Advertise on podcast: Secure Talk Podcast

CMMC wasn't suspended. Only one piece of it was, and the defense contractors acting like the whole program went away are the ones taking on the most risk. Eighty days after the DoD CIO paused CMMC Phase 2, the 60-day review has closed, a class deviation has written the pause into contracts, and the Reform Task Force's recommendations are still not public. Contracting officers and primes aren't waiting. Some solicitations now require a posted SPRS score before you can even open the RFP. In this SecureTalk panel, host Justin Beals sits down with three NIST SP 800-171 practitioners (a C3PAO strategist, a lead CCA and instructor, and a former Navy cryptologist turned enclave provider) to separate what DoD actually decided from what the internet decided for it. WHO THIS IS FOR Defense contractors and subcontractors, compliance and IT leaders preparing Level 1 or Level 2 self-assessments, MSPs and MSSPs serving the DIB, and anyone trying to make sense of CMMC after the Phase 2 pause. TIMESTAMPS 00:00 Why this episode is a panel 00:39 Meet the guests 04:11 "We're NIST 800-171 experts, not CMMC experts" 05:16 80 days after the pause: where things stand 07:21 What hasn't changed: Level 1 and Level 2 self-assessments 08:26 Myth: "CMMC was suspended" 11:33 No SPRS score, no RFP documents 14:08 CMMC is a floor, not a ceiling 14:26 The FAR overhaul and retired clauses still in contracts 18:29 Myth: "CMMC got pushed to November 2028" 22:02 The class deviation most people misread 24:14 What a defensible self-assessment looks like 29:06 Reddit, Discord and the misinformation problem 33:30 Myth: "My MSSP handles CMMC for me" 36:40 Myth: "Our policies prove we're compliant" 40:32 Myth: "We bought an enclave, so we're done" 44:07 Where the real risk lies now 51:13 How to choose outside help SOURCES REFERENCED - DoD CIO memo suspending CMMC Phase 2 (July 13, 2026), via Federal News Network: https://federalnewsnetwork.com/cybersecurity/2026/07/pentagon-suspends-cmmc-phase-two-requirements-launches-review-of-program/ - Sept. 3 acquisition memo codifying the pause, via MeriTalk: https://www.meritalk.com/articles/dod-codifies-pause-of-cmmc-phase-2-dod-cio-says-more-work-needed-on-cmmc/ - 32 CFR Part 170, the CMMC Program rule (phased rollout in §170.3): https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170 - NIST SP 800-171 Rev. 2: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final - NIST SP 800-171A, the assessment methodology: https://csrc.nist.gov/pubs/sp/800/171/a/final - CMMC Program Final Rule: https://www.federalregister.gov/d/2024-22905/p-1876 - Free executive level class: https://www.evolvedcyberacademy.com/courses/Rev3Leadership - CMMC Level 2 Self- Assessment: Step-by-step with Templates: https://www.strikegraph.com/blog/conduct-cmmc-level-2-self-assessment WHAT YOU'LL LEARN The requirement never moved. The pause hit third-party C3PAO assessments, not NIST SP 800-171 compliance and not Level 1 or Level 2 self-assessments. Brian Hubbard sets the bar at a self-assessment you could defend "if the DIBCAC walked in the next day after you posted your score." November 2028 is not a new deadline. Logan Therrien explains it has always been the end of CMMC's four-year phased rollout. Reading it as a two-year reprieve is one of the costliest misreadings in the market. The market is moving faster than the policy. Vince Scott compares it to oil moving through the Strait of Hormuz: there are months of supply in the system before anyone feels the change. Primes are already asking to see SSPs and SPRS scores. GUESTS Logan Therrien, Chief Strategy Officer, Kieri Solutions (C3PAO); 24-year military veteran Brian Hubbard, President, Evolve Cyber; Lead CCA and CMMC instructor; 40+ years in cybersecurity Vince Scott, CEO, Defense Cybersecurity Group; retired Navy cryptologist HOST Justin Beals, founder of Strike Graph and host of SecureTalk, a podcast focused on security news, innovation, and excellence. 🔔 Subscribe for conversations where cybersecurity, compliance and national security meet. #CMMC #NIST800171 #DefenseIndustrialBase

