Send us Fan Mail

AI is changing cybersecurity work. But the bigger challenge for leaders may be whether their talent strategy is changing fast enough to keep up.

The organizations that succeed will not simply hire more experienced people. They will need to identify potential earlier, develop talent internally, create room for continuous learning, and rethink what entry-level cybersecurity work should look like in an AI-enabled environment.

In this episode of Musings from the Cyber Trench, I sit down with Anil Saxena, a workforce development and platform-driven learning leader at ServiceNow, to discuss what is broken in the way organizations hire, train, and develop cybersecurity talent.

We explore how AI is changing cybersecurity roles, why credentials and years of experience are incomplete measures of potential, how simulation-based learning could improve technical hiring, and why organizations need to treat cybersecurity talent as a long-term system rather than a series of positions to fill.

Anil shares practical insights on:

• Why organizations need to develop cybersecurity talent internally instead of relying primarily on experienced external hires
• Why analytical thinking, pattern recognition, curiosity, and stakeholder management become more valuable as AI automates routine work
• How leaders can evaluate cybersecurity potential beyond certifications and years of experience
• Why simulation-based exercises may provide a better way to assess how candidates solve real problems
• How AI can eliminate low-value administrative work without eliminating the need for meaningful entry-level roles
• Why cybersecurity training fails when organizations use one-size-fits-all programs without follow-up or hands-on application
• How organizations can build a cybersecurity talent pipeline around future business needs instead of reacting to vacancies
• Why mid-career cybersecurity professionals should learn to work with AI rather than compete against it
• How strong technical teams depend on leadership, shared working norms, and a common objective

The central takeaway is that cybersecurity workforce development cannot remain reactive. Organizations need to think several years ahead, identify people with the right underlying capabilities, give them meaningful opportunities to learn, and deliberately build the bench before the talent is urgently needed.

ABOUT ANIL SAXENA

Anil Saxena works in workforce development and platform-driven learning at ServiceNow, including work with ServiceNow University. His background spans engineering, organizational design, enablement, and the development of technical teams. His work focuses on how organizations build skills, develop people, and create learning systems that can scale as technology and workforce requirements change.

ZERO TRUST READINESS ASSESSMENT

Responsible for ICAM, Zero Trust, or identity security within a federal agency, prime contractor, or large regulated enterprise?

If you are trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment:

https://zephon.tech/zt

Questions or guest suggestions?

defend@zephon.tech

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

Moving security left was supposed to reduce risk. Instead, many organizations have made developers responsible for hundreds of controls they cannot realistically understand, manage, or consistently enforce.

In this episode of Musings from the Cyber Trench, I sit down with Rick Clark, a cloud, open-source, Linux, and platform engineering leader with three decades of experience, to discuss whether cybersecurity has shifted too far left.

We examine how organizations can build security controls directly into their platforms, reduce control sprawl, respond faster to vulnerabilities, and measure software delivery based on business and security outcomes, not deployment speed alone.

Rick shares practical insights on:

• Embedding security controls into CI/CD platforms so they are applied automatically
• Keeping control ownership with information security while reducing the burden on developers
• Restoring architectural oversight without unnecessarily slowing delivery
• Reviewing legacy controls instead of carrying them unchanged from on-premises environments into the cloud
• Using AI to enforce security controls rather than simply producing code faster
• Measuring software delivery against business value, compliance, and risk
• Recovering from zero-day vulnerabilities through standardized containers and centralized platform control
• Using mutual TLS and end-to-end identity tracking to secure platform communications
• Protecting sensitive data, private keys, and certificates from immature AI agents

The central takeaway is straightforward: developers should write secure code, but they cannot carry the organization’s entire cybersecurity, operations, compliance, and cost-management burden. Security teams must define the controls, and platform teams must make those controls consistent, automatic, and easier to use.

ABOUT RICK CLARK

Rick Clark has 30 years of experience across cloud computing, open source, Linux, platform engineering, and security. He led the development of Ubuntu Server, led engineering for the Rackspace Cloud and helped found OpenStack, worked in the CTO’s office at Cisco Systems, and helped build the Reliance Jio cloud infrastructure in India.

ZERO TRUST READINESS ASSESSMENT

Responsible for ICAM, Zero Trust, or identity security within a federal agency, prime contractor, or large regulated enterprise?

If you are trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment:

https://zephon.tech/zt

Questions or guest suggestions?

defend@zephon.tech

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

You cannot secure AI by filtering prompts alone. If an AI agent can retrieve sensitive data or execute actions, prompt injection becomes an identity, authorization, and architecture problem.

In this episode of Musings from the Cyber Trench, I sit down with Sundar Krishnamurthy, Senior Security Architect at Expedia Group, to discuss how organizations can secure AI in real enterprise environments.

