The Cyber Business Podcast

Guest Introduction Thomas Matthews is the VP of IT at Screenvision Media, which he describes as the second largest on screen cinema advertising company in the country. He has been with the company for 13 years, started in IT in the 1900s when cybersecurity meant shared passwords, and is in charge of the traditional IT stack. Thomas and Matthew discuss how to move employees from outside AI tools to a corporate AI through education, how email attacks rely on context and urgency, and why people still have to verify what AI produces. They also cover role based access, strategic thinking, and using AI to take the monotony out of daily work. Here's a Glimpse of What You'll Learn Why the help desk is the front line and a CISO needs the infrastructure team What a 20 year old recovery plan binder says about how far the industry has come How audit mode exposed data leakage through web based AI prompts Why Thomas chose education over blocking, and what the summer of Copilot achieved Why modern phishing relies on context, and why urgency is the red flag How role based profiles make activity outside someone's job easier to spot Why people must still verify and contextualize what AI gives them How strategic thinking, mentoring, and better prompts remove the monotony from work In This Episode Thomas explains that Screenvision Media is the second largest on screen cinema advertising company in the country, where audiences watch ads with no skip and no pause. He has been in IT since the 1900s, when cybersecurity meant shared passwords, and he now runs the traditional IT stack. He believes IT and security should be closely knit, because a CISO can only do so much without the infrastructure team and the help desk, which he calls the front line. Holding up a recovery plan binder that is 20 years old and two inches thick, he notes that a major recovery vendor can now sync a business to the cloud in an afternoon, a sign of how mature these processes have become. On AI, he says Screenvision is a Microsoft shop that adopted Copilot and cut out other tools through policy and technology. While watching in audit mode, he was unpleasantly surprised by how much data leaked through web based prompts, with employees holding full conversations about financials and prospecting through what he calls a super powered stranger. Instead of saying no, Thomas took an education approach. He says IT used to be the department of no, but that stance no longer works because the tools are free and readily available. During what he calls the summer of Copilot, he ran breakout sessions with individual teams on how to write a good prompt and how their own data connects to the corporate AI. Usage now averages about 80 prompts per user per week, by his count, and he is moving into what he calls the agentic autumn, with agents that pull tasks together across departments. He shared usage reports with employees to show he was not reading their prompts, only encouraging use of the tool. He sees his people as good people, but says the road to hell is paved with good intentions, and they do not always know the damage of putting financials into an outside model. On email, he says modern phishing tools look at patterns such as how someone signs a message, so the work is part detective. He teaches that urgency is a warning sign, that the company will never withhold a paycheck, and that people should feel empowered to push back and report. He also builds role based profiles for access and equipment, so activity outside a person's job stands out, even across a large home based workforce. Thomas says AI is being embedded in accounting and sales software, but people still have to verify the work and contextualize the output rather than just trust it. Asked how to keep people from treating AI as fire and forget, he points to cross departmental work, understanding how teams operate, and wanting people to be strategic and not tactical. He compares the daily basics to brushing your teeth and wants people to own their roles. He mentors people entering cybersecurity and IT, and says the CISSP reflects a manager mindset, not a doer mindset. He tells the story of employees who pressed a button on a console for years, until someone lifted the console and found it was not attached to anything. AI, he says, can analyze processes, connect workflows, and take the monotony out of tasks like gathering 22 spreadsheets from five departments. He adds that a good question gets a good result, that consistent prompts can be scheduled, and that he can point an AI assistant at his recovery plan and ask for the top five action items after a branch office loses power. Matthew compares leading AI to mentoring employees, and Thomas closes by thanking him for the conversation. Sponsor for this Episode... This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Roberta Anderson is the CISO of Onterris, an environmental services company that works around the world on oil and gas emissions, clean water, and clean air. She leads the overall cybersecurity strategy, has worked at companies that handle protected health information and military and government information, and is the author of Breaking the Firewall, a book on how women in cybersecurity move from entry level to the C-suite. Roberta and Matthew discuss the pressure that comes with CISO roles, why security fundamentals still hold in the age of AI, and how to use AI responsibly. They also look ahead to what AI could mean for work, purpose, and the next generation. Here's a Glimpse of What You'll Learn Why every CISO role carries its own stressors, public company or private Why Roberta calls the AI panic a new Chicken Little and holds that fundamentals have not changed How vulnerability management, patching, governance, and third party risk still apply Why companies, users, and even AI companies are putting the cart before the horse Why guardrails and clear instructions matter more than blaming