DrZeroTrust

In this episode, we take a hard look at how AI is being integrated into cybersecurity—and where the narrative often diverges from reality. The discussion spans offensive and defensive use cases, the structural challenges facing SMBs, and why open-source cyber threat intelligence (CTI) remains a critical foundation despite aggressive vendor marketing.We also explore the economic pressures shaping today’s security market, including broken pricing models, unrealistic expectations placed on small teams, and the growing gap between compliance optics and real risk reduction. The episode concludes with a forward-looking discussion on applied machine learning, mathematical modeling, and how these approaches can meaningfully support incident responders in the field.Practical applications of AI in cybersecurity operationsOffensive vs. defensive AI tradeoffsThe SMB security gap and market failureOpen-source CTI as a force multiplierPricing models and market distortionApplied ML and mathematics for real-world incident responseProduct direction and long-term vision00:00 — Introduction and company overview38:10 — Pricing models, market dynamics, and systemic issues39:26 — Future plans, roadmap, and strategic vision52:00 — AI in offensive and defensive cybersecurity operations58:54 — Open-source CTI and applied AI capabilitiesKey Topics CoveredChapters

In this conversation, I discuss the latest findings from the Identity Theft Resources Center's Business Impact Report. He highlights alarming cybersecurity trends, particularly the rise of AI-powered attacks and their financial implications for small businesses. The discussion covers the disconnect between perceived security preparedness and actual security measures, as well as best practices for improving cybersecurity resilience.TakeawaysCyber attacks are a near-universal threat, especially for small businesses.The financial cost of cybercrime is being passed directly to consumers, creating a hidden 'cybertax'.Business leaders' confidence in their cybersecurity preparedness has significantly declined.There is a dangerous disconnect between the perception of risk and the adoption of basic security controls.Small business leaders have mixed opinions on the role of AI in cybersecurity.AI-powered attacks are a significant threat, accounting for over 40% of incidents.Cyber insurance is becoming less reliable, forcing businesses to find alternative recovery methods.Loss of customer trust and employee turnover are significant consequences of cyber attacks.Training alone is not sufficient to prevent cybersecurity breaches.Mastering foundational cybersecurity practices is essential for resilience.

Hard truth: if you’re shipping AI and haven’t rethought identity, you’re not “innovating” — you’re just building a faster, prettier fraud engine.In this conversation with Heather Dahl, we dig into what identity in the age of AI really means — and why mutual authentication is now the minimum entry fee for doing business online.A few blunt takeaways:AI changes the economics of scams — this isn’t “50 cents here, a dollar there” anymore, it’s industrialized fraud at AI speed.A slick AI experience on top of a weak identity is just a scam delivery platform.If you burn a customer with a security failure, you don’t get a second chance. They move on.Every dollar you put into AI without strong identity and mutual authentication is risk capital for the attacker, not innovation spend.If your systems can’t prove who they are to the customer, and your customers can’t prove who they are to you, your “AI strategy” is really just an attack surface with good branding.🔗 Watch the full episode + bring this to your next board or exec conversation about “AI investments” and “digital experience.” If identity and mutual auth aren’t on the slide — the strategy is incomplete.#ZeroTrust #AI #Identity #MutualAuthentication #CyberSecurity #DigitalTrust #FraudPrevention #CustomerExperience #VerifiableCredentials #ScamsAtScale

In this conversation, I discuss the evolving landscape of cybersecurity, particularly the impact of #ai on #cyberattacks. I highlight a recent AI-driven #cybersecurity campaign, its implications for businesses, and the importance of robust cybersecurity measures. The discussion also covers vendor security in the financial sector, lessons learned from a ransomware attack in Nevada, government cybersecurity strategies, and the recent Cloudflare outage. The conversation concludes with insights into new threat intelligence tools and the need for continuous vigilance in cybersecurity practices.TakeawaysAI models have become genuinely helpful for cybersecurity operations.The first documented case of a large-scale cyber attack executed with minimal human intervention has emerged.Businesses must take cybersecurity seriously as threats become more commoditized.Phishing training alone is insufficient as a cybersecurity control.Lateral movement and privilege escalation are critical cybersecurity vulnerabilities.Government strategies need to focus on shaping adversary behavior and public-private partnerships.The recent Cloudflare outage highlights systemic issues in internet infrastructure.New threat intelligence tools are emerging to help organizations stay secure.Cybersecurity is a shared responsibility that requires vigilance from all stakeholders.The landscape of cyber threats is evolving rapidly, necessitating continuous adaptation.

