Advertise on podcast: The Virtual CISO Moment

In this episode of The Virtual CISO Moment, Greg Schaffer talks with cybersecurity veteran Scott Foote about what hasn’t changed in cyber risk over the last 35 years—and why AI is amplifying those same mistakes at unprecedented speed. They discuss shadow AI, insecure defaults, “vibe coding,” privacy risks, and the growing need for practical AI governance. Drawing on decades of experience across industry and government, Scott shares why fundamentals still matter, how organizations can bring order to AI chaos, and what leaders need to understand before adopting AI at scale. A thoughtful, wide-ranging episode for CISOs, vCISOs, board advisors, and executives trying to understand where cyber risk ends and AI governance begins—and why fundamentals still matter more than ever.

In this episode of The Virtual CISO Moment, Greg sits down with Mike Gropp to explore an unconventional journey into cybersecurity—from entrepreneurship and living in China to offensive security and red teaming. The conversation dives deep into the real-world risks of “vibe coding,” AI-driven development, and why security can’t be an afterthought for business builders. Mike also shares hard-earned lessons on communication, risk ownership, and staying grounded in a high-stress industry—plus how endurance running keeps him sharp both mentally and professionally.

How do you explain security risk to executives who don’t speak “security”? What really changes when you move between regulated industries like healthcare and energy? And why are communication skills just as critical as technical ones in cybersecurity? In this episode, Greg Schaffer speaks with Tatiana Argueta, Senior Security Engineer, about: *Operating security programs in regulated environments *Translating cyber risk into business impact *Why understanding your business is a core security skill *How Toastmasters helped shape her security leadership style *Emerging risks: AI, geopolitics, and misinformation This is a practical, grounded conversation for CISOs, vCISOs, and security practitioners navigating real-world risk. #Cybersecurity #InformationSecurity #CISO #vCISO #RiskManagement #SecurityLeadership #GRC

What happens when a routine IT problem turns into a full-blown ransomware crisis? In this episode of The Virtual CISO Moment, Greg Schaffer sits down with Zach Lewis, CIO, CISO, and author of Locked Up, to explore the reality of leading through a LockBit ransomware attack—without the benefit of hindsight. Zach takes listeners inside the moment things went sideways: the rapid shift from disaster recovery to incident response, the pressure of board-level questions with incomplete information, and the difficult calls around communication, transparency, and timing. He shares what plans actually helped, what broke down under stress, and the lessons that only emerge when theory collides with a real adversary. The conversation also explores why higher education is such a demanding environment for security leaders, how pragmatic controls beat “perfect” security in a crisis, and why storytelling—not frameworks alone—is essential for executive buy-in. Zach closes by reflecting on resilience, balance, and why stepping away from the keyboard is critical to surviving a long career in cybersecurity. A candid, experience-driven episode for CISOs, vCISOs, and security leaders who want to know what ransomware response really looks like when it’s no longer hypothetical.

In the Season 8 premiere of The Virtual CISO Moment, host Greg Schaffer sits down with Corey LeBleu, Founder and CEO of Relix Security, to explore how offensive security and penetration testing are evolving in a world shaped by cloud platforms, AI, and “vibe coding.” With more than two decades of hands-on experience in application and network penetration testing—including leadership roles at Verizon and boutique consultancies—Corey shares a practitioner’s view of what high-value penetration testing really looks like, and why too many organizations still confuse checkbox scans with meaningful security assurance. The conversation covers: How penetration testing has changed—and hasn’t—in the age of AI The risks introduced by low-code/no-code platforms and AI-generated workflows Why misconfigured tools and automated scans can create a false sense of security What CISOs and vCISOs should demand from penetration test reports to drive real business value The difference between vulnerability scanning, penetration testing, and “continuous testing” hype Emerging AI-specific attack vectors, including prompt injection and model abuse Common client misconceptions about penetration testing and testing frequency Translating technical findings into business risk executives can act on Managing stress in offensive security and cybersecurity leadership roles Whether you’re advising clients as a vCISO, running a security program, or evaluating penetration testing vendors, this episode offers grounded guidance on separating signal from noise—and ensuring offensive security investments actually improve risk posture.

In this special episode of The Virtual CISO Moment, Greg Schaffer shares five cybersecurity predictions for 2026 grounded in real-world patterns — not hype. From the tightening of SOC 2 audits and the rise of “vibe coding” risks, to a coming shakeout in the vCISO market, influencer-driven security shaming, and the growing dangers of contractor misclassification, this episode explores the second-order consequences many organizations are already overlooking. If you’re a business leader, CISO, or vCISO, this episode will challenge assumptions and help you see where governance failures quietly become security failures.

In this episode of The Virtual CISO Moment, Greg Schaffer sits down with Logan Edmonds, Chief AI Officer at ScaleSight and founder of TTS Cyber, for a lively and insightful discussion on the intersection of AI, cybersecurity, and small to mid-sized business operations. Logan shares his unique journey from studying theology to becoming an AI-driven cybersecurity leader, highlighting how early IT experiences shaped his pragmatic approach to solving business problems. Greg and Logan dive deep into how SMBs misunderstand both security and AI, including the dangers of chasing trends, the misconception that compliance equals security, and why AI can’t magically fix broken business processes. Logan emphasizes a business-first mindset: start with understanding operations, outcomes, and risks—not with the technology. The conversation also covers: Why focusing on operational efficiency is the real driver behind meaningful AI adoption How to talk about risk without falling into fear, uncertainty, and doubt The importance of trust and partnership in security consulting Realistic AI use cases, guardrails, hallucination risks, and the myth of effortless automation Balancing stress in cybersecurity through healthy personal hobbies Logan’s forward-looking plans in CMMC, AI strategy, and helping organizations scale responsibly Engaging, humorous, and packed with practical insight, this episode is a must-listen for leaders navigating AI adoption, cybersecurity maturity, or the unique challenges of SMB environments.

