or critical CUI aggregations and demands direct government audit. The quantitative approach represents a shift. Instead of binary pass/fail, contractors receive scores reflecting actual security posture. An 88 out of 110 qualifies for Level 2 conditional status with plan of action and milestones. These numbers measure real capabilities across incident response, access control, and continuous monitoring. The Supply Chain Ripple Effect: Prime contractors bear new responsibility for subcontractor compliance. Before contract award, they must verify—not just accept—that subs meet requirements. Security questionnaires aren't sufficient anymore. Primes need evidence, validation, and continuous visibility. An affirming official—typically a senior executive—personally attests to the government that the organization actively manages supply chain risk. This accountability changes relationships throughout the defense industrial base. Practical Considerations: Bob addresses the questions contractors are asking: How do you define system boundaries when CUI flows through your infrastructure? Why does each information system need a unique CMMC identifier? What does "current CMMC status" mean for maintaining certification? How do you schedule C3PAO assessments when capacity is limited and 35% of contractors need certification? He also explains why technology becomes essential—automating compliance evidence collection makes continuous monitoring feasible without massive security staff increases. And he's candid about what the next two years bring: with Kirsten Davies nominated as new CIO and Katie Arrington driving implementation, expect aggressive rollout through 2026. Why This Policy...

When we think about cybersecurity, images of tech giants and major financial centers come to mind—but what about the towns where most of us actually live? This SecureTalk episode with cybersecurity researcher Lars Kruse explores an often-overlooked question: how do communities of 20,000-100,000 residents protect themselves in an increasingly digital world? Host Justin Beals and Kruse, who studies at Sweden's Defense University, discuss the practical realities of implementing cybersecurity in resource-constrained environments. Through his research on over 600 European municipalities and validation interviews with consultants and administrators, Kruse reveals fascinating insights about the gap between written policies and daily operations. The conversation opens with a real-world incident from Germany where 72 towns simultaneously lost access to their IT systems—not through sophisticated hacking, but through preventable security oversights. This case study illustrates why understanding operational security matters just as much as regulatory compliance. Key topics explored include: - How mid-sized communities differ from "smart cities" in their security approach - The balance between regulatory requirements like GDPR, NIS2, and DORA - Why employee training consistently ranks as the most critical security investment - Practical frameworks for managing third-party technology vendors - The role of political leadership in prioritizing cybersecurity budgets - How research institutions contribute to better security policies Kruse shares optimistic findings too: many organizations already practice good security fundamentals—they just need guidance connecting their existing processes to compliance requirements. The episode emphasizes that cybersecurity isn't about expensive technology alone; it's about building resilient practices that protect community services and citizen data. Perfect for professionals in public administration, IT management, business operations, or anyone curious about how digital security works beyond headlines. This conversation offers practical knowledge about protecting the digital infrastructure we all depend on daily. SecureTalk features conversations with experts shaping the future of cybersecurity and compliance, hosted by Justin Beals, CEO of Strike Graph. #Cybersecurity #PublicSector #DigitalSecurity #CommunityResilience #SecurityEducation #DataPrivacy #TechPolicy #LocalGovernment #CyberAwareness #ITSecurity