She helps write the rules the entire U.S. defense industrial base gets assessed against — and she's telling you compliance is the floor, not the finish line. Victoria Yan Pillitteri leads the Risk Management Framework/FISMA team at NIST and co-chairs the Joint Task Force uniting DoD, the Intelligence Community, and civilian agencies on one cybersecurity framework. In this episode, she and Justin Beals go inside how NIST actually builds SP 800-53 and 800-171 — what gets cut, what stays, and why "just copy the control language" is a losing strategy for anyone trying to pass an assessment. In this episode:Why 853 is "the Cheesecake Factory menu" of cybersecurity controls — and why that's a feature, not a bugThe real difference between NIST 800-171 Rev 2 and Rev 3, and why "organization-defined parameters" changed everythingWhy writing your own control (not just quoting NIST's language) is the only way to actually pass an assessmentHow FedRAMP 20x, OSCAL, and continuous monitoring are quietly replacing the point-in-time ATONIST's upcoming AI control overlays for predictive, generative, and agentic AI systems Chapters00:00 Introduction00:34 The purpose of NIST standards and measurement science02:24 Cybersecurity outcomes as a Rosetta Stone03:14 The challenge of measuring risk in cybersecurity04:55 Frameworks as operating systems for risk management06:58 The iterative process of developing cybersecurity standards08:11 Interpreting control statements for organizations09:36 The importance of tailoring controls to risk profiles12:30 The relationship between compliance and good risk management14:37 The development process of cybersecurity standards17:27 Differences between Rev2 and Rev3 of NIST 800-17120:01 Broad versus specific requirements in cybersecurity controls22:36 Supporting small businesses with guidance and tools27:23 The balance between prescriptive and flexible standards30:24 Cybersecurity in public-private partnerships34:53 Moving from point-in-time to continuous authorization40:23 AI risks and the development of tailored controls44:53 The future of cybersecurity standards and AI security Resources referenced:NIST SP 800-53 (Security and Privacy Controls) — [link]NIST SP 800-171 Rev 2 & Rev 3 (Protecting CUI) — [link]NIST Risk Management Framework — [link]NIST Cybersecurity Framework — [link]NIST AI Risk Management Framework — [link]FedRAMP 20x Program — [link]OSCAL (Open Security Controls Assessment Language) — [link] #NIST80053 #NIST800171 #CMMC #FedRAMP #CyberCompliance #RiskManagement #CUI #SecureTalk