the tool How human error and machine error compare when tools learn from patterns Why separation of duties still matters when AI checks AI What AI could mean for purpose, creativity, and the next generation In This Episode Roberta explains that Onterris works to help the environment, from oil and gas emissions to clean water and clean air, and that her role is to set the overall cybersecurity strategy and keep the company safe. When Matthew asks whether leading security at a publicly traded company is the harder job, she says she has taken every role extremely seriously, whether private or public. Her past companies handled protected health information and military information, which she describes as extremely stressful, since the information involves people's health and, in military work, their lives. A public company brings reporting to the board, SOX compliance, shareholders, and other regulations, and she concludes that every CISO role simply has its own stressors. On AI, she says she is a huge fan when it is used appropriately, then offers a statement she knows not everyone agrees with: AI is almost like a new Chicken Little. She does not believe everything must change, because AI does not remove the need for vulnerability management, patching, governance, or third party risk management. AI makes existing vulnerabilities easier and faster to exploit and makes skipped basics more obvious, so teams need to do what they should have been doing and do it faster. Roberta wants AI used in a responsible manner and says many companies, people, and even AI companies are putting the cart before the horse. Drawing on a background that includes medicine, she compares AI to neural pathways and to a gifted child: you cannot let an underdeveloped brain loose without guardrails, and if you give a smart child a task without saying how to do it, you should not be surprised when something goes wrong. People blame the tool, she says, but they did not train the tool to do what they expected. She also points out that when a person allows the wrong alert, the result is chalked up to human error, yet computers are not allowed to make mistakes, even though they are being trained to learn through pattern recognition much as people do. She does not expect any system to be fully infallible. She raises separation of duties as a fundamental that matters for SOX controls: when one system does everything, collusion becomes easy, and AI checking AI is usually the same AI checking itself. If truly segregated tools check each other, she says, that would give people comfort. When Matthew brings up the movie WALL-E and the risk of handing everything to technology, Roberta says she does not think the future goes that way. She expects status to shift toward what people do with their free time, with a resurgence of the arts and humanities and more value placed on creators and handmade work over mass-produced goods. Many people now get their fulfillment from work because that is all they have time and energy for, she says, and as AI takes on physical and mental work the question becomes what you do with your life. She sees younger people looking for more fulfillment and a purpose, and she argues that this generation grew up in a world of comfort and prosperity that her own generation worked hard to build. Matthew adds that he hopes the next generation gets to do more of the passion work and calls this a new era. Roberta closes by inviting listeners to connect with her on LinkedIn, noting that she loves mentoring and reads every message she receives, and Matthew says he would welcome her back to talk about her book. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction James Hengsterman-Cash is the CISO at Unison, which provides software and services, often as a SaaS provider, that simplify complex government problems, from managing major programs, contracts, acquisition, and grants to cost engineering. He has spent 20 years in the field, works in a highly regulated space, and also teaches executive courses on AI and security. James and Matthew examine how fast AI adoption is changing risk for a technology company that serves government customers, and where AI genuinely helps defenders. The conversation moves from security fundamentals and in-house models to tool costs, security that stays out of the user's way, and keeping skilled people at the center. Here's a Glimpse of What You'll Learn Why James compares today's AI adoption to the open S3 bucket stage of cloud How more unknown unknowns still lead back to security fundamentals Where AI helps defenders, from alert fatigue to red teaming alongside humans Why a highly regulated company cannot use every new startup tool What an in-house model needs in guardrails and AI expertise Why code review is a strong place to start with AI How model routing and tokenomics help match models to tasks Why an accountable human who understands the systems stays essential In This Episode James cites a 2025 report saying only 8% of companies lacked an AI feature on their road map, and he describes the current moment as the open S3 bucket stage, with more unknown unknowns to account for than before. Pressure arrives from several sides: more discovered vulnerabilities, some sloppy coding, and a push to adopt AI internally for business productivity and for customers. At Unison, code is reviewed in the pipeline, and he keeps returning to fundamentals such as patching systems and deploying secure code. He calls AI a fantastic tool for specific use cases, including alert fatigue, and says pen testing and red teaming need both AI tools and humans, because each catches things the other misses. In a highly regulated space only a subset of tools qualifies, since trust and organizational maturity matter. On bringing models in house, James says larger organizations need someone who understands AI and not just LLMs, and that a frontier model deployed internally without the right guardrails introduces