CISO Series Podcast
Can You Please Train the AI on Your Way Out the Door?

There's no doubt that AI will displace some portion of current knowledge workers, including in cybersecurity. But if it can displace all of them, how do businesses differentiate? Will cybersecurity become commoditized by everyone using the same LLMs?

This week’s episode is hosted by David Spark, producer of CISO Series and Mike Johnson, CISO, Rivian. Joining is Jean-Paul Calabio, vp and CISO, Grainger.

Listen to the full episode here.

Scanning the map isn't securing the territory

The scariest application security problems aren't in the code, they're in the assumptions between components. The identity providers, the service-to-service auth, and the legacy endpoint that sidesteps your permission model, as discussed on the r/cybersecurity on Reddit. Scanners don't see any of that. What AI is doing right now isn't solving those harder problems. It's clearing the false-positive backlog that was eating up human hours, freeing people up to do the work machines can't yet handle. That's progress worth taking seriously.

CFOs don't fund faith

Building a quantified risk model has helped some CISOs walk out of a board meeting with a budget increase. Adrian Salasa, CISO, ShiftKey shared his own success with that. But security isn't the only department that has to justify itself. When was the last time someone calculated the ROI on the receptionist? The harder question is whether quantification moves the needle or just changes the aesthetics of the ask. Risk quantification is the gold standard... in theory. In practice, someone can always find the seam in your numbers. A clear story about trade-offs, told to someone who understands what else is competing for that budget, may land just as well. The CFO, comparing your security request to a $17 million piece of equipment that keeps the factory running, needs context, not a formula.

What your AI inherits

When a CEO announces that AI can replace their workforce, they're admitting their business never had much of a core to begin with. When every competitor runs the same models, you've got a commodity business with a margin problem, said Dave Edwards of Artificiality. Humans have been displaced by new technology before, and the workforce adapted each time. But security is a harder case. AI can triage alerts, cut through noise, and document what analysts need to act on. What it can't do is pick up the phone, read a situation sideways, or know which anomaly feels wrong when the logs say everything's fine. If the people carrying that institutional knowledge walk out, your AI inherits the playbooks, but not their judgment.

Nobody owns the gap

A cooling tower fails to drain before a freeze. A chiller plant shuts down. Ninety percent of global derivatives trading goes offline. This scenario can happen without an attack, because nobody owns the space between cyber and physical infrastructure, argued Ed Walters of Alpha Origins. Cyber says operational technology or OT isn't their domain. Facilities says it's a security problem. The CISO reports risk. The vp of operations reports uptime. The exposure lives exactly where those two conversations never meet. Legacy hardware runs for decades because replacement means downtime no one will authorize. The systems most critical to protect are the ones least tolerant of the controls designed to protect them. Someone has to own resilience. The practical test is simple: when something breaks, who does the CEO call? That person owns it, whether the org chart says so or not.

Listen to the full episode on our blog or your favorite podcast app, where you can read the entire transcript. If you haven’t subscribed to the CISO Series Podcast via your favorite podcast app, please do so now. 

Thanks to Jonathan Waldrop, CISO, Acoustic for providing our "What's Worse" scenario.

 Thanks to our podcast sponsor, ThreatLocker

Subscribe to CISO Series Podcast

Please subscribe via Apple Podcasts, Spotify, YouTube Music, Amazon Music, Pocket Casts, RSS, or just type "CISO Series Podcast" into your favorite podcast app.

Security You Should Know
Securing Mobile Apps with Guardsquare

In this episode, Ryan Lloyd, chief product officer at Guardsquare, explains how the platform combines code obfuscation, runtime integrity checks, and real-time threat monitoring to secure mobile apps at the binary level, integrated directly into the CI/CD pipeline. Joining him are TC Niedzialkowski, head of IT & security at Opendoor, and Montez Fitzpatrick, CISO at NavVis.

Want to know:

• Why does organizational apathy around mobile app security persist even as mobile becomes the primary customer channel?

• What's the difference between app integrity and code integrity, and why does it matter for defending against repackaging attacks?