I sat down with Karim Toubba, CEO of LastPass, to discuss the challenges and triumphs of navigating cybersecurity in today's digital landscape, especially the issues we face when we have been breached. This is a masterclass in how to handle #cybersecurity crisis!In this episode, Karim shares insights into LastPass's response to significant security breaches, the importance of authentic #leadership, and the evolving role of password management in a networkless world. Tune in for a candid conversation about resilience, change, and the future of cybersecurity.Takeaways: Leadership in Crisis: Karim Toubba emphasizes the importance of authentic leadership and taking responsibility, even when new to a role, as a key factor in navigating crises effectively.Security as a Priority: LastPass has made significant investments in security infrastructure and culture, highlighting the necessity of a sustained commitment to cybersecurity at all organizational levels.Cultural Shift: The implementation of security measures like Yubikeys and the focus on changing employee mindsets underscore the need for a cultural shift in cybersecurity practices.Challenges of Attribution: The difficulty in attributing cyberattacks to specific actors is discussed, with an acknowledgment of the sophisticated nature of the threats faced.Evolving Cyber Landscape: The conversation touches on the evolving nature of cybersecurity threats and the need for continuous adaptation and investment to stay ahead.Product Innovation: LastPass's expansion beyond password management to include products like SAS Monitor and SAS Protect demonstrates their commitment to addressing broader security challenges.User-Centric Security: The importance of making security measures user-friendly and front-and-center is highlighted as a critical factor in improving overall cybersecurity.

🚨 Identity is one of the many links in the #cybersecurity kill chain. If you think your perimeter is going to save you, you’re already compromised.In this episode, I sit down with Tim Prendergast to rip apart the myths of identity management in 2025. We’re talking:🔹 Why re-engineering identity security isn’t optional—it’s survival.🔹 How Zero Trust changes the way we think about foundational #security .🔹 The balancing act: usability vs. airtight controls.🔹 Why privileged access is the real battleground in every org today.The hard truth? Every business on the planet is facing the same identity chaos. Zero Trust isn’t some buzzword—it’s the operating system for the modern enterprise.👊 No sales pitches. No hand-waving. Let's get real about how to build security that actually works.

In this episode, I sit down with Ofer Klein to dig into the messy truth about #ai governance, “shadow AI,” and why most CISOs are already behind the curve. We’re talking about the reality that AI isn’t just a shiny new tool — it’s a #cybersecurity #threat vector, a compliance nightmare, and the next accelerant for both attackers and defenders.If your organization thinks it can “wait and see,” you’ve already lost. Visibility, governance, and proactive strategy aren’t optional anymore — they’re survival.Tune in and find out why AI will either accelerate your business or dismantle it — and why your security leadership better decide which side of that equation they’re on.

In this episode of The Dr. ZeroTrust Show, I sit down with Geoff Halstead, co-founder and Chief Product Officer of Faction Networks, to delve into the realities of Zero Trust Networking.We break down:Why legacy and #iot devices remain a massive #risk surfaceHow hardware plays a decisive role in #cybersecurity strategy.The investment challenges are holding back true innovation.Why accountability and continuous monitoring are non-negotiable for building a secure digital future.If you’re serious about securing infrastructure against modern threats, this is a conversation you don’t want to miss.

In this episode, Mike Elkins maps a whole‑of‑business blueprint for digital safety that actually reduces risk you can measure. We break down what “holistic” really means in practice: identity as the control plane, data‑centric design, continuous verification, least privilege, segmentation that shrinks blast radius, and automation that removes human bottlenecks. From cloud and SaaS to OT/IoT and third‑party risk, Chase shows how to connect policy, architecture, and operations so security becomes a repeatable system—not a pile of tools.TakeawaysWhy piecemeal controls create “debt‑in‑depth”How to center Zero Trust on identities, not networksPragmatic micro‑segmentation and just‑in‑time accessA simple metric stack for the board (exposure, blast radius, dwell time)How to align GRC with day‑to‑day enforcementNo FUD. No silver bullets. Just the playbook to make “holistic” real.

