CEO and Entrepreneur Jean Phillip Bernier, the CEO of AnniQ and Spin Quantum Tech, shares his enthusiasm for AI and Quantum Computing technology advances. Bernier tracks the progress of Quantum Computing, especially IBM’s rapid development from a 5-qubit machine in 2017 to a prediction of a 100,000-qubit machine by 2033. The staggering quantum processing power, he believes, could unlock problem-solving potential beyond our current imagination.

Bernier spotlights the role of cloud computing in democratizing technology. He reminisces about the early computing era when Sun Microsystems’ technologies were out of reach for many due to high costs. Cloud computing has flipped this narrative, transforming sophisticated, expensive technology tools to something affordable to organizations of virtually any size. Anyone with a credit card can delve into Quantum Computing capabilities. This, in turn, fosters a thriving community of quantum algorithm enthusiasts and learners.

Bernier explores three real-world applications of Quantum Computing: 1) business operations optimization, 2) AI algorithm acceleration, and 3) most significantly, a unique encryption method known as “entropic encryption.” This approach is a game-changer for data security. Traditional encryption relies on the secrecy of a single key, which is under threat with quantum technology’s ability to consider all possible solutions simultaneously. Entropic encryption offers a fresh perspective by harnessing the inherent chaos and entropy of quantum states, hiding data in a sea of what appears to be random noise. The data is unreadable without the correct pattern, providing a new layer of security and a multiplicity of decryption avenues.

To make sense of the complex Quantum Computing world, Bernier draws parallels between Newton’s concept of gravity and the superposition principle in quantum mechanics. Just as gravity influenced falling objects before Newton quantified it, Quantum Computing uncovers existing, yet previously unexplored data patterns. At the same time, Bernier acknowledges the nascent state of Quantum Computing, referring to recent incidents of broken algorithms as a part of the technology’s learning curve.

When it comes to cybersecurity, Bernier predicts a convergence of AI and Quantum Computing. He shares about an ongoing project Spin Quantum Tech is managing with a U.S. company, where they are leveraging both Quantum Computing and AI to develop a novel anti-ransomware solution. The team is capitalizing on the power of Quantum Computing to rapidly explore a multitude of decryption keys, paired with AI’s predictive and learning capabilities, to swiftly identify and implement the correct decryption pattern. This fusion of technologies is expected to create a dynamic solution, capable of not only recovering information held ransom but doing so in a manner that eliminates the necessity for victims to negotiate with cybercriminals. The project is pioneering in its approach and could radically reshape the cybersecurity landscape, providing robust defenses against the ever-evolving threat of ransomware.

LinkedIn: https://www.linkedin.com/in/jean-phillip-bernier-artificial-intelligenge-marketing-analytics-quantum-computing/ 

AnniQ: https://www.anniq.ai 

Spin Quantum Tech: https://spinqtech.com/

Kitecast

Jean Phillip Bernier: Quantum AI: The Future of Cybersecurity

In the latest Kitecast episode, Lisa Plaggemier, the Executive Director of the National Cybersecurity Alliance, discusses what it takes to empower digital safety for all peoples and organizations. With an extensive background in marketing, operations, and cybersecurity, including a decade at Ford Motor Company and senior roles at CDK Global and InfoSec, Lisa brings a wealth of experience and lessons learned to the topic. Her focus is on helping businesses and individuals protect themselves in the digital world, which enables organizations to develop better cybersecurity risk management strategies.

Lisa emphasizes the importance of consistent and clear communications when it comes to cybersecurity awareness. She highlights the success of Cybersecurity Awareness Month, an initiative founded by the National Cybersecurity Alliance, attributing its effectiveness to the consistency of the message over time. Lisa also stresses the need to demystify cybersecurity for the average person, making it more attractive and less intimidating to adopt safe online practices.

One of the key challenges Lisa identifies is the knowledge gap between IT professionals and business owners, particularly in small businesses. To address this gap, the National Cybersecurity Alliance launched a training class tailored to educate business leaders on managing cybersecurity as a function of their business. The organization also recognizes the importance of early cybersecurity education, with plans to develop age-appropriate content for children in collaboration with PBS Kids.

Lisa shares insights from the National Cybersecurity Alliance’s annual survey, revealing alarming trends such as the persistence of insecure password practices and the overconfidence of younger generations in their ability to navigate cybersecurity risks. She also discusses the need for widespread adoption of multi-factor authentication (MFA) and the role of social media companies in mandating more stringent security measures.

In addition to the above, Lisa emphasizes the National Cybersecurity Alliance’s commitment to promoting cybersecurity awareness through various initiatives, including the creation of a comedic series called Kubikle Series to engage a broader audience. With her expertise and dedication to the cause, Lisa—and the National Cybersecurity Alliance—continue to play a crucial role in empowering individuals and organizations to stay safe in the ever-evolving digital landscape.