An agent anyone could talk to just pulled the levers on one almost nobody could reach — and it happened inside the crown jewels: a live code repository. Google gave its AI agent human-level trust — and paid for it.When Dan Lisichkin, a researcher at Pillar Security, started mapping every Google repository running an embedded coding agent, he wasn't hunting for prompt injection — he was hunting classic CI/CD bugs. The AI angle showed up almost by accident, flagged by his own automation. What he found inside Google's Agent Development Kit repository was a low-privilege issue-triaging bot commenting on GitHub *as a trusted collaborator* — a status that should be reserved for humans the maintainers know. As Dan puts it, describing the moment his manager pushed back on downplaying the find: *"this is an agent triggering another agent... this is like no one talked about this before."* The prompt injection wasn't the hard part — weaponizing it was.Dan walks through Pillar's CFS framework (Context, Format awareness, instruction Salience) and how he literally used Google's own CONTRIBUTING.md file as the blueprint for the injection that would slip past the triage agent undetected. From there, one gated comment — normally reserved for trusted maintainers — was enough to trigger a second, far more privileged agent. This isn't a bug you patch once — it's a new attack surface.Dan's read is blunt: multi-agent systems create "weird machine" behavior — undefined states nobody designed for, not flaws in a specific line of code. He and Justin dig into why bolting more rules onto a non-deterministic system is Sisyphean, why bot identities need database-row-level granularity instead of human-style trust, and why Dan — a former malware researcher — thinks mandatory human-in-the-loop is often the wrong answer at scale. Chapters:  00:00: Cold Open: The Agent That Wasn't Supposed to Talk**- Google's public triage bot and the collaborator-status anomaly- Why "an agent triggering another agent" had never been formally described before 04:12:  Building the Hunt: Automation Over Manual Bug-Hunting**- Dan's CI/CD vulnerability scanner, built on top of Claude Code- How an AI-generated "AI agent injection" tag became the whole story- Reference: [Simon Willison — "The Lethal Trifecta for AI Agents"] 14:30: The Exploit: Contribution Guidelines as an Attack Roadmap**- Google ADK repository, the PR-triaging agent, and the CONTRIBUTING.md file used as a weapon- Pillar Security's CFS framework for indirect prompt injection (Context, Format awareness, Salience) — [Pillar Security Blog: Autonomy of Indirect Prompt Injection]- Why jailbreaking ≠ what Dan is doing — "I'm not trying to break the wall, I'm trying to walk through the door it left open" 28:05: Impact: Two Bugs, Two Verdicts**- GitHub token exfiltration, PR/issue metadata manipulation, and the fake "looks good to merge" trail- The second bug: a GCP service account and code-execution potential — "there was more juice on that one"- Why Google didn't pay a bounty — and why that answer is more interesting than the bug itself 38:50:  Identity, Granularity, and the Human-in-the-Loop Debate**- Why bot identities need GitHub App/Actions scoping, not personal-access-token trust- The case *against* blanket human-in-the-loop — review fatigue, OpenClaw, and "people are going to do this anyway"- SolarWinds, CryptoLocker, and why Dan thinks this is a closed-gap problem, not an open one Resources: Lisichkin, D. (2026, August 3). I'll just call you: Agent-to-agent privilege boundary failures in CI/CD on Google's ADK repository. Pillar Security. https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository https://danusminimus.github.io/ #aiagents #security #promptinjection #google #defcon #vulnerability---

Communities are blocking $130 billion in AI data centers while the entry-level jobs that used to train the next generation of engineers quietly disappear. Chapters:  00:00:  The Backlash: 800 Groups, 49 States, $130B BlockedGallup: 71% of Americans don't want a data center built near them (Gallup)Data center opposition tracker, Q1 2026 filings (referenced industry opposition data)CMMC as precedent for regulating critical infrastructure (DoW CMMC Phase 2 program) 04:30:  Why AI Is "Eating Our Young" in Education**Fran Berman & co-author's unpublished piece on the fraying mid-career pipelineBetter Tech (MIT Press) — Chapter appendix: AI classroom syllabus and exercises 14:00:  Tech as Critical Infrastructure, Not a ReligionBetter Tech prologue: treating tech like food, water, roads, and the power gridGDPR (EU, 2018) as a case study in regulation done right — and its limitsVermont's data broker law as a case study in weak enforcement 26:00: Design Can't Be Bolted On Later**Self-driving cars and the hidden environmental cost of full autonomyAttack surface risk: denial-of-service on connected, self-driving fleets 34:00: Governing the Hybrid Human-AI Society**EU AI Act — risk-tiered regulation: unacceptable, high-risk, low-risk categoriesU.S. Equal Employment Opportunity Commission guidance on algorithmic hiring 41:00: The Hype Curve and the Data Center Reckoning**Western Massachusetts communities rejecting new AI data centersEfficiency vs. quality of life — Berman's closing argument Communities are saying no to AI's biggest infrastructure bet.In the first quarter of 2026 alone, local opposition blocked or delayed 75 data center projects worth roughly $130 billion — nearly matching all of 2025's total in a single quarter. Dr. Fran Berman, former head of the San Diego Supercomputer Center, argues the fix isn't more hype, it's precedent we already have. She points to CMMC itself: "If we can look at the defense supply chain and say this is critical infrastructure, it has to meet a bar, then we can look at the trillion dollars of compute being built into the middle of American life and say the same thing." AI isn't just displacing jobs.  It's starving the pipeline that builds senior engineers. Berman's sharpest warning is about who trains the next generation of professionals when entry-level coding and writing jobs — the ones junior people used to cut their teeth on — get automated away. She compares it to a surgeon who's never had supervised time in the operating room: "Unless you have that experience and the mentorship of more senior professionals, it's really hard" to develop the judgment senior engineers rely on. Good regulation needs more than a law on the books. Drawing on her book Better Tech (MIT Press), Berman walks through why GDPR worked where Vermont's data broker law didn't — and previews how the EU AI Act's risk-tiered approach (unacceptable, high-risk, low-risk) could become the model for governing hybrid human-AI decision-making, where, as she puts it, "the only accountable entities are humans." ✍️ About the AuthorDr. Fran Berman is an award winning-data scientist, pioneer in public interesttechnology, and community leader and builder. She directs the Public InterestTechnology Initiative at UMass Amherst and is a Faculty Associate at the BerkmanKlein Center for Internet and Society at Harvard. Berman is former head the SanDiego Supercomputer Center and served as Vice President for Research atRensselaer Polytechnic Institute. She currently serves as a Trustee of the AlfredP. Sloan Foundation and is a popular regular panelist on public radio’s WAMCRoundtable with 400,000 monthly listeners in seven states. For more information,see https://www.franberman.com. Link to the book: https://mitpress.mit.edu/978026205488...

