Advertise on podcast: The Cyber Mettle Podcast with Alyson & Omar

Is cybersecurity really facing a talent shortage—or are we looking at the problem the wrong way? In this episode of The Cyber Mettle Podcast, Omar and Alyson welcome Jakub Zvernia, Technical Program Lead for Cyber Path, Australia's national cyber workforce professionalization pilot delivered by the Australian Computer Society. Together they explore why thousands of aspiring cybersecurity professionals struggle to land their first role despite persistent workforce shortages, why organizations need to rethink hiring, and how skills-first career pathways could reshape the future of the industry. The conversation also examines: • Why traditional recruiting models may be holding organizations back • The value of neurodiversity and diverse thinking in cybersecurity • How employers can better support career changers and veterans • Why cybersecurity education alone isn't enough • Building practical career pathways beyond entry-level roles • Why organizations—not just individuals—must invest in workforce development • Lessons from Australia's CyberPath initiative that have global relevance Whether you're a cybersecurity practitioner, hiring manager, executive, educator, student, or someone considering a career transition into cyber, this discussion offers practical insights into building a stronger, more resilient workforce. Chapters 00:00 Opening & Introducing Jakub Zvernia 02:18 What Is Cyber Path? 05:07 Why Graduates Still Can't Get Hired 08:55 The Business Case for Skills-Based Hiring 12:23 Career Changers, Veterans & Hidden Talent 16:55 Building Cyber Talent from Nontraditional Backgrounds 19:33 Why Entry-Level Isn't the Real Skills Gap 25:52 Preparing for an Aging Cyber Workforce 28:43 Learning Beyond Certifications 32:10 Why Employers Must Change Too 35:14 A Call to Action for the Cybersecurity Industry 37:01 Final Thoughts If you enjoyed this conversation, subscribe to The Cyber Mettle Podcast for more discussions at the intersection of cybersecurity, leadership, resilience, governance, and human performance. #Cybersecurity #CyberWorkforce #CyberCareers #Leadership #SkillsBasedHiring #CyberPath #CyberMettlePodcast

The IAPP AIGP certification is becoming one of the most sought-after credentials in AI governance, but what does preparing for it actually teach you? In this episode of The Cyber Mettle Podcast, Omar Sangurima and Alyson Laderman go beyond exam prep to discuss something much bigger: how professionals actually learn. As Alyson works through an intensive 28-day AIGP bootcamp with Dr. Kyle David (Dr. Privacy), the conversation explores: Why memorization isn't enough How certification exams can better validate real-world skills AI governance versus legal practice Different learning styles Study strategies that actually work Why asking questions is a professional strength, not a weakness The surprising value of learning communities The discussion also highlights Dr. Kyle David's AIGP Master Class and why community, mentorship, and collaboration may ultimately become the most valuable part of the certification experience. Whether you're studying for the AIGP, working in AI governance, cybersecurity, privacy, compliance, legal, or risk management, this conversation offers practical advice that extends far beyond one exam. Chapters 00:00 Welcome Back to Cyber Mettle 03:04 Alyson Announces Her AIGP Journey 06:04 Why the AIGP Is Such a Challenging Certification 07:10 Should Certification Exams Test Memorization? 11:26 Real AI Governance vs. Passing the Test 16:03 What Better Certification Exams Could Look Like 20:54 Everyone Learns Differently 27:37 Inside an AIGP Master Class 33:17 Why Smart People Stay Quiet 39:57 Alyson's Personal Study Strategy 43:20 Learning, Humor & (Yes) Clown College 46:12 Ego Is the Enemy of Learning 53:45 Building Real Professional Relationships 55:09 Omar's Toastmasters Leadership Lesson 1:00:24 How to Create Better Learning Communities 1:02:22 Final Thoughts: Be Human 🎙 Subscribe for conversations on cybersecurity, AI governance, leadership, privacy, resilience, and professional growth. #CyberMettlePodcast #AIGP #AIGovernance #Cybersecurity #ArtificialIntelligence #Privacy #Leadership #ProfessionalDevelopment

