The 229 Podcast

A threat researcher at Sysdig was picking through the logs of a recent breach when something stopped him cold. The attacker moved too fast. No pauses, no fumbles, no fatigue. Over 600 payloads fired in sequence. When one failed, it read the error and adjusted. One time, from a failed login to a working fix in thirty-one seconds. No human does that. Buried in the attacker's code were comments -- th...

July 10, 2026: Bill Reid , Healthcare and Life Sciences Lead in the Office of the CISO at Google , has spent his career working with health system security leaders, and he keeps running into the same blind spot: healthcare is underestimating the browser as an attack surface. Drex DeFord sits down with Bill to explore why the shift from thick client infrastructure to a secure, browser-first endpoin...

July 6, 2026: Bill Russell, Drex DeFord, and Sarah Richardson are back from four executive summits in Napa, covering CIOs, Chief Application Officers, Chief Analytics Officers, and CNIOs. The through-line across every room? AI pressure is intense, budget cuts are real, and a clear leadership vision is nearly impossible to find. From nurses being left out of decisions they should be driving, to ana...

Why the Browser Is Your Health System's Biggest Security Gap | Google Fridays with Andrew Rollo July 3, 2026: Andrew Rollo , Sales Engineer at Google , has led browser deployments for organizations with 10,000-plus endpoints, with a dedicated focus on healthcare. Drex DeFord sits down with Andrew to unpack why the browser has become the most vulnerable and most overlooked tool in a health system's...

Jul 2, 2026: Sarah Richardson, Lisa Johnson , and Tamara Havenhill-Jacobs spent thirteen weeks completing an MIT AI strategy course on planes, evenings, and what Tamarah calls her "AI Sundays." What they brought back wasn't hype. It was clear. In this conversation with Sarah Richardson, recorded live from a 229 CIO Summit in Napa, the two leaders get honest about what actually changed: how one bui...

June 23, 2026: Jason Elrod , CISO at MultiCare , unpacks why traditional identity and access management doesn't map to AI agents, what happens when an employee leaves and their agents keep running with no one accountable, and why exploitability management is replacing vulnerability management as the right frame for security leadership. They also get into social engineering of AI models, the Harvar...

June 29, 2026: Scott D'Entremont , CEO of Parlance , joins Bill Russell, Drex DeFord, and Sarah Richardson to unpack the week's most pressing health IT headlines. The panel covers Mythos, the AI model just pulled offline after social engineering exposed its guardrail vulnerabilities. Then Scott brings 30 years of conversational AI experience to a sharper conversation: AI is flooding healthcare sys...

June 22, 2026: Bill Russell and Drex DeFord launch into Newsday fresh off city tour dinners across Atlanta, Philadelphia, Pittsburgh, and Rochester. The two dig into what's actually happening with AI on the ground: a smaller health system that vibe-coded a nurse scheduling app and made it work while bigger systems looked on skeptically, the build vs. buy debate coming back with new energy, and Ant...

June 18, 2026: Shiv Rao , Co-founder and CEO of Abridge , has spent eight years building the company into something most people didn't see coming. Now live in 300+ health systems, touching 250 million patients and processing over 100 million clinical conversations a year. But Shiv isn't just a technologist. He still rounds at UPMC as a practicing cardiologist, and that dual lens shapes everything...

A dormant Instagram account tied to the Obama White House started posting pro-Iranian content. No hacked password. No malware. No phishing email. Just a polite conversation with Meta's AI support agent. Researchers are calling it out plainly: AI agents are built to be helpful, and that eagerness is exactly what attackers are starting to exploit. The attack surface isn't the password anymore -- it'...

June 15, 2026: Bill Russell, Drex DeFord, and Sarah Richardson sit down to work through the question sitting at the top of every health system's agenda: what has AI actually done for us? Personal productivity gains are real. Meeting counts are dropping, hours are being saved, and individual leaders feel the difference. But the enterprise ROI case is proving harder to make. With Dave Lundahl's thre...

That UAC prompt -- the little shield asking you to approve a publisher -- is one of the most foundational trust signals in Windows security. Your tools rely on it. Your team relies on it. Two people figured out how to sell it. What they built, and which ransomware gangs bought access, has a direct line to at least one recent health system breach. Drex breaks it down. Remember, Stay a Little Parano...