In this hard-hitting episode of The DrZeroTrust Show, we peel back the layers of FEMA’s #vulnerabilities—not in hurricanes or wildfires, but in its #digital backbone and #leadership. From fragile #cybersecurity defenses to internal dysfunction, these issues strike at the core of FEMA’s ability to deliver when America needs it most. I’ll break down how systemic missteps and weak strategies threaten resilience, and what must change if our nation is to withstand the crises of tomorrow.This isn’t just about disaster relief—it’s about national security, accountability, and the future of government response in the cyber age. Tune in to get the unfiltered truth.

Cyber meets Congress—no spin, no buzzwords. In this episode of The Dr. ZeroTrust Show, we break down what it's like to work with the folks on Capitol Hill from a Tech CEO's perspective. In this episode, you will hear about how leaders should approach collaborating with lawmakers, and perhaps even learn a thing or two about what it means to lead from the front as a CEO.If this helped, like, subscribe, and drop your questions in the comments—what should we tackle next?#cybersecurity #capitolhill #congress #zerotrust #policy #nationalsecurity #cisa #NIST #CIRCIA #SBOM #AIpolicy #electionsecurity #criticalinfrastructure

Cybersecurity conferences: equal parts chaos, collaboration, and caffeine. ☕💻 Behind the buzzwords and vendor swag, real innovation happens. We’ll break down how these gatherings shape the industry, spark partnerships, and prep us for the next wave of #threats. Tune in for no-BS insights on making the most of these events.

We pull no punches on the escalating #cyberwarfare threat from state-sponsored actors, with China leading the charge. From alarming penetration test results to underfunded state laws like Ohio’s latest effort, this episode dissects why America’s response is dangerously inadequate. This isn’t just another #cybersecurity scare—it’s a call for a complete strategic overhaul to safeguard national #security before it’s too late.TakeawaysChina is currently leading in cyber warfare against the U.S.The threat landscape is rapidly evolving, with increasing vulnerabilities.Broken access control remains the most common vulnerability in systems.Cybersecurity spending is slowing down, which is concerning for national security.Ohio's new cybersecurity law lacks funding and practical enforcement measures.Leadership in cybersecurity is crucial for effective defense strategies.Many organizations are still using outdated technology and practices.The need for comprehensive training and resources in cybersecurity is critical.Legislative measures must be backed by funding to be effective.The conversation highlights the urgency for a new approach to cybersecurity.

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses significant developments in cybersecurity, including Palo Alto's $25 billion acquisition of CyberArk, the implications of rising AI threats, and the ongoing challenges posed by data breaches and ransomware. He emphasizes the need for a more robust cybersecurity framework, particularly in light of recent trends in fraud and the consolidation of the cybersecurity industry. The discussion also touches on the political influences affecting cybersecurity education and the importance of adopting Zero Trust principles.TakeawaysPalo Alto's acquisition of CyberArk is a significant move in the cybersecurity landscape.The consolidation of cybersecurity firms raises concerns about market competition.Data breaches linked to Shiny Hunters highlight vulnerabilities in CRM systems.AI is increasingly being used in sophisticated cyberattacks.The AI fraud crisis is already impacting various sectors, including government programs.Political influences are affecting hiring practices in cybersecurity education.CISA's new guidance on Zero Trust emphasizes the importance of microsegmentation.Ransomware attacks are evolving, with a notable increase in targeting the oil and gas sector.The volume of data stolen in ransomware attacks is on the rise.Cybersecurity requires continuous adaptation to emerging threats and technologies.

In this conversation, Dr. Chase Cunningham discusses the current state of cybersecurity, focusing on market growth, the workforce gap, the impact of data breaches, and the role of AI. He emphasizes the importance of zero trust architecture and highlights the human factors that contribute to cybersecurity risks. The discussion also covers incident trends and the need for organizations to adapt their strategies to mitigate risks effectively.TakeawaysThe cybersecurity market is projected to grow significantly, reaching $878 billion by 2034.Data breaches are becoming increasingly costly, with the healthcare sector being the most affected.Zero trust architecture is gaining traction as organizations seek to reduce breach costs.There is a significant gap in the cybersecurity workforce, with millions of unfilled positions.Despite the demand for cybersecurity professionals, many qualified individuals remain unemployed.AI is transforming the cybersecurity landscape, but it also poses new risks.Human factors remain a significant vulnerability in cybersecurity.Organizations must implement technology to mitigate risks associated with human error.The majority of cybersecurity incidents are often attributed to a small percentage of employees.Zero-Trust strategies are essential for future cybersecurity resilience.