Quantum computing represents one of the most significant advances in computer science we'll see in our lifetimes. We're watching error correction rates improve faster than predicted, with Google's Willow chip achieving benchmarks that compress development timelines dramatically. For security professionals, this creates an exciting challenge: how do we architect systems today that remain secure as computing power evolves? What makes this particularly interesting is that blockchain and Web3 technologies are at the forefront of this transition—not because they're more vulnerable, but because they're leading the way in implementing quantum-resistant solutions. Unlike traditional systems where encryption happens behind closed doors, blockchain's transparency means every transaction, every wallet, every cryptographic operation is visible on a public ledger. When post-quantum cryptography becomes necessary, these systems can't just patch quietly in the background. They need to migrate entire ecosystems while maintaining trust with users who can see every change on-chain. In this episode, we sit down with James Stephens, founder and CEO of Krown Technologies and a certified cryptocurrency forensic investigator, to explore how the blockchain industry is pioneering quantum-resistant infrastructure that will inform security practices across all sectors. What We Discuss: James brings practical experience from both investigating cryptocurrency breaches and building quantum-resistant blockchain infrastructure. His forensic work revealed that most losses come from key mishandling and social engineering rather than cryptographic breaks—insights that shaped how he approaches designing secure systems for any environment. This conversation covers both the technical innovation happening in quantum computing and the architectural decisions security teams need to make to prepare their organizations for this next era of computing power. About the Guest: James Stephens is a recognized authority in blockchain security and cryptocurrency forensics with over a decade of experience at the intersection of digital assets, cybersecurity, and quantum innovation. He holds certifications including CBE, CCFI, and CORCI, and is the author of "Quantum Reckoning: Securing Blockchain and DeFi in the Post-Quantum Era." #Cybersecurity #QuantumComputing #PostQuantumCryptography #Blockchain #Web3 #DeFi #InfoSec

Discover how strategic foresight is revolutionizing cybersecurity thinking. In this compelling SecureTalk episode, renowned futurist Heather Vescent reveals the 12 invisible paradigms that have shaped our entire approach to cybersecurity - and why breaking them could transform how we defend digital systems. Back in 2017, Vescent applied strategic foresight methodology to cybersecurity, uncovering fundamental assumptions like "security always plays catch-up," "the user is always wrong," and "we are completely dependent on passwords." Her research, published in 2018, predicted the passwordless revolution that's now mainstream reality. This isn't just theoretical - Vescent demonstrates how appreciative inquiry flips traditional problem-solving approaches. Instead of asking "what's broken and how do we fix it," she explores "what's working well and how do we amplify it?" This methodology helped identify paradigm shifts that seemed radical in 2018 but are now industry standard. Key insights include: - How to shift from reactive to proactive security postures - Why attack surface analysis needs systematic approaches - The role of AI as thought partner rather than replacement - How transparency reduces insider threat attack surfaces - Practical applications of decentralized identity technologies - Why security teams should focus on strengths, not just vulnerabilities Vescent also addresses the commercialization challenges facing promising technologies like self-sovereign identity, explaining how ethical innovations often get compromised during market adoption. Her work bridges the gap between cybersecurity's technical realities and its broader societal implications. For CISOs, security leaders, and technologists seeking to influence rather than just react to the future, this conversation provides actionable frameworks for anticipating threats and building more resilient systems. Vescent's strategic foresight methodology offers a roadmap for moving beyond endless problem-solving cycles toward security that creates value rather than just preventing loss. Resources: Shifting Paradigms Paper: https://www.researchgate.net/publication/330542765_Shifting_Paradigms_Using_Strategic_Foresight_to_Plan_for_Security_Evolution Threat Positioning Framework GPT: https://chatgpt.com/g/g-68100f6a8c7481919d693ec9d4d9faab-the-threat-positioning-framework-gpt-by-h-vescent Self Sovereign Identity Book : https://www.amazon.com/Comprehensive-Guide-Self-Sovereign-Identity-ebook/dp/B07Q3TXLDP?&linkCode=sl1&tag=vescent39-20&linkId=2797fe6ea49dff79952bc866ec8e8baf&language=en_US&ref_=as_li_ss_tl Heather's email list: https://research.cybersecurityfuturist.com/

