Cyber Smokehouse

Take your cybersecurity leadership and operational strategy to the next level with practical insights on AI-driven planning, risk-based zero trust, and framework execution. It’s time to stop chasing unachievable 100% security and start building resilient, business-aligned security programs that maximize risk tolerance and protect core operations. Who better to guide you through this transition than CISO and Director of Cybersecurity at Select Sires, Elie Hachem? You will learn how to leverage AI to accelerate security roadmaps, implement CIS Controls v8.1 for tangible gap analysis, apply sales psychology to navigate executive boardrooms, and scope zero trust practically around high-value assets rather than blanket mandates. Get motivated to engage business partners, build proactive incident containment, and align security investments directly with organizational ROI! Takeaways: Shifting from 100% Security to Resilience: Achieving total security is unrealistic; CISOs must focus on minimizing…

Take your enterprise Microsoft architecture and AI strategy to the next level with practical insights on Copilot deployment, agentic governance, and modern cloud security. It’s time to slow down, eliminate data sprawl, and secure your foundational permission structures before turning loose generative AI across your organization. Who better to guide you through it than 13-time Microsoft MVP, Cloud Architects co-host, and principal technology consultant Chris Goosen? You will learn how to navigate the 70+ Copilot product variations, contain sensitive data leaks using isolated enterprise models, govern unmonitored agent sprawl, and transition away from legacy Active Directory infrastructure. Get motivated to evaluate your M365 licensing efficiency, adopt automated patch management, and implement a "best of platform" security approach that saves budget while maximizing protection! Takeaways: Cutting Through Copilot Branding: With dozens of distinct Copilot products across M365, GitHub, and Power Platform,…

Take your technology risk and compliance strategies to the next level with powerful insights on independent control validation, third-party risk management, and the evolving audit ecosystem. It’s time to move past rubber-stamp compliance, navigate the alphabet soup of IT frameworks, and understand how AI is transforming sampling into full-population testing. Who better to guide you through it than retired EY partner, Americas Technology Risk practice leader, and senior cybersecurity advisor Bernie Wedge? You will learn how to evaluate auditor credibility through peer reviews, avoid the marketing trap of "instant" SOC 2 tools, and streamline multi-framework testing into a single efficient audit cycle. Get motivated to ask tougher questions of your third-party providers, align controls across the business, and build a trust center that provides real transparency! Takeaways: The Reality of SOC 2: While lower-cost auditors and automated GRC tools have created instances of "security theater," SOC 2 remains a…

Take your application security strategy to the next level with powerful insights on securing fast-paced agentic development, navigating abstracted SaaS platforms, and bridging the gap between engineers and security teams. It’s time to move past rigid no-saying, embrace "vibe coding" as a shared collaborative workspace, and build resilient security systems that stand the test of time. Who better to guide you through it than DevSecOps podcast host, blockchain application security expert, and Founder & Managing Principal Consultant at Asgard Security, Ken Toler? You will learn how AI-driven tools are accelerating threat modeling and supply chain management, why abstracted "squishy middle" infrastructure presents new attack vectors, and how to foster a curious, error-friendly engineering culture. Get motivated to enable your developers, simplify system abstractions, and build collaborative bridges across your entire organization! Takeaways: The Pace of Agentic Development: AI tools and agentic development aren't…

Take your cybersecurity program to the next level with powerful insights on structuring security reporting lines, combating shadow risk, and building an engaged, transparent team culture from scratch. It’s time to move past organizational blind spots, establish top-down AI guardrails, and align vulnerability management directly with business priorities. Who better to guide you through it than Fortune 100 security leader, former CISO at Hyundai Capital America, and former VP & CISO at LIV Golf, Eddie Younker? You will learn how reporting directly to executive leadership eliminates conflicts of interest, why effective vulnerability management relies on business support rather than just IT execution, and how to foster a "family away from family" culture that achieves industry-leading employee engagement. Get motivated to build cross-functional relationships, educate leadership teams, and take a business-first approach to security! Takeaways: The Power of Reporting Structure: Reporting directly to the CEO gives…