LinkedIn: https://www.linkedin.com/in/lisaplaggemier

NCSA: https://staysafeonline.org/ 

Kubikle Series: https://kubikleseries.com/

Lisa Plaggemier: Empowering Digital Safety for All

Edna Conway, an innovative executive and thought leader with over 30 years of experience leading cybersecurity, risk management, and value chain transformation at Fortune 10 technology companies, highlights how collaboration in cybersecurity is critical for the development of and adherence to policy and practice in this Kitecast episode. Edna is currently a Senior Fellow at the Carnegie Endowment for International Peace and CEO and Founder of EMC Advisors. She currently is an advisor or board member for a long list of technology and professional services startups and nonprofit organizations.

One theme from the discussion with Edna centered on the cybersecurity workforce shortage. She emphasized the need to look beyond traditional sources and backgrounds to find talent. This requires partnerships between companies, academia, and nonprofits focused on training and upskilling people from diverse backgrounds for cybersecurity roles. Apprenticeship and mentorship models were discussed as potential solutions.

The conversation then delved into cybersecurity policy and regulation. Edna provided her perspectives on the balance between driving security practices versus overregulation that hinders business. She noted that legislation often lags behind technology advancements, making public-private collaboration critical. Edna stressed the importance of the private sector proactively stepping up security rather than just reacting to new regulations.

Another key topic from the podcast touched on the crowded landscape of cybersecurity startups and the challenges they face. Beyond just having an innovative product, Edna emphasized the importance of serving a real customer need, providing a complete solution, and demonstrating value to multiple stakeholders in an organization beyond just the security team. Making customers’ lives easier is key to standing out.

Edna also touched on the need to embed security into business processes and objectives from the start, rather than bolting it on afterwards. She discussed the concept of “secure by design” and how leading organizations are building security into everything from their products to their supplier relationships. This proactive, holistic approach is critical to managing cyber risk in an increasingly interconnected business environment.

LinkedIn: https://www.linkedin.com/in/ednaconway

EMC Advisors: https://www.linkedin.com/company/emcadvisors

Edna Conway: Collaboration in Cybersecurity Policy and Practice

John Christly, VP of Services for Blue Team Alpha, and author of two cybersecurity books, brings his wealth of experience to this episode of Kitecast. With a background spanning roles such as CEO, CIO, CISO, and CTO, as well as military service, Christly offers unique insights into the world of cybersecurity compliance for Department of Defense (DoD) contractors.

In this enlightening discussion, Christly demystifies the Cybersecurity Maturity Model Certification (CMMC) process. He explains how many organizations are surprised to find they’re further along in compliance than they initially thought, thanks to existing frameworks like DFARS and NIST 800-171. However, he cautions that self-attestation is no longer sufficient, emphasizing the need for third-party verification in the new CMMC landscape.

Christly also delves into the critical role of FedRAMP certification in doing business with the government. He highlights the importance of data sovereignty and security in protecting American interests. The conversation explores the challenges of achieving “FedRAMP-like” status and the expertise required to truly build secure systems to DoD specifications.

The podcast doesn’t shy away from emerging threats, with Christly offering valuable insights on managing AI-related risks in the workplace. He stresses the importance of clear policies, employee education, and ongoing monitoring to harness the benefits of AI while protecting sensitive data. Christly’s practical advice on consolidating security tools and gaining visibility into cloud application usage provides actionable strategies for improving organizational cybersecurity posture.

Whether you’re a DoD contractor or simply interested in elevating your cybersecurity practices, this episode of Kitecast is a must-listen. Tune in now and take the first step towards robust, compliant cybersecurity for your organization.

LinkedIn
https://www.linkedin.com/in/johnchristly/

Blue Team Alpha
https://www.blueteamalpha.com

Book: NIST 800-171 Controls Made Simple: A Step by Step Guide
https://www.udemy.com/course/nist-800-171-controls-made-simple 

Book: The Basics of Cybersecurity
https://www.amazon.com/dp/B0CZY65DQC

John Christly: Demystifying CMMC to Protect the DIB

Jerod Brennen, VP of Cybersecurity Services at SideChannel, brings a unique perspective to cybersecurity leadership. Originally pursuing a career in music education, Brennen's journey led him through various IT roles before landing in cybersecurity at a public utility. Today, he serves as a vCISO for multiple organizations while also creating educational content for LinkedIn Learning, where he has developed over 40 courses covering topics from application security to ethics in technology. His unconventional path from music to technology has shaped his approach to security leadership, emphasizing the importance of both technical expertise and human understanding.

As a vCISO, Brennen emphasizes the importance of tailored security approaches for small and medium-sized businesses. His work at SideChannel involves helping organizations across various sectors—from healthcare technology to manufacturing—build resilient security programs that align with their specific needs and capabilities. He highlights that while many of these businesses may not have the resources for a full-time CISO, they still require sophisticated security leadership to protect their digital assets and maintain compliance with industry standards. Brennen’s approach focuses on building security programs that enable business growth rather than simply implementing restrictions, ensuring that security measures support rather than hinder organizational objectives.

A significant portion of the conversation focused on the challenges of data security in modern business environments. Brennen discusses the complexities of managing data access, particularly in cloud environments, and emphasizes the importance of proper tenant separation for different environments (development, testing, production). He notes that while cost often drives initial cloud decisions, mature organizations eventually shift their focus to building stable, secure infrastructure that aligns with their business goals. The discussion delved into the increasing importance of compliance frameworks such as SOC 2 and CMMC, with Brennen sharing insights on how organizations can effectively prepare for and maintain these certifications while avoiding common pitfalls. He stresses the importance of viewing these compliance requirements not just as checkboxes, but as opportunities to build genuine security resilience.