In this episode, host Greg Schaffer interviews Thomas Sweet, an award-winning CIO/CTO and 2023 Tech Titan Emerging CTO, who shares his unconventional journey from civil engineering to enterprise IT and cybersecurity leadership. Tom reflects on his early days at NEC, Microsoft, GM Financial, and more, offering key lessons learned while leading global teams and driving digital transformation. The conversation covers:🔹 How Tom transitioned from civil engineering into IT🔹 The problem-solving mindset engineering instilled in him🔹 His approach to building strong, low-attrition teams through genuine leadership🔹 Why AI is already reshaping IT—and why resisting it may hinder career growth🔹 How he uses AI to accelerate secure coding, automation, and testing🔹 The emerging landscape of AI-specific attacks🔹 The importance of decompression and how Tom balances life outside technology A thoughtful, engaging look at technology leadership, organizational culture, and the rapidly changing role of AI in the enterprise.

This Thanksgiving-week episode welcomes back Chuck Anderson, IT consultant at Reliant Managed Services, for a deep dive into some of the biggest shifts in cybersecurity and technology over the past year and a half. Chuck and Greg explore the rapid rise of AI (good and bad), the looming disruption of quantum computing—especially its impact on encryption and certificates—and the operational realities organizations face as they prepare for a post-quantum world. They also dig into change management, why empathy matters more than ever in cybersecurity, and how tech pros can better communicate and lead through major transformation. A forward-looking, practical, and enjoyable conversation for anyone navigating today’s evolving cyber landscape.

In this episode of The Virtual CISO Moment, host Greg Schaffer speaks with Dave McKenzie, co-founder and director of Damn Good Security and a seasoned cybersecurity leader based in Scotland. Dave shares his fascinating journey from aspiring pilot to IT support technician, to leading security operations for major organizations, and ultimately launching his own company. His path, driven by curiosity, adaptability, and a dislike of handwriting, reveals how technical expertise and communication skills blend to form a truly effective security professional. This wide-ranging conversation is packed with humor, practical insights, and wisdom for anyone in the cybersecurity field.

In this episode of The Virtual CISO Moment, Greg Schaffer welcomes back cybersecurity expert and best-selling author Peter H. Gregory — who’s written over 50 books and helped shape many of today’s top security and certification programs. They dive deep into: 💡 AI Governance — how to use AI safely, ethically, and legally (and why “shadow AI” may be your biggest unseen risk) 📚 Publishing Your Technical Book — Peter’s step-by-step insights from idea to printed page ⚙️ Data Governance & Privacy — why strong data management is essential before implementing AI Peter also shares details on his upcoming AI Governance Professional (AIGP) study guide and offers timeless advice for aspiring cybersecurity authors. 🎧 Tune in for expert perspectives, practical insights, and a few laughs along the way. #Cybersecurity #AIGovernance #vCISO #DataPrivacy #InfoSec #PeterHGregory #GregSchaffer #VirtualCISOMoment

Patrick Rost, owner and advisor at InfoSecurity Blueprint, joins Greg Schaffer to discuss his journey from a technology enthusiast to an information security entrepreneur. Patrick shares insights on helping small and midsized businesses take their first steps toward better security—emphasizing that information security is about managing business risk, not just technology. He explains his “wash one dish” approach to simplifying security, why “InfoSecurity” matters more than “Cybersecurity,” and how fractional advisory services can empower organizations without overwhelming them. The discussion also explores AI governance for small businesses, risk-based thinking, and how to make security engaging—even fun—for executives.

Walter Haydock, founder of StackAware, joins Greg Schaffer to discuss how AI-powered companies can manage cybersecurity, privacy, and compliance risks using the ISO 42001 AI governance framework. Learn why AI literacy matters, what organizations can learn from Amazon’s AI missteps, and how to make smarter risk decisions in the age of generative AI.

Recently The Virtual CISO Moment podcast host Greg Schaffer was asked to participate in a question and answer session with students at Minnesota State University who are using his book Information Security for Small and Midsized Businesses as part of their studies. In this special and extended episode, a recoding of that conversation, they talk about concerns of small and midsized businesses and the outlook for the information security and cybersecurity fields.

In this inspiring and deeply personal episode of The Virtual CISO Moment, Greg Schaffer sits down with cybersecurity professional Andrew Staton to discuss his journey from high school CyberPatriot competitions in Huntsville to federal cybersecurity consulting. Topics Covered: How local cyber education programs launched Andrew’s career The evolving landscape of CMMC and compliance misconceptions Why data scoping is key for affordable federal compliance The importance of mental health in cybersecurity Andrew’s personal transformation and rediscovering purpose Faith, community, and building a healthy cybersecurity lifestyle Andrew’s story is one of grit, growth, and grace—a must-listen for cyber pros, students, and leaders alike.