June 10, 2026: In healthcare where downtime means lives, identity security is no longer just about who logs in. Bill Russell sits down with Peter Barker , Chief Product Officer at Ping Identity , to unpack why the agentic AI era demands a fundamental rethinking of identity. From giving AI agents first-class credentials to shifting the security boundary from login to the point of action. If your he...

CISA -- the federal agency whose job it is to protect America's critical infrastructure -- had its own internal credentials sitting in a public GitHub repository for six months. Plain text passwords. AWS GovCloud keys. SSH access tokens. Visible to anyone on the internet with a browser. What makes this worse: the contractor who created the repository didn't slip up accidentally. They actively disa...

June 8, 2026: Bill Russell, Drex DeFord, and Sarah Richardson break down three headlines every health IT leader needs to hear. New York City Health and Hospitals suffered a breach that exposed biometric data, fingerprints, palm prints, and geotagged photo metadata through a third-party vector. Unlike passwords or Social Security numbers, that data cannot be replaced. Second, the long-anticipated H...

June 5, 2026: Bree Bacon doesn't just talk about burnout; she survived it. Author, Speaker, & Elite Energy ™ Coach, Bree spent years giving 110% to everything until panic attacks and her miscarriage forced her to crash. What she discovered in the aftermath became a life-saving framework that challenges everything healthcare leaders think they know about performance, capacity, and sustainable s...

June 3, 2026: Adnan Iqbal , co-founder and CEO of Luma Health , joins Bill Russell for a direct conversation about one of healthcare's most stubborn problems: patient access. With 14-day average waits for a PCP appointment, 18% no-show rates, and call centers buried in fax workflows, the problems haven't changed, but the tools finally have. Adnan shares how Luma built a platform from scratch to or...

June 2, 2026: Crystal Broj , Enterprise CDTO at MUSC , is an IT executive, Becker's 2026 Digital Officer to Know, and Top 50 Women Leaders in Healthcare honoree who has built her career on one core belief: start with the problem, not the technology. In this episode of Flourish, Sarah Richardson sits down with Crystal to explore what it really takes to lead complex change, develop talent that outla...

In late 2025, cyber attackers slipped into New York City Health + Hospitals through a third-party vendor and stayed undetected for nearly three months. When they left, they took more than records and Social Security numbers. They took fingerprints and palm prints -- biometric data belonging to some of the most vulnerable patients in the country. You can cancel a credit card. You can get a new pass...

June 1, 2026: Bill Russell, Drex DeFord, and Sarah Richardson bring back the highlights from three simultaneous healthcare summits in Destin, Florida, covering imaging leaders, CTOs, and children's CIOs. The conversations were connected by a few uncomfortable truths: four in ten health systems cannot measure the AI they have already deployed, most organizations have dozens of agents running on the...

May 29, 2026: Asim Malik , VP of Health System Partnerships at DispatchHealth , joins Sarah to explore how high-acuity care is moving beyond traditional hospital walls. From pneumonia to COPD exacerbations, discover why this isn't just about convenience; it's about solving capacity constraints, improving margins, and giving patients back control. Asim breaks down the technology infrastructure, com...

May 25, 2026: Bill Russell, Drex DeFord, and Sarah Richardson turn the episode into an informal review of Sarah's MIT AI Strategy and Leadership course, and the insights are worth the homework. From the surprisingly perfect parallel between today's AI resistance and the original Luddites, to the counterintuitive finding that the organizations succeeding with AI are the most operationally aligned,...

May 26, 2026: Krista Arndt , Associate CISO at St. Luke's University Health Network , and Anahi Santiago , CISO at ChristianaCare , join Drex DeFord for an unfiltered conversation about what it actually takes to lead healthcare security in 2026. From saving nearly 200 hours a month with Microsoft Security Copilot to building a team culture so strong that people rarely leave, Krista and Anahi pull...

May 22, 2026:   Laurie Wheeler , COO - IS&T of MultiCare Health System , is a leader whose philosophy centers on curiosity, humility, and genuine human connection. Laurie shares about her 26 years at MultiCare through listening tours, transforming employee engagement, and leading without ego. From teaching high-reliability courses to creating clinical super user groups, Laurie demonstrate...

May 20, 2026: Mark Ferrari , VP of Advisory Services at Fortified Health Security , joins Drex DeFord on UnHack for a candid conversation about the threat landscape keeping healthcare security leaders up at night. From asset inventory gaps to the explosion of identity-based attacks, Mark brings a rare perspective shaped by military service, 30 years as an EMT, and deep healthcare IT experience. He...