Free Daily Podcast Summary
Razorwire Cyber Security & InfoSec Insights: Daily Summaries Delivered
by Razorthorn Security
Cybersecurity is evolving — and so should you. Razorwire brings the open conversations that give you the edge.Welcome to the Razorwire podcast — your resource for practical advice, expert insights, and real-world conversations on cybersecurity, information security (InfoSec), risk management, governance, security leadership, human factors, and industry trends.Our mission is to help you build a stronger cybersecurity career while supporting a dynamic, agile community of professionals committed to continuous improvement.Each episode brings you actionable advice and real experiences from your host, James Rees — an information security specialist with over 25 years of experience — and from a range of respected guests across the cybersecurity industry. Together, we explore everything from technical strategies and compliance challenges to security culture, communication skills, and leadership development.James Rees is the founder of Razorthorn Security, providing expert consultancy and t
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 1 weeks ago45 min
Rethinking the Endpoint – IGEL Spotlight on Technology
If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do?Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode I'm joined by James Millington, Healthcare Field CTO for EMEA at IGEL, with more than 25 years' experience across virtual desktops, endpoint security and healthcare technology.The way we use endpoints has changed repeatedly. Computing moved from centralised mainframes to PCs, back towards virtual desktops and then into SaaS and cloud services. Hybrid working accelerated that shift again, while rising hardware costs, Windows upgrades and increasingly distributed workforces are forcing organisations to reconsider what they actually need sitting on a user's device.Jim and James look at why the endpoint may be due another rethink. They discuss the security and cost implications of maintaining traditional operating systems, how immutable endpoints change the approach to endpoint protection and what happens as AI creates another generation of applications and risks for security teams to control.Three key talking points:Do we still need Windows at the endpoint? As applications move into SaaS, VDI and the cloud, the role of the endpoint is changing. We look at whether organisations still need a full traditional operating system on every device and what alternatives become possible when workloads run somewhere else.Moving from detection to prevention Endpoint security has traditionally relied heavily on detecting problems and responding to them. Discover how reducing what can run or change on an endpoint alters that model and removes attack surfaces before they need to be monitored.The endpoint problem AI could make worse Shadow AI gives employees another way to introduce software and move information beyond organisational controls. We discuss how controlling what can execute locally could become increasingly important as AI workloads start moving from centralised services onto endpoints.If you're reviewing your endpoint strategy, facing another expensive hardware refresh or considering how AI changes what employees should be allowed to run locally, this conversation is for you.On rethinking the endpoint:“Really, what are my users accessing and where are they accessing it? And is it time to rethink that endpoint?”James MillingtonListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:The Cycle of Centralised Computing From mainframes and PCs to VDI, SaaS and cloud services, computing keeps moving between the endpoint and the data centre. Explore why that cycle matters to today's endpoint strategy.Why VDI Never Really Went Away VDI has moved in and out of fashion for decades. Find out why healthcare remained a strong use case and how remote and hybrid working changed the conversation again.Rethinking the Windows Endpoint If applications and data increasingly live elsewhere, does every employee still need a conventional Windows environment? We discuss what organisations should consider.The Cost of Hardware Refreshes Rising hardware costs and Windows upgrade requirements are putting endpoint budgets under pressure. Discover why extending device life is becoming more attractive.Security by Design Explore how an immutable operating system changes endpoint security by restricting what can be altered or installed rather than relying solely on detecting problems afterwards.Protecting Data in Distributed Healthcare Healthcare is moving closer to patients, creating more distributed endpoints. We discuss why keeping sensitive information off those devices can reduce the consequences of loss or theft.Moving Beyond BYOD Some organisations are reconsidering bring your own device programmes. Find out why greater control and standardisation are coming back into the conversation.Controlling Shadow AI As employees experiment with AI applications, organisations need to decide what can run locally. We explore how endpoint controls can limit unauthorised workloads.AI Comes Back to the Endpoint AI started heavily centralised bu
- 3 weeks ago49 min
Cybersecurity Events Have a Problem
Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat?Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions.Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value.We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again.Three key talking points:When a conference stops being worth itA ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors.Why smaller events feel differentCommunity and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate.People don't go to events to be sold toExpensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.If you're choosing which cybersecurity events deserve a place in your calendar, or organising one and wondering what will actually make people turn up, this conversation is for you.On why smaller events work:" You actually make it small and targeted and tailored. And that's how you engage."James BoreListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:How Cybersecurity Events Have ChangedExplore how major industry events have moved from places to discover technology and meet the community towards a much more commercial model.Is InfoSec Europe Still Worth Attending?A new £50 ticket charge sparks a wider discussion about what attendees actually get from one of cybersecurity's biggest events.The Rise of Community EventsDiscover why BSides and other smaller events are becoming the preferred choice for security professionals looking for different conversations and ideas.Too Many Cybersecurity EventsThe calendar is packed with conferences, dinners and roundtables. We discuss why more choice is making people increasingly selective about where they spend their time.Escaping the Vendor PitchLearn why exhibition floors dominated by sales conversations can struggle to engage the CISOs and security professionals vendors most want to meet.Why Relationships MatterPeople still buy from people. We explore why informal conversations and genuine relationships can offer more value than another product demonstration.What Makes a Good Conference SpeakerInteresting events need people with something meaningful to contribute. Find out why practitioners, specialists and different perspectives matter.Having a Reason to AttendGoing to an event simply because it is there is not enough. We discuss why attendees need a clear idea of what they want from their day.Can Big Conferences Be Fixed?Bigger does not necessarily mean better. Explore whether sma
- Aug 12, 202636 min
A New Voice in InfoSec. What Nobody Tells You About Breaking Into the Industry
What does it actually look like to break into InfoSec from the outside, with no technical background, no industry contacts and no idea what half the acronyms mean?Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this interview episode, I'm joined by Irina Sordiya, a GRC and compliance professional based in Montreal who came into information security from a finance background.Not everyone who works in information security started out in IT. Irina's route in began at a career fair where she stumbled into a fintech startup looking for someone who could translate financial regulation into language a dev team could understand. From there she moved into auditing at KPMG and eventually crossed to the other side, leading security posture and compliance in-house.This is a conversation for anyone considering a career in InfoSec or in the early stages of one. Irina talks openly about feeling like an outsider, not understanding the acronyms and slowly realising that GRC isn't about technical knowledge, it's about understanding risk, building trust and communicating with people. She and Jim also get into the growing problem of grifters in GRC, where Canadian regulation is heading and why the InfoSec community is one of the most welcoming places to build a career.Three key talking points:You don't need a technical backgroundIrina came from a finance degree with no IT experience and a job interview where she was asked if she knew what an auditor does. She got the job. This episode is proof that soft skills, empathy and a risk mindset can take you further than most people expect.G is for grifter in GRCAs regulatory pressure has increased, so has the number of people selling shortcuts. Overpriced courses, AI-generated templates, agents claiming to replace the CISO. Irina and Jim discuss why this preys on people trying to break in and why there's no substitute for doing the work.The risk mindset as a North StarThe best advice Irina received early on was to develop a risk mindset. It's what helps you step back from hundred-page policies and ask what you're actually trying to protect, and why it matters more than technical knowledge for anyone in GRC.If you're thinking about getting into InfoSec or wondering whether you belong, this conversation is for you.On what she'd tell herself on day one:"I would have told myself not to be scared going into this and that there will be always helpers along the way who care about what they do and put ego on the side."Irina SordiyaListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:From Finance to InfoSecIrina's journey started at a career fair with no IT knowledge. Find out how a finance background opened the door to a career in information security.Auditor to In-HouseAs an auditor, an exception means "see you next year." In-house, it means "see you next week." We discuss what changes when you cross to the other side.Building Trust as a GRC ProfessionalDiscover why empathy and relationship building matter more than policy enforcement.AI Governance Is Still Anyone's GuessNo country has got AI governance right yet. We discuss why most organisations are working it out as they go, why ISO 42001 is becoming a starting point and what that means for anyone working in GRC.AI as a Tool for InfoSec ProfessionalsWe discuss where AI can genuinely help with the grunt work of GRC without replacing the thinking that makes the role valuable.G Is for Grifter in GRCWith overpriced courses, AI-generated templates and agents claiming to replace the CISO, we get into why the noise is making it harder for genuine newcomers.The Risk MindsetThe best advice Irina received: develop a risk mindset. We discuss why it matters more than technical knowledge.Why the InfoSec Community Is Worth JoiningIrina's experience has been overwhelmingly positive. We talk about why InfoSec professionals tend to share and support rather than gatekeep.The Future of Entry-Level RolesIf AI takes over the grunt work that junior