The discussion also touched on emerging technologies, particularly the challenges and opportunities presented by AI. Brennen addresses the growing concern among organizations about the secure use of generative AI tools, highlighting the need for clear policies around data sharing with these platforms. He emphasizes the importance of considering long-term implications of AI adoption, drawing parallels with recent events in the tech industry to illustrate the potential risks of data handling by emerging technology companies. His perspective on AI security is particularly relevant given the current landscape where many employees are already using these tools without formal organizational guidance. Brennen advocates for a balanced approach that allows organizations to leverage AI's benefits while maintaining appropriate security controls.

Throughout the conversation, Brennen's passion for education and mentoring shines through. He discusses his extensive work in creating cybersecurity training content, including specialized courses on ethics in information security and emerging technologies. His commitment to education extends beyond formal training, as he regularly contributes to the cybersecurity community through speaking engagements and mentorship opportunities. Brennen’s approach to security leadership combines technical expertise with a strong emphasis on building understanding and capability across organizations.

LinkedIn: https://www.linkedin.com/in/jerodbrennen/ 

SideChannel: https://sidechannel.com/

Jerod Brennen: From Music Educator to Cybersecurity Consultant and Mentor

The Kiteworks 2025 Forecast for Managing Private Content Exposure Risk Report offers a comprehensive analysis of emerging cybersecurity and compliance trends shaping the year ahead. The report identifies 12 pivotal trends affecting how organizations manage private content exposure risk, highlighting critical areas like data privacy regulations, software supply chain security, AI governance, and quantum computing threats. With 75% of the world's population expected to have their personal data protected under privacy laws by 2025, organizations must implement robust strategies to mitigate risks and ensure compliance.

Software Supply Chain Security Remains Critical

During the Kitecast episode, cybersecurity experts Alexandre Blanc and Evgeniy Kharam discussed the alarming rise in software supply chain attacks. These attacks are projected to spiral and the associated cost. The experts emphasized that while compliance frameworks like SOC 2 and ISO 27000 standards provide baseline guidance, organizations must move beyond mere checkbox security compliance. "Alexandre explained, “Organizations often view SOC 2 or ISO certification as the end goal, but that's just the starting point. What matters is building a comprehensive security program that actually addresses real risks and maintains security posture over time."

CMMC 2.0: A Wake-up Call for Defense Contractors

The discussion delved deep into CMMC 2.0 compliance challenges facing defense contractors. While surveys indicate most organizations believe they're prepared for certification, the reality is starkly different: the actual number of organizations ready to pass certification requirements is quite low. Evgeniy noted, "Don't wait to start your CMMC preparation. This isn't just about checking boxes. Organizations need to understand their environment, document their processes, and implement required controls - all of which takes significant time and resources."

AI Adoption Increases Cybersecurity Risk Exposure

The Kitecast conversation highlighted growing concerns about employees inadvertently exposing sensitive data through public large language models (LLMs) and other AI tools. Rather than focusing solely on technical controls, the experts emphasized the need for comprehensive governance frameworks that include clear policies, regular training, and approved platforms for business use. You cannot just block ChatGPT and think you've solved the problem. New AI tools emerge constantly. Organizations need to educate employees about the risks and provide secure alternatives for legitimate business needs.

Data Classification and Zero Trust Architecture

A significant portion of the discussion focused on the challenge of managing unstructured data across organizations. Few organizations have tagged and classified all their unstructured data. This creates significant compliance risk exposure and makes it nearly impossible to properly protect sensitive information. The experts emphasized that implementing zero trust principles can save organizations millions of dollars during a data breach, highlighting the importance of continuous validation and comprehensive monitoring in reducing cyber risk exposure.

2025 Forecast Report
https://www.kiteworks.com/forecast-report/ 

LinkedIn Profile for Evgeniy Kharam
https://www.linkedin.com/in/ekharam/

LinkedIn Profile for Alexandre Blanc
https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/ 

Kiteworks 2025 Exposure Risk Report: 12 Predictions

Arun DeSouza, the Managing Director at Profortis Solutions, brings over two decades of experience as a CISO, having developed and implemented award-winning programs in identity lifecycle management and IoT security. His impressive career includes induction into the CISO Hall of Fame by the Global Cyber Startup Observatory and recognition as a top CISO by Cyber Defense Magazine. Arun’s expertise, combined with his academic background—a Ph.D. in Chemical Engineering from Vanderbilt—offers listeners a unique perspective on navigating today’s complex cybersecurity landscape.

From Chemical Engineering to Cybersecurity Leadership

Arun’s journey into cybersecurity is as unconventional as it is inspiring. Initially trained as a chemical engineer, he transitioned to cybersecurity through hands-on experience and a fearless approach to problem-solving. Faced with the challenge of managing global security for a French company, Arun built a strategic plan that not only upgraded systems but also delivered significant savings. His approach, which he calls the “power of federation,” involved collaborating with partners for discounted pricing and consolidating resources.