Can AI actually improve penetration testing, or does it create an entirely new attack surface? In this episode of The Cyber Mettle Podcast, Omar Sangurima and Alyson Laderman sit down with cybersecurity researcher and executive Dan Shallom to explore how agentic AI is reshaping offensive security, vulnerability discovery, and security assessments. Dan explains why today's AI isn't simply making penetration testing faster—it's changing how security teams think about attack surfaces, business risk, and human expertise. Topics include: • Traditional penetration testing vs. AI-assisted assessments • Why consistency and coverage remain major security challenges • Building AI agents that understand application workflows—not just vulnerabilities • OWASP Top 10 for LLMs and the new risks AI introduces • Why AI needs layered security, guardrails, and governance • Business-contextualized vulnerability prioritization • Human judgment vs. AI reasoning in cybersecurity • Why AI should augment—not replace—security professionals Whether you're a CISO, security leader, penetration tester, application security engineer, or simply trying to understand where AI fits into cybersecurity, this conversation offers practical insights grounded in real-world experience. If you enjoy conversations about cybersecurity, resilience, leadership, governance, and emerging technology, subscribe to The Cyber Mettle Podcast for future episodes. Chapters 00:00 Opening and Inspector Gadget nostalgia 01:22 Meet Dan Shallom 02:34 Traditional Pen Testing vs Agentic AI 05:42 Why Coverage and Consistency Matter 07:35 Hidden Attack Surfaces Inside Modern Applications 08:47 AI Guardrails and Secure Implementation 10:14 Can AI Discover Novel Attacks? 15:18 Why Access Control Remains a Major Challenge 17:45 Business Context Beats Raw CVSS Scores 23:08 Moving Beyond Traditional Vulnerability Scanners 25:20 Human Judgment Still Matters 29:21 OWASP for LLMs and AI Attack Surfaces 33:16 Security by Design 36:16 Can Legacy Organizations Adopt AI? 40:14 Infrastructure, LLMs and Modern Risk 43:14 Final Advice for Organizations Using AI 44:49 Closing Thoughts #CyberSecurity #ArtificialIntelligence #ApplicationSecurity #PenTesting #AgenticAI #CISO #CyberMettlePodcast

Thinking about the AAIR certification from ISACA? Just hours after completing the Advanced AI Risk (AAIR) exam, Omar Sangurima sits down with Alyson Laderman to share his candid experience, preparation approach, key takeaways, and lessons learned from one of ISACA’s newest AI-focused certifications. In this Cert Corner episode, Omar discusses how the AAIR exam compares to certifications like the AIGP, why "ISACA mode" matters when approaching certification exams, the role of AI risk within broader enterprise risk management programs, and what cybersecurity, governance, and risk professionals should understand about AI risk today. The conversation explores practical study strategies, exam structure, governance frameworks, AI risk management concepts, and why understanding business risk may be just as important as understanding the technology itself. Whether you're considering the AAIR certification, working in AI governance, cybersecurity, risk management, compliance, audit, or simply trying to understand how AI risk is evolving inside organizations, this episode offers a real-world perspective from someone who just completed the exam. In this episode: • Omar's immediate reaction after completing the AAIR exam • How the exam compares to AIGP and other ISACA certifications • Understanding "ISACA mode" and certification mindset • AI Risk Management Framework (AI RMF) preparation strategies • Governance, risk, and AI integration challenges • Why context matters when answering certification questions • The relationship between AI risk and enterprise risk management • Whether AI risk deserves its own certification domain • Lessons learned for cybersecurity and risk professionals Chapters 00:00 - Fresh Off the Exam: Initial AAIR Reactions 02:02 - What Is the AAIR Certification? 04:15 - Exam Format, Cost, and Proctoring Experience 06:39 - Comparing AAIR and AIGP Preparation 08:21 - Understanding “ISACA Mode” 11:44 - Certification Study Pitfalls and Exam Dumps 13:11 - Study Strategy and Preparation Approach 20:14 - How the Exam Questions Are Structured 27:04 - Key Domains and AI Risk Concepts 31:25 - Does AI Risk Deserve Its Own Certification? 36:46 - The Real Value of the Certification 40:35 - Final Advice for Future Candidates 42:48 - Why Studying AI Risk Matters #CyberMettlePodcast #AIRisk #AAIR #ISACA #Cybersecurity #Governance #RiskManagement #ArtificialIntelligence #AIGP #CyberLeadership