- Jul 29, 202655 min
Why Social Engineering Still Works & Why AI Is Making It Worse
Social engineering has been around since humans started talking to each other. The psychology hasn't changed, but AI has made the execution almost unrecognisable.Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Bec McKeown, a chartered psychologist specialising in human performance under pressure.Social engineering isn't a technology problem, it's a human one that cybersecurity has inherited. The psychology behind it hasn't changed since Cleopatra was using it to outmanoeuvre empires, but AI has transformed the speed, scale and sophistication of every stage, from automated reconnaissance that builds a complete profile in 30 minutes to real-time voice cloning that references your actual projects and travel schedule.Bec and Richard bring two very different perspectives to the same problem. Bec explains how attackers engineer the conditions in which people make decisions rather than just crafting a convincing message, and why "people are the weakest link" misses the point. Richard shares what he's seeing as a practising CISO, from family members being targeted through gaming platforms to why measuring phishing click rates gives organisations a dangerous false sense of security.Three key talking points:They're not hacking people, they're shaping decisions: Social engineering works because attackers engineer the conditions under which decisions get made, not because people are careless. Bec explains why most security awareness training is solving the wrong problem by focusing on the message rather than the environment in which people are operating.AI has turned social engineering into an automated pipeline: What used to take weeks of manual reconnaissance now takes 30 minutes. AI-powered OSINT can build a complete profile of a target and generate a tailored attack that references their projects, travel and communication style. Combined with real-time voice cloning, these layered attacks are becoming almost impossible to distinguish from a legitimate request.Your family is now part of the attack surface: If the executive is too well protected, attackers go to the people around them. Children on gaming platforms are being cultivated to unknowingly share information about their parents' work and routines, and a compromised family device on a shared home network becomes a route into the corporate environment.The psychology behind social engineering hasn't changed in thousands of years, but the tools to exploit it have. If your defences are still built around phishing simulations and click rate metrics, this episode will make you rethink.On why social engineering isn't about fooling people:"They're not hacking people, they're shaping the conditions in which people make decisions."Bec McKeownListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:The History of Social Engineering From Cleopatra to Cold War intelligence operations, social engineering has worked for as long as humans have communicated. We discuss why the psychology behind it hasn't moved an inch.Influence vs Manipulation Bec explains the difference between making someone do something they don't want to do and making them want to do it, and why that distinction matters for how we build defences.AI-Powered Reconnaissance Find out how AI has turned open source intelligence into a fully automated pipeline that can build tailored attack scenarios from public data in under 30 minutes.Deepfake Voice and Video Attacks We get into why real-time voice cloning combined with genuine project data and manufactured urgency makes modern social engineering attacks almost impossible to spot.Layered Context Attacks Discover why the most dangerous attacks don't rely on a single trick but layer urgency, authority, familiarity and isolation together until there's no reason to doubt what you're seeing.Family as an Attack Surface Children on gaming platforms are being cultivated to share information about their parents' work and routines. We discuss why the family network is now a recognised route into executive environments.Gut
- Jul 15, 202650 min
Who Gets to Control AI? The Governance Crisis Nobody's Solving
The EU just pushed back its AI Act enforcement by 16 months. The US is deregulating. China is governing through infrastructure. And the UK is doing nothing and hoping for the best.Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Jonathan Care, Head of the AI Practice at KuppingerCole.We're not in an AI revolution. We're in an AI accountability crisis with the most incredible marketing budget the technology industry has ever seen. That's how Richard Cassidy frames it, and it sets the tone for a conversation that goes well beyond the usual AI hype into the governance, sovereignty and regulation questions that nobody has convincingly answered.The US, EU, China and the UK have each taken fundamentally different approaches to AI governance and they're diverging, not converging. Meanwhile, the companies building the most powerful models are increasingly the ones defining how they should be used, because governments simply can't keep pace. The conversation also gets into why AI's ability to solve complex mathematical problems is starting to worry the people responsible for the cryptography that underpins modern banking, payments and secure communications.Three key talking points:Four governance models, zero compatibilityThe US over-innovates, the EU over-regulates, China governs through infrastructure and the UK has