Which AI agents can access what? Are those permissions even right? And can you stop a compromised agent mid-action? Okta's Dan Cinnamon says most enterprises can't answer any of the three. Dan Cinnamon has built software, run SAP GRC without an implementation partner, and now architects identity for one of the industry's biggest players. In this conversation with Justin Beals, he lays out why "discoverability" — simply knowing what agents exist and what they're touching — is the single biggest blind spot in enterprise AI right now, and why there's no silver bullet coming to fix it. They also dig into passkeys as a rare win-win security standard, the maturing MCP spec, and where the hard line on agent containment should actually sit. **Timestamps:** 0:00 Intro 1:20 From writing code to securing identity 4:45 Passkeys: the security/usability unicorn 8:30 The SAP GRC re-implementation story 14:10 Attribution and the agentic AI identity gap 18:55 How fast MCP has matured—and what's next 23:40 The 3 unanswered questions every enterprise faces 27:15 Granular identity vs. inherited permissions 32:00 Containment: moving controls closer to the data 36:45 Consent, provenance, and healthcare AI 40:30 Closing thoughts #CISO #AIstrategy, #enterprise #AIsecurity, #agentic #AIgovernance, #Okta #MCPstandard,  #zerotrust #AI agents

The Pentagon paused CMMC Phase 2 with zero warning — and half the defense industrial base is celebrating for the wrong reason. When the Department of War suspended CMMC Phase 2 rollout with no notice, panic spread fast across the defense contractor community — but the requirement to secure CUI never went away. In this special roundtable, host Justin Beals brings together three CMMC insiders — Logan Therrien (C3PAO Chief Strategy Officer, retired Navy submariner), Lance Arnold (30-year industry veteran, just completed his own CMMC Level 2 journey), and Brian Hubbard (President, Evolved Cyber Solutions, CMMC assessor since 2015) — to separate what actually changed from what didn't. They break down the difference between the assessment requirement (paused) and the security implementation requirement (still very much alive under NIST 800-171), why "self-assessment" doesn't mean "no requirement," and what small businesses and primes should do right now instead of waiting for clarity that may not come for months. Sources Referenced: DFARS 252.204-7021 (CMMC assessment clause) DFARS 252.204-7012 (NIST 800-171 compliance clause) DFARS 252.204-7019 (SPRS scoring requirement) 32 CFR Part 170 (CMMC Program Rule) 32 CFR Part 48 NIST SP 800-171 / NIST SP 800-172