a malicious insider. James thinks some AI fatigue is self-inflicted, because organizations pushed AI into places where it was not useful, much like the Google search bar that once appeared on every corporate intranet. He sees code review as a better starting point, since peer reviews do not happen at the level these systems can reach, and he argues that engineers with AI can multiply their output instead of being treated as headcount to cut. On cost and training, he points to model routing tools that match each task to the right model, notes that tokenomics keeps coming up, and says training cannot keep pace when the field changes every couple of months. His answer is to make the secure path the easiest one, as SSO did. He dislikes the phrase that security is everybody's responsibility, says security is security's responsibility, and argues that a phishing click that compromises a network is not the user's failing. Because these models are non-deterministic, some things will still slip through, so he falls back on defense in depth. He adds that adoption spread over years instead of months could have given the industry time to prepare for issues like prompt injection. In the SOC, James describes an AI system that reports how confident it is in an alert so an analyst can look deeper and escalate to Tier 2. For a small business with no security team, he says that beats having nobody review logs and alerts. He hopes SOCs do not disappear and that AI takes over tier 0 triage, and he wants a human who is accountable and understands these systems, noting that no system gets the sinking feeling that makes an experienced engineer stop and double check before a production change. He worries about organizations that ingest compliance and policy documentation into a system and are left with nobody who understands it. He also describes a colleague on his governance team who is not a developer and built a separation of duties and privileged access management tool, which shows the cross-functional reach AI now gives practitioners. On the future of roles, James says people are part of defense in depth, asks what happens when senior analysts leave if no junior pipeline exists, and hopes AI is adopted in tandem with people so each person can deliver far higher quality work. Once the models improve, he says, it is the responsibility of security practitioners and technologists to use them to make things better. This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Steve Goudreau is the Director of IT at Ice Industries, a metal stamper and roll former with seven locations across Mexico, Louisiana, Mississippi, and Ohio. Ice Industries works with heavy machine companies including Volvo and Cummins and makes the solar backing rails for First Solar. Steve has spent 20 of his 35 years in IT in manufacturing, and he now has a team of five at an organization of about 700 people. Steve and Matthew dig into bringing OT and IT together, choosing tools as a small team, and putting AI to work in manufacturing. Here's a Glimpse of What You'll Learn How to give controls teams the remote access they want while keeping OT secure and patched Why controls guys love repetition and how IT can still offer them something extra Why change management and patch management go hand in hand at the OT layer How a small IT team can pick tools when everyone has something new to sell How awareness training helped an employee question a fake IT help desk call on Teams Why trust but verify applies to AI work in design and quality systems How a unified AI strategy and prompt skills keep licenses and ideas from multiplying In This Episode Controls teams want remote access to their machines, and they want their integrators to be able to make changes, which leaves Steve weighing how to allow that access while keeping the OT side secure and patched. Drawing on a large project he led at Midway Products to bring the OT side into the IT side, he explains how the case was made: controls teams had to be on the network, and IT had to show what security could look like there. Steve notes that controls guys love repetition, with small network cells that all use the same IP addresses, so any change has to give them something extra. In the Dragos evaluation, seeing past the PLC to firmware versions and known exploits let IT pitch asset inventory and security at the same time. IT then asked how it could help back up PLCs and HMI recipes, facilitating the work without owning it. He also contrasts the two sides: an office computer can come down for patching and be replaced if it fails, while bricking a PLC affects the cash register of the company, which is why change management and patch management go hand in hand. Choosing tools is its own challenge for a smaller organization. Steve says you can only read so many articles, watch so many podcasts, and sit through so many webinars. Fear of missing out adds pressure because competitors may be using AI to improve their products and attackers use it every day, so his goal is to stay a step ahead or at least on par. Steve also describes much of IT leadership as selling, both to the business and to your own staff, who tend to want to work with new technology. He formed an IT steering committee with the CFO, the director of financial operations, and the president so leaders know what to watch each day and can steer where the organization is going. With the organization behind IT, the team refreshed every endpoint and server, replaced most of the switches, moved to a new SD-WAN provider, and launched user awareness training through Arctic Wolf. That training paid off when Arctic Wolf, which is connected to the company's Office 365 tenants, alerted Steve to a threat actor who had set up a user called IT help desk and was calling an employee on Teams. The employee recognized that urgency never comes like this. On AI, Steve sees promise in quality systems that look for defects and in CAD/CAM work, where people keep