Free Daily Podcast Summary
GRC Uncensored: Daily Summaries Delivered
by Chaos
GRC Uncensored is an experimental podcast designed to elevate real conversations with GRC professionals, auditors, regulators, and those building programs around it. Your hosts are Troy Fine and Elliot Volkman.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 1 weeks ago48 min
And then there was that little PHP vulnerability
It's been a rough week for cybersecurity, and the crew is back to unpack the PHP vulnerability crisis, the controversy surrounding Chainguard's early disclosure, and why responsible disclosure is becoming increasingly complicated.Elliot, Troy, and Kendra dig into how AI is accelerating vulnerability discovery, why traditional patching strategies aren't keeping up, and whether defenders need to fundamentally rethink vulnerability management.Plus, the conversation somehow takes a detour through OnlyFans (thanks Kendra), cybersecurity marriage advice, and the questionable business potential of reading SOC 2 reports online.In this episode:The PHP vulnerability crisis and Chainguard's disclosure controversyResponsible disclosure versus protecting customersAI's impact on zero-days and vulnerability managementWhy risk-based prioritization matters more than everWhether AI agents can help defenders keep pace with attackers Hosted on Acast. See acast.com/privacy for more information.
- Jul 22, 202624 min
The Pentagon just slammed the brakes on CMMC Phase II
Phase II was supposed to begin November 10, 2026 and would have required many contractors handling CUI to obtain third-party CMMC assessments before contract award. Instead, DoD suspended the rollout, paused future implementation milestones, and launched a 60-day review. For now, Phase I self-assessments remain in force. The response window closes mid August. Hosted on Acast. See acast.com/privacy for more information.
- Dec 31, 202547 min
AMA: GRC, SOC 2, and the State of Audits
It’s the last day of 2025, which means it’s time to wrap season one. When Troy and I piloted this series, we didn’t expect thousands of you to tune in, and certainly didn’t expect to pickup the wonderfully smart Kendra to join our crew.With that, we want to thank you for encouraging us to keep this series going. We’ll be back for season 2 soon, and are taking in new pitches for episodes now. To wrap the year, we conducted a AMA on the current state of GRC. We pulled questions from Reddit and LinkedIn and tackled them live in conversation.What we coveredAre we “anti–GRC automation tools”?Short answer: no. Long answer: automation isn’t the problem. It’s misuse, blind trust, and compromised audit integrity are.Cheap SOC 2s and bundled auditsWhy budget startups often don’t have a real incentive to avoid low-cost, bundled auditors, and what you give up when you go that route.SOC 2 pentesting vs PCI DSSWhy SOC 2 allows weak or missing pentests, why PCI doesn’t, and how automated scans differ from real manual testing.Conflicts of interest in the GRC ecosystemPlatforms, auditors, and vCISOs all partner, so where does objectivity break down, and is it even possible to keep it clean?Who’s really at fault: tools or auditors?A blunt discussion on incentives, accountability, and why low-quality audits keep winning.Offshoring and the race to the bottomWhen cost-cutting leads to offshoring, what should clients actually be worried about and what’s just noise.The future of audits and AIWill AI replace auditors? Where automation helps, where humans still matter, and what happens if we stop caring about independent assurance altogether. Hosted on Acast. See acast.com/privacy for more information.
- Nov 20, 202544 min
Do Ethical GRC auditors really exist?
In this episode, the crew digs into a messy but necessary topic: what does ethical auditing even mean in a market overrun with automation shortcuts, low-effort SOC 2 audits, and firms that self-declare “quality” without proving it?With Troy actively auditing today and Kendra working with auditors in real time, the team breaks down where rigor actually shows up, where the system is broken, and why SOC 2’s value is slipping as fast as demand for speed is rising.03:00 – “Quality theater” and firms self-labeling as high quality04:10 – Who defines quality—auditors or customers?05:00 – The four-hour SOC 2 audit example06:00 – The danger of “better than the worst” logic07:00 – What thorough auditing actually looks like (Kendra’s experience)09:30 – SOC 2 inconsistency across auditors and firms11:00 – Should audit firms be objectively measured?15:00 – Kendra’s “secret shopper auditor” idea19:20 – Automation platforms producing shallow “green checkmark” results22:00 – Drive-by auditors rubber-stamping automated data26:00 – Peer review and “enhanced oversight” gaps33:00 – Why the industry isn’t incentivized to fix the quality problem39:00 – Ethical auditors exist—but the system doesn’t reward them Hosted on Acast. See acast.com/privacy for more information.
- Oct 22, 202546 min
SOC 2, Vibes, and the Audit Arms Race
This episode dives deep into the messy, absurd, and sometimes hilarious world of SOC 2 audits and compliance frameworks. Wiz CISO Expert Zlatko Unger joins the crew to talk about the expanding “acronym soup” of frameworks, the blurred lines between automation and assurance, and why finding an auditor who vibes with your team might matter more than the name on the certificate.The crew also debates the future of SOC 2 — from fast-track “15-hour audits” to the rise of AI-generated reports — and whether the entire model needs a ground-up rebuild.Guest: Zlatko Unger, CISO Expert at WizHosts: Troy Fine, Kendra Cooley, Elliot Volkman00:03 — Framework overload00:07 — Auditor “vibe check”00:11 — SOC 2’s fall from grace00:16 — TPRM and audit fatigue00:25 — SOC 2 for robots00:36 — Reform or rebuild? Hosted on Acast. See acast.com/privacy for more information.
