CISO Series Podcast
Once You Memorize the Manual, Our User Interface is Very Intuitive

The user experience for security products is a mess. Does it have to be? Security practitioners often bemoan that interfaces aren't designed by anyone who actually has to use the product. How can security tools optimize interfaces when their products often have to span disparate roles and use cases?

This week’s episode is hosted by David Spark, producer of CISO Series and Andy Ellis, principal of Duha. Their sponsored guest, Edward Wu, CEO and founder, Dropzone AI, joins them.

Listen to the full episode here.

Building context-aware verification frameworks

Open-source intelligence faces growing challenges in distinguishing reliable information from misinformation, particularly as artificial intelligence enables sophisticated content manipulation. Paul Wright of eCrime Intelligence emphasized that "data collected through OSINT may reflect the biases of those who create or share it," highlighting the need for forensic validation techniques like metadata analysis and file integrity checks. Effective OSINT frameworks must recognize three distinct use cases: quick operational hints where reliability matters less, investigative contexts requiring source credibility assessment, and legal evidence where information should be treated as "trash picked up off the ground" requiring extensive corroboration. The emergence of AI-generated content poses additional risks, as attackers can now optimize malicious libraries and misinformation to appear prominently in search results and AI recommendations. Organizations should prioritize provenance tracking and source verification, with the understanding that traditional quality assumptions about community-contributed intelligence may no longer be valid in an environment where automated systems can generate convincing but false information at scale.

Understanding why UX fails

The persistent user experience problems in cybersecurity tools reflect fundamental misalignment between vendor assumptions and operational reality rather than simple design failures. A cybersecurity subreddit discussion criticized vendors for throwing in "features that no one asked for or needed" while organizing interfaces "the way a UX person wants it, but not how security experts would need it." The core challenge lies in workflow diversity across security operations centers, where some teams operate ticket-focused environments while others rely heavily on Slack-based coordination or use SIEM platforms as ticketing systems. Successful security tool vendors increasingly adopt "optional UI" philosophies, recognizing that attempting to be everyone's single pane of glass often results in tools that satisfy no one completely. The most effective approach involves building capabilities that integrate seamlessly with existing workflows rather than forcing teams to adapt to new interfaces, acknowledging that different SOCs have fundamentally different operational needs that cannot be standardized across a single user experience.

Moving beyond AI replacement narratives

The cybersecurity industry's focus on replacing Tier 1 analysts with AI misses the fundamental organizational challenge of building trust in automated systems. The persistent need for human analysts in most security operations stems not from technical limitations but from organizational reluctance to allow automated systems to make consequential changes without human oversight. More valuable discussions should center on using AI to accelerate human capability development, transforming junior analysts into senior practitioners through intelligent assistance and knowledge access rather than eliminating roles entirely. The concept of autonomous or "lights-out" SOCs represents an overreach that damages credibility across the industry by promising outcomes that current technology cannot reliably deliver. Instead, organizations should focus on operationalizing AI agents through coaching mechanisms that allow human operators to provide natural language instructions and contextual guidance, similar to training human team members but leveraging AI's ability to rapidly absorb historical case documentation and organizational knowledge.

Building for a crisis

Building cybersecurity teams capable of handling major incidents as routine operations requires establishing distinct operational cadences and protecting team capacity through automation. Former Uber CSO Joe Sullivan's advice to organizations is to "build a fire department." If you're putting out a lot of metaphorical fires, you'll need dedicated incident management processes that operate independently of normal project and operational workflows. Effective incident response teams maintain three separate tempo operations: project-based work for governance and architecture, standard operational tickets for daily security tasks, and dedicated incident response with clear escalation and rotation protocols. The key lies in having personnel for whom incident management represents their normal operational tempo, allowing subject matter experts to be pulled from other work without disrupting the incident command structure. Organizations must invest heavily in automation to handle routine tasks automatically, creating capacity for human intervention when genuine incidents occur, similar to how humans manage complex navigation without conscious control over individual muscle movements while walking.

Listen to the full episode on our blog or your favorite podcast app, where you can read the entire transcript. If you haven’t subscribed to the CISOSeries Podcast via your favorite podcast app, please do so now.