principles without law. None of these models is compatible with the others, and the largest organisations in the world operate at the intersection of all of them.When companies define the rules because governments can'tAnthropic publicly refused to provide certain capabilities over concerns about surveillance and military use. That exposed the governance vacuum that exists when legislation can't keep pace with innovation. The companies building the most powerful models are now the ones deciding how they should be used.Cryptography is on borrowed timeAI is solving mathematical problems that have never been solved before. The cryptography that underpins banking, payments and the digital economy is based on the assumption that certain problems are too hard to solve. If AI and quantum computing change that assumption, those foundations look fragile.This isn't about what AI can do. It's about who gets to decide what it should do.On what's really driving the AI narrative:"We're not in an AI revolution, we're in an AI accountability crisis that appears to have the most incredible marketing budgets we've ever seen in the history of investment in companies."Richard CassidyListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:The EU AI Act and Why It's Already BehindThe deadline got pushed back 16 months. We discuss what that tells us about the gap between regulatory intent and enforcement.US Deregulation and Innovation at SpeedThe US is betting that innovation matters more than regulation. We get into what that means for everyone else.China's Infrastructure-First ApproachChina isn't writing big laws. It's governing through 50-plus technical standards and sector-specific measures. We discuss why that model is fundamentally different.The UK's Principles Without LawFive non-statutory principles, enforcement delegated to existing regulators. We explore why that creates the lowest compliance burden but the highest uncertainty.AI SovereigntyEveryone says they want it. Almost nobody can explain what it means. We get into why the conversation matters.When the Model Builders Make the RulesAnthropic drew a public line on what it would and wouldn't provide. We discuss what happens when companies, not governments, define how AI is used.AI and the Threat to CryptographyAI is solving problems that have never been solved before. Find out why that has implications for the mathematics that underpins modern encryption.Post-Quantum CryptographyDiscover why the convergence of AI and quantum computing could undermine the foundations the entire digital economy is built on.<
- Jul 1, 202651 min
From ISDN to AI - Two Veterans on How Defence in Depth Has Changed
Defence in depth has evolved every time the technology landscape has shifted. The internet, virtualisation, cloud, SaaS. AI is the next shift, and the old model isn't keeping up.Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined once again by Martin Voelk, co-founder of SpartanX and an ethical hacker with nearly 26 years in cybersecurity.Every major technology shift has forced security teams to rethink how they protect their organisations. The internet moved data outside the building. Virtualisation and cloud meant infrastructure was no longer yours to control. Each time, defence in depth had to evolve. AI is the latest shift, and it may be the one that breaks the model entirely.We trace the journey from on-prem data centres and ISDN routers through to a world where AI agents act autonomously, supply chains are built on unverified code and the offensive side of AI is outpacing the defensive side at a rate security teams can't match. They get into why every AI agent needs its own identity, why shadow AI is a problem most organisations haven't begun to address and why the only realistic answer to AI-powered attacks is AI-powered defence.Three key talking points:Defence in depth has always evolved, but this time it's different:Every previous technology shift gave security teams time to catch up. AI isn't offering that. The pace of change is faster than most organisations can respond to, and the defensive tooling hasn't kept pace with what the offensive side can already do.AI agents need to be treated like people:Every AI agent needs its own identity, authentication and authorisation policies. Without that, a compromised agent can act under a human user's name with no way to tell the difference. The legal and forensic implications are enormous and largely unsolved.The offensive side is winning:AI is finding vulnerabilities faster than teams can fix them. Alert volumes are overwhelming SOCs, attackers are using AI-generated noise to mask real attacks and human in the loop is becoming unworkable at scale. The only realistic counter is defensive AI, but it isn't mature yet.Defence in depth has survived every technology shift so far. AI is testing it in ways we haven't seen before. If you're responsible for securing an organisation that's adopting AI, this is the conversation to listen to.On why security teams are always one step behind:"We don't have the ability to figure out what's going on until it's already happened. We don't have that technology yet."James ReesListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:The Evolution of Defence in DepthFrom ISDN and on-prem data centres to cloud and SaaS, we trace how defence in depth has evolved with every major technology shift.Why AI Is DifferentPrevious shifts gave security teams time to adapt. We discuss why AI isn't offering that luxury.Supply Chain Risk and Unverified CodeOpen source code from GitHub, AI skills downloaded from the web, integrations nobody has reviewed. Discover why the modern supply chain is built on foundations most organisations haven't verified.Third Party Risk