We examine why prompt-level guardrails are not enough, how non-human identities should remain connected to the people they represent, and why security controls must be enforced close to the data and action being requested.

Sundar shares practical insights on:

• Turning security assumptions into automated tests
• Using LLMs to support code reviews and threat modeling
• How indirect prompts can bypass basic guardrails
• Enforcing authorization at the point of data retrieval
• Maintaining human and non-human identity context
• Isolating vector stores to reduce cross-tenant exposure
• Avoiding security shortcuts during MVP development
• Protecting private data when using AI models

The central message is simple: AI security cannot depend on trusting the model or recognizing every malicious prompt. Identity, authorization, data isolation, logging, and defense in depth must be built into the underlying architecture.

ABOUT SUNDAR KRISHNAMURTHY

Sundar Krishnamurthy is a Senior Security Architect at Expedia Group. He conducts architecture reviews across applications, cloud, networks, infrastructure, and AI and machine learning security. His background includes work with AWS, SAP Concur, and Microsoft.

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

Too many organizations still treat compliance as a one-time audit exercise: get the certification, satisfy the customer, and move on.

In this episode of Musings from the Cyber Trench, I sit down with Sarah Lynn, a seasoned IT, cybersecurity, GRC, advisory, and audit preparation leader, to discuss why that mindset breaks down fast.

We talk about what happens when compliance is treated as “paperwork,” where programs usually fail first, and why people, process, and technology all have to work together for compliance to become part of daily operations.

Sarah also shares practical insights on:

• Why undocumented processes are a major red flag
• How leaders can move from checklist compliance to security maturity
• Where organizations underinvest and overspend in compliance programs
• Why buying a tool before understanding the process usually backfires
• AI’s role in compliance, automation, meeting notes, artifact collection, and risk
• Why CMMC, SOC 2, ISO, FedRAMP, and other frameworks require continuous effort
• How trusted advisors and peer groups can help leaders avoid reinventing the wheel

The core message: compliance is not something you “get through.” Done right, it becomes a habit, a management discipline, and a foundation for stronger security.

Guest: Sarah Lynn brings 25+ years across IT, cybersecurity, GRC, audit readiness, risk, continuity, and technology operations, helping SaaS/IaaS-driven organizations turn compliance into practical, business-aligned security.

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

Energy is the upstream of everything

In this episode we explore how energy infrastructure has become one of the most critical and vulnerable systems in the modern world

From power grid attacks to systemic risks this conversation reveals why cyber threats to energy impact entire nations

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

This episode explores the leadership and design challenges behind modern cybersecurity failures.

Morgan Reed, CTO of Transbridge, shares how traditional approaches to security focused on controls, compliance, and restriction often ignore the most critical variable: human behavior.

The discussion reframes cybersecurity as a design and leadership problem, where usability, context, and adaptability determine effectiveness.

You’ll learn: - Why leadership decisions shape security outcomes - How excessive controls create friction and risk - The gap between security policy and real world behavior - Why human centered design is critical in cybersecurity - How AI can support adaptive, context aware systems - What leaders must change to build resilient security environments

This episode is ideal for executives, CISOs, and technology leaders focused on improving security, reducing risk, and building systems that actually work in practice.

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

In this episode of Musings From the Cyber Trench, Vishal Masih speaks with cybersecurity expert Edwin Covert about the evolution of cyber risk management.

Edwin explains why traditional qualitative risk models fail to support business decision making and how organizations can adopt risk quantification to measure probability and financial impact.

The conversation explores how cybersecurity teams can better communicate with business leaders, align with enterprise risk management, and make more effective decisions based on data.

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech

Send us Fan Mail

Cybersecurity expert Robert Siciliano joins Vishal Masih on Musings from the Cyber Trench to discuss why cybersecurity is ultimately a human behavior challenge.

Robert explains why traditional compliance training often fails, how cybercriminals exploit human trust, and why organizations must focus on building a human firewall rather than relying solely on technology.

Robert Siciliano is a private investigator, Certified Speaking Professional (CSP), CEO of Protect Now, LLC, and creator of The Strategic Human Firewall™. He is widely recognized as one of the leading experts on cybercrime and identity theft, with more than 500 television appearances, 1,000 radio contributions, and 3,000+ media features.

The conversation explores how companies can build stronger cybersecurity cultures by helping employees understand that protecting company data also protects their own identity and security.

Responsible for ICAM, Zero Trust, or identity security in a federal agency, prime, or large regulated enterprise?

If you’re trying to move from strategy to execution, start with Zephon’s Zero Trust Readiness Assessment: zephon.tech/zt

Questions or guest ideas? Email defend@zephon.tech