Half the room at Chris Cochran's leadership dinners still calls themselves AI skeptics. He argues they can't afford to be — because the adversary already isn't. Chapters:  00:00 — Intro 02:49 — NSA/threat intel → AI security, storytelling 09:55 — Why leaders feel stuck / no roadmap 14:41 — Three pillars (Protect/Utilize/Govern) 17:00 — Governance as the real foundation / shadow AI 21:37 — Evidence-based scoring vs. pass/fail 26:27 — EU AI Act 28:44 — Fable/Mythos, Project Glasswing access controls 33:18 — Token subsidies, self-hosted models 37:52 — Data poisoning & context poisoning 40:12 — Iron Man suit framing 42:38 — Close: what's next

Most companies chase certifications to win deals — but what actually keeps customers is something no audit can measure. In this episode, vCISO David Grazer makes the case that trust is a measurable economic asset hiding in plain sight: your customer retention rate. Drawing on 15+ years inside high-growth tech companies, David explains why compliance frameworks are customer acquisition tools, not retention strategies — and how the gap between the two is costing businesses more than they realize. This episode is for founders, security leaders, and C-suite executives who want to connect their security and privacy programs to real business outcomes. You'll learn: → Why a SOC 2 or ISO 27001 certification is only the beginning of earning customer trust → How customer churn functions as one of the most honest security metrics available → Why MFA and common security controls often fail the users who need them most → What "Trust by Design" looks like in product development and AI programs → How to translate security risk into language that resonates with your CFO Chapters 00:00 Introduction to Secure Talk and Trust 03:42 David Grazer's Journey into Security and Privacy 08:09 Navigating Compliance and Customer Trust 12:49 The Role of Consulting in Security 18:07 Trust as a Measurable Economic Asset 23:42 Identity Management in the Entertainment Industry 26:09 The VC SO Model and Its Impact 29:13 The Evolution of Compliance Conversations 33:17 Exploring the Intersection of Technology and Society 🔔 Subscribe to SecureTalk for weekly conversations at the intersection of cybersecurity, compliance, and business strategy. #cybersecurity #compliance #CISO #trustbydesign #vciso #informationsecurity #GRC #dataprivacy

You did your self assessment and received a perfect 110 score, congratulations! You met with your C3PAO and scored less than 0. What happened! How can two CMMC assessors examine the same defense contractor and arrive at completely different scores? A lack of rigor in assessment methodology could mean the entire certification system is measuring the assessor — not your security. Logan Therrien, Chief Strategy Officer at Kieri Solutions and one of the original C3PAO lead assessors in the U.S., joins Justin Beals to expose a critical flaw in how CMMC Level 2 assessments are conducted today: no standardized evidence sampling methodology. This episode is for DoD contractors, compliance consultants, and defense industry executives who want to understand what's at stake — and how to navigate assessments before the rules tighten further. What you'll learn: Why NIST 800-171 was intentionally vague — and how that backfired for assessorsHow one assessor might review a single evidence point while another reviews 100%What ISO 17020 accreditation will require of C3PAOs and why it matters nowWhat the 48 CFR expansion means for 118,000+ contractors in the supply chainHow to prepare for an assessment so it feels like an open-book test Logan also co-authored the peer-reviewed paper "The Need for Standardized Evidence Sampling in CMMC Assessments: A Survey-Based Analysis of Assessor Practices" (with John Hastings) — one of the first data-driven studies of assessment methodology in the CMMC ecosystem. Chapters 00:00 Introduction to Secure Talk and Psychometrics 01:45 Understanding CMMC and Its Implications 05:32 Logan Therian's Background and Insights 09:16 The Challenges of Assessment Methodologies 16:10 The Scale and Impact of CMMC Assessments 20:31 Navigating Standards in Cybersecurity 23:53 Evidence Testing in CMMC Assessments 27:43 The Importance of Reliable and Accurate Assessments 36:22 Building Trust Between Industry and Defense 41:46 Future Directions in CMMC Research Resources: Therrien, Logan and Hastings, John. (2026, February 10). The need for standardized evidence sampling in CMMC assessments: A survey-based analysis of assessor practices. arXiv. https://arxiv.org/abs/2602.09905

