Free Daily Podcast Summary
Redefining CyberSecurity: Daily Summaries Delivered
by Sean Martin, ITSPmagazine
Redefining CyberSecurity Podcast Hosted by Sean Martin, CISSP Have you ever thought that we are selling cybersecurity insincerely, buying it indiscriminately, and deploying it ineffectively? For cybersecurity to be genuinely effective, we must make it consumable and usable. We must also bring transparency and honesty to the conversations surrounding the methods, services, and technologies upon which businesses rely. If we are going to protect what matters and bring value to our companies, our communities, and our society, in a secure and safe way, we must begin by operationalizing security. Executives are recognizing the importance of their investments in information security and the value it can have on business growth, brand value, partner trust, and customer loyalty. Together with executives, lines of business owners, and practitioners, we are Redefining CyberSecurity.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 1 weeks ago35 min
Phishing Training Looks the Same Under Three Mindsets | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Verena Zimmermann | Redefining CyberSecurity with Sean Martin
Show notesPhishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.HostSean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/Co-HostJulie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)Guest(s)Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH ZürichResourcesMoreThe Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurityThe Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurityMore Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcastRedefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1YMore about Sean Martin | https://www.seanmartin.com/Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/Advertise on ITSPmagazine | https://www.itspmagazine.com/advertiseITSPmagazine on YouTube | https://www.youtube.com/@itspmagazineStudio C60 | https://www.studioc60.comOn Location schedule | https://www.itspmagazine.com/on-locationAdvertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to exp
- 3 weeks ago32 min
Using AI to Cut GRC Busywork Without Cutting Out the Human | A Redefining CyberSecurity Podcast Conversation with Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline
Guardrails matter as much as the prompt. Princess Okoro tells the agent what it must not do, anchors it to named standards such as ISO and PCI DSS, and instructs it to come back with questions when it is unsure instead of hallucinating. The same thinking shows up in Ask Infosec, an internal custom GPT that answers policy questions for the business, and in a growing map from policy to control to risk that feeds a unified control framework at Trainline.Tooling comes with trade-offs. Trainline is implementing a GRC platform chosen because it handles risk better than the alternatives, and Princess Okoro expects her team's future to blend that platform with AI tools rather than wait for one product to solve everything. She also notes that many GRC platforms lean toward compliance and SOC 2, while the conversation in the UK centers on risk.Next on her list is AI governance. With ISO 42001, the EU AI Act, and the NIST AI framework offering nothing she can lift and shift, Princess Okoro is working out the minimum controls required, because no organization can do everything, and how GRC can serve a business that is pushing hard on AI adoption.For security and risk leaders, the takeaway is plain: GRC earns its seat when it serves the business, and AI helps only after the process underneath it works.HostSean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/Guest(s)Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline | On LinkedIn: https://www.linkedin.com/in/princessdavidokoro/ResourcesTrainline | https://www.thetrainline.com/The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcastRedefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYqAdvertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore all of the programs.Keywordsprincess okoro, trainline, sean martin, grc, ai in grc, ai governance, policy management, ai agents, human in the loop, control mapping, pci dss, iso 42001, risk management, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast About the hostSean Martin, CISSP, is a cybersecurity journalist, marketer and the host of Redefining CyberSecurity. He talks with practitioners, CISOs, researchers and business leaders about how security connects to the way organizations operate, and what that means for risk, revenue and trust. He holds the CISSP, first earned in 2003, and co-founded ITSPmagazine in 2015, where he covers technology, cybersecurity and society.Podcast, Redefining CyberSecurity: https://www.seanmartin.com/redefining-cybersecurity-podcastVideo, Redefining CyberSecurity on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1YNewsletter, The Future of Cybersecurity: https://www.linkedin.com/newsletters/the-future-of-cybersecurity-7108625890296614912/Journalism, ITSPmagazine: https://www.itspmagazine.comFor cybersecurity and technology companies, Studio C60: https://www.studioc60.comLinkedIn: https://www.linkedin.com/in/imsmartin/
