Privacy Under Siege: Navigating Data Theft and the BadBox Threat - Gavin Reid - CSP #208
Release Date: 01/13/2025
ATT&CK → ATLAS: A CISO’s Blueprint for AI Governance - Sandy Dunn - CSP #218
CISO Stories Podcast (Audio)
CISO Sandy Dunn breaks down her blueprint for AI-ready defense—pairing MITRE ATT&CK v18 with MITRE ATLAS to move from policy to behavior-based detections. We hit practical AI governance, her early focus on defending and understanding AI, and how OWASP GenAI tools turn checklists into action. Segment Resources: Article: AI Cheat Sheet: OWASP LLM Governance Checklist: OWASP Threat Defense COMPASS: Visit for all the latest episodes! Show Notes:
info_outline
Security Awareness Through Trust and Influence - Jennifer Selby Long - CSP #217
CISO Stories Podcast (Audio)
Jennifer Selby Long reframes security awareness as more than training—it’s about earning trust and influence with executives and security teams. She shares leadership lessons on how to build stronger alignment and support for security initiatives. Visit for all the latest episodes! Show Notes:
info_outline
OT on the Frontlines: Threat Intelligence You Can’t Ignore - Dawn Cappelli - CSP #216
CISO Stories Podcast (Audio)
Dawn Capelli, Head of OT-CERT at Dragos, unpacks the evolving risks to Operational Technology. From nation-state attacks on Ukraine’s infrastructure to hacktivists targeting U.S. water systems, she explains the PIPEDREAM malware, the top five SANS critical OT controls, and how Dragos’ OT-CERT program offers free resources to help organizations defend critical infrastructure now. Segment Resources: This segment is sponsored by NowSecure. Visit to learn more about them! Visit for all the latest episodes! Show Notes:
info_outline
Reimagining Security Operations: SOC as a Service and the Role of AI - Kevin Nikkhoo - CSP #215
CISO Stories Podcast (Audio)
Kevin Nikkhoo joins the show to explore Security Operations Center as a Service (SOCaaS) and how it compares to traditional SOC models. He breaks down which organizations benefit most from this approach and how AI is reshaping modern SOC operations. Listeners will gain a clear understanding of how SOCaaS can enhance detection and response capabilities—and why embracing AI is key to the future of security operations. Segment Resources: This segment is sponsored by Tines. Tines’ AI-enabled, secure workflow platform empowers your whole team regardless of their coding abilities, environment...
info_outline
From Diagram to Cloud: Rethinking Cloud Security in an Age of Uncertainty - Yogita Parulekar - CSP #214
CISO Stories Podcast (Audio)
From Diagram to Cloud: Rethinking Cloud Security in an Age of Uncertainty Episode Summary: In this month’s episode of CISO Stories, we dive deep into cloud security with cybersecurity veteran and cloud innovator Yogi Parulekar, founder of InviGrid. Against a backdrop of rising geopolitical tensions and tightening budgets, we explore how organizations can move from reactive security to proactive resilience. Yogi introduces the concept of “diagram to cloud” as a smarter, more efficient alternative to traditional “shift left” approaches, emphasizing secure-by-design principles powered...
info_outline
Empowering Developers: Fostering a Culture of Security in AppSec - Danielle Ruderman - CSP #213
CISO Stories Podcast (Audio)
In this episode, we explore the crucial role of cultivating a strong security culture to drive change in AppSec, where training and collaboration are key. Our distinguished guest, Danielle Ruderman, discusses the importance of executive support in ensuring that application development isn't just about churning out apps on time, but also about adopting a secure-by-design approach. We also dive into how to empower developers, foster psychological safety, and make security everyone's responsibility. Tune in for actionable insights on transforming your security culture within your applications...
info_outline
Mapping the Modern Attack Surface: Fintech’s Evolving Risk Frontier - Erika Dean - CSP #212
CISO Stories Podcast (Audio)
In this episode, Erika Dean dives into the evolution of attack surface management (ASM) in financial tech. From foundational strategies to future-focused threats, she explores how shifts in the fintech landscape demand deeper organizational awareness, ongoing tabletop exercises, and proactive preparation. This segment is sponsored by Axonius. Visit to learn more about them! Visit for all the latest episodes! Show Notes:
info_outline
Maximizing Cyber Liability Insurance: Risk, Relationships & Renewal Strategies - Mandy Andress - CSP #211
CISO Stories Podcast (Audio)
Mandy Andress joins our show to discuss leveraging cyber liability insurance for risk reduction. They explore the importance of strong broker relationships and key steps for selecting or renewing a policy—starting with assessing organizational needs. Learn strategies to lower premiums while increasing coverage. Segment Resources: This segment is sponsored by Sophos. Visit to learn more about them! Visit for all the latest episodes! Show Notes:
info_outline
Breach by the Dozen: Incident Response Lessons from the Field - Mike Miller - CSP #210
CISO Stories Podcast (Audio)
In this episode of the CISO Stories Podcast, we’re joined by Mike Miller, a seasoned penetration tester and audit and compliance SME, to explore the real-world impact of incident response controls. From technical to managerial and physical safeguards, Mike shares eye-opening stories from the field—including how he once penetrated a network with nothing more than a dozen doughnuts. We dive into the importance of layered security approaches and practical tips for strengthening incident response frameworks. Don’t miss this blend of humor, insight, and actionable advice for cybersecurity...
info_outline
AI Governance: Navigating Risks, Frameworks, and the Future - Rock Lambros - CSP #209
CISO Stories Podcast (Audio)
In this episode, we sit down with author and AI expert Rock Lambros to explore the evolving landscape of AI governance. We discuss the risks of AI chatbots, comparing OpenAI and DeepSeek, and examine current and emerging governance frameworks. As AI adoption accelerates, organizations must determine the right guardrails and critical questions to ask. This conversation provides insights into how companies are shaping their AI strategies for a more secure and responsible future. Segment Resources: Visit for all the latest episodes! Show Notes:
info_outlineIn this episode, we sit down with experienced CISO Gavin Reid to explore the escalating online threats to privacy, focusing on adversaries and companies illicitly scraping website data for profit. We dive into the implications of such unauthorized data collection and its impact on individual and organizational privacy. Reid also shares insights from his team’s involvement in dismantling BadBox, a coordinated global attack exploiting connected TV (CTV) devices, highlighting the intersection of cybersecurity and privacy concerns.
HUMAN's Satori threat intelligence team has published the following resources on BadBox: https://www.humansecurity.com/company/satori-threat-intelligence/badbox https://www.humansecurity.com/learn/blog/badbox-peachpit-and-the-fraudulent-device-in-your-delivery-box https://www.humansecurity.com/newsroom/human-disrupts-digital-supply-chain-threat-actor-scheme-originating-from-china
Visit https://cisostoriespodcast.com for all the latest episodes!
Show Notes: https://cisostoriespodcast.com/csp-208