Mark Zuckerberg built an AI version of himself that attends meetings and approves budgets while he's elsewhere. That's not science fiction — it's happening now. But when an AI replica makes a consequential decision, who's legally responsible? Who owns it when you die? Dr. Candi Cann, Thanatologist and professor at Baylor University, joins SecureTalk host Justin Beals to explore the uncomfortable intersection of technology, mortality, and identity — and what it means for data governance, digital rights, and the future of enterprise accountability. In this episode: Key topics: digital identity, AI accountability, data governance, CMMC compliance, death technology, digital ethics, AI agents, enterprise security If your organization is deploying AI agents that act on behalf of humans — approving transactions, attending meetings, representing employees — this episode raises the governance questions your security and legal teams need to be asking right now. Subscribe to SecureTalk for weekly conversations at the edge of cybersecurity, compliance, and technology culture. Resources: Book: Augmented: Life and Death as a Cyborg by Candy Cann, MIT Press, 2026. Link: https://mitpress.mit.edu/9780262051118/augmented/

The biggest cybersecurity failures in recent memory — Raytheon, Penn State, Georgia Tech — weren't caused by missing software. They were caused by the wrong people being assigned the wrong tasks, with no shared language to connect the rules to the work. This SecureTalk episode with Dorian Cougias (MoxyWolf, former Unified Compliance Framework CEO) is one of the most systems-level conversations we've had on the show. Dorian spent decades building the infrastructure that compliance programs run on — and he's now rebuilding it from scratch, in the open. What you'll hear: → Why the compliance industry is structurally fragmented across three authority domains that don't communicate → How Bloom's Taxonomy — a tool from education — maps directly to which compliance tasks belong to which roles → Why the Oxford English Dictionary doesn't have "personal data" in it, and what that tells us about regulatory language → The O*NET framework and why the Department of Labor might be the most underused tool in cybersecurity → Shannon's entropy theory, applied to compliance and cognitive load → A new open-source STIG API infrastructure that StrikeGraph is integrating as a launch partner Whether you're deep in the compliance trenches or just fascinated by how complex systems fail — and how to redesign them — this is worth your time. 🔗 strikegraph.com | stigviewer.com Chapters: 00:00 Introduction and Background 02:43 Exploring Compliance and Natural Language Processing 05:15 Military Experience and Signal Intelligence 08:01 Cognitive Load and Compliance Frameworks 10:49 The Importance of Language in Compliance 13:39 The Evolution of Dictionaries and Lexicons 16:16 Bridging Gaps in Compliance Communication 18:47 Innovations at MoxieWolf and Future Directions 22:04 Mapping Skills and Regulatory Guidelines 25:05 Job Applicability and Knowledge Requirements 28:02 The Importance of O*NET in Cybersecurity 29:21 Challenges in CMMC Compliance 33:23 The Role of Technology in Compliance 35:38 Horizontal Practices in Compliance 38:15 Building Effective Teams for Compliance 42:21 Introduction to Compliance Failures 45:19 The Human Element in Compliance 48:10 Navigating Compliance Complexity with Technology 48:57 Introduction to Cybersecurity Compliance Challenges 54:09 The Role of People in Compliance Success 56:01 Guest Introduction: Dorian Cougas 01:00:48 Exploring Bloom's Taxonomy in Compliance 01:05:48 The Importance of Shared Lexicons 01:09:32 Navigating Compliance with Technology 01:15:11 MoxieWolf's Approach to Compliance 01:20:49 The Interconnectedness of Compliance Tasks 01:27:51 Real-World Compliance Challenges 01:33:57 Building Effective Teams for Compliance #Cybersecurity #ComplianceCulture #CMMC #HumanFactors #GRC #TechPolicy #SecureTalk

