The Lock & Key Lounge — An ArmorText Original Podcast

Should We Rethink the Practitioner/Vendor Relationship in Cybersecurity? There is a deeply ingrained, culturally accepted reflex in cybersecurity: Keep vendor sales and marketing people at arm's length during any serious evaluation or decision. Matt Calligan calls it "vendor cooties," and in this episode he argues the assumptions underneath it have not been true for a long time—and...

OT security spending is at an all-time high, yet all these tools do is fill the “do we have X product” hole if the organization isn't investing in a human-driven aggregation layer to curate and make decisions based on the telemetry and data pouring out of them. Danielle Jablanski has examined this problem from a rare intersection of vantage points: as a strategist working with asset owners at...

Anthropic's Project Glasswing used a restricted AI model to surface over ten thousand high-severity vulnerabilities across more than a thousand open-source projects. The 2026 Verizon DBIR tells us vulnerability exploitation just became the number one initial access vector for breaches—up 55% in a single year. Only 26% of critical vulnerabilities were fully remediated last year, down from 38%...

Building Governance that Holds Because the Mission Demands It—Not Because Anyone Required It We have spent years in this industry talking about who belongs in the room—the board table, the executive suite, the security leadership track. What we have talked about far less is what it actually takes to get there, and whether the commitments organizations have made to broadening who leads are holding...

Most security leaders spend their careers building programs in the private sector—strong compensation, clear organizational lines, and at least some degree of control over the stakeholder map. Occasionally, someone makes a different call. Bjørn Watne left senior CISO roles at Telenor and Storebrand—two of Scandinavia's most recognized institutions—to take on one of the most complex security m...

When we talk about securing the electric grid, the conversation usually focuses on preventing outages or protecting the biggest, most visible assets like large power plants, transmission lines, and control centers. But operators know the harder problem is not knocking the grid down; it’s bringing it back up. Grid recovery depends on a fragile chain of smaller substations, control systems, communic...

How AI can turn air gaps into security gaps for ICS/SCADA For decades, critical infrastructure companies have relied on organizational silos—air gaps between IT and operational technology—to ensure that enterprise disruptions do not cascade into the physical systems that keep the lights on. But those silos have been largely successful due to biology and physics: the scale of coordination and depth...

In this RIFF Edition, Navroop and Matt work through seven stories spanning different sectors, threat actors, and tools—but one failure mode: the layer underneath your security stack is the actual attack surface. From the collapse of patching windows to Russian intelligence phishing Signal accounts, from an Iranian-linked group wiping 80,000 Stryker devices through Microsoft Intune to Proton Mail&a...

In the days since the US-Israel strikes against Iran, business guidance has been pouring in from analyst firms, newsrooms, and government agencies—but roughly ninety percent of the coverage focuses on cyber-attack preparedness and supply chain disruption, with the board appearing in less than one percent of what we found. Today's conversation with Christopher Hetner—Senior Cyber Risk Advisor...

Today’s topic is AI, and before you click off let me stop you because we’re coming at this topic from some new directions and with a definitive voice in this space. As organizations accelerate AI adoption across cloud platforms and security operations, they are also introducing new vulnerabilities, attack paths, and questions of control. Today’s conversation explores how AI is reshaping the cyber...

In this RIFF, we connect recent headlines to the realities of communicating during a crisis. Headline 1: Verizon and Microsoft 365/Outlook outages When your primary tools go dark, approvals stall, and coordination breaks down. Headline 2: Iran’s Starlink “kill switch” (with the Russia angle) Satellite isn’t a guaranteed “Plan B.” Geopolitics can shut it down. Headline 3: Identity verification and...

What the Signal IG Report Teaches Enterprises About Communications Risk This episode touches on a topic we initially covered in Episode #2 where discussed the Signal/Atlantic group chat with Marisa Darden of Benesch Law. The latest DoD IG report has brought the privacy-vs-compliance conflict back to the front page. So, today we’re going to translate those findings for the enterprise. 