Navigating Cybersecurity Threats: IoT, Ransomware, and AI

Arun sheds light on the evolving cybersecurity threat landscape, particularly the rapid proliferation of IoT devices. With an estimated 75 billion IoT devices by 2025, the risks associated with insecure software, vulnerable cloud communications, and expanded attack surfaces are more significant than ever. He highlights specific challenges in manufacturing and OT security, where ransomware and supply chain attacks can cripple operations. Arun also warns of the impending threat of AI-powered supply chain attacks, which could amplify the scale and sophistication of breaches. His insights reinforce the need for robust data governance and the adoption of Zero Trust security models to mitigate these risks effectively.

Critical Role of Identity Management and Leadership

Central to Arun’s security philosophy is the concept of identity access management (IAM) as a strategic cornerstone. He introduces the idea of the “identity coin,” which blends physical security (person, device, location) with logical security (attributes, behavior, context). Arun emphasizes that security is not just about technology but also about strong leadership and communication. He advises CISOs to build relationships with senior leaders, use storytelling to convey risks, and align security initiatives with business objectives. His analogy of the CISO as the “captain of the good ship cyber” encapsulates his forward-thinking approach to navigating cybersecurity challenges.

Technical Acumen and Strategic Vision

Arun’s expertise and leadership offer actionable insights for anyone looking to strengthen their cybersecurity strategy. His forward-thinking approach to risk management, identity governance, and embracing change provides a valuable blueprint for both cybersecurity professionals and business leaders. By applying Arun’s principles of strategic planning, collaboration, and Zero Trust security, organizations can navigate today’s complex threat landscape with confidence. 

LinkedIn: https://www.linkedin.com/in/arundesouza/

Profotis Solutions: https://profortissolutions.com/ 


Arun DeSouza: Becoming a Transformational CISO

This insightful Kitecast episode features Dominic Bowen, Partner and Head of Strategic Advisory at 2Secure in Stockholm, Sweden. With over 20 years of experience supporting business leaders, boards, and executives, Dominic brings valuable perspective from his work across cybersecurity, generative AI, risk management, and crisis response. His background spans strategic leadership positions in humanitarian organizations, military service with Special Operations Command, and law enforcement—providing him unique insights into risk management across diverse environments.

Many risks facing organizations today are predictable, not "black swan" events. Dominic emphasizes that effective risk management begins with understanding the business environment before identifying, analyzing, and mitigating threats. Companies that neglect this approach face potential disruptions, as demonstrated by European and North American businesses that expanded into China without adequate risk assessment or those slow to withdraw from Russia after its invasion of Ukraine. Businesses must recognize that events like inflation spikes, terrorist attacks, or regional conflicts aren't unpredictable—proper planning and preparation can help organizations navigate these challenges.

Cybersecurity represents one of the most pressing concerns for business leaders globally. Dominic notes that cyber threats have evolved into warfare weapons, with European officials warning businesses and citizens to prepare for heightened threats. This reality is demonstrated by the Russian attacks on Ukrainian financial institutions before the 2022 invasion and ongoing attacks against energy infrastructure throughout Europe. Even Dominic's International Risk Podcast experiences significantly increased attack attempts whenever episodes covering Russia or Ukraine are released. For businesses, this necessitates not just regulatory compliance but leveraging security frameworks as competitive advantages that enable boards and executives to move forward confidently despite increasing threats.

Artificial intelligence offers transformative benefits for risk management—when properly implemented. Organizations can gain significant advantages through AI-powered predictive analytics, automated threat detection, improved decision-making capabilities, and scenario development. However, many senior leaders remain hesitant to embrace these technologies due to fear and uncertainty. Dominic highlights that companies using AI for real-time threat intelligence gain the same advantage as "the one guy at the bar who hasn't been drinking, who can see that a punch is about to be thrown." Those organizations leveraging AI for fraud detection, identifying insider threats, and recognizing suspicious transactions position themselves ahead of competitors who fail to adopt these tools.

Effective risk management requires methodical approaches regardless of organizational context. Whether operating in conflict zones, developing humanitarian responses, or expanding business operations, Dominic emphasizes that the process remains consistent: understand the environment before attempting to identify or mitigate risks. This principle applies equally to special operations missions, establishing health clinics in conflict regions, or relocating business operations from China to Vietnam. Organizations that invest time in thoroughly understanding cultural, linguistic, political, and historical contexts before implementing risk mitigation strategies achieve substantially better outcomes. 

LinkedIn Profile: https://www.linkedin.com/in/dominic-bowen/ 

2Secure: https://2securecorp.com/ 


Dominic Bowen: Geopolitical Risk Planning & Management

In this insightful episode, cybersecurity experts Mike Crandall and Arun DeSouza join host Patrick Spencer to analyze Kiteworks' Top 11 Data Breaches in 2024 Report. Rather than just focusing on the number of records breached, the report introduces a sophisticated algorithm with seven key factors to score breaches on a scale of 1-10. This method provides a more comprehensive understanding of breach severity by evaluating financial impact, data sensitivity, regulatory compliance implications, ransomware involvement, supply chain impact, and attack vector sophistication. National Public Data topped the list with a score of 8.93, followed by Change Healthcare and Ticketmaster, both scoring 8.7.