Take your cybersecurity strategy to the next level with powerful insights on securing modern healthcare delivery, bridging the digital divide, and translating complex security tech into executive business language. It’s time to rethink patient care availability, move beyond legacy castle-and-moat models, and adopt platform-based zero trust architectures. Who better to guide you through it than U.S. Marine Corps veteran, published author, and Healthcare CISO at Zscaler, Chris Logan? You will learn how ambient AI is transforming clinical workflows, why health systems must consolidate point solutions into platform security to speed up M&A, and how servant leadership builds resilient, high-performing security teams. Get motivated to speak the language of business executives, protect critical patient care environments, and open career doors for the next generation of cyber leaders! Takeaways: Securing Care Everywhere: Healthcare has shifted from hospital-centric care to decentralized delivery across home, mobile,…

Take your understanding of cybersecurity risk, organizational alignment, and executive career pivots to the next level with powerful insights from a 30-year industry veteran! It’s time to rethink the evolving personal liability of CISOs, how to effectively communicate cyber risk to non-technical business leaders, and what it really takes to walk away and build a successful second-act venture. Who better to guide you through it than former CISO at Finastra and Diebold Nixdorf, and co-founder and Chief Travel Officer at Sunshine Travelers Experiences, Scott Berrington? In this episode, you will learn how the rapid influx of emerging tech like AI creates mounting operational risk, the pros and cons of different CISO reporting structures, and strategies for providing true security assurance to demanding global clients. Get motivated to build empowered, self-sufficient security teams, navigate executive burnout, and turn your lifelong passions into your next big career milestone! Takeaways: The Shifting…

Take your cybersecurity operations to the next level with powerful insights on managing high-volume vulnerability patches, securing healthcare IT/OT environments, and applying deep reinforcement learning to autonomous defense. It’s time to move beyond reactive security measures and build resilient, zero-downtime systems in live, life-safety environments. Who better to guide you through it than healthcare CISO, critical infrastructure veteran, and University of Michigan-Dearborn researcher, Keith Lawson? You will learn how the surge in AI coding agents is driving a "tsunami" of software patches, strategies for managing identity as the modern perimeter, and how autonomous AI agents can adapt in real time to protect critical infrastructure. Get motivated to foster a zero-blame, collaborative culture that empowers your technical and non-technical teams to solve complex security challenges together. Takeaways: The Vulnerability Tsunami: The adoption of AI coding agents by software vendors is generating a massive…

Get ready to challenge everything you assume about AI's role in cybersecurity. Shannon Garcia, founder of Strategic Defense and a veteran red team leader with stops at Trustwave, SecureWorks, IBM, and Kudelski Security, joins the Cyber Smokehouse to break down why manual, human-led penetration testing still outperforms automated AI tools, and why that might not last forever. You'll learn how shadow IT quietly drains company budgets, why remote work has changed both testing methodology and phishing success rates, and how translating technical findings into business language can protect million-dollar contracts. Plus, Shannon shares her unlikely path from 11 years as an AMD engineer to building two cybersecurity companies from scratch. Takeaways: AI is reshaping conversations across cybersecurity, but Shannon's teams still rely on manual, human-led penetration testing. She notes that automated AI pen testing platforms can't yet handle certain test types, like wireless assessments, and that clients often value…

Strong cybersecurity programs aren't built through quick fixes, they're built through thoughtful leadership, patient execution, and investing in people. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Ward Balcerzak, Field CISO at Sentra, to discuss what effective security leadership looks like in today's rapidly evolving landscape. Ward shares lessons from building security programs, mentoring future leaders, adopting AI responsibly, and helping organizations avoid reactive decision-making. From creating realistic AI roadmaps to developing cybersecurity talent and leading through change, this conversation offers practical guidance for security leaders focused on building resilient organizations for the long term. Takeaways: Successful AI adoption requires thoughtful planning rather than rushed implementation. Ward explains that many organizations are reacting to AI with unrealistic timelines and expectations. Leaders should slow down, identify their objectives, understand…

