Lorrie Cranor: Why Security Fails Real People

Dr. Lorrie Cranor, Director of the CyLab Security and Privacy Institute at Carnegie Mellon University joins Ann Johnson, Corporate Vice President, Microsoft, on this week's episode of Afternoon Cyber Tea to discuss the critical gap between security design and real-world usability. They explore why security tools often fail users, the ongoing challenges with passwords and password less authentication, and how privacy expectations have evolved in an era of constant data collection. Dr. Cranor emphasizes the importance of user-centered design, practical research, behavioral insights, and simpler, more transparent systems to help CISOs build security programs that truly work for people.    Resources:   View Lorrie Cranor on LinkedIn             View Ann Johnson on LinkedIn       Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks   Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft, Hangar Studios and distributed as part of N2K media network.

Troy Hunt, founder of Have I Been Pwned, joins Ann on this week's episode of Afternoon Cyber Tea to explore what billions of breached records reveal about attacker behavior, human weakness, and the state of breach disclosure. He explains why organizations often hesitate to notify victims, how breach fatigue shapes user responses, and why transparency is both powerful and challenging. Troy also shares how he personally fell for a phishing attack, illustrating that even experts have moments of vulnerability. The conversation points toward a more resilient future and what it will take for both people and organizations to stay ahead of evolving threats.    Resources:   View Troy Hunt on LinkedIn  View Ann Johnson on LinkedIn     Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks           Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft, Hangar Studios and distributed as part of N2K media network.

Brad L. Mortensen, President of Weber State University joins Ann on this week's episode of Afternoon Cyber Tea to discuss the evolving role of higher education in preparing the future cybersecurity workforce. Brad shares how Weber State supports students from all backgrounds through open enrollment, stackable credentials, real-world learning partnerships, and a focus on both technical training and durable human skills like communication, resilience, and problem solving. He talks about the rise of AI in the classroom, the importance of industry collaboration, and why fostering adaptability and creativity is essential to meeting growing cyber talent demands.     Resources:   View Brad L. Mortensen on LinkedIn    View Ann Johnson on LinkedIn       Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks           Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Amy Hogan-Burney, Corporate Vice President of Customer Trust and Security at Microsoft joins Ann on this week's episode of Afternoon Cyber Tea to discuss her unexpected journey into cybersecurity, Microsoft’s evolving approach to combating global cybercrime, and the importance of collaboration across the private and public sectors. She reflects on lessons from the latest Microsoft Digital Defense Report, the growing impact of AI on security, and the challenges of regulatory complexity. Amy also shares insights on cyber diplomacy, building strong legal-technical partnerships, and the career advice that’s guided her path all while remaining optimistic about the future of cybersecurity.     Resources:   View Amy Hogan-Burney on LinkedIn     View Ann Johnson on LinkedIn        Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks            Discover and follow other Microsoft podcasts at microsoft.com/podcasts       Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Darren Kane, Chief Security Officer at NBN, Australia’s national broadband network joins Ann on this week's episode of Afternoon Cyber Tea to shares insights from his unique journey through law enforcement, financial enforcement, and corporate security, and how those experiences shaped his leadership of a converged security organization that unites physical and cyber defense. He discusses the challenges of securing critical infrastructure across a vast continent, the importance of collaboration between government and industry, and how data convergence and AI are reshaping resilience strategies. Darren also reflects on the evolving role of the CSO, the value of holistic risk management, and why nurturing human resilience is just as vital as technological defenses.    Resources:   View Darren Kane on LinkedIn   View Ann Johnson on LinkedIn       Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks           Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Frank X. Shaw, Chief Communications Officer at Microsoft, joins Ann on this week's episode of Afternoon Cyber Tea to explore the critical role of communication in cybersecurity. They discuss how transparency and trust shape effective response to cyber incidents, the importance of breaking down silos across teams, and how AI is transforming communication strategies. Frank shares insights on leadership, the power of internal communications, navigating misinformation in an era where perception matters as much as technical reality, and why building a culture of security awareness starts with clear, honest messaging—no fluff, no spin.    Resources:   View Frank X. Shaw on LinkedIn     View Ann Johnson on LinkedIn       Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks           Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Volker Wagner, Chief Information Security Officer at BASF, joins Ann on this week's episode of Afternoon Cyber Tea to  talk shop on what it really takes to defend one of the world’s largest chemical companies. From his early days in auditing to leading global cyber for high-stakes industrial and research environments, Volker shares battle-tested insights on resilience, Zero Trust, and the fundamentals that never go out of style. He dives into the hard lessons learned from ransomware, the realities of third-party risk, and how AI is reshaping everything from incident response to supply chain security. Most importantly, he makes the case for why trust, communication, and culture aren’t soft skills—they’re survival skills for modern CISOs.  Resources:   View Volker Wagner on LinkedIn           View Ann Johnson on LinkedIn    Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks           Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Matt Rowe, Chief Security Officer at Lloyds Bank, joins Ann on this week's episode of Afternoon Cyber Tea to explore the future of cybersecurity. They discuss the accelerating pace of change in the industry, from AI and automation to data-driven security practices and identity management. Matt shares how Lloyds Bank is modernizing its approach by reducing friction, upskilling teams, and fostering a growth mindset, while also laying foundations for resilience and agility across the financial ecosystem. The conversation highlights why now is the moment to rethink security strategies and how optimism, creativity, and collaboration can help defenders stay ahead.    Resources:   View Matt Rowe on LinkedIn     View Ann Johnson on LinkedIn        Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   The BlueHat Podcast    Uncovering Hidden Risks            Discover and follow other Microsoft podcasts at microsoft.com/podcasts       Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Erez Liebermann, partner at Debevoise & Plimpton and a leading voice in cybersecurity and data privacy joins Ann on this week's episode of Afternoon Cyber Tea. Together, they unpack how legal and security teams can act as strategic partners, aligning regulatory compliance with business priorities while preparing for and responding to incidents. Erez offers actionable insights from real-world experience on breaking down silos, building trust, and balancing transparency with legal prudence during breaches. Listeners gain practical strategies for fostering cross-functional collaboration, improving incident response, and strengthening organizational resilience in today’s evolving threat landscape. Resources:  View Erez Liebermann on LinkedIn   View Ann Johnson on LinkedIn     Related Microsoft Podcasts:  Microsoft Threat Intelligence Podcast  The BlueHat Podcast   Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts    Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.

Amy Edmondson, Harvard Business School professor and psychological safety pioneer joins Ann on this week's episode of Afternoon Cyber Tea. Together they discuss how creating psychologically safe environments allows teams, especially in high-pressure fields like cybersecurity, to speak up about early warnings, embrace the red, and learn from failure. Amy shares her framework for distinguishing between intelligent, basic, and complex failures, and offers practical guidance for leaders looking to build high-performing, resilient teams in uncertain, fast-moving environments. Resources:  View Amy Edmondson on LinkedIn             View Ann Johnson on LinkedIn     Related Microsoft Podcasts:  Microsoft Threat Intelligence Podcast  The BlueHat Podcast   Uncovering Hidden Risks     Discover and follow other Microsoft podcasts at microsoft.com/podcasts      Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of N2K media network.