- Oct 9, 202546 min
Clean Reports, Flawed Systems, and the Future of GRC
TJ, Kendra, and Elliot are back, and welcomed Evan Millman, GRC Manager at Abnormal Security, for what started as a casual chat and evolved into a sharp look at compliance blind spots, the role of AI in GRC, and how professionals can shape their careers in a changing field.[00:02:00] Evan shares how he used ChatGPT to analyze a risk assessment report.[00:05:00] What GRC leadership looks like at Abnormal Security (ISO 27001, 27701, 42001, SOC 2).[00:07:00] The complicated relationship between organizations and auditors — bias, incentives, and the reality of “clean” reports.[00:12:00] Why third-party attestations are table stakes, not real assurance.[00:19:00] TJ and Evan debate solutions: peer reviews, government oversight, or is the system fundamentally flawed?[00:27:00] How Abnormal approaches vendor risk: criticality ratings, renewals, and compensating controls.[00:32:00] Tools and automation in GRC — benefits and buyer’s remorse.[00:36:00] The role of AI: evidence review, documentation search, and “trust but verify.”[00:39:00] Should GRC professionals become coders, or double down on soft skills?[00:44:00] Evan’s career advice: networking, persistence, and why soft skills matter more than technical depth. Hosted on Acast. See acast.com/privacy for more information.
- Sep 25, 202543 min
AI Guardrails, Foot Guns, and the Ostrich Problem
This week on GRC Uncensored, hosts Troy Fine and Elliot Volkman sat down with Merritt Baer, Chief Security Officer at Enkrypt AI, for a candid conversation about the collision between AI, governance, and security. Merritt brought decades of CISO experience — from AWS to the intelligence community — and didn’t hold back, fully embracing our podcast name, on what’s hype, what’s real, and what CISOs should be doing today. Key Moments[00:03:00] – How Merritt uses ChatGPT to re-voice her own drafts — and why she immediately strips out the “saccharine” endings.[00:05:30] – Why security and innovation don’t need to “hold hands” — they just need shared expectations.[00:08:45] – The “foot guns” moment: how an accounting firm’s chatbot started teaching customers to hide assets from the IRS.[00:13:30] – Why most enterprises don’t even know where AI is being used internally.[00:15:00] – How to build guardrails that are realistic, enforceable, and tuned over time.[00:24:30] – Why “ostrich” policies will fail — and how enforcement actions, not regulations, will shape AI accountability.[00:40:00] – Merritt’s closing advice for CISOs: you don’t need to be an expert, but you do need a plan. Hosted on Acast. See acast.com/privacy for more information.
- Aug 28, 202548 min
The Softer (and Sometimes Spicier) Side of GRC
In the latest episode of GRC Uncensored, hosts Kendra Cooley and Troy Fine sat down with Jake Bernardes, CISO of Anecdotes and host of Risking It All, to talk about the positive side of GRC. What unfolded was less about sugar-coating and more about the tensions shaping our industry from AI disruption to the shaky future of SOC 2 reports. More specifically, is there a world where we see a consolidation of regulations and frameworks in response to the sprawl we see now?[00:02:00] AI and Auditing – Will automation replace auditors or make them indispensable?[00:06:00] The Positive Side of GRC – How automation is reshaping the auditor’s role.[00:15:00] Are Compliance Platforms Lowering the Bar? – Check-the-box programs vs. meaningful assurance.[00:23:00] The SOC 2 Debate – Is it still valuable, or creating a false sense of security?[00:30:00] Toward Continuous Assurance – Dynamic trust centers and evidence as the new currency.[00:40:00] The Future of Risk in GRC – Why risk registers must evolve and become data-driven.[00:46:00] Closing Thoughts – Optimism about where GRC is headed despite today’s challenges. Hosted on Acast. See acast.com/privacy for more information.
Get GRC Uncensored summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
The Grimerica Show
Casual conversations with fringe thinkers on spirituality, alternative history, and UFOs.
Cleared Hot - Powered By BRCC
A former military pilot shares stories of adventure, fitness, and leadership to explore resilience and personal growth.
Acquisition Talk
Discusses the management, technology, and political-economy of weapon systems acquisition.
Cyberside Chats: Cybersecurity Insights from the Experts
Cybersecurity experts discuss emerging threats, AI-driven attacks, and defense strategies for professionals and executives.
The Crucible - The JRTC Experience Podcast
A podcast focused on modern warfighting and the leadership skills required for Army units to succeed in complex combat environments.
Outloud with Gianno Caldwell
A conservative political commentator explores news and culture by challenging prevailing orthodoxies and advocating for free expression.
Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure
Expert discussions on cybersecurity, national security, and threats to critical infrastructure like energy and water systems.
"The Cognitive Revolution"
Explores the transformative impact of artificial intelligence through interviews with innovators shaping its future.
CISSP Cyber Training Podcast - CISSP Training Program
A weekly podcast delivering practical CISSP exam preparation and cybersecurity strategies from an experienced industry professional.
Regulation Podcast
A group of friends explore absurd humor through podcasts, video game playthroughs, and improvised comedy.
The Just Security Podcast
Expert analysis of national security, foreign policy, and rights from practitioners, academics, and affected individuals.
Macroaggressions
A podcast exploring conspiracy theories about global power structures with humor and guest interviews.
About GRC Uncensored
GRC Uncensored is an experimental podcast designed to elevate real conversations with GRC professionals, auditors, regulators, and those building programs around it. Your hosts are Troy Fine and Elliot Volkman.
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from GRC Uncensored in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's GRC Uncensored daily summary?
It's a free AI-powered email that summarizes new episodes of GRC Uncensored as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the GRC Uncensored podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official GRC Uncensored product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Chaos.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does GRC Uncensored release new episodes?
GRC Uncensored publishes biweekly. Our AI generates a summary within hours of each new episode.
What topics does GRC Uncensored cover?
GRC Uncensored covers topics including News, Business, Management. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting GRC Uncensored summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.