the creativity and AI handles monotonous steps such as drawing holes at a set spacing. Trust but verify, he says, because AI can hallucinate. Ice Industries is in the middle of its own AI journey: an outside consulting firm interviewed dozens of people about pain points and returned a long report and a spreadsheet ranking use cases by ROI, including projects estimated at six to eight months, without naming tools. The open question is whether to chase high ROI projects or longer term efforts such as predicting preventive maintenance from bearing, actuator, and thermal readings, which carry a bigger impact and a lower ROI but mean less downtime and happier employees and customers. Steve is also weighing Claude, ChatGPT, and Copilot as the preferred agent. The company has set up a Claude enterprise license, and he asks colleagues to share what they find. He wants to wrangle everything into a unified strategy as individual licenses start to appear on corporate credit cards. Steve compares prompt engineering to doing Boolean searches in Google, since most people still ask the simple question. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Brian Walters is the Director of IT at Building Plastics Inc, known as BPI, an employee owned flooring and tile distributor based in Memphis, Tennessee with 13 locations, mostly in the Mid South, and more than 60 years in business. Brian spent years in consulting across government, nonprofit, and commercial clients, and he says that experience taught him that understanding the business makes an IT leader better. He was brought in about a year ago, after a turnover in the C-suite, to transform technology at a company that sees itself as not just a flooring distributor but also an IT company, and he holds all the responsibility of a CIO without the title. He joins the show to talk about wading into AI through governance and education, putting data and security fundamentals first, and why he believes human expertise remains essential as AI use grows. Here's a Glimpse of What You'll Learn Why BPI sees itself as an IT company as well as a flooring distributor Why Brian believes understanding the business makes IT leaders better at driving transformation How Brian is wading into AI through governance, employee education, and a business reason for every use Why a modern ERP rollout became a chance to clean up data, and what garbage in, garbage out means for AI Why Brian focused on foundational security, including multi factor authentication, before rolling out AI tools Why Brian wants tools that show what employees are doing with AI, as guardrails and not Big Brother How an AI written ERP script showed Brian why oversight and expert review still matter Why Brian says smart people know you can't just let AI do everything, from deepfakes to children's education In This Episode Brian opens with the story of BPI, an employee owned company for more than 60 years that began as a vinyl flooring business and grew into wood floors, tile, and countertops, ranking, as he understands it, among the top five flooring distributors in the country and a little higher in tile. He joined about a year ago, after a turnover in the C-suite, to help transform technology, which meant working through technical debt, including an old mainframe system customized so heavily it could no longer take regular updates, and an older mindset that IT is there to keep the lights on. The new leadership sees it differently, and Brian says his consulting years taught him that when you understand the business, you know the pain points and gaps and can help leaders make educated decisions and set strategic goals. His first quick wins were security and governance, and a move to a modern SaaS ERP became a chance to make sure the data was good. The center of the conversation is how Brian approaches AI, which he sums up as wading in. He thinks it is wise to wade in and educate, and points to the high failure rates often cited for AI projects as a reason to slow down. He built governance policies and employee education on the premise that people are going to use AI no matter what, arguing that locking it down is not reasonable, and he asks for a strategic business reason behind every use. He stresses that good data is key and recalls the developer's rule of garbage in, garbage out, which is why governance boards and data cleanup are part of the ERP modernization. BPI already uses AI for meeting minutes and some generic workflows, but his priority is foundational security, such as implementing multi factor authentication, and he is cost conscious as a company that is not a Fortune 500. He is candid about ethics concerns, noting no rule says you must tell people they are talking to AI, and that China and the European Union seem further along on guidance. Brian then looks ahead. On his roadmap this year is a monitoring tool that shows how employees use AI, which he frames as guardrails and not Big Brother: protecting proprietary information while learning which tools actually help people. He explains why oversight matters with a story about a non IT employee who sent him an AI written script to implement in the ERP, one that could not account for how the system or program fits together, and he sees IT roles shifting toward pulse checks, log monitoring, and making sure the model keeps delivering both technical and business ROI. When a C-suite colleague asked whether he had done a presentation in AI, he answered that he used 30 years of experience to write the prompts and question the data sources, because smart people know you can't just let AI do everything. He raises deepfakes as a growing cybersecurity concern, notes that AI is getting better at identifying AI, such as in resumes, and worries about how AI will affect children's education, hoping we teach creative and constructive thinking and don't end up like Wall-E. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Jason Stockinger is VP and CISO of Cambium Learning Group, an education technology company made up of four power brands serving school districts and homeschoolers across the United States, where he protects student data and the teachers who administer it. A 21-year military veteran who also spent 17 years in banking, Jason says he has not had his hands on a keyboard since 2008, and that his job now is advocating for cybersecurity and the funding to match. He is the author of Stop Misreading Talent, a book on leadership drawing on the neurodivergent, veteran, and corporate worlds, shaped by his own early missteps as a leader and by what he has learned as the father of a neurodivergent son. He joins the show to talk about why not a culture fit is a leadership cop out, why a team should look like a window and not a mirror, and where AI helps and does not help in security and daily work. Here's a Glimpse of What You'll Learn Why Jason calls not a culture fit a cop out, and what he thinks leaders should ask instead How reduction in force meetings, with names on a spreadsheet, can turn into a popularity contest Why Jason says a team should look like a window, not a mirror Why an analyst who thinks differently may be your best ally for log files and forensics What splitting the last slice of pizza with his son taught him about people who attack problems from a different angle How a Monsters, Inc. style AI assistant pointed at SharePoint helped Jason get up to speed at a new company Why Jason says the bad guys have an edge because many organizations are scared to use AI to combat AI Why Jason says CISOs will tell you the real problem is users clicking on things, and whether there is a patch for the human In This Episode Jason opens by describing Cambium and his role protecting students, their data, and the teachers who administer it, and credits his team, especially the people answering phone calls from users and customers and the IT and security operations staff with eyes on glass, now assisted by AI, as the unsung heroes. He then traces his leadership story from 21 years in the military, where everyone has had a bad leader, to the realization that he was one of those leaders early on. He says his neurodivergent son has taught him more about leadership, and crossing from the veteran world into the corporate one meant learning that you cannot tell people to drop and give you 20 push ups. Those lessons became his book, which argues you may be sitting on talent you did not even realize was there. He is blunt that not a culture fit is a cop out, recalling meetings where names on a spreadsheet are judged like a high school popularity contest, and urges leaders to ask whether the person is simply in the wrong seat on the bus. The center of the conversation is curiosity and diversity of thinking. Jason explains that leaders are often given about 40 percent of the information and asked to decide fast, relying on experience that may be decades old, and that his own quick judgments caused pain, so he now advises taking an extra minute to ask what you are missing. Early in his career he surrounded himself with people who looked and talked like him, until he realized he was looking in a mirror, and he now says a team should look like a window. A neurodivergent analyst in a hoodie crushing Mountain Dews may be the best person for log files and forensics, he says, and some of the people with the best results have ignored corporate politics and gotten things done their own way. He shares a story about splitting a last slice of pizza with his son, who wanted the meat and cheese, as proof that some people attack problems from a completely different angle, and wonders whether AI is missing that because of the bias built into it. He closes the thread with his own fit story: cutting grass as a kid, 17 years in a bank, and a love of AI that finds a time for meetings. In the back half, Jason turns to AI, security, and people. He sees AI augmenting what we dislike but warns that models can drift from fundamentals, and he uses Copilot every morning to summarize his day. He notes that CISOs think like bad guys, always looking for the next vector of attack, and while defenders are often one or two steps behind, they catch up quickly, so never doubt human ingenuity. He built a Monsters, Inc. style assistant that berates him as it searches SharePoint, yet still values the person who tells you where the coffee is. He argues the bad guys have an edge because many organizations are scared to put AI in their environment to combat AI, and that most CISOs will tell you the problem is users clicking, so he hopes AI takes on more and humans can focus on relationships. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Neil Goodrich is SVP and Senior Head of Technology at Phillip Jeffries, a family founded and family run luxury wall covering company that grew from a garage startup with 10 grasscloths into 5,500 SKUs and 15 locations worldwide. The company works with artisans around the world and is deeply involved in environmental and charitable causes, including 500,000 trees planted with the Arbor Day Foundation. Neil came to the role from professional services, drawn to a company that makes products with techniques handed down over generations, and he leads a technology mandate built around being the easiest wall covering option for an interior designer. He joins the show to talk about how AI fits a craft business, how to spend the benefit of AI productivity, and why he believes security has shifted from hardening to response time. Here's a Glimpse of What You'll Learn How Phillip Jeffries uses technology to be the easiest wall covering option for an interior designer Why Neil sees the trade wall covering space as behind the curve on technology, and how that sets the company apart How an AI agent could help showroom staff cover 5,500 SKUs and questions from swatch matching to shipping dates Why Neil frames the real AI question as how to spend the benefit, and