Why do most cybersecurity investments feel impossible to justify? Because the measurement tools are broken — built on gut instinct, not research. Researchers Minh Nguyen (Florida Atlantic University) and Thi Tran (Binghamton University) set out to fix that. In this episode, they break down their landmark paper "Effects of Cybersecurity Readiness on Firm Performance: Evidence from Conference Calls" — the first study to systematically measure cybersecurity readiness at the firm level and link it directly to financial performance. What they found will change how you think about security budgets: → Outsider mentions of cybersecurity in earnings calls are 100x more predictive of firm performance than insider mentions → Even a single co-occurrence of security-related language drives measurable returns on assets the following year → Companies that act proactively - not reactively - earn greater market trust This is the episode for CISOs who need real data to justify investment, security leaders tired of folklore-based decision-making, and anyone curious about how AI, NLP, and causal inference are reshaping the business case for cybersecurity. Chapters 00:00 Introduction to the Guests and Their Backgrounds 02:34 The Intersection of AI, Business, and Cybersecurity 05:32 Understanding Cybersecurity Readiness 08:31 The Importance of Measurement in Cybersecurity 11:16 Developing a Cybersecurity Dictionary 14:16 The Impact of Outsider Perspectives on Firm Performance 16:51 The Role of Transparency in Cybersecurity 19:40 Future Research Directions in Cybersecurity 22:37 Conclusion and Final Thoughts 🔗 Paper: "Effects of Cybersecurity Readiness on Firm Performance: Evidence from Conference Calls"  https://scholarspace.manoa.hawaii.edu/server/api/core/bitstreams/b098c310-db83-42cc-8932-852ef7ebcc86/content #Cybersecurity #CyberROI #CISO #FirmPerformance #CybersecurityResearch #NLP #CausalInference #InfoSec #SecurityLeadership #ConferenceCall``

The West has been building AI like it's the apocalypse. China has been building it like it's a tool. That one difference — rooted in centuries of philosophy, theology, and cultural storytelling — may be the most important thing nobody is talking about in the AI debate right now. SecureTalk host Justin Beals sits down with scholars Bogna Konior (NYU Shanghai), Mi You (University of Kassel), and Vincent Garton to explore their co-edited book "Machine Decision Is Not Final: China and the History and Future of Artificial Intelligence" — and what it reveals about the hidden assumptions driving the decisions we make about AI governance, security, and society. What this conversation unpacks: → Why Western AI fear traces back to Christian theology — not rational risk analysis → How the Chinese term for AI literally means "human-made wisdom ability" — no alien mind implied → The 2019 Elon Musk vs. Jack Ma exchange that exposed the cultural divide in real time → What DeepSeek's open-source breakthrough says about innovation, restriction, and creative problem-solving → Why this debate matters far beyond the US and China — and who else is watching closely If you work in cybersecurity, tech leadership, or AI policy, the cultural lens on this technology isn't a soft question. It shapes real architectural, governance, and regulatory decisions. Chapters 00:00 Introduction and Perspectives on AI in China02:41 The Meaning Behind the Claw Machine Image05:33 The Book's Creation and Collaborative Efforts08:32 Cultural Perspectives on AI: East vs. West11:06 The Impact of Open Source AI Models13:45 Innovation in a Controlled Environment16:20 Human-Made vs. Artificial Intelligence19:23 The Philosophical Underpinnings of AI22:06 The Role of Human Agency in AI Decisions24:54 Exploring the Future of AI and Society27:26 The Synthesis of Technology and Society30:22 Conclusion and Final Thoughts44:17 Understanding Artificial Intelligence: A Cultural Perspective47:08 Machine Decision: The Chinese Perspective on AI49:59 Innovation and Openness in AI Development50:27 Global Implications of AI Beyond Superpowers50:37 Introduction and Context of AI Governance01:00:53 The Role of Computers in Decision Making01:08:26 Transparency in AI and Governance01:17:58 Cultural Perspectives on AI: East vs. West01:23:46 The Singularity and Its Philosophical Implications01:27:15 Simulation and Reality in AI Discourse01:35:14 Social Implications of Large Language Models 🎙️ SecureTalk is hosted by Justin Beals, CEO of Strike Graph. 🔔 Subscribe for weekly conversations at the intersection of cybersecurity, technology, and leadership. #ArtificialIntelligence #AIPolicy #ChinaAI #DeepSeek #Cybersecurity #AIGovernance #TechLeadership #OpenSourceAI ```