A significant finding discussed by the experts is the shift in industry targeting patterns, with financial services overtaking healthcare as the most breached sector. As Arun explains, "Banks have a lot of money... attackers are more likely to get paid," making financial services increasingly attractive targets compared to healthcare organizations that may be less likely to pay ransoms due to regulatory constraints. Mike adds that threat actors constantly adapt their tactics based on which sectors provide the highest return on investment, though healthcare remains highly vulnerable with the Change Healthcare breach creating nationwide disruption.

The conversation emphasizes how credential theft continues to plague organizations despite sophisticated controls. Five of the top 11 breaches resulted from credential compromises, including attacks that bypassed multifactor authentication. Arun highlights that despite years of security awareness training, approximately 25% of incidents remain attributable to human error. He warns of the growing sophistication of social engineering with AI-generated phishing that will soon include voice modulation and deepfakes, making attacks increasingly difficult to detect. Mike recommends leveraging AI defensively to detect anomalous behaviors that humans might miss.

Both experts stress the critical importance of data protection and classification. As Patrick notes, "Zero trust must extend to that data layer." Arun advocates for AI-powered data characterization and governance platforms that can proactively identify sensitive information requiring protection. Mike emphasizes the need for proper data classification, noting that organizations often struggle to differentiate between critical and non-critical data. He recommends data minimization strategies including cold storage for inactive data to reduce the potential attack surface. The experts agree that building enterprise-wide risk awareness requires collaboration across departments rather than treating security as an isolated IT function.

The panel concludes that organizations must prioritize zero-trust architecture implementation, adopt data minimization strategies, and enhance incident response capabilities. Arun frames this as a comprehensive coalition of "people, process, and technology safeguards all working together." Mike adds a sobering perspective for businesses that might not see themselves as targets: "These weren't the 11 hacks of 2024. These were the top hacks... there are literally hundreds of thousands, if not millions more. And that's you." The experts emphasize that breach impact often depends more on data sensitivity than raw numbers, and security resources should be allocated accordingly.

Top 11 Data Breaches in 2024 Report: https://www.kiteworks.com/top-data-breaches-report/ 

Arun DeSouza LinkedIn: https://www.linkedin.com/in/arundesouza/ 

Mike Crandall LinkedIn: https://www.linkedin.com/in/crandallmike/ 


Analysis and Lessons from Kiteworks Top 11 Data Breaches in 2024 Report

This Kitecast episode features Chris Pogue, Director of Digital Forensics at CyberCX, a cybersecurity veteran with 25 years of experience. Chris brings unique insights from his extensive background spanning penetration testing, executive leadership, and military instruction. As an adjunct professor at Oklahoma State University, he teaches both international business and digital forensics, emphasizing the critical importance of communication between technical and non-technical stakeholders.

Chris introduces CyberCX as "the biggest cybersecurity company you've never heard of"—a pure-play security firm with 1,500 professionals globally. Founded in Australia through the acquisition of 24 boutique security firms, CyberCX stands apart by focusing exclusively on cybersecurity expertise without the distractions of hardware sales or software development. With specialized teams including 200 penetration testers and 40 incident responders, they offer comprehensive security solutions tailored to each client's unique risk profile.

The conversation reveals alarming trends in the threat landscape, including the surprising resurgence of SQL injection attacks targeting forgotten systems and unpatched vulnerabilities. Chris explains that once an exploit is announced, threat actors typically begin targeting it within 24 to 48 hours, yet organizations often take 60 to 90 days to implement patches. The podcast also explores how ransomware tactics are evolving from simple data encryption to targeting operational technology and critical infrastructure, creating more leverage by disrupting business continuity rather than just threatening data exposure.

Third-party risk management emerges as a critical concern, with Chris noting that the traditional "castle and moat" security model has become obsolete in today's interconnected business environment. He describes how Business Email Compromise attacks frequently move laterally across supply chains, with compromised trusted partners becoming vectors for invoice fraud and malware distribution. The conversation also touches on the emerging role of AI in creating more convincing phishing campaigns and voice synthesis attacks.

Drawing on decades of experience, Chris offers this compelling perspective on security investment: "In my career, I have yet to find an organization who under-invested in cybersecurity and was thankful that they did later." With data breach costs averaging $4.5 million globally and $9 million in the United States, the economic argument for proactive security becomes increasingly clear. Don't miss this eye-opening discussion on the frontlines of cybersecurity defense.

LinkedIn Profile: https://www.linkedin.com/in/christopher-pogue-msis-6148441/ 

CyberCX: https://cybercx.com/ 


Chris Pogue: Digital Forensics in the Modern Threat Landscape

Scott McCrady's path to becoming CEO of SolCyber started in the server rooms of the early 2000s. Back then, he was installing Nokia security appliances and building some of the first security operations centers for major corporations. McCrady spent years at companies like Symantec and FireEye, where he learned that keeping businesses safe requires more than just technical know-how. He built Symantec's security services across Asia Pacific, managing teams in multiple countries and learning how different businesses approach security challenges. Later at FireEye, he helped launch their partner strategy during the rise of nation-state attacks. Today, he runs SolCyber with a simple mission: help companies protect themselves from identity-based attacks that bypass traditional security tools.

