“If you do a penetration test to an organization and you get blocked, this is where you stop the test, right?” says Sharon Nimirovski who founded White-Hat Ltd., a leading Israeli cybersecurity firm recently acquired by EPAM. “But in real life, the attacker doesn’t do that.” In our latest #CybersecurityByDesign conversation Nimirovski tells Sam Rehman, our Chief Information Security Officer and SVP, that nefarious actors keep looking for other ways inside. “They don’t leave. They’re moving to, maybe, spear phishing. They’re moving maybe to infected URLs, maybe infected Android apps.” How do Nimirovksi and his team meet this barrage of digital assaults? Behind the scenes they repel attackers by building “a database of all the attack techniques and the vectors they use.” His team brings this offensive armada to clients, to test for their systemic weaknesses, and when they find them they create a “vaccine” against the vulnerabilities (“That vaccine is only a behavioral rule that we embed into the client’s given technologies”). A fascinating conversion straight from the front lines of offensive security. 

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 26: Bringing the Offensive Angle with Sharon Nimirovski and Sam Rehman

“Can we use generative AI in a way that teaches us something that we might not have known otherwise, and in that learning… create something that actually has the potential to increase agency for all inside of the system?”

Good question, Angela Stockman! It is, in fact, one of many good questions that Stockman, the author of *The Writer’s Guide to Pedagogical Documentation,* raises as our guest on *The Resonance Test.*

In this episode, Stockman joins Kristin Heist, Senior Director of Innovation Consulting at EPAM Continuum, and our Brian Imholte to dig deep into Gen AI and education. 

Part of that digging involves the art of *asking questions.* Heist says that while building a tutor with input from educators, teachers have been “pushing us to design tools that follow the principles of Socratic method” and not just giving the answers to students.  

Stockman agrees saying that teachers don’t want to see “learners leaning on AI tools just to generate answers or to produce work in ways that you know undermine their opportunity to sharpen their own saw.”

The hope is that students will become keen enough to create whole new ways of doing things—and that teachers will, too. 

Part of teachers’ craft, says Heist, is “learning what works for their students, learning what their students understand, learning who their students are.” But the reality is that teachers are extremely time-constrained. And this makes personalization a challenge.
 
Stockman says that for teachers “who are working with sometimes over one hundred students in a single day,” personalization is “kind of unrealistic”—but a GenAI tutor can truly help.

The real focus is where GenAI tools can, as Heist says, “elevate the teacher's craft,” as opposed to replacing what they're currently doing.

And let’s not forget data! Stockman says that AI is “helping us scoop the data out of their lived learning experiences. We don't have to bring learning to a halt in order to assess what's going on and it can help us with the interpretation of massive amounts of qualitative data.” 

If you have questions about GenAI and EDU, and you know you do, listen up. 

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

The Resonance Test 94: Angela Stockman on GenAI in Education

What should we be focusing on? It’s an essential question for all of us… but for those in the cybersecurity game, it’s critical. Focusing on the wrong things here can be *costly.* Or so says Neatsun Ziv, Co-Founder and CEO of OX Security, in this *#CybersecurityByDesign* conversation with Sam Rehman, EPAM’s CISO and SVP. 

Ziv says that, when it comes to fixing code, “95% of the things” that organizations work on have “zero risk impact,” adding: “That is an insane amount of money that the organization should have spent creating a bigger gap between them and the competitors.”

Managing risk is indeed a major challenge for contemporary organizations. “There's no such thing as one single application anymore,” says Rehman, who wonders: “How do you manage the inherent risk from all these components?”

Ziv says the answer is about getting clients to focus on what’s critical to them. There’s a need to distinguish between vulnerability, theoretical risk and actual practical risk. What is a practical risk? It means getting clients to recognize, as an organization: “This is what I'm concerned about.” 

“I always tell people the risk is managed,” adds Rehman, who says that approach is underpinned by asking questions such as “What's your security posture?” and assessing a client’s risk tolerance.