Thanks to Matt Muller, field CISO, Tines for contributing this week’s “What’s Worse?!” scenario. 

Huge thanks to our sponsor, Dropzone AI

Subscribe
Subscribe to CISO Series Podcast

Please subscribe via Apple Podcasts, Spotify, YouTube Music, Amazon Music, Pocket Casts, RSS, or just type "CISO Series Podcast" into your favorite podcast app.

Security You Should Know
Coordinating Security Tools with Tines

Security orchestration sounds great in theory, but in practice, coordinating between different security tools remains a headache. As workflows need to move faster to keep pace with AI-driven attacks, security professionals find themselves overwhelmed with manual “muck work” rather than focusing on business enablement.

In this episode, Matt Muller, field CISO at Tines , explains how their no-code workflow automation platform helps security teams eliminate manual work that bogs them down. Joining him are Bil Harmer, CISSP, CISM, CIPP, information security advisor at Craft Ventures, and Brett Conlon, CISO at American Century Investments.

Listen to the episode and find the transcript here.

Thanks to our sponsor, Tines

Subscribe
Subscribe to Security You Should Know

Please subscribe via Apple Podcasts, Spotify, Amazon Music, Pocket Casts, RSS, or just type "Security You Should Know" into your favorite podcast app.

What I love about cybersecurity…

“What I love about cybersecurity is how we are continuously competing against smart attackers who are trying all sorts of different things to get into systems and networks.“ - Edward Wu, CEO and founder, Dropzone AI

Listen to the full episode of “Once You Memorize the Manual, Our User Interface is Very Intuitive”

Is It Even Possible to Fast-Track Your Way Into Cybersecurity?

"Security today is much more complex than it was 20 years ago. Can you just say, 'Hey, I took a one-week Coursera course on how to look at alerts in the Splunk SIEM, and now I can take on a SOC role'? It’s much more than that." - David Cross, CISO, Atlassian

Listen to the full episode of “Is It Even Possible to Fast-Track Your Way Into Cybersecurity?”

Subscribe to our newsletters on LinkedIn!

CISO Series Newsletter - Twice every week

Cyber Security Headlines Newsletter - Every weekday

Security You Should Know Newsletter - Weekly

Helpdesk is the Best Place to Start Your Cybersecurity Career

You’re thinking about getting into cybersecurity, and someone tells you to start at the help desk. In this conversation, I spoke with Oliver Plante, vp of support, ThreatLocker at Zero Trust World about why that advice holds up—and what you actually learn on the front lines.

From dealing with frustrated users to introducing security controls without breaking workflows, help desk experience builds empathy and real-world judgment. If you’re just getting started, this is what a solid foundation really looks like.

Watch the full video here.

Thanks to our sponsor, ThreatLocker

LIVE!
Cyber Security Headlines - Week in Review

Make sure you register on YouTube to join the LIVE "Week In Review" this Friday for Cyber Security Headlines with CISO Series reporter Richard Stroffolino. We do it this and every Friday at 3:30 PM ET/12:30 PM PT for a short 20-minute discussion of the week's cyber news. Our guest will be Cyrus Tibbs, CISO, PENNYMAC.

Thanks to our Cyber Security Headlines sponsor, ThreatLocker

Super Cyber Fridays!
Join us Friday for “Hacking Vendor Competition”

Join us on Friday, July 18, 2025, for Super Cyber Friday: “Hacking Vendor Competition.”

It all kicks off at 1 PM ET / 10 AM PT, when David Spark will be joined by Andy Ellis, principal, Duha, and Gianna Whitver, co-founder and CEO, Cybersecurity Marketing Society, for an hour of insightful conversation and engaging games. And at 2 PM ET / 11 AM PT, stick around for our always-popular meetup, hosted right inside the event platform.

Register now

Thank you!
Thank you for supporting CISO Series and all our programming

We love all kinds of support: listening, watching, contributions, What's Worse?! scenarios, telling your friends, sharing in social media, and most of all we love our sponsors!

Everything is available at cisoseries.com.

Interested in sponsorship, contact me, David Spark.