- 4 weeks ago35 min
The ESET PROTECT Launch Brings 24/7 Monitoring, AI Security, and a Cyber Warranty to Small and Midsize Businesses | A Brand Story Conversation with Ryan Grant, Country Manager & GM, North America at ESET | Hosted by Sean Martin
Ryan Grant, Country Manager & GM, North America at ESET, joins Sean Martin to discuss the launch of ESET PROTECT, announced September 30, 2026. The platform brings 24/7 monitoring, AI security, and a cyber warranty to small and midsize businesses. Ryan Grant says the design came from feedback from ESET clients and partners, along with a survey of 2,000 SMB customers earlier this year. About 70% of those customers had some sort of antivirus tool, and less than half had tools such as multi-factor authentication, EDR, monitoring, or email security.What does ESET PROTECT include? Ryan Grant describes an out-of-the-box cybersecurity-as-a-service offering built natively into one platform, where those pieces are typically stitched together with different consoles. It combines AI-led security, advanced endpoint protection, EDR, 24/7 AI monitoring with human oversight, Microsoft and Google environment coverage, premium support, and a cyber warranty. It comes in three packages: Core, Premium, and Ultimate.Core includes the latest security protocols with AI, endpoint, server, and mobile protection, and management of Google and Microsoft environments. Ryan Grant describes it as just short of an EDR because it leaves out 24/7 monitoring. Premium adds EDR, 24/7 monitoring from the ESET SOC, the cyber warranty, and premium support. Ultimate adds a dedicated SOC analyst for the business, a human with eyes on glass 24/7 working with an additional team behind the scenes.How does ESET PROTECT reach organizations with 10 seats? Sean Martin raises the divide between the haves and the have-nots, and asks whether a 15-person or 20-person shop can get the same level of protection. Ryan Grant says platforms with this security and services typically serve 500 or 600 seats in most cases, or 250 and above, and ESET took this one down to 10 seats. His reasoning is that SMBs were the biggest vulnerability point because they lack the budgets and the staff.Many organizations cannot find security talent and many cannot afford it, Ryan Grant says, which is why he calls 24/7 monitoring the most critical piece. Partners told him last week that they consistently see breaches in the middle of the night and wake up to notifications about an incident ESET saw, how it was contained, and recommendations for what comes next. Ryan Grant says there is no silver bullet, and ESET aims to right size what each organization needs.Where is the platform running? Ryan Grant says ESET sees it in legal offices, dental offices, regional retailers with offices behind several shops, education, and municipalities. Sean Martin adds that regulation brings overhead that makes it hard to achieve what the regulation is trying to accomplish, and puts it to Ryan Grant that ESET makes meeting the requirement feasible in a fiscally sound way.How does the cyber warranty fit with cyber insurance? Ryan Grant says the warranty wraps around the ESET offering, and ESET's partnership with Cysurance is part of the launch. Sean Martin puts it that the controls he describes bring confidence and proof to the insurers, and Ryan Grant agrees. Cyber insurance takes a significant set of basics, including multi-factor authentication, a remediation plan, training, and EDR, and customers who meet the requirements can also go get a policy.How should organizations approach AI tools and agents? Sean Martin points back to polymorphic viruses a decade or two ago, says he does not believe AI is so novel that organizations do not know what to do, and Ryan Grant agrees. Ryan Grant says to extend the existing cyber practice into AI tools, with governance, access control, a repository of approved tools, and attention to where data sits. He treats an AI tool like another employee with access to the infrastructure, and Sean Martin adds that employees plus things acting like employees add a wild card.Ryan Grant sees the gap in baseline policy for what is allowed, governance of applications and data, and access controls, with shadow AI appearing when employees download the tools they need. He points to the ESET Research GuardBreaker article, where a malicious file carried a nuclear weapon prompt as a decoy for the AI. His response is multilayer defense, 24/7 monitoring, and human oversight.For agents, ESET offers a free AI Skills Checker that sandboxes an agent and watches its behavior. Ryan Grant says about 900,000 scans over roughly t
