CISO Insights: Voices in Cybersecurity

This episode explores the challenges financial institutions face in translating the complex legal requirements of the EU’s Digital Operational Resilience Act (DORA) into practical, daily operations. We dive into the "DORA in Control" framework developed by NOREA, which consolidates the regulation into 95 actionable controls across eight domains to simplify compliance and gap assessments. Finally, we discuss how adopting an engineer...

This episode explores how the widespread deployment of agentic AI is fundamentally redefining enterprise security by creating fully autonomous, adaptive, and scalable threats that act with growing authority to execute multi-step operations and interact with real systems. We analyze how this shift has industrialized cybercrime, allowing automated operations to orchestrate ransomware and launch hyper-personalized social engineering c...

The cybersecurity market is saturated with "AI washing," forcing CISOs to rigorously vet vendors promising "autonomous" capabilities that often lack genuine intelligence. This episode provides a battle-tested framework for demanding proof over promises, revealing critical technical red flags like claims of zero hallucinations or a lack of essential data residency guarantees. Learn how to avoid creating new liability and instead ach...

This episode explores the alarming trend of catastrophic, back-to-back outages in late 2025, including the AWS DNS failure, Microsoft’s Azure Front Door configuration cascade, and the Cloudflare collapse, all caused by configuration errors in highly concentrated edge services. We analyze how a single error in one cloud region can create a dependency avalanche that paralyzes thousands of third-party services across finance, healthca...

The cybersecurity landscape continues to evolve, demonstrating worrying trends as rapidly advancing Generative AI capabilities enable sophisticated attacker tactics, making phishing attempts much more targeted and customized. This episode explores how pervasive digital dark patterns leverage consumer cognitive biases, tricking users into sharing personal information and navigating manipulative interfaces, like pre-selected consent ...

Smart devices like Amazon's Alexa and modern smart TVs are perpetually monitoring domestic life, utilizing technologies such as Automatic Content Recognition (ACR) to harvest viewing habits and inadvertently recording private conversations through frequent, long-duration misactivations. These recorded interactions are sent to the cloud for training sophisticated AI systems through human review, a mandatory data collection process t...

Threat actors are exploiting human psychology using sophisticated techniques like AI-powered deepfakes and emotional manipulation to bypass traditional security defenses. This episode explores how nonprofits and consumer organizations are increasingly targeted by highly effective scams, including CEO impersonation fraud, Business Email Compromise (BEC), and fraudulent social media donation requests. We break down the new threat lan...

We dive into the most financially devastating threats of 2025, revealing how ransomware, which accounted for 76% of incurred losses in one portfolio, and vendor breaches continue to drive significant financial damage. The discussion explores how AI is turbocharging social engineering and credential stuffing (which caused a 250% increase in Account Takeover attacks in 202), enabling threat actors like Scattered Spider to "log in" us...

This podcast dissects adversary tactics, techniques, and procedures (TTPs), focusing on how attackers leverage social engineering and human psychological weaknesses like fear and trust to gain unauthorized access. We explore the proactive strategies of Red Teaming and Breach and Attack Simulation (BAS), which use the MITRE ATT&CK framework to emulate real-world attacks and test defensive capabilities. Tune in to understand the ...

This podcast explores the comprehensive responsibilities of modern InfoSec professionals, ranging from core security operations like vulnerability management across operating systems, network devices, and containers, to ensuring physical security and managing application development standards. Dive deep into emerging and complex domains such as AI Governance, securing training data for GenAI models, managing IoT device identities, ...

This episode explores the complex division in state mandates between general consumer privacy laws and specific children’s design codes, which often function as separate acts or amendments. We break down how compliance is determined either by broad, quantitative thresholds like annual gross revenue and high data volume, or by the specific service's intention or likelihood of being accessed by minors. Crucially, we contrast the age ...

Australia faces a heightened global cyber threat environment driven by geopolitical tensions, with malicious actors continuing to target organizations of all types and sizes, which has led to rising cybercrime costs and serious data breaches. Drawing on guidance from the Australian Signals Directorate (ASD) and the Australian Institute of Company Directors (AICD), this episode details why boards must operate with a mindset of ‘assu...

This episode explores the transformative challenge of modern security, focusing on how organizations must adapt their strategies to both secure generative AI applications and leverage AI to strengthen existing defenses. We dive into the critical concepts of securing functionally non-deterministic AI systems by implementing external security boundaries, defense-in-depth strategies, and utilizing Automated Reasoning (formal verificat...

Nation-state hackers are now deploying autonomous AI agents like Claude to execute 80–90% of sophisticated espionage and crime campaigns at machine speed, requiring human intervention at only a few critical decision points. Defenders are thrust into an urgent "AI vs. AI arms race," racing to adopt proactive measures like Google's Big Sleep to detect zero-day threats and implement the Model Context Protocol (MCP) to automate inciden...

Anthropic revealed on November 13, 2025, that Chinese state-sponsored hackers successfully weaponized its Claude AI system to conduct the first documented AI-orchestrated cyber espionage campaign. The sophisticated operation, which targeted approximately 30 global organizations including technology companies, financial institutions, and government agencies, was executed with alarming efficiency, as the AI systems performed 80–90% o...

Explore the systematic RESIST 3 framework, which guides government communicators through six sequential steps designed to build resilience against the impacts of manipulated, false, and misleading information (MDM). This episode details the crucial "Recognise" stage, where communicators use the FIRST indicators (Fabrication, Identity, Rhetoric, Symbolism, Technology) to identify the components of compromised messages and coordinate...

The 2025 OWASP Top 10 reveals a fundamental shift in application security, showing how threats have transformed from simple code flaws like buffer overflows to exploiting the systemic complexity of cloud-native and microservices architectures. This newest list confirms the continued dominance of Broken Access Control (A01) and spotlights the critical surge of Security Misconfiguration (A02) to the number two spot, reflecting that i...

APIs are the "nervous system" of modern applications, making them the number one attack vector, with flaws like Broken Object Level Authorization (BOLA), Broken Object Property Level Authorization (BOPLA), and Broken Function Level Authorization (BFLA) accounting for a high percentage of breaches. This episode delves into the multi-layered "defense-in-depth" strategies required to mitigate these threats, focusing on input validatio...