why he chooses to enhance the core experience What the robber barons and the Mandalorian teach Neil about ratcheting up work and handing too much to AI How AI gave a self described non artist new creative skills, and why he still expects a premium on handmade work Why Neil says patching jumped from a nice to have to a top priority overnight Why Neil argues hardening is no longer sufficient and response time is what matters when AI finds every target In This Episode Neil opens with the story of Phillip Jeffries, a family run luxury wall covering business whose culture of giving back, from blood drives to local kids' organizations spending the day at the office, is built into structured programs. He explains that the trade wall covering space is generally behind the curve on technology, so his team's cornerstone is making Phillip Jeffries the easiest option for an interior designer, a mandate he says predates him and is part of the company's DNA. AI has first paid off inside the IT shop, where QA, code writing, and troubleshooting have been a freebie, and his focus now is the showroom. Staff there field questions as wide as matching a swatch from another product to when a back ordered order will ship across 5,500 SKUs, and Neil sees an AI agent as a way to give them smooth, instantaneous answers. He notes that interior designers are essentially project managers juggling orders from many vendors, and wants wall covering to be the fire and forget part of their job, so they can fall backward into the company's arms and trust its recommendations. The middle of the conversation turns to a question Neil says is still very much in the wild: who gets the benefit of AI, and how do you spend it? Companies can reduce headcount or change their scaling ratio so the business grows without adding people, and while others are making crazy bets in one direction or the other, Neil says Phillip Jeffries is in neither camp and is focused on enhancing its core experience. He ties that to the history of the work week, noting that the robber barons were shocked when productivity rose after workers got two days off, and wonders whether people plugged in 18 hours a day, with AI making it easy to knock out one more thing, are being worn down. He is candid that he has little hope for a four day work week anytime soon. A Mandalorian episode in which a planet cannot shut down its rogue robots because nobody remembers how to do anything becomes his cautionary tale about handing over too much. Neil then explains that one of the attractions of joining a company that makes things was the lineage and artistry, and that AI has been additive for him personally: someone who once withdrew from his only art class when grading shifted from effort to quality now creates images he never could. He is careful about the other side, thinking of graphic designers and photographers, and predicts a premium on artisan, handmade work. On security, he says patching jumped from a nice to have to a top priority overnight, and he sees AI tools that query an inventory of PCs and patch what is missing as a way to keep maintenance as fast as attackers exploit. At his last company, security agents found that three separate lows were really one high, and he argues hardening is no longer sufficient: it is about response time, because AI means anyone can instantly find the mom and pop hardware store in Dubuque or a forgotten division in a basement, and obscurity is no longer a weapon. Sponrsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Adam Palmer is the CISO of First Hawaiian Bank, the largest bank in the state of Hawaii, with almost $30 billion in assets and operations across Hawaii, Guam, and Saipan. With 25 years in cybersecurity, he began as a U.S. military officer, worked on both the vendor and operational sides of the industry, and spent ten years in cybersecurity roles in Europe before taking on his current role just under six years ago. Adam leads the bank's technical security, governance, operational management, and risk reduction efforts, and he thrives on transformation work, building programs and operating models from the ground up. He joins the show to talk about the advantages of a mid sized bank, why he insists on a human in the lead of AI driven decisions, how he vets vendors in a regulated environment, and why he believes fighting AI with AI is the only way to keep pace. Here's a Glimpse of What You'll Learn Why Adam says a mid sized bank's agility can be a real advantage over a larger institution Why Adam counsels patience and planning, including months of assessment, over chasing a quick win How start small, scale smart, govern carefully shapes an AI committee that reviews every use case Why Adam refuses to be the department of no, and how he presents trade-offs so leaders decide with eyes open What human in the lead, not human in the loop, means for a regulated security operations center Why Adam wants vendors to prove transparency instead of wrapping an AI buzzword around a traditional tool Why Adam argues cyber risk should be quantified in business terms instead of red, yellow, and green heat maps Why Adam believes security leaders must fight AI with AI, and why crisis mode is the wrong response In This Episode Adam opens by explaining why working at a mid sized bank has real advantages. Having worked at a global bank where the budget was larger but a large ship turned slower, he says First Hawaiian Bank's agility lets his team adopt more advanced tools and move faster, and that smaller does not mean less advanced, since the bank carries the same programs and similar risks at a different scale. His advice to new CISOs is patience and planning: when he arrived in early 2021, he resisted the pressure for a quick win, spent the first several months carefully assessing the program's maturity, built a multi year plan, and then executed on it, which he says produced better effectiveness. He enjoys stepping into roles where