- Sep 15, 202627 min
When Everyone Can Build Their Own Tools, What Holds Security Together? | A Redefining CyberSecurity Podcast Conversation with John Linford, Security Portfolio Director of The Open Group
⬥EPISODE NOTES⬥Something structural is shifting in how security work gets done. When anyone on a team can stand up a working tool in an afternoon, the constraint stops being capability and starts being coherence. John Linford, Security Portfolio Director at The Open Group, spends his time on exactly that problem, running the Security Forum, the Open Trusted Technology Forum, and the Assured Dependability Work Group, where practitioners from organizations of wildly different sizes argue their way toward standards that are supposed to survive contact with reality.His framing of the tool question is blunt and worth stealing. When a team says it can build the thing, the first response is to ask what decision the thing informs. A dashboard showing numbers nobody was looking at before is not a security improvement, it is a new source of numbers. Standards, in this reading, are not compliance artifacts to be shown to an auditor. They are the thing that tells an organization which part of the problem a tool is supposed to solve, and how it fits alongside everything else already in place. The corollary matters just as much: when the tools themselves conform to a standard, vendors compete on the value they actually deliver rather than on the cost of switching away from them.Linford takes the same argument up a level to architecture. Security architecture only works when it sits inside a broader enterprise and IT architecture rather than beside it, and that requires a CISO with genuine authority and a seat at the executive table. Where that authority is thin, The Open Group's Security Forum has leaned on the idea of security champions, people embedded across teams who do not need deep security skills but do need to know when to pull a specialist into the room. Getting that right moves the security conversation into the design phase, which is the only place it is cheap.The scaling question gets an honest answer. The Open Group operates on one vote per member organization, which means a three-person shop carries the same weight in a final standard as Microsoft or RTX. That structure forces the standards to be implementable by organizations that have no security architect at all, and it shows up in deliberate choices like defining roles rather than job titles, because in a small company one person wears eight of them.Then there is zero trust, which Linford describes with a line that circulates as a running joke inside the Security Forum: it is just what cybersecurity should have been from the beginning. The Zero Trust Commandments trace directly back to the Jericho Forum's deperimeterization work from the 1990s, and they fit on a single page on purpose. Secure assets according to their value and the damage their compromise would cause, and the spending priorities sort themselves out. The alternative, as he puts it, is announcing you will implement all five hundred-odd controls in NIST 800-53 and wishing yourself luck.His closing point is the one most likely to sting. Security practitioners are fluent in security and frequently illiterate in business. Telling a board that twenty controls are required for conformance with the EU Cyber Resilience Act invites one question about cost. Telling them the same work opens a market and removes a year of analysis before expansion is a different conversation entirely, about the same twenty controls.⬥GUEST⬥John Linford, Security Portfolio Director at The Open Group | On LinkedIn: https://www.linkedin.com/in/johndouglaslinford/⬥HOST⬥Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/⬥RESOURCES⬥The Open Group | https://www.opengroup.org/The Open Group Security Forum | https://www.opengroup.org/forum/security-forum-0Zero Trust Commandments | https://pubs.opengroup.org/security/zero-trust-commandments/Zero Trust Architecture at The Open Group | https://www.opengroup.org/forum/security/ZerotrustThe TOGAF Standard, 10th Edition | https://www.opengroup.org/togafOpen Trusted Techn
- Sep 2, 202622 min
Marketing Volume Held Steady. Scrutiny Went Up. | Lens Four by Sean Martin | Read by TAPE9