In a converted hat factory in 1990s Boston, a group of hackers worked through the night to techno beats and Soul Coughing, driven by a simple philosophy: "smarter beats bigger." One of them, Chris Wysopal, would later stand before Congress and deliver a stark warning—a small group of dedicated hackers could bring down the entire internet in 30 minutes. Today, that same hacker faces a new challenge. The AI revolution everyone celebrates may be creating the largest security vulnerability in computing history. Chris and his team at Veracode just completed the most comprehensive study of AI-generated code ever conducted—testing 100 different language models across 80 coding scenarios over two years. What they discovered contradicts everything the tech industry believes about AI development tools. The Reality Behind the Hype: Despite billions in investment and years of development, AI systems create vulnerabilities 45% of the time—exactly matching human error rates. While AI has dramatically improved at writing code that compiles and runs, it has learned nothing about writing secure code. The models have simply gotten better at disguising their mistakes. The Mathematics of Risk: Development teams now code 3-5x faster using AI assistants like GitHub Copilot and ChatGPT. Same vulnerability rate, exponentially faster development speed equals a multiplication of security flaws entering production systems. Many organizations are simultaneously reducing their security testing capacity just as they accelerate their vulnerability creation rate. The Training Data Problem: The source of the issue lies in contaminated training data. These AI systems have absorbed decades of insecure code from open-source repositories and crowd-sourced platforms like Reddit. They've learned every bad coding practice, every deprecated security measure, every vulnerability pattern from the past 30 years—and they're reproducing them at machine speed. The Technical Reality: Chris walks through specific findings: Java fails security tests 72% of the time, cross-site scripting vulnerabilities appear consistently, and inter-procedural data flows confuse even the most advanced models. The study reveals why some vulnerability types prove nearly impossible for current AI to handle correctly. From Underground to Enterprise: This isn't just another technical report—it's a perspective from someone who helped define modern cybersecurity. The same analytical approach that once exposed vulnerabilities in massive corporate systems now reveals why the AI coding revolution presents unprecedented challenges. The Path Forward: While general-purpose AI struggles with security, specialized models focused on fixing rather than generating code show promise. Chris explains how Veracode's targeted approach to code remediation succeeds where broad AI systems fail, pointing toward solutions that embrace the "smarter beats bigger" philosophy. The hacker who once operated in shadows now examines these systems in broad daylight, revealing how our accelerated development practices may be outpacing our ability to secure them. Chapters 00:00 The Origins of Loft Hacking Group 07:48 Generative AI in Software Development 13:39 Vulnerabilities in AI-Generated Code 18:56 The Challenges of Secure Coding 24:34 The Future of AI in Software Security 29:45 The Impact of AI on Developer Roles Resources: Veracode 2025 GenAI Security Report

90% of Twitter users are represented by only 3% of tweets. When you scroll through your feed and form opinions about what "people are saying" about politics, you're not seeing the voices of nine out of ten users. You're seeing the loudest, most extreme 10% who create 97% of all political content on the platform. In this episode of SecureTalk, host Justin Beals explores the "invisible majority problem" with Dr. Claire Robertson, Assistant Professor at Colby College. Together they examine how moderate voices have been algorithmically erased from our public discourse, creating pluralistic ignorance that threatens democracy itself. Dr. Robertson's journey began at Kenyon College during the 2016 election—a blue island in a sea of red where Trump won the county by 40 points but the campus precinct went 90% blue. Surrounded by good people who saw the same election completely differently, she dedicated her career to understanding how we end up living in different realities. Topics covered:

The cybersecurity landscape just shifted permanently, and most organizations aren't ready. While CISOs struggle with alert fatigue from 40+ security tools, a new threat vector is emerging that makes traditional identity management obsolete: AI agents acting autonomously across enterprise systems. Join Secure Talk host Justin Beals for a critical conversation with Rishi Bhargava, the security architect who built Demisto into a $560M category-defining platform and now leads Descope in solving the next impossible challenge. This episode delivers actionable insights for everyone—from Fortune 500 CISOs managing complex threat landscapes to business leaders evaluating AI adoption risks. For Security Professionals, you'll discover: • How AI agent proliferation creates an "identity explosion" that traditional IAM can't handle • Why probabilistic AI systems require fundamentally different access controls than deterministic human users • Advanced WebAuthn and FIDO2 implementation strategies for zero-trust architectures • SOC2 compliance frameworks adapted for AI-human hybrid workflows • Real-world SOAR evolution lessons from the Demisto acquisition For Business Leaders, you'll learn: • Why passwordless authentication directly impacts customer acquisition and retention • The hidden costs of password-related support tickets and user drop-offs • How early AI identity management adoption creates competitive advantages • Risk assessment frameworks for AI agent deployment in sensitive environments For Everyone: • Why your current passwords are a ticking time bomb in an AI-first world • How biometric authentication actually works (and why it's more secure than you think) • Practical steps to future-proof your digital security today Whether you're architecting enterprise security for thousands of employees or simply trying to understand why your login experience keeps getting more complex, this episode reveals the forces reshaping digital identity. The organizations that master AI agent authentication will lead their industries—those that don't risk catastrophic breaches and customer exodus. #CISO #AIAuthentication #EnterpriseIdentity #ZeroTrust #PasswordlessSecurity #CyberSecurityStrategy #IAM #BiometricAuth #SecurityCompliance #AIAgents

The most dangerous threats don't break down the door - they already have the keys. March 23, 2003, Kuwait: Command Sergeant Major Bart Womack was loading ammunition and watching Tiger Woods play golf at 1 AM when a grenade rolled into his tent. What followed was every leader's worst nightmare - discovering that one of your own had been planning to destroy you all along. This isn't just a military story. It's a threat to security we face everywhere. In today's world of workplace shootings, corporate espionage, and school violence, the statistics are terrifying: • Insider threats cause 60% of all security breaches • From Sandy Hook to Fort Hood - trusted insiders inflict maximum damage • Corporate employees steal billions in trade secrets annually • The average insider threat goes undetected for 85 days What makes this episode essential viewing: Real Combat Experience: CSM Womack survived two Bronze Star combat situations, including a firefight with North Korean forces in the DMZ The Diary Revelations: The attacker's own writings revealed: "Destroying America was my plan as a child" - written YEARS before joining the Army Life-Saving Strategies: The 6 proactive methods that could prevent workplace violence, school shootings, and corporate sabotage Universal Application: These hard-learned lessons apply to offices, schools, places of worship, and anywhere people gather The Shocking Truth: While 5,000 soldiers searched for "insurgents," the real enemy was wearing the same uniform, had taken the same oath, and was sleeping in the tent next door. Why This Matters to YOU: Whether you're a parent worried about school safety, a manager responsible for employee welfare, or simply someone who wants to protect your community - the warning signs are the same. Political polarization, social media radicalization, and workplace tensions create the perfect storm for insider threats. What You'll Learn: ✅ The "Trust No One" philosophy (and what it really means) ✅ How to implement "Observe, Listen, Report" in your environment ✅ Why your gut instinct is your strongest security tool ✅ The evolution from belief → radicalized → extreme ✅ Real warning signs that leaders consistently miss CSM Bart Womack transformed his traumatic experience into a mission: preventing others from experiencing what he and his soldiers endured. His insights have protected countless workplaces, schools, and communities. The Bottom Line: In an era where conspiracy theories fuel real violence, where workplace tensions explode into tragedy, and where trusted insiders become active threats - these lessons could save your life. 🎖️ 29-year Army veteran, 101st Airborne Division 📖 Author of "Embedded Enemy" 🎤 Professional security consultant and keynote speaker 🔒 Insider threat prevention expert This episode contains discussions of violence and may not be suitable for all audiences. #InsiderThreat #WorkplaceSafety #SchoolSecurity #Cybersecurity #MilitaryStory #SecurityAwareness #ThreatPrevention #CorporateSecurity #NationalSecurity #CrisisManagement #SecurityLeadership #RiskManagement #EmergencyPreparedness #SafetyTraining #SecurityEducation Subscribe for more real-world security insights that could save lives. Your safety depends on what you don't see coming.