Your backups may be protected. Your data may be protected. But what happens if you lose access to the systems that let you access everything else? In this episode of  ⁨@TheCyberMettlePodcast⁩ , Omar Sangurima and Alyson Laderman sit down with Muli Motola, CEO and Co-Founder of Acsense, to discuss one of the most overlooked areas of cybersecurity and resilience: Identity and Access Management (IAM). As organizations continue moving to the cloud and embracing Zero Trust architectures, identity systems have become the foundation of modern operations. Yet many businesses still lack a recovery strategy for the very systems that control access to everything else. Muli shares the real-world incident that inspired Acsense, lessons learned from large-scale identity-related breaches, and why identity resilience is becoming a board-level business issue. Topics include: Why IAM has become a critical business dependency The hidden risks of cloud-based identity systems Shared responsibility between vendors and customers Lessons from MGM and Caesars Palace Identity resilience and disaster recovery planning Operational mistakes versus cyberattacks AI, automation, and identity management risk Single points of failure in modern IT environments What boards and executives should be asking today How organizations can prepare for identity-related disruptions If your organization relies on cloud services, SaaS applications, remote work, customer portals, or Zero Trust security models, this conversation is essential listening. RESOURCES FROM ACSENSE Want to learn more about Identity Resilience, IAM Recovery, and Disaster Recovery Planning? Muli Motola and the Acsense team have published several free resources, including their Disaster Recovery Guidebook for Identity and Access Management. Explore the full resource library: https://acsense.com/resources/white-papers/ Recommended resource: Disaster Recovery Guidebook for Identity & Access Management Whether you're a CISO, IT leader, MSP, security practitioner, or business executive, these guides provide practical frameworks for thinking about identity resilience, recovery planning, and operational continuity. 🎙 About The Cyber Mettle Podcast The Cyber Mettle Podcast explores the intersection of law, business, cybersecurity, technology, resilience, and leadership. Hosted by Omar Sangurima and Alyson Laderman 🔔 Subscribe for future conversations on cybersecurity, resilience, business continuity, leadership, AI, governance, and emerging technology. CHAPTERS 00:00 Introduction 01:07 Meet Muli Motola 02:12 What Is Identity and Access Management? 04:31 Why IAM Is More Critical Than Most Organizations Realize 05:42 The Incident That Inspired Acsense 08:12 The Butterfly Effect of Identity Systems 09:31 Cloud Identity and the New Single Point of Failure 10:56 Lessons from MGM and Caesars Palace 13:56 AI, Automation, and Identity Risk 15:26 Why Identity Recovery Is So Difficult 17:24 Cyber Resilience and Immutable Recovery 19:03 Shared Responsibility in Identity Security 22:11 Who Understands Identity Resilience Today? 24:24 Operational Mistakes vs Cyberattacks 26:52 The Importance of Recovery Autonomy 29:00 AI Agents and Privileged Access Risks 32:34 Why Customers Are Worried About AI Modifying History 34:14 What CEOs and Boards Need to Understand 36:34 Building Effective Recovery Objectives 39:27 Why Identity Is Foundational to Business Continuity 43:33 The Future of Identity Resilience 48:25 Final Thoughts