Management Is BrokenAI fills in vendor questionnaires and AI reviews the answers. We get into why the current TPRM process is fundamentally flawed.Shadow AILearn why unapproved AI usage is one of the hardest risks to detect and why most organisations have no way of monitoring it.Continuous AuthenticationSingle sign-on isn't enough anymore. We discuss why continuous authentication is becoming essential in environments where AI agents operate alongside human users.AI Agent Identity and AccountabilityFind out why every AI agent needs its own identity and access controls, and what happens when a compromised agent acts under a human user's name.Alert Fatigue as an Attack VectorFlooding a SOC with noise to mask a real attack isn't new, but AI makes it possible at a scale that's almost impossible to manage.Prompt Injection via Log FilesFind out how a prompt injection hidden in a standa
- Jun 17, 202650 min
Daybreak and the Battle for AI Security: The Arms Race Accelerates
AI used to be something security vendors built into their own products. Now OpenAI is going direct, positioning itself as the layer that security runs on. What does that mean for the rest of the industry?Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined again by Jon Care, Head of the AI Practice at KuppingerCole, to unpack OpenAI's launch of Daybreak.OpenAI launched Daybreak on 11 May 2026. It's not a security product, it's a platform play designed to embed AI-driven security directly into the development lifecycle, with a three-tier access model and a partner programme that includes Cisco, CrowdStrike, Palo Alto and a dozen other major vendors. This is OpenAI's bid to become the infrastructure that security runs on.But the governance questions are enormous. Who counts as a "verified defender"? Who decides? What happens when someone with access changes jobs or gets laid off? And when the same model families sit on both sides of the equation, how do you govern dual use? Jim and Jonathan argue the industry urgently needs an independent regulatory body to oversee access to these capabilities. The conversation also gets into China's response to Western chip restrictions and why the idea that any one country can control AI capability is already looking outdated.Three key talking points:Daybreak isn't a product, it's a platform land grab: OpenAI isn't selling to security vendors the way AI has traditionally been integrated into the market. It's going direct to CISOs and development teams, bypassing the existing vendor layer entirely. This episode gets into what that means for the security market and why the major vendor partnerships may not be enough to mask the disruption.The governance gap nobody has answered: Daybreak gates access based on "verified defender" status, but there's no public specification of what that means, no independent auditing and no appeals process. This episode raises the uncomfortable questions about who qualifies, what happens when access follows a person rather than an organisation and what model could end up benefitting the industry the most.You can't contain capability: China's response to Western chip restrictions has been to develop its own hardware at pace, certifying nine domestically designed AI processors for state procurement. The assumption that any single country can control access to frontier AI capability is already looking outdated and that has serious implications for everything from dual use governance to the future of the AI arms race.Daybreak launched on the same day Google confirmed the first AI-built zero day. If you care about where the security market is heading, this is the conversation to listen to.On who controls access to AI security capability:“OpenAI sets the criteria, OpenAI approves or denies and OpenAI monitors usage. For those of you who noticed, I said OpenAI three times in that past sentence. That was deliberate.”Jon CareListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:What Daybreak Actually Is Find out what OpenAI's Daybreak initiative involves and why it's being positioned as infrastructure rather than a product.A Platform Land Grab Explore why Daybreak is OpenAI's bid to own the security developer toolchain and what that means for the existing vendor ecosystem.Partner Asymmetry Major vendors get early and deeper access. We discuss what that means for everyone else.Who Counts as a "Verified Defender"? There's no public specification, no independent auditing and no appeals process. We get into why that's a problem.Dual Use Governance The same models are being used for offence and defence. Discover why that raises questions nobody has answered yet.Credential Portability What happens when someone with access to the most permissive tier gets laid off or changes jobs?The Case for Independent Regulation We discuss why the industry needs an equivalent of PCI DSS for AI security access, independent of any single government or vendor.AI vs AI Daybreak launched the same day Google confirmed the first AI-built ze
- Jun 3, 202650 min
Third Party Risk in the Age of AI. A Spotlight on Black Kite