Most security programs are built around understanding what has already happened, but what if organizations could begin anticipating cyber threats before they materialize? In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Tim and Suzanne O'Neil, founders of AigisPoint Predictive Intelligence. Drawing on decades of experience spanning enterprise security architecture, military leadership, entrepreneurship, and business strategy, they discuss their approach to predictive cyber risk, how AI and machine learning are reshaping threat modeling, and the realities of building an innovative cybersecurity startup. From balancing innovation with security to understanding AI's limitations, this conversation explores how organizations can begin thinking beyond reactive cybersecurity while remaining grounded in practical risk management. Takeaways: Traditional threat modeling remains largely static, creating an opportunity to apply AI and machine learning to forecast potential cyber threats…

Cybersecurity leaders today face a challenge that extends far beyond technology: keeping pace with constant change. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with John Rogers, Chief Information Security Officer and Head of Technology Risk at MSCI. Drawing on experience spanning consulting, financial services, and executive security leadership, John shares his perspective on AI governance, third-party risk management, board communication, and the growing complexity facing security teams. Listeners will gain practical insights into how organizations can approach AI governance, communicate cyber risk effectively to executives and boards, rethink traditional third-party risk practices, and prepare for a future where security leaders must balance innovation with increasingly complex threats. Takeaways: The speed of change remains one of the biggest challenges facing security leaders today, with AI accelerating both innovation and the barrier to entry for attackers. AI…

Most cybersecurity conversations start with technology. Michael Myint starts with the foundation. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Michael Myint, a cybersecurity executive whose thirty year career spans Big Four consulting, global enterprises, and high growth healthcare startups. He has built programs from scratch, led organizations through public incidents, and mentored security leaders who have gone on to surpass him. You will walk away with a sharper view of where AI is genuinely changing the threat landscape, why vendor consolidation is coming, whether organizations are ready or not, and what separates the security professionals who rise from the ones who stall. Takeaways: Board communication lives or dies on business relevance. Phishing rates and patch counts belong in the appendix. Metrics tied to revenue, speed to delivery, and product outcomes are what earn executive attention and budget support. AI is disrupting the entry level pipeline in ways the…

Cybersecurity careers are rarely linear, and building effective security leadership requires more than technical expertise alone. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mea Clift, CISO at Cengage, for a conversation about cybersecurity career growth, leadership, curiosity, and risk management. Mea shares insights on how professionals can find their place within the cybersecurity industry, why curiosity is essential for long-term success, and how passion drives deeper expertise. The discussion also explores misconceptions about the CISO role, business impact assessments, security risk, and the realities of operating modern security programs. Outside of cybersecurity, the conversation shifts into Mea’s approach to smoking and grilling, including charcoal setups, smoking techniques, and favorite recipes. Takeaways: Cybersecurity professionals should find a specialty they’re passionate about. Mea explains that broad interest alone is not enough to build a successful…

What happens when organizations scale rapidly through acquisition while simultaneously navigating AI adoption and evolving cyber risk? In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Matthew Mudry, CISO at Alera Group, to discuss the operational realities of securing large-scale acquisitions, integrating fragmented environments, and managing cybersecurity risk during periods of aggressive growth. Matthew shares firsthand experiences standardizing security across acquired organizations, balancing business pressure with security due diligence, and navigating the growing complexity introduced by AI technologies. The conversation explores M&A integration challenges, data loss prevention, access control, AI governance, leadership communication, security roadmaps, and the future of the CISO role. Takeaways: M&A creates significant operational security complexity. Matthew discusses the challenge of integrating acquired businesses into standardized security platforms and processes.…

Cybersecurity is evolving faster than ever, and leaders are being forced to rethink how they approach risk, resilience, and modern defense strategies. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mike Salem to discuss today’s rapidly changing cyber landscape and the growing influence of AI on both attackers and defenders. Throughout the conversation, Mike shares insights on emerging cyber threats, operational challenges facing security teams, and the importance of adaptability in modern cybersecurity leadership. The discussion also explores how organizations can better prepare for evolving risks while balancing innovation, visibility, and practical security execution. This episode offers valuable perspective for cybersecurity leaders, IT professionals, and organizations navigating constant technological change and increasing security complexity. Takeaways: • AI is rapidly changing the cybersecurity landscape. The conversation explores how AI is accelerating both…