⬥EPISODE NOTES⬥ For a full year, agentic AI was the pitch. This year the conversation shifted to whether it holds up once it is actually running in production, against real work. Vendors came armed with customer-sourced numbers rather than concept demos — hours returned per analyst per week, percentages of alerts dispositioned without human review, agreement rates measured against human analyst judgment. Buyers arrived having spent the months since the previous major conference testing products and weighing what they were told against what they saw. Not one of the four questions that dominated the show is exciting, and not one of them is actually an AI question. Naming an owner before something ships is governance. Showing your work is audit. Knowing where your components came from is supply chain hygiene. Configuring a tool to reach the outcome it was bought for is the oldest plain, unrewarded work there is. AI did not create those problems — it made them impossible to keep deferring. Marketing volume held steady. Scrutiny went up. In this edition of Lens Four: 🔹 Why the easy read on Black Hat USA 2026 — that AI arrived — is a year late, and what moving from pilot to production actually exposed underneath it 🔹 The 4 questions that replaced the whether debate: who is accountable, what is the evidence, where is the data coming from, and is the foundation configured to hold the weight 🔹 How production turned governance into a named, accountable owner assigned before an agent ships, with a documented business justification behind it 🔹 The sharpest reframe of the week: a rogue agent is usually not malfunctioning, it is doing exactly what it was told, relentlessly, until it succeeds 🔹 The Midnight in the War Room session on the gap between people authorized to take risks and people expected to mitigate them, and why burnout rather than obsolescence is the analyst risk to manage 🔹 Why "black box" became unacceptable, and the 2 ways teams are validating: reading the reasoning trail directly, and replaying historical alerts against what human analysts already concluded 🔹 Sovereignty getting repaired in real time, from a geography and compliance word into a control word about who owns the derivative value of an organization's data 🔹 AI's own supply chain, and the 2 capability gaps leaders keep naming: a basic AI inventory, and third-party visibility into which vendor products already have AI embedded in them 🔹 The Vulnerability Research in the Agentic Age keynote on a pipeline producing well over 1,000 potential local privilege escalation findings, and why discovery got cheap while absorption did not 🔹 Post-quantum timelines compressing from 10 to 15 years toward as little as 3, and why crypto-agility belongs in the refresh cycle rather than a standalone initiative 🔹 What buyers were actually shown: roughly 75 percent of 10,000+ daily alerts cleared without primary analyst review, up to 19 minutes returned per analyst per hour at 99.7 percent agreement with human verdicts, and analyst throughput moving from about 10 closed alerts per shift to 50 or 60, all vendor-reported rather than audited 🔹 The 47 AI SOC vendors counted on the floor, roadmaps compressing from 12 to 18 months down to 3 to 6, and why the market got louder exactly as buyers got more specific 🔹 Why token costs that are not falling set a ceiling on adoption pace that governance readiness cannot lift, and what that means for consumption-based pricing 🔹 Why a resurgence of value-added resellers and system integrators is the market pricing a job that has to happen somewhere: which products fit which environments, and how you connect it all Fourth Lens: Proof does not transfer. Different analysis approaches expose different properties, which makes tool efficacy hard to compare in the abstract, and prioritization frameworks are already moving toward environment-specific attributes. A number on a vendor slide came out of someone else's alert mix and someone else's data — it is evidence of something, but it is not evidence about you. So the burden lands partly on the buyer, with a split most people get wrong. The vendor owes the apparatus: a visible chain of reasoning, audit logs, the ability to replay your own history, and hands-on access without a six-month procurement cycle in front of it. The buyer owes the environment and the baseline. Neither side can produce the answer alone, and human on the loop is what that bargain looks like once it is running. If scrutiny only works when you have built something capable of doing the checking, what have you built? ▶ Full article and references: seanmartin.com/lens-four ▶ All Black Hat USA 2026 conversations: <a href="https://www.youtube.com/playlist?list=
- Jul 11, 202615 min
The Flood Made Everything Free. So Now We Pay for Proof. | Lens Four by Sean Martin | Read by TAPE9
⬥EPISODE NOTES⬥ Tidal is about to stop paying royalties on any track it judges to be fully machine-made. Frame that as a music story and you miss the shift underneath it. By Deezer's own detection, roughly 75,000 AI-generated tracks now arrive every day, about 44% of everything uploaded, yet that same AI music is only 1 to 3 percent of what people actually play, and around 85% of those streams are flagged as fraudulent. The flood is not an audience. It is an attack on a shared payout. This edition follows one pattern across six industries: when the cost of generating something collapses toward zero, platforms stop paying for output and start paying for proof of human origin. Tidal cuts AI royalties. The Authors Guild sells a "Human Authored" badge for ten dollars a title. YouTube demonetizes "inauthentic" content. curl killed its bug bounty after a flood of AI slop, then reopened when the slop got good. And where no gatekeeper owns the payout, hiring, the open web, the scientific record, the flood just degrades the mechanism until no one trusts it. In this edition of Lens Four: 🔹 Tidal's July 15 policy ends royalty attribution and direct-to-fan sales for fully AI-generated tracks, a payout decision, not a content ban. 