• How does obfuscation function as a real security control rather than just security through obscurity?

• How does Guardsquare fit into the CI/CD pipeline, and what does the actual build overhead look like for development teams?

• What API and webhook capabilities exist for routing threat monitoring data into your existing security stack?

• How does Guardsquare's mobile app attestation model bind server-side APIs to verified legitimate app instances — and why does that matter for stopping bots and credential theft?

Read more and listen to the full episode for the answers you need.

Thanks to our podcast sponsor, GuardSquare

Subscribe to Security You Should Know

Please subscribe via Apple Podcasts, Spotify, Amazon Music, Pocket Casts, RSS, or just type "Security You Should Know" into your favorite podcast app.

Best advice I ever got in security…

“The best advice I ever got in security was to create a stakeholder map so before I go into a meeting, I understand what motivates each of my stakeholders.“ - Jean-Paul Calabio, vp and CISO, Grainger

Listen to the full episode of “Can You Please Train the AI on Your Way Out the Door?”

Breaking the Reactive Cycle of Cybersecurity

"There is only one way to win the game, which is not to play. If you are constantly trying to keep up, you are going to fail." - Rob Allen, chief product officer, ThreatLocker

Listen to the full episode of “Breaking the Reactive Cycle of Cybersecurity”

Subscribe to our newsletters on LinkedIn!

CISO Series Newsletter - Twice every week

Cybersecurity Headlines Newsletter - Every weekday

Security You Should Know Newsletter - Weekly

Why Multi-Factor Authentication Is No Longer Enough

Sponsored article

MFA is working exactly as designed. That's the problem.

When attackers intercept session tokens in real time, a one-time code offers less protection than most organizations assume. The real gap isn't authentication, it's device trust and network restrictions. Applying Zero Trust principles, including deny-by-default policies and managed device requirements, closes the door that MFA alone leaves open.

Read the full article here.

Big thanks to our sponsor, ThreatLocker.

Cybersecurity Headlines - Department of Know

Our LIVE stream of The Department of Know happens every Friday at 4 PM ET / 1 PM PT with CISO Series producer Richard Stroffolino, and a panel of security pros. Each week, we bring you the cybersecurity stories that actually matter, and the conversations you’ve been having at work all week long.

Friday’s episode will feature Gary Chan, CISO, SSM Health and Peter Liebert, CISO, LifeOmic. Join us on YouTube and catch up on what shaped the week in security.

Thanks to our Cybersecurity Headlines sponsor, Doppel

Super Cyber Friday
Join us Friday for “Hacking the Cloud Security Playbook”

Join us on Friday, May 15th, 2026, for Super Cyber Friday: “Hacking the Cloud Security Playbook: An hour of critical thinking about CNAPP in the age of AI development.”

It all kicks off at 1 PM ET / 10 AM PT, when David Spark will be joined by Dan Benjamin, vp product - data, identity, and AI security, Palo Alto Networks, and Howard Holton, CEO, GigaOm, for an hour of insightful conversation and engaging games. And stick around for our always-popular meetup, hosted right inside the event platform.

Register for this episode on Crowdcast!

Thanks to our Super Cyber Friday sponsor, Palo Alto Networks

Participate! Add our live shows to your calendar

Learn more about all of the fun ways you can participate, and add our events to your calendar.

Google Calendar, iCalendar, Outlook, or export an .ics file

Cybersecurity Headlines - Daily News Shorts

Subscribe to the CISO Series YouTube channel, for daily shorts videos from CISO Series reporter, Rich Stroffolino. You can find all of the stories he’s covered, plus new content every weekday, at the Cybersecurity Headlines Shorts YouTube playlist.

Thank you for supporting CISO Series and all our programming

We don’t just say we appreciate your feedback; we incorporate it into our programming. Learn more about all of the fun ways you can participate.

We love all kinds of support: listening, watching, contributions, What's Worse?! scenarios, telling your friends, sharing on social media, and most of all we love our sponsors!

Everything is available at cisoseries.com.

Interested in sponsorship, contact me, David Spark.