Every American has a Social Security number. Most assume it's protected. Chuck Borges was the person responsible for that protection at the SSA — and what he discovered from the inside is something every American deserves to know. Chuck is a combat veteran, MIT graduate, and the Social Security Administration's first dedicated Chief Data Officer. He arrived two weeks before the 2025 administration change, watched data governance requests get denied and sensitive work get siloed away from the officials responsible for protecting it,  and when the risk became too great to ignore, he spoke up. It cost him his job. In this episode of SecureTalk, Chuck and host Justin Beals cover:- Why NUMIDENT data breach goes far beyond a typical data breach- How shadow IT and unchecked access created a governance nightmare inside the SSA- The national security implications of 550 million identity records at risk- What it actually takes to blow the whistle when the stakes are this high This is one of the most important cybersecurity conversations of 2025, not because of the technology involved, but because of what it reveals about the systems we trust to protect us. Chapters 00:00 From Dreams to Data: A Unique Journey02:47 Navigating the Data Landscape: Challenges and Innovations05:41 The Role of Governance in Data Management08:20 Civil Service and the Mission Mindset11:16 Chaos and Change: The Impact of Administration Shifts13:52 Empathy in Leadership: The Human Element16:51 Life Experience and Effective Governance21:16 Siloing and Data Manipulation in Government23:30 The Risks of Shadow IT and Data Security27:39 The Dangers of Numident Data30:08 The Nightmare of Data Exfiltration31:52 The Courage to Blow the Whistle36:19 Transitioning to Political Service38:24 Challenges of Running for Office41:36 Building Community Through Problem Solving43:05 Introduction to Data Sensitivity and Governance44:33 The Risks of Data Exposure45:55 Chuck Borges: A Profile in Data Leadership46:46 Introduction to SecureTalk and Data Security47:37 The Role of the Social Security Administration48:35 Chuck Borges: A Journey Through Data Governance50:28 The Impact of Administration Changes on Governance56:14 Challenges in Data Management and Governance01:00:58 The Risks of Data Exposure and Mismanagement01:05:37 Whistleblowing and Ethical Responsibilities01:14:56 Running for Office: A New Chapter in Public Service Resources:  Chuck Borges Website - https://chuck4md.comTwitter - https://twitter.com/Chuck4MD 🔔 Subscribe to SecureTalk for weekly conversations on cybersecurity, leadership, and the technology shaping our world.#SocialSecurity #DataGovernance #Cybersecurity #DataBreach #NationalSecurity #Whistleblower #FederalCybersecurity #IdentityTheft #SecureTalk #CDO

On the morning of September 11th, 2001, John Ackerly was briefing White House officials on federal privacy legislation. Hours later, everything changed — and those two realities, data that wasn't shared when it should have been, and data that was exposed when it shouldn't have been, became the founding idea behind Virtru. In this episode of SecureTalk, host Justin Beals sits down with John Ackerly, CEO and co-founder of Virtru and former White House technology policy adviser, to explore why perimeter security alone is broken — and what data-centric, cryptographic control means for the future of cybersecurity. They cover: 00:00 Introduction to SecureTalk and Data Security02:28 John Ackerly's Experience and Insights on Privacy Legislation05:05 The Dichotomy of Privacy and Security09:12 Public-Private Partnerships in National Security12:24 Navigating Compliance and Security in Business15:26 The Role of Technology in Security Solutions18:40 Family Ties and Military Background in Cybersecurity20:41 Insider Threats and Data Security Innovations23:29 The Importance of Data Management and Audits26:12 Cultural Impact on Security Practices29:19 Future Challenges: Quantum Computing and Security32:52 The Evolution of AI and Data Science in Security Whether you work in cybersecurity, government, or technology policy, this conversation connects the policy decisions of the past 25 years to the architectural challenges we face today. 🔒 Learn more about Virtru: https://www.virtru.com 🎙️ Subscribe to SecureTalk for weekly conversations at the intersection of technology, security, and society.