What the Signal IG Report Teaches Enterprises About Communications Risk This episode touches on a topic we initially covered in Episode #2 where discussed the Signal/Atlantic group chat with Marisa Darden of Benesch Law. The latest DoD IG report has brought the privacy-vs-compliance conflict back to the front page. So, today we’re going to translate those findings for the enterprise. 

Join Navroop and his guest Crowell and Moring's Global Co Chair on Privacy and Cyber, Emma Wright live in Riyadh, Saudi Arabia as they continue their discussion over dinner and mock-tails right on the heels of their speaking session at Black Hat MEA 2025.  This RIFF session is an unscripted discussion further unpacking how cybersecurity and resilience planning will be potentially impacted by...

The Benefits of Developing People Skills That Are Missing From Today’s Cybersecurity Teams Why tomorrow’s cybersecurity leaders will rise not through deeper technical mastery, but through empathy, translation, and human connection. In this episode of The Lock & Key Lounge , host Matt Calligan explores what he calls “The Humanity Firewall,” highlighting an often-overlooked truth in cybersecurit...

From Signal getting squeezed by AWS to Microsoft Teams launching what some think as spyware, the stories this week all circle the same theme: trust, resilience, and sovereignty.

Welcome to The Lock & Key Lounge, debuting its first-ever RIFF Edition — a new, unscripted spin on security conversations hosted by Navroop Mitter, Founder and CEO of ArmorText, alongside Matt. In this episode, the duo riff through a series of stories and ideas that caught their attention — from Asahi’s production-halting cyberattack and Jen Easterly’s bold take on “The End of Cybersecurity,”...

The Nightmares Acquirers Often Miss Behind the glossy surfaces of emerging tech and M&A deals lies a quiet but critical risk: compromised code, embedded threat actors, and the increasing industrialization of the cybercriminal ecosystem. In this episode, we’re diving into how tech built by startups, often developed with freelance labor and questionable security hygiene, is making its way into t...

 The Cyber Risks We’re Still Ignoring In today’s episode, we’re diving into the quiet crises already happening in the fields, warehouses, and distribution networks we depend on every day—and why so few in cybersecurity are paying attention. From the $400M breach you didn’t hear about, to the operational systems federal policies refuse to name, Kristin helps us connect the dots between food, resili...

Communicating When You Can’t Trust the Network When adversaries can read the playbook—searching email, SharePoint, Teams/Slack, and even joining incident response calls—communication becomes the attack surface. That’s why the FBI now explicitly urges organizations to “plan to use out-of-band communications when normal channels like email and VoIP are compromised.” This episode is about preparednes...

Unpacking Regulatory, Contractual, and Sanctions Challenges from DPRK-Affiliated Schemes Today, we’re zeroing in on a uniquely challenging scenario—what happens when the insider threat isn’t an employee at all, but rather a remote worker posing under false pretenses, potentially linked to adversarial nations like the DPRK. Landon Winkelvoss is here to help us understand how these investigations pl...

Navigating Remote Worker Deception Today we’ll explore the legal landmines that organizations face when uncovering remote workers connected to adversarial states like the DPRK. We'll unpack critical questions about liability, disclosure obligations, compliance pitfalls, and sanctions risks—helping legal teams prepare to navigate the regulatory maze following remote worker deception discoverie...

How Extreme Weather Disrupts Digital Defenses When the forecast calls for hurricanes, floods, wildfires or heat waves, most organizations are focused on physical risk. But what happens when cyber risk rides shotgun with those storms? In today’s episode, we’ll explore how extreme weather events don’t just disrupt operations—they create windows of opportunity for cyberattacks. Attackers are increasi...

Cyber Threats to Global Good and the Fight for Collective Defense Why nonprofit organizations are bigger cyber targets than most realize—and how the NGO-ISAC is helping defend the sector.  NGOs face a cyber threat landscape that’s as serious—if not more —than private sector organizations. Partly because they often face those challenges with fewer resources, leaner teams, and less public awareness...

Traditional tabletop exercises have a reputation for being, well, a little dry. Picture it—stale slides, scripted injects, and facilitators who may or may not be able to keep an audience engaged. But what if we could change that? What if tabletop exercises felt more like high-stakes crisis simulations, pulling participants into a dynamic, unfolding story rather than another box-checking exercise?...