Advertise on podcast: RSAC

App generators can ship a working app in an afternoon, and many of them build on the same backend-as-a-service: Supabase. That shared foundation means one misconfiguration can repeat across thousands of deployments. Ari Marzuk, Lead Security Researcher at Salesforce, and Roi Nisimi, Principal Security Researcher at Orca Security, break down a real-world technique attackers use to turn that weakness into a campaign. They show how Certificate Transparency logs can build a self-replenishing target list of more than 40,000 leads. Listeners will understand why app generators concentrate risk in shared backend services. how Certificate Transparency exposes vulnerable deployments at scale, how attackers design campaigns that compromise many victims at once, and what this playbook means for teams building or securing generated apps.

Every cybersecurity founder eventually gets asked some version of the same question: was I always going to end up here, or did the problem just find me? Eran Barak has lived both answers. After building and selling Hexadite to Microsoft, he spent years working inside one of security's messiest problems — data protection scattered across a dozen disconnected tools — before deciding to found Mind, an AI-native data loss prevention company, in 2023. In conversation with Jenny Brock, RSAC's Senior Manager of Innovation Programs, Barak walks through the decisions that shaped his path from first exit to second company: how he chose his co-founders, when to leave a comfortable executive track, and why he stepped back from angel investing once Mind became his full-time bet. Listeners will learn: - How to know whether a recurring problem is actually worth building a company around - What to look for in a co-founder — and why Barak compares the choice to a marriage - Why validating market pain matters more than product polish in the early days - When angel investing helps a founder, and when it becomes a conflict worth walking away from

Cisco's Chief Security & Trust Officer, Anthony Grieco, was among the first defenders granted early access to Anthropic's frontier AI model, Mythos, through Project Glasswing, a cybersecurity initiative led by Anthropic to secure the world's most critical software. In this episode, he joins Dr. Hugh Thompson to share what that early look revealed and what he's learned about using frontier AI models for security since then. He also covers how frontier AI is impacting how he leads teams through constant change, builds internal buy-in with leadership, and separates real AI risk from noise.

What separates a track submission that gets accepted from one that doesn't? On this episode of RSAC Cyber at the Top Podcast, members of the RSAC Leadership & Workforce Development Program Committee open up their review process: the criteria they weigh, the gaps they see most often, and what actually signals a strong proposal versus a forgettable one. Guests include Shawn Harris, VP of Information Security Strategy, Engineering, and Architecture at The Walt Disney Company, alongside fellow committee members John D. Johnson, President/Founder, Docent Institute, and Patricia Titus, Field CISO, Abnormal AI, the conversation draws on years of reviewing Conference submissions to give prospective speakers a real look inside the process. Rather than generic tips, you'll hear the specific criteria reviewers apply and how to shape a submission around them. If you're considering submitting a talk for an RSA Conference 2027 track, this episode is a working guide—practical, direct, and grounded in what reviewers are actually looking for.

When a CISO has a direct line to the CEO, it reshapes how cybersecurity risk gets discussed, prioritized, and acted on across the organization. In this episode, Frank Fischer, Group CISO at DHL, shares what he's learned leading security at one of the world's largest logistics companies. Fischer breaks down what makes the CISO-CEO relationship work, how to translate complex cyber risk into business language the board and executive team understand, and whether direct CISO-to-CEO reporting is the right model for every organization. He also outlines the communication and leadership skills CISOs need to develop to be effective at the executive level.

As AI systems move into production, managing supply chain risk goes beyond traditional SBOMs. This podcast episode shares lessons from the first cycle of AI Bill of Materials (AIBOM) audits—where theory met reality in contracts, disclosures, and accountability. With the rapid adoption of AI agents and foundation models in enterprise environments, organizations face new challenges in visibility, provenance, and third-party AI risk. Attendees will take away practical strategies for enforceable controls, adaptable schemas, and continuous assurance in an evolving AI supply chain landscape.

Quantum computing is no longer a distant threat. It is now a present-day concern for security leaders who must protect data that could be harvested today and decrypted tomorrow. In this episode, Noopur Davis, Chief Information Security and Product Privacy Officer at Comcast, cuts through the hype to explain what quantum resilience really means for enterprise security programs. She shares a practical roadmap for getting started now and tackles the harder organizational challenges: making the business case to executive leadership and helping teams develop the skills they'll need for this shift. Whether your organization is just beginning to think about quantum readiness or looking to accelerate progress, this episode offers clear, actionable guidance on where to start.