Can AI make organizations more effective without replacing people?   Cybersecurity leader Joshua Copeland joins Omar Sangurima and Alyson Laderman to discuss AI, workforce development, cybersecurity, governance, and the unintended consequences of automation. In this episode: • Why AI should augment people rather than replace them • The hidden costs of AI adoption • AI-generated code and cybersecurity risks • Workforce development and employee retention • AI bias and accountability • The future of human judgment in an AI-driven world Joshua also shares the story behind his widely followed "Unpopular Opinion" posts and explains why honest conversations are essential for the cybersecurity profession.   Key Topics Artificial Intelligence Cybersecurity AI Governance Workforce Development Business Resilience Leadership Risk Management Compliance Connect with The Cyber Mettle Podcast LinkedIn: https://www.linkedin.com/company/the-cyber-mettle-podcast Website: https://cybermettle.org Chapters 00:00 Introduction and Guest Welcome 02:18 Joshua Copeland's Cybersecurity Journey 05:16 The Origin of "Unpopular Opinions" 08:33 Why Cybersecurity Needs More Honest Conversations 11:40 AI Should Augment People, Not Replace Them 15:00 The Real Cost of Replacing Employees 18:26 Startup Growth, Retention, and Innovation 21:00 Ego, Venture Capital, and AI Adoption 22:25 AI Coding, Vibe Coding, and Security Risks 24:23 Why Data Breaches Can End Small Businesses 26:55 The Hidden Costs of AI 30:31 Dependency, Skills Decline, and AI Reliance 32:57 Which Jobs Will Survive AI? 35:43 Human Judgment vs Artificial Intelligence 39:22 AI, Law, Liability, and Accountability 43:28 Hiring Bias and AI Training Data 46:45 Governance, Risk, and Organizational Responsibility 50:59 Final Thoughts on AI

Most cybersecurity career advice focuses on technical skills. This episode explores the skill that often determines long-term success: building genuine relationships. What does it take to build a successful cybersecurity career when your background isn't technical? In this episode of The Cyber Mettle Podcast, Omar Sangurima and Alyson Laderman sit down with Arielle Cireseanu-Acevedo, Esq. to discuss career growth, networking, leadership, mentorship, storytelling, and the power of authentic relationships in cybersecurity and beyond. Ari shares her journey from healthcare operations and legal work into cybersecurity leadership, proving that career transitions are possible when organizations invest in people and individuals remain committed to learning. Topics include: Transitioning into cybersecurity without a technical background Why networking is really about relationships, not business cards Career development and internal mobility  Building trust and professional credibility The value of mentorship and sponsorship Storytelling as a cybersecurity and leadership skill Soft skills that accelerate career growth Why kindness is a competitive advantage Creating opportunities through authentic human connection 
Whether you're early in your career, considering a transition into cybersecurity, or leading teams, this conversation offers practical advice for building a career that lasts. Subscribe for more conversations at the intersection of cybersecurity, leadership, business, law, and resilience.

#Cybersecurity #CareerDevelopment #Leadership #Networking #CyberMettle #InfoSec #ProfessionalGrowth #SoftSkills CHAPTERS 00:00 – Introduction & Meet Arielle Cireseanu-Acevedo 02:15 – Ari's Career Journey Into Cybersecurity 08:13 – Why Organizations Should Invest in Their People 12:22 – Career Growth, Retention & Boomerang Employees 16:21 – What Networking Actually Means 20:23 – Networking Beyond Business Cards 23:21 – Food, Community & Building Connections 26:15 – Toastmasters and Public Speaking Growth 31:08 – Storytelling as a Career Superpower 36:33 – How Lawyers and Non-Technical Professionals Enter Cybersecurity 40:36 – Why Relationships Matter More Than You Think 46:23 – Gatekeeping vs Mentorship 50:11 – Building Authentic Professional Relationships 56:32 – Supporting Others Without Expecting Something Back 01:00:25 – Final Thoughts on Cyber Mettle

What happens when cybersecurity, investigative journalism, hacker culture, and privacy rights collide? Pulitzer Award-winning journalist Yael Grauer joins  ⁨@TheCyberMettlePodcast⁩  to unpack data brokers, surveillance tech, OSINT culture, online privacy, hacker paranoia, and why your personal information is far more exposed than most people realize. In this episode of The Cyber Mettle Podcast, Dr. Omar Sangurima and Alyson Laderman sit down with journalist, cybersecurity educator, and privacy advocate Yael Grauer for a wide-ranging conversation covering: * The reality of modern data brokers and why removing your information online is so difficult * The overlap between hacker culture and