Machines Running Amok: We've Created More Than We Can Secure Twenty years ago, you could count the servers in your data center. Today, we've unleashed an army of digital entities that's spiraling beyond our control. For every human employee, there are 50-100 machine identities operating in your environment—containers, serverless functions, and automated processes that spawn and disappear by the minute. We've created more computing power than we have the ability to secure, and the machines are running amok. In this episode of SecureTalk, we dive deep into the invisible crisis affecting 91% of organizations: machine identity breaches. Join host Justin Beals and cybersecurity expert Oded Hareven, CEO of Akeyless, as they explore why password rotation is dead, how ephemeral computing is breaking traditional security models, and what revolutionary approaches like distributed fragment cryptography mean for the future of cybersecurity. What You'll Learn: • Why 85% of identity breaches now come from compromised machines, not humans • The fundamental mismatch between static security and dynamic infrastructure • How military-grade cybersecurity innovations are transforming commercial applications • Why the AI-quantum computing convergence is forcing us to rethink encryption • Practical steps toward "SSO for machines" and ephemeral security models Key Topics: Guest: Oded Hareven, Co-founder & CEO of Akeyless. Timestamps: 00:00 Introduction to Cybersecurity and Machine Identities 04:37 The Evolution of Security Paradigms 09:30 Akeyless and Machine Identity Management 13:53 Zero Trust and Ephemeral Security 18:36 The Impact of AI and Quantum Computing on Security 23:19 Future Trends in Cybersecurity and Akeyless's Vision Resources: #Cybersecurity #CloudSecurity #MachineLearning #QuantumComputing #DevSecOps #IdentityManagement #ZeroTrust

Open Source vs Commercial: How "Winning Culture" Has Made Us More Vulnerable | Greg Epstein Silicon Valley's shift from collaborative open-source principles to winner-take-all commercial dominance hasn't just changed business models—it's made us fundamentally more vulnerable. When companies prioritize winning everything over building secure, collaborative ecosystems, we all pay the price. But there's a profound irony: the more desperately these leaders chase absolute victory, the more they reveal themselves as losers of the most important game—building meaningful human communities. In this episode, Harvard and MIT Humanist Chaplain Greg Epstein explores how tech's false prophets have led us astray and, more importantly, how we might find our way back to building human-centered security that actually works. The strongest security has never come from building higher walls—it comes from creating ecosystems where everyone's success strengthens the whole. When we understand how to work together better, we all create better security. What You'll Learn: • How winner-take-all thinking creates systemic vulnerabilities • Why collaborative open-source principles build more resilient systems • The hidden security costs of commercial dominance • Practical strategies for building multi-stakeholder security • How to shift from competition to collaboration in your organization Watch this episode to discover how changing your approach to teamwork and partnerships can dramatically improve your security posture. About Greg M. Epstein: Greg serves as Humanist Chaplain at Harvard University and MIT, and spent 18 months at TechCrunch exploring the ethics of companies shifting our definition of humanity. He's the author of "Tech Agnostic: How Technology Became the World's Most Powerful Religion, and Why it Desperately Needs a Reformation." Timestamps: Chapters 00:00 The Corruption of Winning Culture 02:39 The Role of Community in Security 05:44 Navigating the Media Landscape 08:20 The Algorithmic Influence on Information 11:01 The Cult of Personality in Tech 13:44 The Messianic Figures in Technology 16:24 The Fall of Tech Prophets 19:15 The Importance of Losing 21:44 The Future of Technology and Humanity 24:29 The Need for Ethical Technology 26:56 The Role of Men in Modern Society 29:39 The Impact of AI on Society 32:15 The Cult-like Nature of Tech Culture 34:54 The Importance of Human Connection 37:43 The Future of Humanism in Tech 40:11 The Path Forward for Technology and Humanity #TechEthics #CommunityBuilding #DigitalSecurity #TechCulture #HumanistChaplain #SiliconValley #TechReformation