🔹 Deezer takes in about 75,000 AI tracks a day (44% of uploads), up from roughly 10,000 a day at the start of 2025, while human uploads barely moved. 🔹 The paradox that reframes the debate: AI music is 44% of uploads but 1 to 3 percent of listening, and about 85% of those streams are fraudulent. 🔹 The first US criminal AI streaming-fraud case: Michael Smith pleaded guilty after collecting more than 8 million dollars in royalties from hundreds of thousands of AI songs and roughly 1,000 bot accounts. 🔹 curl shut down its bug bounty under a flood of AI vulnerability reports, then reopened a month later because the AI reports got good enough to read. Cutting the money did not cut the volume. 🔹 The counter-case: recruiters see about 11,000 job applications submitted to LinkedIn every minute, up 45% in a year, with no single payout to switch off. 🔹 Provenance becomes a product: Suno (2 million subscribers, about 7 million songs a day) adds identity-verified voice cloning while the Authors Guild sells human certification. 🔹 The danger tier: roughly 20% of AI-recommended software packages do not exist (slopsquatting), and close to 10% of cancer papers show paper-mill signatures. 🔹 The language turned first: Merriam-Webster made "slop" its 2025 word of the year, and YouTube quietly renamed "repetitious" content to "inauthentic." 🔹 Human filters see it clearest: DJ Sam Young asks why we need fifty versions of the same thing, and producer Gregoire Gensollen says he will remember the human moments, not the tool. Fourth Lens: The three lenses meet at one move. Platforms re-price payouts around human origin, the market builds products that certify it, and the language teaches us to want it. That is not a defense of artists, it is a paywall around authenticity, sold as virtue, and it is arriving before audiences even asked for it. Reality has come at a premium, exactly as predicted in 2017. So the real question is not whether the real is worth more. It is this: when proof of human becomes a product, who is making the money, and who handed them the right to decide what counts as real? ▶ Read the full article and references ▶ Subscribe to Lens Four ▶ Redefining CyberSecurity Podcast ▶ Music Evolves Podcast ▶ ITSPmagazine ▶ Studio C60 Sean Martin, CISSP, is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and Music Evolves Podcast, and writes Lens Four at seanmartin.com. Keywords: AI-generated music, Tidal, De
- Jul 1, 202616 min
We Made Everything Faster. We Never Defined Better. | Lens Four by Sean Martin | Read by TAPE9
⬥EPISODE NOTES⬥ Almost every booth at Infosecurity Europe 2026 had settled on the same four words. Outcomes. Resilience. Sovereignty. Human in the loop. The messaging had grown up, more tempered than RSAC, more honest in its European register. The tell was quieter — almost none of it could connect those words to a definition of success a buyer could actually verify. Strip away the polish and the show floor was a working argument about what the cybersecurity market is for, at the exact moment the clock that governs it collapsed to seconds. The go-to-market caught up to the language. The capability did not. This is the prove-it problem, and it is worth pulling apart clearly. In this edition of Lens Four: 🔹 Why the quiet vocabulary convergence mattered more than any single product launch — outcomes, resilience, sovereignty, and human in the loop became the words everyone said, and almost none could tie them to a definition of success a buyer could verify 🔹 The number that should reorganize every SOC — the jump from initial access to the next stage collapsing from 8 hours to 22 seconds, with ransomware finishing in under an hour, most often on a Wednesday night 🔹 How Qualys reframed measurement itself — a client environment of 62 million risk findings cut to under 1% that could actually be executed, because the dashboard was never the deliverable, remediation was 🔹 Why Corelight put the same test on the detection itself — a black box tells you little, so keep the data behind every alert in the open and let an analyst prove what it actually is, the way one proof of value surfaced unencrypted sensitive traffic in 30 minutes 🔹 How Sumo Logic showed the repeatable version — prove a fix once, then let an agent apply that proven fix across 599 identical machines under human oversight, and its move into the AWS European Sovereign Cloud put something concrete under the week's sovereignty talk 🔹 