investigative journalism * Doxxing, OSINT, digital privacy, and online safety * The ethics of public records and personal information * Surveillance technology and the expanding privacy landscape in the United States * Why journalists and hackers often misunderstand each other * Social engineering, trust, and online investigation culture * MMA, jiu-jitsu culture, and surprisingly relevant cybersecurity lessons   Yael also shares insights from her investigative reporting career, including collaborative reporting work tied to award-winning journalism projects and her experience helping people better understand how exposed their data really is online.   This episode blends cybersecurity, law, journalism, privacy, and human behavior into a candid and practical discussion about the digital world we all navigate every day. If you work in cybersecurity, privacy, journalism, tech, law, investigations, OSINT, or risk management — this conversation is packed with insight.   Subscribe for more conversations at the intersection of cybersecurity, business, law, technology, and human resilience.   #Cybersecurity #Privacy #DataBrokers #OSINT #DigitalPrivacy #Journalism #CyberMettle #InfoSec #HackerCulture #onlinesafety CHAPTERS 00:00 — Intro & Meet Yael Grauer 01:05 — From MMA Journalism to Cybersecurity 03:24 — Jiu-Jitsu, Injuries & Hacker Culture 07:30 — Why Hackers and Journalists Clash 10:41 — Trust, Sources & Media Relationships 15:14 — Building Credibility in Cyber Journalism 19:08 — Award-Winning Investigative Reporting 23:47 — Surveillance Tech & Data Brokers 24:51 — Getting Doxxed & Why Privacy Matters 27:52 — The Legal & Ethical Gray Areas of Data Collection 30:10 — Public Records, Online Exposure & Digital Footprints 35:50 — OSINT, Investigative Skills & Ethical Boundaries 38:08 — Online Dating, Trust & Digital Verification 39:52 — Why Human Instinct Still Matters 42:02 — Upcoming Speaking Engagements & Future Work 44:26 — Jiu-Jitsu Hygiene, Essential Oils & Closing Laughs

“AI won’t take your job” is comforting. But, James McQuiggan explains why that’s not entirely true and what cybersecurity professionals must do next. In this episode of The Cyber Mettle Podcast, Dr. Omar Sangurima and Alyson M. Laderman, Esq. sit down with cybersecurity veteran James McQuiggan to discuss the uncomfortable reality of AI disruption, workforce resilience, human risk, deepfakes, and the future of cybersecurity careers. James brings more than 25 years of experience across cybersecurity, IT, SCADA systems, incident response, security awareness, AI, and cyber threat intelligence. Formerly a CISO Advisor at KnowBe4 and now founder of Apparent Security, James shares candid insights on:  Whether AI can actually replace cybersecurity jobs Why repetitive work is most at risk The rise of “vibe coding” and AI-generated software Why human oversight still matters in cybersecurity Lessons from Stuxnet, SolarWinds, ransomware, and Change Healthcare  The cybersecurity challenges facing schools and educators Human risk management and security awareness The importance of community, mentorship, and paying it forward Dad jokes as a cybersecurity branding strategy The conversation blends serious industry insight with humor, career advice, practical AI guidance, and a reminder that cybersecurity is ultimately still about people. If you're navigating AI disruption, building a cybersecurity career, or trying to future-proof your skills, this episode delivers practical perspective without the hype. ABOUT JAMES MCQUIGGAN James McQuiggan is the founder of Apparent Security, cybersecurity educator, speaker, and longtime security advocate with experience spanning IT networking, SCADA systems, incident response, AI security, and human risk management. He previously served as a CISO Advisor at KnowBe4 and teaches Cyber Threat Intelligence at Full Sail University. Subscribe to  ⁨@TheCyberMettlePodcast⁩  to hear human conversations at the intersection of cybersecurity, business, law, AI, and human resilience. CHAPTERS 00:00 – Intro & Welcome 01:19 – James McQuiggan’s Cybersecurity Journey 03:56 – Can AI Take Your Job? 06:41 – Repetitive Work vs Human Judgment 09:39 – Why Humans Still Matter in Cybersecurity 11:11 – AI Mistakes, AWS Stories & Empty Databases 13:52 – Vibe Coding & AI-Generated Software Risks 16:34 – “Ship It Now, Fix Security Later” Returns 17:40 – Do We Need a Cybersecurity “Chernobyl”? 