McCrady explains that hackers don't break into networks the way they used to. Twenty years ago, they looked for open ports and vulnerable servers. Ten years ago, they targeted employee laptops and phones. Today they steal usernames and passwords, especially administrative accounts. Insurance companies tell McCrady that nine out of ten breaches happen because someone's login credentials got compromised. The problem gets worse because IT teams often give employees more system access than they need—it's easier than figuring out exact permissions each person requires. McCrady shared an example: a company with 500 employees had over 70 administrative accounts. Some hadn't been used in nine months, then suddenly started browsing the internet—a clear sign that hackers had taken control.

Even large companies with thousands of employees struggle with basic security tasks. McCrady works with organizations that can't answer simple questions like "Where are all our security logs stored?" or "Who can access our customer data?" These aren't startups—these are established companies with IT departments and security budgets. They have data scattered across different systems, some going to one security vendor, some to another, and some not monitored at all. While vendors push artificial intelligence and machine learning solutions, most businesses just need help organizing what they already have. They need to get their house in order before worrying about advanced threats.

So what actually works? McCrady keeps it simple with five must-haves. First, turn on multi-factor authentication everywhere, even though software companies charge extra for it. Second, add email security beyond what Microsoft or Google provides because business email compromise is how most attacks start. Third, install endpoint detection software that catches modern malware. Fourth, run security awareness training so employees recognize phishing emails (and to keep your cyber insurance valid). Fifth, buy cyber insurance now while it's affordable. McCrady's company, SolCyber, packages these essentials into what they call "foundational coverage"—basically, outsourced security for businesses that need protection but can't afford a full security team. For larger companies, they handle the complex stuff like managing security logs from dozens of systems and responding to attacks in real-time.

The days of building walls around your network are over. Today's hackers use legitimate usernames and passwords to walk through the front door. McCrady's experience shows that most businesses need help with the basics before they can tackle advanced threats. Modern managed security providers like SolCyber offer practical solutions that focus on protecting user identities, monitoring for unusual behavior, and responding quickly when something goes wrong. It's like having someone clean your kitchen while you enjoy your Friday afternoon—sometimes it's smarter to bring in experts who do it every day.

LinkedIn Profile: https://www.linkedin.com/in/scottmccrady/  
SolCyber Website: https://solcyber.com/

Scott McCrady: Modern MSPs and Identity-first Security

Scott McCrady's path to becoming CEO of SolCyber started in the server rooms of the early 2000s. Back then, he was installing Nokia security appliances and building some of the first security operations centers for major corporations. McCrady spent years at companies like Symantec and FireEye, where he learned that keeping businesses safe requires more than just technical know-how. He built Symantec's security services across Asia Pacific, managing teams in multiple countries and learning how different businesses approach security challenges. Later at FireEye, he helped launch their partner strategy during the rise of nation-state attacks. Today, he runs SolCyber with a simple mission: help companies protect themselves from identity-based attacks that bypass traditional security tools.

McCrady explains that hackers don't break into networks the way they used to. Twenty years ago, they looked for open ports and vulnerable servers. Ten years ago, they targeted employee laptops and phones. Today they steal usernames and passwords, especially administrative accounts. Insurance companies tell McCrady that nine out of ten breaches happen because someone's login credentials got compromised. The problem gets worse because IT teams often give employees more system access than they need—it's easier than figuring out exact permissions each person requires. McCrady shared an example: a company with 500 employees had over 70 administrative accounts. Some hadn't been used in nine months, then suddenly started browsing the internet—a clear sign that hackers had taken control.

Even large companies with thousands of employees struggle with basic security tasks. McCrady works with organizations that can't answer simple questions like "Where are all our security logs stored?" or "Who can access our customer data?" These aren't startups—these are established companies with IT departments and security budgets. They have data scattered across different systems, some going to one security vendor, some to another, and some not monitored at all. While vendors push artificial intelligence and machine learning solutions, most businesses just need help organizing what they already have. They need to get their house in order before worrying about advanced threats.

So what actually works? McCrady keeps it simple with five must-haves. First, turn on multi-factor authentication everywhere, even though software companies charge extra for it. Second, add email security beyond what Microsoft or Google provides because business email compromise is how most attacks start. Third, install endpoint detection software that catches modern malware. Fourth, run security awareness training so employees recognize phishing emails (and to keep your cyber insurance valid). Fifth, buy cyber insurance now while it's affordable. McCrady's company, SolCyber, packages these essentials into what they call "foundational coverage"—basically, outsourced security for businesses that need protection but can't afford a full security team. For larger companies, they handle the complex stuff like managing security logs from dozens of systems and responding to attacks in real-time.

The days of building walls around your network are over. Today's hackers use legitimate usernames and passwords to walk through the front door. McCrady's experience shows that most businesses need help with the basics before they can tackle advanced threats. Modern managed security providers like SolCyber offer practical solutions that focus on protecting user identities, monitoring for unusual behavior, and responding quickly when something goes wrong. It's like having someone clean your kitchen while you enjoy your Friday afternoon—sometimes it's smarter to bring in experts who do it every day.