Cyber defenders are experiencing unprecedented levels of stress, burnout and fatigue. New data is helping us understand the scale of the challenge. In this episode, we unpack the findings from a recent study that tracked the effects of resilience training on hundreds of cybersecurity professionals. From sleep and stress to burnout risk and attrition, we’ll dig into what the numbers reveal, what the training actually involves, and whether the results hold up to scrutiny. Essential listening for anyone leading or working in a security team.

In today’s threat landscape, no organization can defend itself alone. In this episode, Jenny Menna, Chief Security Officer at Sallie Mae and board member at FS-ISAC, explores the critical role of threat intelligence sharing and peer collaboration in modern cybersecurity. From the rise of less sophisticated but highly motivated attackers to the growing importance of real-time insights and trusted networks, she discusses how information sharing has expanded beyond data into actionable defense strategies. Jenny also shares practical guidance on building trust, overcoming legal and cultural barriers, and turning collective intelligence into meaningful action.

Security leaders are facing a new reality: SaaS has become the path of least resistance for attackers. As organizations adopt thousands of third-party applications and shift sensitive data into public infrastructure, traditional security approaches are struggling to keep up. In this episode, we explore why SaaS risk has emerged as a critical battleground, how it differs from legacy infrastructure risk, and where many organizations are still falling short. We also examine how attackers are evolving their tactics, the emerging risks introduced by AI-powered SaaS features, and what practical steps CISOs can take to regain control. Tune in for actionable guidance on prioritizing, partnering with the business, and building a more resilient SaaS security strategy.

As AI expands across critical sectors, this podcast episode examines how it disrupts privacy and compliance, creating new risks in consent, data use, and re‑identification. Through real cases and practical guidance, listeners learn how to build privacy‑first AI systems that maintain trust and regulatory alignment. Speakers: Noor Bains, Principal Field Solutions Architect, CDW Tatyana Sanchez, Senior Coordinator, Content & Programming, RSAC Kacy Zurkus, Director of Content, RSAC 922322

This episode explores the intersection of innovation and security, and why today’s CISOs must help shape what comes next. Nasrin Rezai, SVP & CISO at Verizon, discusses how security leaders can work with startups to drive meaningful change. She shares what makes a young company stand out, how to structure successful pilots, and where startups often miss the mark with enterprise buyers. If you’re balancing bold ideas with responsible risk management, this episode offers clear, actionable insights for leading innovation with confidence.

This podcast presents a quantum-safe blueprint for Privileged Access Management, integrating AI and Zero Trust principles. We'll explore how to protect critical access against quantum threats and AI-powered attacks, addressing the current preparedness gap. Learn actionable strategies for crypto-agility and securing all identities, human and non-human, for a resilient future. Speakers: Malhar Vora, Principal Engineer | Engineering & People Leader, ANZ Bank Tatyana Sanchez, Senior Coordinator, Content & Programming, RSAC Kacy Zurkus, Director of Content, RSAC

Speed is becoming a defining advantage in cybersecurity. In this episode, Phyllis Schneck, VP and CISO at Northrop Grumman, joins Dr. Hugh Thompson to explore how high-performance computing is reshaping cyber defense. From accelerating real-time threat detection and response to amplifying the impact of AI and automation, they discuss how increased compute power is transforming both attackers and defenders. The conversation also highlights the importance of building secure foundations, avoiding common pitfalls, and enabling organizations to move at speed without increasing risk. Guest: Dr. Phyllis Schneck, Vice President & Chief Information Security Officer, Northrop Grumman

Many organizations treat GenAI governance as a documentation or compliance exercise. This podcast episode reframes AI governance as a system-design problem and presents control-plane patterns for managing risk, accountability, and compliance across large-scale AI deployments. Speakers: Varun Raj, Associate Partner, Kyndryl Tatyana Sanchez, Senior Content Coordinator, RSAC Kacy Zurkus, Director, Content, RSAC