“You need to be smart about the investment,” says Ziv. He notes that this is where experienced leaders become practical. He gets them to answer questions like: What's exposed? What's internal? What do you want to replace first? How do we do it? 

Ultimately, he says, it’s getting clients to be mature enough to say that they’d focus on the “5% [of efforts] that would actually make a difference in the first year or the second year.” The trick is taking a balanced approach, and the guys bring the idea of balance into the realms of supply chain and open source. 

We leave you with a warning: Listening might have a serious impact on your own security posture. Click play now! 

Host: Kenji Ross
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 69: Neatsun Ziv and Sam Rehman on the Balanced Approach to Risk Management

“If you want to know the future, look at the past.” While no one in their right mind would claim Einstein was giving any thought whatsoever to the future of the financial services industry, history would have once again proven him right if he had. Once upon a time, one’s choice of bank was based on how well that particular institution had won over your trust. That meant building relationships with the customers and the community at large.


While it’s hard to envision any other reality, it’s only been a couple of decades where convenience and the digital experience became such dominating factors. But as banks increasingly leverage emerging technology to race toward automation and digital optimization, the notion of trust and relationship building has all but faded into the rearview. Or has it?


“Yes, you need to have an amazing digital experience. It needs to be convenient, easy and it needs to flow… But you also need to be able to get ahold of a banker just as quickly. You need that opportunity to have someone jump into that digital experience as you’re a part of it–if you have a challenge, or a question or an alternative need. For our industry, that’s what everyone is trying to solve.” This is the mantra of Eric Sobie, SVP, Head of Consumer Sales and Strategy at Heartland Financial USA, Inc. It’s his belief that in order for the financial services industry to move forward, it needs to find a way to bridge the gap between the personalized experiences of the past with the efficiency and digital innovation of today.

And as Chris Tapley, VP of Financial Services Consulting at EPAM, points out, it’s a notion with strong precedent behind it. “It’s interesting because what bank customers told us is that they have very disparate use cases for in-person versus digital interactions with their banks. They want to move money digitally; they want to check balances digitally; but when they need advice, or when they need a problem solved, they… want some kind of in-person interaction. Being able to converge that digital and human experience will be critical.”


As the two discuss, it's this convergence where the emergent technologies of AI and generative AI will play an important role. While they might make it possible to further automate, optimize and streamline customer interactions – for example, recommending a specific product for a customer based on the available data – is this what consumers really want?


As Sobie makes note, the alternative is to leverage these technologies to gain a more thorough understanding of the customer, and to upskill bankers to better build relationships with their customers based on this insight. “I think banks, rightfully so, are a little nervous about AI, because we are a business built upon trust; we want nothing to invalidate that trust. Let’s not use AI to create an opportunity to drive [a product] recommendation. But can we get predictive analytics? Can we understand where the customer is on their road map… and can we get a whole view of who that customer is from the data?” That’s how banks can bridge the gap between today’s digital environment and the personalized experiences of the past.

Now, it’s time to dive into the full *Resonance Test* conversation. Enjoy your stay.


Host: Alison Kotin 
Engineer: Kyp Pilalas 
Producer: Scott MacAllister
Executive Producer: Ken Gordon

The Resonance Test 95: Technology, Trust & the Customer Experience with Eric Sobie & Chris Tapley

How are CISOs holding up in the era of AI? 

According to Tim Ramsay, Managing Director of Mandiant Client Advisory (now part of Google Cloud), and our guest on *Silo Busting*: “You have a number of parts of the organization that may be embracing AI without any involvement from central IT, and more importantly… without security.”

Not an easy situation for a CISO. 

But not to worry, Ramsay and Sam Rehman, EPAM’s CISO and SVP, have seen this kind of thing before. In the pre-AI age, there were other technology inflection points, such as virtualization and the cloud, and our conversationalists learned that dealing with them involved clear communication and trust.

