Critical Infrastructure: The Risk Hiding in Plain Sight – Jason Manar – CSP #225

June 8, 2026

In this episode, former FBI cyber leader Jason Manar joins us to unpack the state of critical infrastructure security and why small and medium-sized businesses are more connected to it than they realize. From power, telecom, healthcare, finance, and supply chains, Jason explains how hidden dependencies can turn “not our problem” into a business-sto...

IAM Technologies

IAM for MSSPs: The Hidden Risk of Blind Trust – Dustin Sachs – CSP #224

May 11, 2026

Identity and access management is often sold as a technical problem, but real-world deployments tell a different story. For MSSPs managing access across multiple client environments, IAM becomes a test of trust, accountability, decision fatigue, and human behavior. In this episode of CISO Stories, we explore why access reviews become rubber stamps,...

AI/ML

From Compliance to Code: Rethinking Cloud Security – Richard Marcus – CSP #223

April 13, 2026

Jess talks with Rich about what it takes to secure a cloud-first organization at scale. Rich explains how compliance as code helps teams build secure-by-default environments in AWS and Azure. He also shares why continuous monitoring gives organizations stronger visibility and a more reliable path to audit readiness. The episode closes with a look a...

Threat Intelligence

From Alerts to Action: Making Public–Private Threat Intel Actually Useful – Ian Washburn – CSP #222

March 9, 2026

Threat intelligence too often arrives as a steady stream of alerts that don’t translate into clear, timely decisions. This episode explores how public-sector intel flows today through channels like CISA, MS-ISAC, and CIS—and why changes in funding and distribution can reshape what organizations actually receive and when. We also imagine an all-in s...

Supply chain

Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data – Jadee Hanson – CSP #221

February 9, 2026

CISO Jadee Hanson shares how Vanta “drinks its own champagne,” running on NIST CSF with quarterly baseline reviews and using Vanta’s GRC platform to turn every release into live UAT for privacy, governance, and compliance. We rethink third-party management—why point-in-time risk scores are fading and how AI drives continuous monitoring and outcome-...

Zero trust

Keys Without People — John Heasman on Cleaning Up Non-Human Access – John Heasman – CSP #220

January 12, 2026

Title: Keys Without People” — John Heasman on Cleaning Up Non-Human Access Summary: John breaks today’s non-human identity mess into three buckets: core tools your business runs on, old/one-off integrations that linger, and engineer tokens left behind. His playbook is simple: decide what’s truly critical, assign a clear owner, keep access minimal,...

Risk Assessments/Management

Agents at the Door: Vetting Non-Human Identities in External IAM – Rakesh Soni – CSP #219

December 8, 2025

This episode was about agentic IAM—what it is and the risks that come with letting non-human agents act for customers. We defined external IAM, then traced how the industry moved from basic login and MFA to consent, delegation, and now agent-to-agent interactions. Along the way we unpacked key risks for CISOs and practitioners to consider. Segment...

AI benefits/risks

ATT&CK → ATLAS: A CISO’s Blueprint for AI Governance – Sandy Dunn – CSP #218

November 10, 2025

CISO Sandy Dunn breaks down her blueprint for AI-ready defense—pairing MITRE ATT&CK v18 with MITRE ATLAS to move from policy to behavior-based detections. We hit practical AI governance, her early focus on defending and understanding AI, and how OWASP GenAI tools turn checklists into action. Segment Resources: Article: https://www.linkedin.com...

Threat Intelligence

Security Awareness Through Trust and Influence – Jennifer Selby Long – CSP #217

October 13, 2025

Jennifer Selby Long reframes security awareness as more than training—it’s about earning trust and influence with executives and security teams. She shares leadership lessons on how to build stronger alignment and support for security initiatives.

Vulnerability Management

OT on the Frontlines: Threat Intelligence You Can’t Ignore – Dawn Cappelli – CSP #216

September 8, 2025

Dawn Capelli, Head of OT-CERT at Dragos, unpacks the evolving risks to Operational Technology. From nation-state attacks on Ukraine’s infrastructure to hacktivists targeting U.S. water systems, she explains the PIPEDREAM malware, the top five SANS critical OT controls, and how Dragos’ OT-CERT program offers free resources to help organizations defe...

Governance, Risk and Compliance

Reimagining Security Operations: SOC as a Service and the Role of AI – Kevin Nikkhoo – CSP #215

August 11, 2025

Kevin Nikkhoo joins the show to explore Security Operations Center as a Service (SOCaaS) and how it compares to traditional SOC models. He breaks down which organizations benefit most from this approach and how AI is reshaping modern SOC operations. Listeners will gain a clear understanding of how SOCaaS can enhance detection and response capabilit...

Critical Infrastructure: The Risk Hiding in Plain Sight – Jason Manar – CSP #225

IAM for MSSPs: The Hidden Risk of Blind Trust – Dustin Sachs – CSP #224

From Compliance to Code: Rethinking Cloud Security – Richard Marcus – CSP #223

From Alerts to Action: Making Public–Private Threat Intel Actually Useful – Ian Washburn – CSP #222

Beyond Vendor Risk: Real-Time GRC, AI, and Protecting App User Data – Jadee Hanson – CSP #221

Keys Without People — John Heasman on Cleaning Up Non-Human Access – John Heasman – CSP #220

Agents at the Door: Vetting Non-Human Identities in External IAM – Rakesh Soni – CSP #219

ATT&CK → ATLAS: A CISO’s Blueprint for AI Governance – Sandy Dunn – CSP #218

Security Awareness Through Trust and Influence – Jennifer Selby Long – CSP #217

OT on the Frontlines: Threat Intelligence You Can’t Ignore – Dawn Cappelli – CSP #216

Reimagining Security Operations: SOC as a Service and the Role of AI – Kevin Nikkhoo – CSP #215

Leadership News & Analysis

Microsoft takes down websites used to create 750 million fraudulent accounts

Zebra Technology’s Mike Zachman: Be a business enabler, not a hurdle

Lenovo’s Skip Mann: Exceptional security leadership like being a human Swiss Army knife

1,000 CISOs strong: How cross-company collaboration strengthens enterprise cybersecurity

Host Todd Fitzgerald reflects on 100 episodes of the CISO Stories podcast