Tired of the buzzword bingo flooding the cybersecurity industry? So is Zlatko Unger. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Zlatko Unger, CISO Expert at Wiz, for a no-nonsense conversation that cuts straight through the AI noise and gets back to what actually matters in security. With over 18 years of experience spanning security, risk, privacy, and compliance, Zlatko brings the kind of hard-earned perspective that only comes from building and scaling security programs in the real world. From the growing complexity of identity and access management to the supply chain gaps that keep him up at night, Zlatko lays it all out plainly. You will walk away with a clearer picture of where AI is genuinely useful in security programs, where technical debt is quietly piling up while everyone chases the next shiny thing, and what it takes to lead remote security teams and communicate risk to a board that may not want to hear it. This one is packed with substance, humor, and the kind…

How is AI changing both the threat landscape and the way security teams operate? Today’s guest is a seasoned cybersecurity leader navigating these changes at scale. Introducing David Cross, CISO at Atlassian. David joins Ernie Anderson and Graeme Payne to share how AI is reshaping cybersecurity, from attacker capabilities to internal defense strategies. He discusses how AI is lowering the barrier for attackers, why security teams must adapt to an increasingly fast-moving environment, and how organizations should think about managing risk as new technologies emerge. David also touches on the importance of understanding evolving threats, maintaining strong fundamentals, and ensuring teams are prepared to respond to continuous change. Takeaways: AI is lowering the barrier for attackers: David explains that AI makes it easier for more individuals to carry out attacks, increasing both the volume and accessibility of threats. The pace of change is accelerating risk: He highlights that the speed at which AI is…

How do you secure an environment when the technology is evolving faster than teams can keep up? Today’s guest is a cybersecurity leader operating at the intersection of AI, product security, and enterprise scale. Introducing Jason Loomis, CISO at Freshworks. Jason joins Ernie Anderson and Graeme Payne to share why the speed of AI innovation is becoming one of the biggest challenges in cybersecurity today. He dives into how AI is accelerating both development and risk, the growing difficulty of maintaining guardrails in AI-generated code, and why organizations are still struggling to implement governance at scale. Jason also shares a candid perspective on how AI may impact the future of cybersecurity talent, particularly at the entry level, and why continuous learning is becoming non-negotiable for security professionals. Takeaways: The biggest challenge is simply keeping up. Jason states directly that the pace of change, especially driven by AI, is the hardest problem organizations face today. AI is…

Why do organizations still struggle with cybersecurity despite more tools and innovation than ever before? Today’s guest is a seasoned cybersecurity executive with deep experience across enterprise and public sector environments. Introducing Merlin Namuth, CISO for the City and County of Denver. Merlin joins hosts Ernie Anderson and Graeme Payne to share why foundational security practices continue to be the biggest challenge for organizations today. He dives into why core disciplines like asset management and vulnerability management are often overlooked despite being critical, how AI is both a force multiplier and a growing threat, and why leadership, communication, and continuous learning are essential in cybersecurity. Merlin also shares practical insights on building high-performing teams, developing talent, and staying relevant in an industry that is constantly evolving. Takeaways: Foundational security practices remain the biggest gap. Merlin emphasizes that organizations still struggle with core…

How do you translate cybersecurity from a technical function into a true business priority? Today’s guest is a seasoned cybersecurity leader with deep enterprise experience. Introducing Chris Correia, CEO of CGS CyberDefense. Chris joins hosts Ernie Anderson and Graeme Payne to share how cybersecurity leaders must evolve from technologists into business storytellers who can align security with organizational priorities. He dives into why security conversations need to shift from tools to outcomes, how risk quantification enables better executive decision-making, and why organizational resiliency goes far beyond traditional cyber playbooks. Chris also shares leadership lessons from building teams, investing in the next generation, and creating long-term client relationships rooted in trust and value. Takeaways • Cybersecurity must be communicated in business terms. Chris emphasizes that security leaders need to translate technical concepts into business language to effectively engage executives and boards. •…