Today’s CISOs “don't want to kill the business or stop the business,” says Ramsay. “They want to enable the business. But that kind of presupposes they know what the business is trying to do.” 

What’s necessary, he says, is for business leaders “to have some level of trust that the security people are actually going to bring something productive to the conversation and not just rule from a position of fear, uncertainty and doubt.”

CISOs must teach their colleagues that secure business is, as Ramsay notes, a team sport and that organizations must know their data assets. Security people must also be clear about risk. “We need to be real about what type of threats we actually are engaging,” says Ramsay.

The lessons of DeepSeek emerge during the episode. Ramsay says he thought there’d be “some voice in the room who would have said, ‘Guys, are we ready? Are we ready for global type of exposure here?’” Getting ready, in fact, means that security must be included from the beginning, both Ramsay and Rehman agree. Rehman adds: “To secure something as an aftermath is a million times more difficult than if you have security in mind when you’re actually going through that innovation process.” 

Rehman asks how CISOs can build the necessary trust. “Meetings are always good, but relationships are where it gets real,” replies Ramsay. “Conversations that CISOs are having alongside other C-levels are going to be much more effective” than meetings that can sometimes feel adversarial. 

Build strong enough relationships and sometimes business leaders will deliver the security message themselves. “It takes a secure CISO to let others carry the message sometimes,” says Ramsay. “It takes the pressure off the CISO to be always the bearer of threats and news of risk.”

Says Rehman: “So much of security requires... letting go of that insecurity.”


Host and Producer: Ken Gordon
Engineer: Kyp Pilalas

Silo Busting 70: Lessons for the Modern CISO with Tim Ramsay and Sam Rehman

What does the phrase “aquatic corporate community” mean to you? A school of fish in business suits holding an underwater meeting around a table of coral? Well, for our guests on the latest episode of *The Resonance Test,* it’s all about plunging into a strategic social responsibility program called “Let’s Swim Together.” 

Antonio Silva, President of European Aquatics, and Kate Pretkel, EPAM’s VP and Head of Sustainability Programs, have pooled their knowledge to answer questions from Balázs Magyar, Senior Director of Account Management at EPAM. 

Swimming is not just sports skill, says Silva, “It's a life skill.” He rightly points out that the pool is a place that can be used by everyone: babies, children, and adults. And, as Magyar notes, it promotes discipline, responsibility, social connections, and physical- and mental health. 
“Let’s Swim Together,” is starting with a pilot program for EPAM Hungary but the program will expand to other companies, other countries. Silva adds that with this initiative, we can reach “the specific goals of a company” and “so-called environmental, social and governance goals.”

This is good news for Pretkel, who speaks ESG fluently. She says that EPAM has a long tradition of helping employees “to make a good impact on the communities that we live and work in,” adding that “It's not *just* about people working for a specific company, but also their friends, their families, their kids and their communities.” 

The challenge, with all these groups, is getting people to take the first step toward the water. 
“We are looking at the whole employee experience,” says Pretkel. The trick is making it easier for our employees to join. To do so, they are incorporated into the “overall experience that we are creating for them.” She says it’s all about “building these habits and also in some cases engaging the team so they can help each other to make this first step.”

In short, Silva and Pretkel are excited about building what Antonio calls, yes, “the aquatic corporate community.” He concludes: “It's about reaching some social goals that [the participants] could not reach if they were not involved in such an activity.”

Host: Macy Donaway
Engineer: Kyp Pilalas
Producer: Ken Gordon



The Resonance Test 96: Building an Aquatic Corporate Community with Antonio Silva & Kate Pretkel

Today’s incident response ain’t your grandfather’s IR. But the psychology surrounding it hasn’t changed an iota. This is precisely what Sam Rehman, EPAM’s Chief Information Security Officer and SVP, and Tab Bradshaw, Chief Operating Officer at Redpoint Cybersecurity, are talking about on this #SecurityByDesign conversation. 

