40k apps; 40 days; 1 public key

Henry Comfort's road to entrepreneurship was anything but linear—a string of scrappy early ventures gave way to running a UK football club's operations in his early twenties, then to global COO at Darktrace through its acquisition by Thoma Bravo, before he cofounded Geordie in 2025 to bring purpose-built security and governance to how AI agents actually operate. What ties it together, Comfort says, is relationships: nearly every leap in his career, and every early customer at Geordie, traces back to trust built with someone first. In conversation with Jenny Brock, RSAC's Senior Manager of Innovation Programs, Comfort talks through how relationships opened doors before he had a track record to point to, the story behind Geordie's name (borrowed from a 19th-century mining safety lamp), and what it took to win the RSAC Innovation Sandbox Contest as a company barely a year old. Listeners will learn why Comfort sees relationships, more than credentials or product polish, as the thread connecting every stage of a founder's career, how to earn trust with early customers—especially security teams—before you have much of a product to show, the Industrial Revolution parallel behind Geordie's name and brand story, and what winning the RSAC Innovation Sandbox Contest actually changed for fundraising, hiring, and the customer pipeline.

Threats now move faster than traditional planning cycles, so a fixed resilience plan can be outdated soon after it’s approved. The real test is how quickly your organization can adapt while still moving toward its goals. In this RSAC Cyber at the Top Podcast episode, Dr. Kevin Jones, Global CISO at Bayer, shares how he leads a global security organization through constant, high-speed change. He also explains what he’s learned about keeping teams effective without wearing them down. Listeners will learn how AI is changing the speed and scale of both attack and defense, and what that means for team priorities, the emerging trends Dr. Jones believes security leaders should watch now, practical ways CISOs can build adaptability into their teams while guarding against burnout, and why resilience is shifting from fixed plans to organizational agility.

App generators can ship a working app in an afternoon, and many of them build on the same backend-as-a-service: Supabase. That shared foundation means one misconfiguration can repeat across thousands of deployments. Ari Marzuk, Lead Security Researcher at Salesforce, and Roi Nisimi, Principal Security Researcher at Orca Security, break down a real-world technique attackers use to turn that weakness into a campaign. They show how Certificate Transparency logs can build a self-replenishing target list of more than 40,000 leads. Listeners will understand why app generators concentrate risk in shared backend services. how Certificate Transparency exposes vulnerable deployments at scale, how attackers design campaigns that compromise many victims at once, and what this playbook means for teams building or securing generated apps.

Every cybersecurity founder eventually gets asked some version of the same question: was I always going to end up here, or did the problem just find me? Eran Barak has lived both answers. After building and selling Hexadite to Microsoft, he spent years working inside one of security's messiest problems — data protection scattered across a dozen disconnected tools — before deciding to found Mind, an AI-native data loss prevention company, in 2023. In conversation with Jenny Brock, RSAC's Senior Manager of Innovation Programs, Barak walks through the decisions that shaped his path from first exit to second company: how he chose his co-founders, when to leave a comfortable executive track, and why he stepped back from angel investing once Mind became his full-time bet. Listeners will learn: - How to know whether a recurring problem is actually worth building a company around - What to look for in a co-founder — and why Barak compares the choice to a marriage - Why validating market pain matters more than product polish in the early days - When angel investing helps a founder, and when it becomes a conflict worth walking away from

Cisco's Chief Security & Trust Officer, Anthony Grieco, was among the first defenders granted early access to Anthropic's frontier AI model, Mythos, through Project Glasswing, a cybersecurity initiative led by Anthropic to secure the world's most critical software. In this episode, he joins Dr. Hugh Thompson to share what that early look revealed and what he's learned about using frontier AI models for security since then. He also covers how frontier AI is impacting how he leads teams through constant change, builds internal buy-in with leadership, and separates real AI risk from noise.

What separates a track submission that gets accepted from one that doesn't? On this episode of RSAC Cyber at the Top Podcast, members of the RSAC Leadership & Workforce Development Program Committee open up their review process: the criteria they weigh, the gaps they see most often, and what actually signals a strong proposal versus a forgettable one. Guests include Shawn Harris, VP of Information Security Strategy, Engineering, and Architecture at The Walt Disney Company, alongside fellow committee members John D. Johnson, President/Founder, Docent Institute, and Patricia Titus, Field CISO, Abnormal AI, the conversation draws on years of reviewing Conference submissions to give prospective speakers a real look inside the process. Rather than generic tips, you'll hear the specific criteria reviewers apply and how to shape a submission around them. If you're considering submitting a talk for an RSA Conference 2027 track, this episode is a working guide—practical, direct, and grounded in what reviewers are actually looking for.

When a CISO has a direct line to the CEO, it reshapes how cybersecurity risk gets discussed, prioritized, and acted on across the organization. In this episode, Frank Fischer, Group CISO at DHL, shares what he's learned leading security at one of the world's largest logistics companies. Fischer breaks down what makes the CISO-CEO relationship work, how to translate complex cyber risk into business language the board and executive team understand, and whether direct CISO-to-CEO reporting is the right model for every organization. He also outlines the communication and leadership skills CISOs need to develop to be effective at the executive level.

As AI systems move into production, managing supply chain risk goes beyond traditional SBOMs. This podcast episode shares lessons from the first cycle of AI Bill of Materials (AIBOM) audits—where theory met reality in contracts, disclosures, and accountability. With the rapid adoption of AI agents and foundation models in enterprise environments, organizations face new challenges in visibility, provenance, and third-party AI risk. Attendees will take away practical strategies for enforceable controls, adaptable schemas, and continuous assurance in an evolving AI supply chain landscape.

Quantum computing is no longer a distant threat. It is now a present-day concern for security leaders who must protect data that could be harvested today and decrypted tomorrow. In this episode, Noopur Davis, Chief Information Security and Product Privacy Officer at Comcast, cuts through the hype to explain what quantum resilience really means for enterprise security programs. She shares a practical roadmap for getting started now and tackles the harder organizational challenges: making the business case to executive leadership and helping teams develop the skills they'll need for this shift. Whether your organization is just beginning to think about quantum readiness or looking to accelerate progress, this episode offers clear, actionable guidance on where to start.

Cyber defenders are experiencing unprecedented levels of stress, burnout and fatigue. New data is helping us understand the scale of the challenge. In this episode, we unpack the findings from a recent study that tracked the effects of resilience training on hundreds of cybersecurity professionals. From sleep and stress to burnout risk and attrition, we’ll dig into what the numbers reveal, what the training actually involves, and whether the results hold up to scrutiny. Essential listening for anyone leading or working in a security team.