he is the first person in the job, and likes building his own operating model while still aligning to frameworks and holding himself accountable to industry standards. The center of the conversation is how Adam approaches AI, which he sums up as start small, scale smart, govern carefully. He sits on the bank's AI committee, which carefully reviews every use case, and he wants AI implemented only when it has a legitimate, clearly articulated business value, with his team designing the guardrails. He insists security cannot be the department of no, because saying no only drives shadow IT, so he lets the business identify where it sees value and then presents the trade-offs, risks, and costs so leadership decides with eyes open. On the security side, he sees AI improving mean time to detect and mean time to resolve, an idea central to a presentation he gave on transforming the bank's security operations center to build board and executive confidence, provided tools stay auditable and transparent. That is where his distinction comes in: not human in the loop, but human in the lead, with AI prioritizing incidents and consolidating information, and an analyst making the final call on critical decisions. Adam is just as direct about vendors and metrics. He calls the AI security space a bit of the Wild West and says the vendors that stand out show transparency, prove their tools are truly better than what he can achieve without them, and do not simply wrap a traditional tool in an AI buzzword, since auditors and regulators demand to see what the AI is doing. He is open to smaller companies that prove themselves and avoids depending on a single platform as a single point of failure. He presses for cyber risk quantification in business terms, noting that every other part of the business presents priorities in dollars, and calls identity the perimeter, with human and non human identities needing strong control because authorized activity can still be malicious. The danger, he says, is moving too fast, yet the only answer to machine speed offense is equally strong AI on defense, and he is surprised when security leaders act in crisis mode, since his bank has planned for years to move at machine speed. Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Michael McAndrews is the CISO of Archwell Capital, a family of companies working primarily in financial services, with a focus on mortgages, insurance, and the technology behind them. Its largest organization, Motor, is a business process outsourcing group and an AI development group, and Michael secures a globally distributed workforce with very few brick and mortar offices. A hands on engineer who spent years in incident response, he brings pragmatism to the tension between AI efficiency and risk. He joins the show to talk about governing AI development in a regulated industry, why he tells his team to treat AI like an intern, how small per seat AI spending slips past traditional budget scrutiny, and why he relies on carefully chosen partners to counter AI powered threats he does not have the in house defenses to meet alone.   Here's a Glimpse of What You'll Learn Why Michael says AI can flag a missed signature on a mortgage application but should never make the decision How Michael separates two AI risks: employee usage that leaks data and governance of AI development Why Michael tells his team to treat AI like an intern, with a specific task and a checked result How $20 per seat spread over six to nine months can quietly add up to a $200,000 software purchase Why renting private AI infrastructure from a provider can beat owning it, and why accountability matters How Michael relies on partner and tool selection to counter AI powered attacks Why Michael turned the tables and asked the host about CISO tenure and the pressure of the job   In This Episode Michael opens by describing Archwell as a family of companies built around financial services, with Motor as its largest organization, and by drawing a clear line between the two AI problems he manages. The first is employee usage, where he worries about data leaking to third parties through the growing number of tools that are building in AI, and is putting controls in place. The second is governance of AI development, where Archwell is setting standards so its products avoid bias and never let AI make the actual decision. In mortgage lending, he explains, AI can flag that an applicant forgot to sign a field or check a box before the file moves through the process, while the decision itself stays with underwriters and humans. That philosophy carries into a favorite instruction for his team: treat AI like an intern, give it a specific task, always check the work, and remember it will not replace you, even as developers who hit their token limits react as if someone took their lollipop away. The conversation then turns to the economics of AI, where Michael sees an unexpected check on the replacement narrative. A $200,000 software request would draw tough questions from leadership, he says, but $20 per seat across a whole workforce over six or nine months reaches the same total and slips by unnoticed, which is why he is building governance around consumption versus time based models. Asked whether organizations will bring AI in house, Michael says Archwell has tried and found larger partners with more infrastructure to be more efficient and cost effective, and notes that in house does not have to mean on premises, since a private cloud rented from a provider can keep data private without the burden of owning hardware. For now, contracts are his main control with frontier model providers, covering no training on Archwell data, retention, and how quickly they must notify him of an incident, and he prefers a provider who is accountable if something goes wrong over holding the patching risk himself. In the back half, Michael turns to people and the road ahead. A hands on engineer who admits the move into