“It really comes down to the preparation piece,” says Bradshaw. It’s about being well prepared and asking: “How often do you prepare in your organization, at a technical level, at an executive level, to handle some sort of incident?” 

Rehman agrees and says that he has clients wondering, “OK, so when am I done?” The perception is that being IR-ready is enough, he says. “That's not the case. It's a muscle. It's emotion. It's how you work. It's how you react to it.”

There are benefits to knowing the proper way to react. “A well-handled breach really builds credibility,” says Bradshaw, adding that the word “reasonable” is omnipresent in IR documentation. He says: “Reasonableness is not just about having a mitigation strategy.” It’s also about, say, practicing tabletop exercises. Regularly. So that when you’re asked about doing regular tabletop sessions, the answer is, as Bradshaw puts it: “Yes, we did it every quarter for the past five years. We feel like we're in a pretty good spot that if something happens, might not be perfect, but we think we have good preparation, consistent preparation, consistent practice, to your point, to respond to the incident when it does occur.”

Rehman says that security people are “used to having that sudden sense of violent impulse and urgency coming to us,” but what about the business leaders and everyone else in the organization? He asks Bradshaw about IR communication: “How do you guide the team through it, especially when everybody's thinking about, ‘Oh, am I gonna be on the news?’”
Of the thousands of breaches Bradshaw and his team have responded to, for “a third, maybe half” of them, there is “some internal chaos at the client—and it's not because anybody's doing a bad thing.” 

“It really comes down to what I call C-squared,” says Bradshaw, which is shorthand for “communication and coordination. Someone has to be the quarterback.”

Bradshaw says the chaos is about “a lack of preparation and testing.” A tabletop exercise needs to be a live fire exercise: “Doing it once a year is not good.” Too many organizations treat IR as a checklist, which is a mistake. He says: “It's a living, cross-functional discipline that evolves with the threat landscape externally, obviously, and also internally as people move.”

And so?  

Get moving. Hit play and get ready. 

Host: Lisa Kocian
Engineer: Kyp Pilalas
Producer: Ken Gordon



Silo Busting 71: IR Now with Tab Bradshaw and Sam Rehman

In the age of AI, there’s no going it alone. Partnership is now an absolute necessity. 

This conversation between Colleen Kapase, VP of Channels and Partner Programs at Google Cloud, and Elaina Shekhter, EPAM’s Chief Marketing and Strategy Officer, demonstrates the value of partnership done right. Their back-and-forth embodies the enduring partnership, and unshakable trust, that Goole Cloud and EPAM have built over the years. 

Kapase notes that the conversations she's had with partners were often about modernizing cloud infrastructure rather than more nuanced AI discussions. No more! “It's moved beyond a CIO conversation to a product conversation, to a CMO conversation.” Google and their partners are asking: “What are you doing to leverage AI to advance our products or offerings or processes and customer experience?”

This kind of working is, Kapase says, an opportunity to “grow, grow, grow, grow” that can deeply impact their partners’ customer experience and product development.

Shekhter says that lately there has been much restructuring of the partner ecosystem and then asks bluntly: What is partnership *for?*

“Just delighting the customer,” says Kapase. “I don't know if it gets any more complicated than that.”

Complicating things somewhat, Shekhter wonders if her interlocutor has advice on how partnership can be customer-centric in AI-native transformation work.

“It can sound basic, but communication is *so* important,” says Kapase. “It is really the basis of any great partnership… Strong communication just can make you better together.”
Better together, indeed. 

So, for those who are in or want to join the Google Cloud crowd, or care about partnerships more generally, listen up! Much here to learn about partner-driven delivery and adoption, the role of Agentspace and AI innovation, the importance of optimism, and more.