How do you secure environments that are constantly changing, distributed, and increasingly difficult to see? Today’s guest is a forward-thinking cybersecurity leader focused on tackling modern visibility and infrastructure challenges. Introducing Clete Taylor, Senior Security Architect at Frost. Clete joins hosts Ernie Anderson and Graeme Payne to explore how evolving environments are reshaping the way organizations approach security. He shares how the shift to cloud and hybrid infrastructure has created blind spots that traditional tools struggle to address. The conversation dives into why visibility is foundational to security, how attackers exploit gaps in awareness, and what organizations must do to adapt. Clete also highlights the importance of proactive strategy, continuous monitoring, and aligning security practices with how modern systems actually operate. Takeaways: • You cannot secure what you cannot see. Modern environments are dynamic and distributed, making visibility the foundation of any…

How do organizations stay secure when identity, access, and infrastructure are more distributed than ever before? Today’s guest is a seasoned cybersecurity leader focused on modern identity and cloud security challenges. Introducing Joe Mendygral, Senior Director at TBD Cyber. Joe joins hosts Ernie Anderson and Graeme Payne to explore how identity has become the core battleground in cybersecurity. He also delves into how cloud environments, AI, and evolving attack methods are forcing organizations to rethink how they detect and respond to threats. Joe shares practical insights on visibility, detection, and why traditional security approaches are struggling to keep up with modern environments. The conversation highlights the growing importance of understanding user behavior, securing identities, and building adaptive security strategies that evolve alongside threats. Takeaways: • Identity is now the primary attack surface. As organizations move to cloud-first environments, attackers are increasingly targeting…

How do cybersecurity leaders manage risk, talent, and rapid innovation as AI transforms both threats and defenses? Today’s guest is a seasoned cyber intelligence leader and strategic risk advisor. Introducing Steve Bay, Vice President of Cybersecurity and Chief Information Security Officer at Coretelligent. Steve joins hosts Ernie Anderson and Graeme Payne to share how AI is reshaping the cybersecurity landscape and what leaders must do to stay ahead. He also delves into talent challenges, evolving threat dynamics, and the importance of balancing innovation with governance in a rapidly changing environment. Steve shares insights from his journey into cybersecurity, his experience in intelligence and enterprise security, and his perspective on how organizations can navigate uncertainty while building resilient security programs. Takeaways: AI is the biggest disruptor in cybersecurity today: AI is transforming how both defenders and attackers operate. Organizations must understand how employees are using AI…

How can cybersecurity leaders translate technical threats into real business decisions without losing executive alignment or strategic clarity? Today’s guest is a thoughtful cybersecurity strategist and business-focused security leader. Introducing Jimmy Lummis, Director and Business Information Security Officer at IHG Hotels & Resorts. Jimmy joins hosts Ernie Anderson and Graeme Payne to discuss how modern security leaders must bridge the gap between technical teams and executive leadership. He also explores the realities of cyber risk quantification, the role of AI in modern threat landscapes, and why translating cybersecurity into business language is essential for effective decision making. Takeaways Cybersecurity is ultimately about managing risk, not eliminating it. Jimmy explains that no organization can achieve perfect security. The real responsibility of leaders is determining what level of risk the business is willing to accept and aligning security investments accordingly. Cyber risk must be…

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with David Nolan, Principal Advisor at Apex Advisors, to explore how organizations must rethink cybersecurity as digital environments grow more complex and interconnected. David shares why the traditional concept of a network perimeter is rapidly disappearing as organizations adopt cloud platforms, distributed workforces, and connected technologies. As a result, security leaders must move beyond reactive defense and focus on building resilience, visibility, and strategic alignment across the entire digital ecosystem. The conversation explores how cybersecurity must evolve from a purely technical discipline into a business leadership priority, how organizations can anticipate emerging threats, and why security culture plays a critical role in protecting modern systems. Takeaways: Cybersecurity Must Be a Business Priority: Security is no longer confined to the IT department. Organizations that integrate cybersecurity into strategic decision…