leadership has been a challenge, he describes pulling his hands back from the keyboard, begrudgingly, in exchange for control over tools, training, and budget that lets him help the whole team, and he tells a younger teammate who never wants to lead that his skills will eventually outgrow individual tools. He calls this the most exciting shift he has seen in quite some time, not a scary one, while still preferring a human voice to an AI agent on the phone. On defense, he explains that because AI lowers the barrier to entry for attackers, he reached a clear conclusion after asking a CISO group that included Glasswing companies what a smaller company should do: partner and tool selection matter most, and he becomes a spectator watching two robots fight it out with his own money on the line. He closes with a candid conversation about unplugging, noting that not every problem needs solving immediately, and in a rare role reversal asks the host about CISO tenure and the pressure of the job, which he says leaders mostly put on themselves.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.

Guest Introduction Tony Bryson is the CISO of the Town of Gilbert, Arizona, and returns to the show to talk about the risk he named when his CTO asked him, six years ago, what the town's greatest risk was: critical infrastructure. Gilbert runs water, wastewater, water collection, and traffic operation systems, the same kinds of operational technology that municipalities and private operators across the country depend on every day. Tony has taken his message on IT and OT convergence to utility audiences and has built a partnership model with his town's public works teams that brings in trusted outside experts. He joins the show to explain what has changed about the threat, how a town can respond without taking on SCADA itself, and why telling residents the whole story matters as much as any technical control.   Here's a Glimpse of What You'll Learn Why Tony says the air gap that once protected operational technology no longer exists How vendor remote access for support and patching quietly defeats the old air gap mentality Why attacks on critical infrastructure are often first noticed by a plant worker, not by security tools Why OT's focus on availability, six nines instead of five, changes how patching and monitoring get done How Gilbert partnered with public works and brought in trusted third parties who speak the plant's language Why Tony argues for a federal minimum standard for securing critical infrastructure How honest conversations with residents about water rates built understanding and trust   In This Episode Tony opens with the question his CTO asked him when he first joined Gilbert six years ago, what is the town's greatest risk, and his immediate answer: critical infrastructure. He explains that these operational technology systems were never built with the same security assumptions as IT, and that while they once sat in environments that were not noteworthy targets, nation-state actors, hacktivist collectives, and cyber syndicates now treat them as low hanging fruit, partly because intrusion detection and system monitoring rarely exist on the OT side. He notes that attacks have often been discovered by a plant worker who spotted something odd on a SCADA screen, and that the old air gap defense has been undone by service and subscription models in which vendors require remote access for support and patching. The result is what he calls a convergence between IT and OT that forces plants to adopt IT best practices. The middle of the conversation is a clear-eyed look at why OT security lags and what actually works. Tony explains that plants have traditionally avoided antivirus because scans can knock over sensitive systems like historians, rely on SCADA monitoring that watches the process rather than the network, and sometimes run default logins, thin segregation of duties, and weak backups. He adds that critical infrastructure leans hard on availability, targeting six nines where IT balances confidentiality, integrity, and availability, which he describes as a scalene triangle with availability stretched out. He recalls presenting on IT and OT convergence at a Southwest utilities seminar in Las Vegas in 2023, where the room looked at him like he had four heads, and he was then swarmed with questions in the hallway for up to two hours. Gilbert's answer has been partnership: educating public works, being candid that his team knows nothing about SCADA, and bringing in the best vendors in the marketplace as trusted third parties who speak the language of the plant, covering network segregation, asset and supply chain management, ongoing vulnerability assessment, and full time system monitoring. The final stretch moves from technology to policy and public trust. Tony makes the case that critical infrastructure needs a federal minimum standard, noting that water and wastewater operators work from IEC 62443 and the Purdue model while each industry follows its own frameworks, and he explains why states push back on unfunded mandates. He argues that a million dollars of security spending is small next to the billions of dollars of buried infrastructure and the public trust at stake. He then brings it home with Gilbert's own story: aging infrastructure in acidic soil forced a dramatic water rate increase, and when a resident raised it at an AI symposium in downtown Phoenix, Tony chose to explain exactly what the town was facing and how smart meters might someday help residents find leaks. Afterward, the resident thanked him and said he now understood why the increase was required, even though he was still not happy about it. Tony closes by honoring plant operators as rock stars who keep the water flowing, and urging them to bring in experts for what they do not know they do not know.   Sponsor for this episode This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact, [email protected], or 301-798-9170.