19:10 – Stuxnet & Critical Infrastructure Wake-Up Calls 20:21 – Retail Breaches, PCI & Ransomware Economics 22:32 – Why Some Organizations Still Ignore Cybersecurity 24:36 – School Systems, Human Risk & Teacher Targeting 27:56 – OT, SCADA & Availability in Critical Systems 28:46 – The Story Behind Apparent Security 29:27 – Dad Jokes, Presentations & Security Awareness 31:44 – Theater Background & Public Speaking 33:04 – Why the Company Is Called “Apparent Security” 34:35 – Wrestling, Branding & Memorable Gimmicks 37:18 – AI Career Advice & Paying It Forward 40:23 – Conferences, Community & Cyber Networking 41:58 – “The Most Secure Woman in the World” Joke 43:20 – Final Thoughts & Closing   TOPICS COVERED AI and cybersecurity careers, Human-in-the-loop security, SOC analyst evolution, Deepfakes and generative AI, Cybersecurity education, Security awareness training, Supply chain attacks, Stuxnet and critical infrastructure, Ransomware economics, Vibe coding risks, Community and mentorship in cyber    #CyberSecurity #ArtificialIntelligence #AI #CyberMettle #HumanRisk #Deepfakes #CyberCareers #InfoSec #SecurityAwareness #CyberPodcast #GenerativeAI #SOCAnalyst #Ransomware #CyberLeadership #KnowBe4 KEYWORDS: James McQuiggan Apparent Security Cybersecurity AI jobs Will AI replace cybersecurity jobs AI in cybersecurity Human risk management Cybersecurity careers 2026 Deepfake cybersecurity SOC analyst AI Generative AI security Cybersecurity podcast Cybersecurity leadership Cybersecurity education Vibe coding cybersecurity KnowBe4 cybersecurity AI workforce disruption Cybersecurity mentorship Cybersecurity community Ransomware discussion Stuxnet cybersecurity

AI is changing cybersecurity hiring faster than most companies are prepared for. Recruiter Pete Strouse joins  ⁨@TheCyberMettlePodcast⁩  to explain why entry-level roles are disappearing, how GRC is evolving, and what professionals must do to stay relevant. In this episode of The Cyber Mettle Podcast, Omar Sangurima and Alyson Laderman sit down with Pete Strouse, founder of InfoSec Connect and widely known as “The GRC Recruiter,” for an unfiltered conversation about the future of cybersecurity hiring. Pete shares what he’s seeing firsthand across GRC, compliance automation, MSSPs, consulting firms, and cybersecurity startups, including: Why companies increasingly want senior talent without building junior pipelines; How AI and automation are reshaping GRC and SOC analyst roles; The hiring biases most companies won’t openly discuss; Why networking matters more than ever in cybersecurity; The growing importance of GRC engineering and AI governance; How transferable skills can outperform “perfect” resumes; Why culture and motivation matter more than compensation alone; and The hidden long-term risks of eliminating entry-level opportunities. The discussion also explores private equity’s impact on cybersecurity organizations, recruiting realities behind the scenes, and what cybersecurity professionals should focus on now to remain competitive in an AI-driven market. If you work in cybersecurity, GRC, compliance, governance, audit, risk management, or are trying to break into the industry, this episode delivers practical insight from someone who sees hiring trends every single day.   ABOUT PETE STROUSE: Pete Strouse is the founder of InfoSec Connect and a longtime recruiter specializing in Governance, Risk, Compliance (GRC), information security, audit, DFIR, MSSPs, and cybersecurity startups. Known online as “The GRC Recruiter,” Pete has spent more than a decade helping organizations hire cybersecurity talent while advising professionals on career strategy and market trends. Chapters:  00:00 – Introduction and disclaimer 01:11 – Pete Strouse’s background in GRC recruiting 02:04 – Why GRC platforms now need actual practitioners 03:02 – AI, automation, and the disappearing entry-level role 05:09 – The cybersecurity hiring market reality 06:43 – Why companies only want experienced hires 08:17 – Experience requirements and hiring bias 09:29 – Where entry-level cybersecurity talent can still gain experience 11:34 – Networking strategies that actually work 14:13 – Why human connection matters more in the AI era 15:25 – Hiring biases companies rarely admit publicly 17:20 – Private equity’s growing influence in cybersecurity 18:54 – Market consolidation and compliance automation 20:25 – Personal branding and standing out in cybersecurity 22:31 – Transferable skills hiring managers value 24:41 – Why recruiters fight for candidates with strong intangibles 26:15 – Can resumes communicate intangible skills? 