What the criminal economy revealed as the honest mirror — an underground market for AI attack tools that went from 38 posts to over 1,400 in two months, tiered and redundant, an AI call center for hire that sounds like SaaS 🔹 Why the board's only real question, are we okay, now lands on the CISO as personal liability, just as AI moves from experimentation to deployment inside the organization 🔹 How consolidation and absorption are sorting the floor — 40-plus tools in silos, "make us relevant" becoming an executive hire, and the 12-to-18-month reckoning where AI absorbs functions that fill today's expo hall 🔹 The tell underneath all of it — when every booth converges on the same three or four words, the words stop doing the one job language has at a trade show: helping a buyer tell two things apart Fourth Lens: The vocabulary moved faster than the products underneath it. The industry repositioned around outcomes without ever defining the outcome, and the bill comes due over the next 12 to 18 months, not because AI arrives, but because AI removes the last place to hide the question. Naming the outcome was the easy part. Proving it repeats, across environments and teams and budgets that share nothing but the problem, is the part the vocabulary skipped. When the story can no longer be rounded up, are we okay, and can you prove it twice? 🥁 🎶 A very big THANK YOU to our Infosecurity Europe 2026 Full Coverage Sponsors: Corelight · Qualys · Sumo Logic 👏 👏 👏 ▶ Full article and references ▶ Full Infosecurity Europe 2026 coverage ▶ Subscribe to Lens Four ▶ Redefining CyberSecurity Podcast ▶ Music Evolves Podcast ▶ ITSPmagazine ▶ Studio C60 Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and <a href="h
- Jun 19, 202614 min
The Quantum Threat Is Already a Business Decision You're Making Today | An On Location Conversation at Infosecurity Europe 2026 with Rik Ferguson, Vice President of Security Intelligence
⬥EPISODE NOTES⬥ At Infosecurity Europe 2026, Sean Martin sits down with Rik Ferguson, Vice President of Security Intelligence at Forescout, a day before Rik Ferguson takes the keynote stage with a deliberately provocative title: "Post-Quantum Cryptography Is a Way Off. We Can Wait, Can't We?" The honest answer, he says, is that waiting is a choice, and it is the wrong one. The threat is neither theoretical nor distant. Rik Ferguson walks through why the infrastructure for harvest-now, decrypt-later attacks already exists, pointing to Salt Typhoon, to BGP rerouting by unfriendly nations, and to intelligence agencies stockpiling encrypted data they cannot read yet but expect to read later. With NIST placing Q Day around 2035, Google pointing at 2029, and IBM's fault-tolerant Starling system slated for 2029, the distance between "someday" and "the hardware you purchase this year" has effectively closed. Sean Martin keeps steering the conversation back to the business. The parallel both of them keep returning to is Y2K, which became a non-event precisely because people did the work. The quantum question, Rik Ferguson argues, is not only about security or resilience, it is a budget and procurement question: which data has a long enough shelf life to still matter when it is finally decrypted? Pharmaceutical R&D, merger and acquisition strategy, sovereign debt positions, and legal negotiations all live under an assumed umbrella of privacy that encryption may not hold. The most unsettling point is what a harvest-now attack does to incident response. There is no time-bounding. Adversaries could have been collecting for a decade, and the first sign of trouble arrives only when the data is weaponized or made public, leaving the investigation disabled by chronology alone. Rik Ferguson closes with a message that reaches past cryptography itself: as attacks move toward autonomy, defense has to as well, which is why he wants the industry to move past Assume Breach and into Assume Autonomy. ⬥HOST⬥ Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/ ⬥GUEST⬥ Rik Ferguson, Vice President of Security Intelligence, Forescout | https://www.linkedin.com/in/rikferguson/ ⬥RESOURCES⬥ Infosecurity Europe 2026 is taking place June 2-4, 2026 | ExCeL London -- Follow our coverage: https://www.itspmagazine.com/infosecurity-europe-2026-infosec-london-cybersecurity-event-coverage The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/ Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast On Location | https://www.itspmagazine.com/on-location ⬥KEYWORDS⬥ sean martin, rik ferguson, infosecurity europe, post-quantum cryptography, pqc, harvest now decrypt later, hndl, q day, quantum computing, encryption, salt typhoon, quantum agility, crypto agility, post-quantum migration, procurement, on location, itspmagazine Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
Get Redefining CyberSecurity summaries in your inbox
Free AI-powered daily recaps. Key takeaways, quotes, and mentions — in a 5-minute read.