The Resonance Test 97: The Power of Partnership with Colleen Kapase and Elaina Shekhter

AI is not as new as we think, says Gary Rivlin, author of *AI Valley: Microsoft, Google, and the Trillion-Dollar Race to Cash in on Artificial Intelligence.* 

As our non-artificial guest on *The Resonance Test,* Rivlin tells host Barry Briggs that back in the 1950s, it was thought that AI was always right around the corner. There would be a gathering of technologists who said: “Give us 10 years and we'll have this thing largely solved.” Which meant, says Rivlin: “AI was ‘a decade away’ for about 70 years.”

Rivlin notes that recommendation engines and Google Translate have been operating for a while. “Google Translate has been around since 2015. That's AI, but no one really thinks of it as AI.”  However, when ChatGPT strutted onto the scene, it was something else. Rivlin says: “We were talking to it. Suddenly: AI that you could converse with. It's a whole different beast.”
The builders of that beast are his topic in *AI Valley.* 

Rivlin, who was a reporter for *WIRED* in the dot-com days, returns to his old beat to document the onset of the recent, fast-blooming AI spring. He and Briggs, a former CTO at Microsoft IT, bring years of history into the conversation to offer an assessment at this moment of peak AI in Silicon Valley. 

They talk, for instance, of Reid Hoffman. Briggs says, “He’s the exception to the rule of nice guys finish last.” Rivlin zings back, calling Hoffman: “A billionaire you can root for” and adding “this lonely kid who wanted friends created LinkedIn, which connects the world.”

Together they remember the dot-com days of irrational exuberance, getting-rich-by-selling-dog-food-online. “The problem was we tend to overestimate the short-term impact of a technology and underestimate the long term,” says Rivlin, adding we’re seeing a similar sort of thinking with AI today.  

The pair reflect on how people used to joke about autocomplete. “I should have started thinking, ‘this could turn into sentences, this could turn into paragraphs, this could turn into dialogue,’” says Briggs.

Rivlin notes that agents aren’t “trustworthy” yet. He says that if an agent is going to “make material decisions, it really needs to be trustworthy.” In two, five, 10 years from now, “AI agents are going to be central to the work life of many, maybe perhaps most of us.”

We trust that you’ll be informed and entertained by this episode. Click on!

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon



The Resonance Test 98: Gary Rivlin, Author of “AI Valley”

“In French, we say when it’s raining at a wedding, it will be a beautiful marriage leading to a happy life,” says Syz Bank COO, Boris Chave. Reflecting on an announcement made on stage in 2023 alongside EPAM’s now-CEO Balazs Fejes during an afternoon storm in Geneva, Chave adds: “I think this rainy event was the beginning of a successful project and a happy partnership between Syz and EPAM.”  

Swiss banks have a well-known reputation for being protective of customer data, and Syz Bank is no exception. For years, the bank relied on on-prem servers and top-shelf security solutions to protect its customer data. However, the cost of those solutions was rising sharply, which led Chave to wonder if there existed a better solution. “The challenge with our setup was that even though we had these best-in-breed technology solutions, the ongoing investments we needed to make to protect our data just weren’t sustainable. I had to ask myself, should we continue down this path with its huge impact on P&L? Not to mention I wasn’t comfortable with the complexity of our systems.” 

Fast forward to June of 2025, and EPAM has just finished helping Syz Bank migrate all its IT infrastructure to cloud-based systems, no small feat. As Fejes points out, “You got new notebooks, new applications, you migrated everything to the cloud. You basically built, de facto, a brand-new bank.” As Chave notes, not only did EPAM help Syz Bank navigate the cloud migration, but we did so with minimal impact on operations. “So many aspects of this project have been a huge success. We delivered on time and on budget without any outages for customers or employees.”

The move to the cloud came at a rather fortuitous time. Fejes says: “When you and I met on that stage in 2023, nobody was really talking about AI yet. But now you’re probably finding yourself in a very privileged situation because some of your competitors might still need to work on what I would call the foundational elements of their infrastructure, whereas you’re in a situation where you can take advantage of the capabilities of the cloud.” Says Chave: “The foundation we have now will give us access to some of the best AI technology without having to make huge investments in infrastructure just to deliver something. We can try out new tools and pivot quickly.”