Healthcare cybersecurity is no longer just about compliance, it’s about resilience. In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Hugo Lai, Chief Information Security Officer at Temple Health, to explore how healthcare organizations can protect patient care in an era of AI adoption, ransomware threats, and relentless budget pressure. Hugo shares practical insights from leading enterprise security programs inside one of the most operationally complex industries. From managing medical device risk to embedding daily threat intelligence briefings into team culture, this conversation dives deep into what modern cyber leadership looks like when lives are on the line. Key Takeaways Resilience Over Compliance: HIPAA may focus on privacy, but today’s healthcare security must prioritize operational continuity and patient care even during disruption. Budget Discipline Builds Trust: Security leaders who spend intentionally and align with organizational priorities are more likely to secure…

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Wade Myers to explore the leadership discipline required to navigate modern cyber risk. Wade shares why complexity is the enemy of effective security programs, how executives must think about tradeoffs instead of perfection, and why clarity, not control, is the real advantage in today’s threat landscape. The conversation dives into decision-making under uncertainty, aligning cybersecurity with business priorities, and the importance of building teams that can operate confidently in high pressure environments. Wade unpacks how security leaders can move beyond compliance thinking and instead focus on meaningful risk management that strengthens resilience across the organization. Takeaways: Cybersecurity is a decision-making discipline, not a toolset. Effective programs are built on sound judgment, prioritization, and alignment with business objectives—not simply the deployment of more technology. Risk cannot be eliminated, only managed…

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Damian Apone, cybersecurity executive and practitioner with deep experience building and operating security programs inside complex organizations. Damian brings a grounded, real-world perspective on why cybersecurity initiatives often fail, not because of missing tools, but because of misalignment between people, process, and technology. He shares hard-earned lessons on operationalizing cyber resilience, managing risk in imperfect environments, and helping leaders move beyond checkbox compliance toward security programs that actually work in practice. The conversation covers executive communication, prioritization, realistic threat modeling, and why resilience, not perfection, is the goal. Takeaways: Cybersecurity failures rarely stem from missing tools. Most breakdowns occur in the handoffs between people, processes, and technology where ownership is unclear and assumptions go unchallenged. Resilience matters more than perfection.…

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Gregg Barrow, a global cybersecurity leader at the forefront of quantum-safe computing, to explore one of the most underestimated threats facing organizations today: the coming impact of quantum computing on data security. The conversation dives into crypto-agility, inventorying cryptographic assets, leadership accountability, and the real risks of waiting too long. This episode challenges cybersecurity leaders to rethink long-term resilience in a world where yesterday’s “secure enough” quickly becomes tomorrow’s breach. Takeaways: Quantum computing poses a real, future threat to today’s encryption standards. Organizations must begin preparing now, not when quantum computers become mainstream. Crypto-agility, the ability to swap cryptographic algorithms quickly, is critical. Most companies don’t know where or how cryptography is embedded across their systems. Inventorying cryptographic assets is the first actionable step toward quantum…

How can organizations cut through security tool sprawl and focus on what truly reduces cyber risk? Today’s guest is a veteran cybersecurity leader with more than 25 years of experience helping global enterprises protect their data and operations. Introducing Erik Hart, Chief Information Security Officer at Cushman & Wakefield and former security leader at organizations including CrowdStrike and Mimecast. Erik joins the show to discuss why vulnerability management must become more data-driven, how identity has emerged as the new firewall, and where AI and automation can meaningfully reduce risk. He also shares leadership insights on challenging outdated security practices, prioritizing what matters most to the business, and building security programs that scale with modern, cloud-first organizations. Takeaways: Platform consolidation must be intentional. Moving toward “platformization” can simplify operations, but only if organizations clearly understand which capabilities add real value. Vulnerability…

This is Cyber Smokehouse. Join Ernie and Graeme as they grill the minds, dig into the experience, and serve up the stories of leaders in cybersecurity. Cyber Smokehouse is sponsored by TBDCyber, a cybersecurity strategy consulting firm.