Get Free Summaries →Free forever for up to 3 podcasts. No credit card required.
You Might Also Like
Listeners also like.
Random Access Memories
Conversations with tech professionals reveal the personal stories behind their careers in cybersecurity, AI, startups, and leadership.
Cyberside Chats: Cybersecurity Insights from the Experts
Cybersecurity experts discuss emerging threats, AI-driven attacks, and defense strategies for professionals and executives.
Security Now (Audio)
A weekly deep dive into cybersecurity news, hacking trends, and digital defense strategies for professionals and individuals.
Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure
Expert discussions on cybersecurity, national security, and threats to critical infrastructure like energy and water systems.
The Watchtower
Cybersecurity, data, and AI leaders share candid insights on real-world challenges and innovations beyond the headlines.
CISSP Cyber Training Podcast - CISSP Training Program
A weekly podcast delivering practical CISSP exam preparation and cybersecurity strategies from an experienced industry professional.
Ahead of the Threat: The FBI Cyber Podcast
FBI officials and experts discuss emerging cyber threats and cybersecurity fundamentals with government and industry guests.
Plaintext with Rich
Explains cybersecurity topics in simple terms to help listeners stay safer online.
The Conscious Edge Podcast: Redefining Wealth as a Whole Human Experience
Alecia St. Germain
The Low Down
A podcast about hacking.
Your Brand Amplified
Explores the strategies and mindsets of successful entrepreneurs in business growth, marketing, and personal branding.
The Jedburgh Podcast
Leaders and high performers from military, business, and athletics share strategies for elite performance, leadership, and personal growth.
About Redefining CyberSecurity
Redefining CyberSecurity Podcast Hosted by Sean Martin, CISSP Have you ever thought that we are selling cybersecurity insincerely, buying it indiscriminately, and deploying it ineffectively? For cybersecurity to be genuinely effective, we must make it consumable and usable. We must also bring transparency and honesty to the conversations surrounding the methods, services, and technologies upon which businesses rely. If we are going to protect what matters and bring value to our companies, our communities, and our society, in a secure and safe way, we must begin by operationalizing security. Executives are recognizing the importance of their investments in information security and the value it can have on business growth, brand value, partner trust, and customer loyalty. Together with executives, lines of business owners, and practitioners, we are Redefining CyberSecurity.
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Redefining CyberSecurity in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Redefining CyberSecurity daily summary?
It's a free AI-powered email that summarizes new episodes of Redefining CyberSecurity as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Redefining CyberSecurity podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Redefining CyberSecurity product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Sean Martin, ITSPmagazine.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does Redefining CyberSecurity release new episodes?
Redefining CyberSecurity publishes weekly. Our AI generates a summary within hours of each new episode.
What topics does Redefining CyberSecurity cover?
Redefining CyberSecurity covers topics including Technology, Education, Business. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Redefining CyberSecurity summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.