27:36 – Do cover letters still matter? 29:38 – Technical skills worth learning right now 32:01 – Why portfolios and proof matter more than resumes 34:50 – The cybersecurity talent pipeline problem 36:12 – Why MSSPs should hire more junior talent 38:32 – Understanding employee motivators 40:19 – Leadership, culture, and retention strategies 44:24 – Loyalty, layoffs, and short job stints 46:09 – How Pete developed his recruiting philosophy 48:31 – Pete’s advice for fixing cybersecurity hiring 49:12 – Final thoughts and closing   #CyberSecurity #GRC #AI #CyberJobs #InfoSec #CyberCareers #GovernanceRiskCompliance #CybersecurityLeadership #Compliance #RiskManagement #CybersecurityHiring #AIinCybersecurity #CyberMettlePodcast   KEYWORDS: cybersecurity hiring, GRC careers, AI in cybersecurity, cybersecurity recruiting, Pete Strouse, InfoSec Connect, cybersecurity jobs, entry level cybersecurity, GRC engineering, cybersecurity workforce, cybersecurity talent shortage, AI automation jobs, compliance automation, cybersecurity leadership, cybersecurity recruiting trends, governance risk compliance, cybersecurity mentorship, private equity cybersecurity, AI governance, cybersecurity networking

Thinking about the CISM? The exam is changing, and most people misunderstand what it actually tests and validates. Here’s what ISACA really expects, plus how to think like a manager (not an engineer) to pass. In this Cert Corner episode of  ⁨@TheCyberMettlePodcast⁩ , Dr. Omar Sangurima and Alyson Laderman break down the Certified Information Security Manager (CISM) certification: what it is, what’s changing on November 3rd, and whether it’s actually worth your time. This isn’t a surface-level overview. We get into: The new exam structure and domain weighting Why CISM is considered a “gatekeeper” certification The critical mindset shift: thinking like a manager, not a practitioner How CISM compares to CISSP and CRISC Real-world value: how it helps you connect security functions and lead programs We also cover test-taking strategy, remote proctoring realities, and why many candidates struggle. It's not because they lack knowledge, but because they answer from the wrong perspective. If you're aiming for mid-to-senior level cybersecurity roles, managing teams, or moving into leadership, then this episode is for you. ⏱️ CHAPTERS 00:00 – Welcome to Cert Corner: Why CISM Still Matters 01:45 – Big Change: New CISM Version Coming November 3 03:20 – Experience Requirements & “Gatekeeping” Reality 05:10 – New Domain Weighting: Program + Incident Management 07:00 – Who CISM Is REALLY For (Manager-Level Focus) 08:30 – CISM vs CISSP: Which One Should You Get? |10:15 – The Certification Gap Above Manager Level 11:30 – Exam Format: 150 Questions, 4 Hours, No Adaptive Scoring 12:45 – KEY TIP: Think Like a Manager, Not a Technician 14:30 – Incident Response Example: Why “Follow the Plan” Wins 16:00 – Distractors and Test Strategy Insights 18:00 – Remote Proctoring: What to Expect (and Fear) 22:00 – Real Talk: Proctoring Horror Stories & Test Anxiety 26:00 – Cost Breakdown: What You’ll Actually Spend 27:30 – CISM vs CRISC: Risk vs Program Leadership 29:30 – CISM vs CISSP Deep Comparison 33:45 – Career Impact: How CISM Changes Your Thinking 37:00 – Breaking Down Silos Across Security Teams 39:00 – Why Companies Misuse Certifications in Job Reqs 41:00 – Final Thoughts: Should You Get the CISM? 42:30 – Outro and What Certs to Cover Next Keywords: CISM certification, ISACA CISM 2025, cybersecurity certifications, CISM vs CISSP, CRISC vs CISM, cybersecurity management certification, security program management, ISACA exam changes, cybersecurity leadership cert, cyber career path #CISM #CyberSecurity #ISACA #Certifications #CISSP #CyberLeadership #GRC #InfoSec #CyberCareers #CyberMettle