Your vendors are adopting AI faster than you can assess them. What does that mean for your third party risk? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode, I'm joined by Jeffrey Wheatman, Senior Vice President and Cyber Risk Strategist at Black Kite. Jeffrey previously spent over a decade as an analyst VP at Gartner where he launched their third party cyber risk management coverage.Third party risk management used to be fairly straightforward. If finance was happy and legal had done their redlining, you signed the contract and moved on. That world is gone. Organisations are now dependent on layers of vendors, suppliers and service providers, and the chain goes deeper than most security teams can see. When a logistics company can go from operational to out of business in five months after a ransomware attack, and one incident at Jaguar Land Rover can measurably affect UK GDP, the question isn't whether third party risk matters. It's whether your programme can keep up.This episode covers how the old model of spreadsheets and questionnaires is giving way to intelligence-led continuous monitoring, why AI has made the problem exponentially harder and how Black Kite is helping organisations cut through the complexity, from mapping supply chain connectivity and scoring ransomware susceptibility to cutting a 500-question vendor questionnaire down to 30.Three key talking points:You can't protect what you can't see: Most organisations know who their biggest vendors are. Beyond that, it gets murky fast. This episode gets into why even mature organisations still struggle to see past the first or second layer of their supply chain, why figuring out which vendors actually matter is harder than it sounds and why Jeffrey always tells people to solve their third party problem before worrying about their fourth.AI just made your third party programme ten times harder: Your vendors are already using AI, whether they've told you or not. The person you're speaking to may not even know, because it could be embedded two or three layers down. Meanwhile the market is flooded with AI solution claims and attackers are using it to move faster than ever. This episode covers the three ways AI is complicating third party risk and why most organisations haven't even begun to get their AI governance right.From questionnaires to continuous intelligence: The old model of sending out hundreds of questions, hoping for honest answers and filing the results is finished. This episode covers how the industry is moving from periodic assessment to continuous monitoring, why real data beats self-reported questionnaires and how platforms like Black Kite are helping organisations focus on the vendors that actually pose a risk.If your third party risk programme is still running on spreadsheets and annual reviews, this episode will make you uncomfortable. And it should.On why most organisations don't know which vendors matter most:“I always badly paraphrase Animal Farm by George Orwell. All your vendors are equal, but some vendors are more equal than others. And most people don't really know how to figure that out.”Jeffrey WheatmanListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:When a Vendor Goes Down, You Go Down With Them We discuss why the conversation has shifted from data protection to operational resilience.The Nth Party Problem Most organisations can't see past the first or second layer of their supply chain. The web of interconnected vendors is far more complex than it looks – we talk about where to start if you haven't solved your third party basics yet.Concentration Risk and Single Points of Failure Heavy reliance on a handful of major cloud providers creates risks that can't easily be mitigated. We explore what you can realistically do about it.Three Ways AI Is Complicating Third Party Risk Discover why AI isn't just changing the threat landscape for your own organisation but fundamentally altering how you need to think about every vendor in your supply chain.Shadow AI in Your Supply Chain Learn why shadow AI in your vendor ecosystem is a growing risk when most organ
About Razorwire Cyber Security & InfoSec Insights
Cybersecurity is evolving — and so should you. Razorwire brings the open conversations that give you the edge.Welcome to the Razorwire podcast — your resource for practical advice, expert insights, and real-world conversations on cybersecurity, information security (InfoSec), risk management, governance, security leadership, human factors, and industry trends.Our mission is to help you build a stronger cybersecurity career while supporting a dynamic, agile community of professionals committed to continuous improvement.Each episode brings you actionable advice and real experiences from your host, James Rees — an information security specialist with over 25 years of experience — and from a range of respected guests across the cybersecurity industry. Together, we explore everything from technical strategies and compliance challenges to security culture, communication skills, and leadership development.James Rees is the founder of Razorthorn Security, providing expert consultancy and t
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Razorwire Cyber Security & InfoSec Insights in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Razorwire Cyber Security & InfoSec Insights daily summary?
It's a free AI-powered email that summarizes new episodes of Razorwire Cyber Security & InfoSec Insights as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Razorwire Cyber Security & InfoSec Insights podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Razorwire Cyber Security & InfoSec Insights product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Razorthorn Security.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts. Upgrade to Pro for 15, or Premium for 50. Browse our full catalog at /podcasts.
How often does Razorwire Cyber Security & InfoSec Insights release new episodes?
Razorwire Cyber Security & InfoSec Insights publishes biweekly. Our AI generates a summary within hours of each new episode.
What topics does Razorwire Cyber Security & InfoSec Insights cover?
Razorwire Cyber Security & InfoSec Insights covers topics including News, Technology, Business, Careers. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Razorwire Cyber Security & InfoSec Insights summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.