Adopting Zero Trust

As organizations push return-to-office (RTO) mandates and chase efficiency, many security teams are quietly accumulating debt they don’t know how to unwind. In this episode, we are joined by Lea Cure Thorpe and Kayne McGladrey to unpack the less-discussed consequences of recent security decisions: RTO exposure, endpoint blind spots, tooling overload, analyst burnout, and the slow erosion of junior...

In this episode, we break down Whisper Leak, a newly disclosed side-channel issue affecting encrypted LLM communications. JBO explains how attackers can infer conversation topics using packet size and timing metadata without breaking encryption. The discussion covers how the research team discovered the issue, how vendors (including Microsoft and OpenAI) mitigated it, and what it means for the fut...

In this episode of Adopting Zero Trust, hosts Elliot Volkman and Neal Dennis discuss critical infrastructure security with expert guest Ian Branson, Vice President of Global Industrial Cybersecurity at Black and Veatch. The discussion centers around the philosophical and strategic approaches to handling incidents and breaches, especially in the operational technology (OT) realm. Branson highlights...

In this episode of Adoption Zero Trust (AZT), host Neal Dennis and producer Elliot Volkman sit down with Bradon Rogers, Chief Customer Officer at Island, to discuss how AI is compounding the already existing problems tied to shadow IT. The conversation explores how modern enterprises handle the growing complexities of unregulated software use, the role of enterprise browsers in mitigating risks, a...

Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Live from ThreatLocker’s Zero Trust World (ZTW), cybersecurity heavyweights Dave Bittner , host of CyberWire Daily  and Dr. Chase Cunningham AKA Dr. Zero Trust shared their unfiltered thoughts on the state of cybersecurity, AI, and government regulations. From the shifting landscape of compliance enfor...

New intelligence: Silk Typhoon, formerly tracked as HAFNIUM, is a China-based threat actor most recently observed targeting IT supply chains in the US. Today, we released a new report in conjunction with the Department of Justice's action against twelve Chinese nationals that includes mercenary hackers, law enforcement officers, and employees of a private hacking company. This group has been charg...

It’s mid-February, but somehow, we’ve already been through what feels like a year's worth of change in the cybersecurity and regulation world. Beyond the standard incidents, outages, and attacks… there have been obvious impacts that have downstream effects. Regardless of regulatory changes, which we’ll cover as those impact our space, AZT brought together a few minds who have thoughts on the year...

Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow ou...

In this episode of 'Adopting Zero Trust (AZT)', host Neal Dennis and producer Elliot Volkman delve into the often-overlooked realm of soft or 'non-tech' skills in cybersecurity. This week, we chat with Courtney Hans , VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam , author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vita...

Season 3, Episode 15: We gather a panel of journalists, communications, and a researcher to discuss how cybersecurity news and incidents are reported. You can read the show notes here . In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they a...

In our final preview episode of GRC Uncensored, we explore a particularly bipolar debate: do you need a GRC tool to manage compliance, or will spreadsheets suffice? After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack. Hosted on Acast. See acast.com/privacy for more...

We are interrupting our regularly scheduled podcast series to introduce you to a new series we developed: GRC Uncensored. This pilot season will elevate conversations about GRC that are often buried under millions of dollars in marketing spend. No boring talks about controls or frameworks, just unfiltered discussions with auditors and practitioners in the GRC space. We'll be back to our regular AZ...

Welcome back to Adopting Zero Trust! In this episode, hosts Elliot Volkman and Neal Dennis are joined by Rob Allen, Chief Product Officer of ThreatLocker, to dive deep into the operationalization of Zero Trust. Despite covering various aspects over three seasons, this crucial topic is addressed thoroughly. They explore pre-adoption preparation, aligning organizational actions, and the importance o...

Season 3, Episode 13: Cato Network’s Etay Maor provides fresh research on the abuse of unpatched log4j libraries. Catch this episode on  YouTube ,  Apple ,  Spotify , or  Amazon .  You can read the show notes here . This week on Adopting Zero Trust (AZT), we highlight a significant cybersecurity risk focused on the notorious Log4j vulnerability and the growing concern around shadow IT. Featuring e...

Season 3, Episode 12: Could the overturning of Chevron Deference impact cybersecurity and privacy regulations? Catch this episode on  YouTube ,  Apple ,  Spotify , or  Amazon .  You can read the show notes here . Welcome back to Adopting Zero Trust or AZT. In our latest episode, we assembled a distinguished panel to dig into a timely topic affecting the cybersecurity landscape but has the fog of w...

Season 3, Episode 11: Vulnerability management is critical to any Zero Trust strategy, but you probably already know that. Fortra’s Tyler Reguly breaks down severity vs. risk. Catch this episode on  YouTube ,  Apple ,  Spotify , or  Amazon .  You can read the show notes here . Every organization relies on some form of technology to run, and each tool you add increases the risk of vulnerabilities c...

Season 3, Episode 10: Elliot chat’s with Vivek Ramachandran of SquareX about his approach to tackling the impossible: Social engineering. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . For nearly three decades, social engineering, particularly phishing, has been one of the most impactful and financially draining cyber threats. Betwee...

Season 3, Episode 9: We chat with SonicWall’s Doug McKee about the top 5 threats targeting SMBs based on recent research. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . Cybersecurity challenges come in many different flavors regardless of how old your company is or how many employees it houses. Larger companies have to deal with laye...

Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines ofte...

Season 3, Episode 7: Though regulation impacting cybersecurity moves slow, when new laws are introduced it often puts significant strain on companies. Lacework’s Tim Chase and Drata’s Matt HIllary discuss navigating the latest broad-sweeping regulations. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . The time between a law being prop...

Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not? Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal a...

Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . There are many aspects of cybersecurity that are not classified as cool or sexy, but every component...

Season 3, Episode 4: Forrester Principal Research Analyst on Zero Trust, David Holmes, shares his perspective on the current and future state of Zero Trust. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . Zero Trust is a concept, a strategy, a philosophy, and, for some poor souls, a solution you can buy ( it’s not ). Through our three...

Season 3, Episode 3: Canva’s Head of Enterprise Security, Kane Narraway, discusses how to deploy a Zero Trust strategy in under a year. Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . This week on Adopting Zero Trust (AZT) we chat with Kane Narraway , the head of Head of Enterprise Security at Canva. Prior to his current role. Kane ha...

Season 3, Episode 2: In our conversation with Energy Solution’s CIO David Weisong we chat about how new processes, technology, and budgets are formed.   Catch this episode on  YouTube ,  Apple ,  Spotify ,  Amazon , or  Google .  You can read the show notes here . It’s a mystery as old as time: the cybersecurity and technology budget and acquisition strategy. How are they formed? How are these pro...