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses the recent ransomware attack on Marks & Spencer, the implications of Ingram Micro's investigation into a ransomware incident, and the lessons learned from major cyber attacks. He highlights the importance of cybersecurity measures, job opportunities in the field, and government initiatives aimed at improving cybersecurity. The conversation also explores the rise of sophisticated cyber threats, including deepfake scams and the activities of the hacker group Scattered Spider, concluding with insights into the future of cybersecurity.TakeawaysMarks & Spencer's ransomware attack was the result of social engineering.The attack involved impersonation of employees to reset passwords.Micro segmentation and multi-factor authentication could have mitigated the attack.Ingram Micro is investigating a ransomware attack that is affecting its operations.Lessons from past cyberattacks emphasize the need for software updates and ongoing training.Deepfake scams are becoming a significant threat.There are numerous job opportunities in the field of cybersecurity.Government funding for cybersecurity is crucial for rural hospitals.The SEC is settling with SolarWinds over cybersecurity failures.Organizations often overlook cybersecurity best practices.

In this conversation, Dr. Zero Trust discusses various cybersecurity incidents, including the Norwegian dam hack, retail data breaches, and the challenges posed by data brokers. He emphasizes the importance of proactive security measures and the need for better regulations in the digital age. The discussion also touches on leadership changes at Cyber Command, emerging cybersecurity startups, and ethical considerations in the industry.TakeawaysThe Norwegian dam hack highlights the risks of weak passwords.Proactive security measures are essential for critical infrastructure.Data breaches in retail can affect millions of individuals.Leadership changes at Cyber Command may impact cybersecurity strategy.Data brokers operate in a regulatory gray area across states.Privacy concerns are exacerbated by the lack of federal regulations.Cybersecurity incidents in airlines can have widespread implications.The VA data breach serves as a historical lesson for cybersecurity.Emerging startups are addressing various cybersecurity challenges.Ethical considerations in cybersecurity practices are crucial.

In this episode, Dr. Zero Trust discusses a record-breaking data breach involving 16 billion exposed passwords, the implications of cyber warfare in current geopolitical conflicts, and the challenges surrounding digital sovereignty in Europe. The conversation highlights the need for better cybersecurity practices and the evolving nature of warfare in the digital age.Takeaways16 billion passwords exposed in a massive data breach.The data breach raises questions about the accuracy of reported figures.Cybercriminals are shifting tactics, using info stealers and malware.The future of warfare involves cyber operations combined with kinetic actions.Deep fakes and manipulated media are becoming prevalent in conflicts.Cybersecurity measures like MFA and strong passwords are essential.Legislators are often unaware of the complexities of cybersecurity.Digital sovereignty claims in Europe are questionable due to reliance on US companies.The intersection of cyber and traditional warfare is increasingly blurred.Public awareness of cybersecurity threats is crucial for national security.

In this conversation, Dr. Chase Cunningham and Eric Krohn discuss the evolving landscape of cybersecurity, particularly focusing on the impact of AI and Zero Trust principles. They explore the challenges small and medium businesses face in adopting new technologies, the importance of risk management, and the need for a collaborative approach between technology and business strategies. The discussion also touches on the recent funding trends in cybersecurity startups and the role of AI in enhancing security measures while addressing the human element in cybersecurity practices.TakeawaysThe AI boom is reshaping the cybersecurity landscape.Zero Trust is becoming a standard practice in security.Risk management strategies must evolve with technology.AI can enhance cybersecurity but requires careful implementation.Small and medium businesses face unique challenges in cybersecurity.Funding for cybersecurity startups is on the rise.Collaboration between tech and business is essential for success.AI can help simplify complex cybersecurity processes.Understanding the human element is crucial in cybersecurity.The future of cybersecurity will be driven by innovation and adaptability.

How does a company deal with AI sprawl? What is the "oh shit" moment when an enterprise realizes how much risk AI is introducing? Where can we fix this issue? Why was Reco 4 years ahead of the problem, and what have they learned as they took their solution to market? Lots of insight on this one with the co-founder of Reco!