Beyond enabling new and surprising technologies, the move to the cloud also had another major impact on Syz Bank: a reduction in complexity. What was previously 140 applications working together to protect the bank’s data has been reduced to seven on the cloud system. “So many people are underestimating the impact of complexity in terms of environment stability and cost. Program simplification is probably one of the best ways to achieve cost-efficient operations,” says Fejes.

It might seem counterintuitive that such a complex transformation could result in such simplicity, but that’s exactly how this project played out. Now, with the stage set, let’s raise the curtain on this episode.  

Host: Michael Nicholls  
Engineer: Kyp Pilalas 
Producer: Scott MacAllister 
Executive Producer: Ken Gordon

The Resonance Test 99: Balazs Fejes and Boris Chave on Syz Bank's Digital Transformation

When it comes to the topic of drug discovery and development, scientists are busy furrowing their lab-goggled brows trying to understand what’s real and what’s hype when it comes to the power and potential of AI. 

This *Resonance Test* conversation perfectly dramatizes the situation. In this episode, Emma Eng, VP of Global Data & AI, Development at Novo Nordisk, and scientist and strategist Chris Waller provide a candid view of drug development in the AI era.   

“We're standing on a revolution,” says Eng, reminding us that “we've done it so many other times” with the birth of the computer and the birth of the internet. It’s prudent, she cautions, not to rush to judgement guided by either zealots or skeptics.

Waller says, of the articles about AI and leadership in *Harvard Business Review,* one could do “a search and replace ‘AI’ with any other technological change that's happened in the last 30 years. It's the same kind of trend and processes and characteristics that you need in your leadership to implement the technology appropriately to get the outcomes that you're looking for.”  

Which means, for pharma, much uncertainty and much experimentation. 

“I think experimentation is good,” says Eng, who then adds that we need to always keep track of what is it that we're experimenting on. She says that the word “experimentation” can “sound very fluid” but in fact, “It's a very structured process. You set up some very clear objectives and you either prove or don't prove those objectives.”

Waller references the various revolutions (throughput screening, combinational chemistry, data, and analytics revolutions) that pharma has seen and says: “We've all held out hope for each and every one of these revolutions that the drug discovery process is going to be shrunk by 50% and cost half as much. And every time we turn around, it's still 12 to 15 years, $1.5 to $2 billion.”

Will AI make the big difference, finally?

“Maybe we need to be revolutionized as an industry,” she says. “It can be hard to make much of a difference as long as there are few big players.” Just a few big players, she says, is “the nature of pharma.”

Of course, our scientists are measured in their assessments about industry change. After all, as Waller says, the systems involved—the human body, the regulatory environment, the commercial ecosystems—are all “super-complicated.”

Eng notes that an important side-effect around the AI hype is corporate interest in data. “Now it's much easier to put that topic on the table saying, ‘If you want to do AI, you need to take care of your data and you need to treat it like an asset.’”

Listen on as they test topics such as regional and regulatory challenges in AI adoption, change management, and future tech and long-term impact (watch out for quantum, everyone!). 
In the end, Eng returns to the idea of revolutions. “You think you want so much change in the beginning which you don't get because it takes time,” says Eng. This makes us underestimate what will happen later. Having such a farseeing mindset is significant, she says, because “these technology shifts will have a large impact on the long term.”

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

The Resonance Test 100: Emma Eng of Novo Nordisk

EPAM Continuum's award-winning podcasts feature interviews with people practicing innovation in various forms, digging into their ability to deliver results. Repeatedly.

Silo Busting 26: Bringing the Offensive Angle with Sharon Nimirovski and Sam Rehman

The EPAM Continuum Podcast Network

Related tracks