LinkedIn Profile: www.linkedin.com/in/scottmccrady/
SolCyber Website: solcyber.com/


Dr. Rick Goud brings a unique perspective to the data sovereignty conversation, combining medical informatics expertise with entrepreneurial technology innovation. As co-founder and Chief Innovation Officer of Zivver, a secure digital communications platform acquired by Kiteworks in 2025, Goud's journey began with an unexpected twist – missing out on medical school in the Netherlands' lottery system led him to medical informatics, where he discovered his passion for solving healthcare's data security challenges. His background as a strategy consultant in healthcare, where he witnessed firsthand the alarming frequency of sensitive patient data being shared through insecure channels, sparked his mission to create solutions that balance robust security with user-friendly functionality.

The podcast reveals a fundamental tension in European data sovereignty: While Europe boasts the world's strongest data protection laws like GDPR and the upcoming EU Data Act, organizations remain heavily dependent on foreign cloud infrastructure. Goud explains that the challenge extends beyond mere infrastructure – it's the absence of true European alternatives for essential software services that creates vulnerability. He highlights recent incidents, including a French Microsoft executive's court admission that Microsoft cannot prevent U.S. government access to data without customer notification, and the shocking case of a Dutch criminal court judge whose email was blocked by Microsoft at the behest of American authorities. These examples underscore how data sovereignty encompasses not just data protection, but also continuity of service and freedom from foreign interference.

When addressing the economic realities of data sovereignty, Goud advocates for a pragmatic, risk-based approach rather than wholesale abandonment of U.S. cloud services. He emphasizes that organizations should start by identifying their specific risks – whether it's human error (the leading cause of data breaches), email interception, weak passwords, or phishing attacks. The solution often lies in implementing encryption layers where organizations maintain control of their own keys, effectively rendering data unreadable even if accessed by unauthorized parties. This approach allows organizations to continue using familiar tools like Microsoft 365 and Gmail while adding crucial security layers for sensitive information, avoiding the massive costs and behavioral changes required by complete infrastructure migration.

The conversation concludes with practical advice for organizations beginning their data sovereignty journey. Goud recommends starting with "low-hanging fruit" – simple security measures that can be implemented quickly, such as activating DANE (DNS-based Authentication of Named Entities) for email encryption, which despite being available for a decade, sees adoption rates of only 15% to 20%. He stresses the importance of email and file security as the primary risk points where data leaves organizational boundaries. Rather than embarking on multi-year infrastructure overhauls, organizations should focus on immediate, achievable improvements while building partnerships with trusted vendors and peer organizations facing similar challenges. This collaborative approach ensures organizations aren't navigating the complex data sovereignty landscape alone.

LinkedIn: https://www.linkedin.com/in/rickgoud/

Rick Goud: Navigating Europe’s Data Sovereignty Challenges

Cybersecurity experts Heather Noggle and Dr. Arun DeSouza discussed Kiteworks' Data Security and Compliance Risk: 2025 Annual Survey Report, which introduces the industry's first quantitative risk scoring algorithm. The comprehensive study of 461 organizations reveals that 46% now operate in high- to critical-risk territory, with the median enterprise scoring 4.84 on a 10-point scale—dangerously close to the high-risk threshold of 5.0.

The experts analyzed a counterintuitive finding about third-party risk management: Organizations managing 1,001-5,000 external partners face the highest security risk (average score 5.19), surpassing enterprises with over 5,000 third-party relationships. These larger enterprises can monitor risks in real time, while mid-sized partner ecosystems struggle with enterprise-level complexity on mid-market budgets—resulting in 24% experiencing 7+ annual security incidents.

Industry-specific findings revealed surprising risk disparities. Energy topped the risk charts due to legacy IoT devices and 30-year-old technologies vulnerable to exploitation. Technology ranked second, which Noggle attributed to the "overconfidence factor" and rapid employee turnover. "Tech companies are losing people so fast, they want to implement things so fast. That to me is a perfect storm," DeSouza noted. Conversely, heavily regulated sectors like life sciences demonstrated lower risk scores due to compliance-driven security investments.

The report exposed a dangerous "confidence paradox" where organizations claiming to be "somewhat confident" in data governance showed 19% higher risk scores than those acknowledging uncertainty.

AI governance emerged as a critical vulnerability. While 64% of enterprises track AI-generated content (up from 28% in 2024), only 17% have deployed technical governance frameworks. The stakes are high—the IBM Cost of a Data Breach Report found that 97% of AI-related breaches lacked proper controls, with AI breaches costing $670,000 more than average. 

Poor data visibility creates cascading failures: Organizations unable to count their third parties showed 46% correlation with unknown breach frequency, while 31% of those with 5,000+ partners take over 90 days to detect breaches.

Heather Noggle: https://www.linkedin.com/in/heathernoggle/ 
Arun DeSouza: https://www.linkedin.com/in/arundesouza/ 


2025 Annual Survey Report: AI and Third-Party Security Danger Zone

Kevin Powers, Faculty Director of the Masters of Legal Studies in Cybersecurity Risk and Governance at Boston College Law School, began his professional and academic journey when he volunteered for a task force exploring cybersecurity education at Boston College. Rather than developing a purely technical curriculum, he advocated for an interdisciplinary approach that would integrate law, business, and risk management. "Cybersecurity is not just a technical issue," Powers explained during the podcast episode. Working with stakeholders from the White House, FBI, major financial institutions, and technology companies, the team built a curriculum designed to produce well-rounded cybersecurity professionals.

The program launched in 2015 and recently transitioned to BC Law School, offering 10 courses taught entirely by practitioners actively working in the field. Students include FBI agents, financial compliance officers, and executives from Fortune 50 companies, with an average age of 33.
A central theme of Powers' program is bridging the communication divide between technical teams and business leadership. With recent SEC regulations and requirements like New York's DFS Part 500 mandating board-level cybersecurity oversight, organizations need professionals who understand both technical controls and business implications.

"Boards are recognizing cybersecurity as a core business function," Powers noted, emphasizing that every company operating on networks faces operational risk when systems go down. The program prepares students to communicate cyber risk in business terms and develop governance frameworks aligned with regulatory requirements like CMMC 2.0, FedRAMP, and the NIST Cybersecurity Framework.

The program has evolved rapidly to address artificial intelligence governance. Powers redesigned his coursework after discovering AI tools could complete assignments in minutes, shifting 70% of grading to oral presentations that emphasize critical thinking over output.
Looking ahead, Powers identified cloud security and data sovereignty as critical concerns. Many organizations mistakenly believe SaaS platforms automatically back up their data, leaving them vulnerable during incidents. The CDK Global attack on car dealerships illustrated how unprepared businesses can be when cloud services fail.

Beyond academics, Powers emphasizes creating networks. Graduates maintain connections with government agencies, financial institutions, and technology companies, facilitating collaboration across sectors. The program hosts the annual Boston Conference on Cybersecurity, which draws hundreds of attendees including CISOs from major sports franchises and law enforcement leaders.

For organizations navigating increasingly complex regulatory landscapes, Powers' message is clear: cybersecurity expertise must extend beyond technical skills to encompass governance, compliance, and strategic business alignment. As cyber threats evolve, professionals need frameworks like NIST to demonstrate reasonable security practices to regulators while protecting operational continuity.

LinkedIn: https://www.linkedin.com/in/kevin-powers-54893a8/ 
Boston College School of Law: https://www.bc.edu/bc-web/schools/law.html 


Kevin Powers: From Academic to Practical Cybersecurity

Most organizations are racing to adopt AI without considering the security implications. Justin Greis, former leader of McKinsey's cybersecurity practice and founder of an AI-powered consulting firm Acceligence, explains why this approach creates risk and how security leaders can change the conversation.

Companies are deploying AI at different maturity levels. Some distribute AI tools to business units and wait for use cases to emerge. Others push boundaries with advanced algorithms. Few consider the associated risks. The right stakeholders often aren't in the room when AI decisions are made, either because organizations want to move fast or because security teams are underfunded and focused on daily operations. Technology companies are making AI capabilities available at unprecedented speeds, leaving organizations uncertain about securing and deploying these tools responsibly.

Security should be the foundation of trust, not an afterthought. McKinsey research found that customers make buying decisions based on product security when companies can demonstrate testing and rigor. A secure, certified product materially influences purchasing choices compared to alternatives without visible security standards.

Greis emphasizes that compliance certifications like SOC 2 or ISO represent minimum requirements, not security maturity. Organizations secure enough to meet business objectives naturally achieve compliance. The goal is translating business initiatives into security requirements that exceed baseline standards.

The Chief Information Security Officer position has shifted from back-office administrator to business enabler. AI has accelerated this change by converging infrastructure, technology, and cybersecurity into unified platforms. CISOs now have opportunities to demonstrate how they understand business context and can help organizations move faster and safer.

The challenge for security leaders is communication and relationship building. Years of underfunding forced CISOs to focus on survival rather than strategy. As security functions reach parity with other departments, more leaders can engage at the executive and board level. This shift requires CISOs to develop storytelling skills that contextualize security metrics for business audiences rather than overwhelming boards with technical details.

As AI agents begin making decisions without human oversight, organizations face new risks. The push to remove humans from decision loops creates efficiency but introduces vulnerabilities, particularly when AI accesses data it shouldn't process or makes decisions affecting vulnerable populations. Companies need frameworks to identify where human oversight remains necessary and mechanisms to monitor those boundaries.

Organizations implementing AI successfully have thought through secure development lifecycles, DevSecOps, and product operating models. Those starting from scratch face larger organizational changes to incorporate security, privacy, and responsible AI practices into development workflows.

LinkedIn: https://www.linkedin.com/in/justingreis/


Justin Greis: AI Meets Cybersecurity

Kitecast features interviews with security, IT, compliance, and risk management leaders and influencers, highlighting best practices, trends, and strategic analysis and insights. Kitecast is cohosted by Tim Freestone and Patrick Spencer who have more than four decades of combined experience in technology and cybersecurity senior leadership roles.

Kitecast

Pinned to spotlight

Popular tracks