AI isn’t replacing cybersecurity professionals. It’s reshaping what matters. The future belongs to those who can connect the dots, not just execute tasks. In this episode of  ⁨@TheCyberMettlePodcast⁩ , Omar Sangurima and Alyson Laderman sit down with Frederic (Fred) Descloux to explore one of the biggest shifts happening in cybersecurity today: the return of the generalist. Fred Descloux is the founder of Zero Drama Security, a straight-talking advisory firm built on a simple premise: most security programs are overcomplicated, under-effective and full of noise. He works with organizations to cut through AI hype, eliminate compliance theater and focus on what actually matters: data, decisions and real risk. Alongside his advisory work, he serves as a senior security and data protection leader at a global public company, bringing a pragmatic, no-BS perspective to modern security. As AI accelerates execution and automates routine work, organizations are facing a new challenge—decision-making, accountability, and connecting fragmented systems. Fred shares insights from nearly two decades in security, privacy, and risk across consulting, global organizations, and startups. Together, they unpack: * Why AI is compressing execution and what that means for experts * The real reason “talent gaps” persist in cybersecurity * How silos, governance failures, and lack of accountability hold organizations back * Why generalists who can connect business, risk, and technology are becoming critical * How to build practical, enforceable policies (and avoid governance theater) * What the next generation of cybersecurity leaders will look like This conversation goes beyond tools and tactics—it’s about mindset, leadership, and the future of the profession. If you're in cybersecurity, risk, legal, or business leadership, this episode will challenge how you think about expertise, career growth, and organizational design. Links: https://zerodramasecurity.com https://www.linkedin.com/in/fredericdescloux  ⏱️ CHAPTERS 00:00 – Introduction and Guest Welcome 01:30 – Fred Descloux’s Background & Career Path 05:00 – The Value of Being a Generalist in Cybersecurity 07:00 – Breaking Down Silos & Organizational Friction 10:30 – AI’s Impact on Security Roles & Execution 12:00 – “The Easy Work is Gone” — What AI Changes 14:30 – Decision-Making, Ownership, and Accountability 16:30 – Why Accountability is Missing in Organizations 19:00 – Governance Basics: Policies, RACI, and Simplicity 23:00 – Writing Policies That Actually Work 27:30 – Losing Credibility Through Poor Governance 30:00 – Risk vs Compliance vs Audit — Key Differences 33:00 – Cybersecurity as a Business Function 36:00 – The Importance of “So What?” in Security Strategy 39:00 – From Chaos to Clarity: Simplicity in Security 41:00 – AI as a Revealer, Not Just a Tool 43:00 – The Rise of the Generalist Mindset 46:00 – Talent Gap Myth & Workforce Evolution 50:00 – Rethinking Career Progression in Cybersecurity 53:00 – Apprenticeship, Trust, and Learning by Doing 56:00 – The Future: Faster Growth, Younger Leaders 58:30 – Closing Thoughts KEYWORDS: cybersecurity leadership, AI in cybersecurity, risk management, governance, generalist vs specialist, cybersecurity careers, CISO strategy, security governance, RACI chart, cyber risk, AI automation security, security policy best practices, talent gap cybersecurity, cyber workforce development, security leadership mindset #CyberSecurity #AI #RiskManagement #CyberLeadership #InfoSec #Governance #CISO #CyberCareers #SecurityStrategy #TheCyberMettlePodcast

Scams aren’t what they used to be, and your loved ones are the target. From AI voice cloning to data brokers, this is the conversation families need to have now. This episode of  @TheCyberMettlePodcast  tackles one of the most urgent — and uncomfortable — topics in cybersecurity today: protecting seniors and vulnerable family members from modern scams. Hosts Omar Sangurima and Alyson Laderman are joined by Cat Karow, founder of ZoraSafe, who brings over 20 years of experience in cybersecurity and product development. Together, they break down how scams have evolved from obvious fraud to highly targeted, AI-driven manipulation. This episode is more than just about technology; it's about human behavior, trust, and the reality that anyone can be targeted. In this conversation, you’ll learn: * How AI impersonation scams are changing the threat landscape * Why data brokers make scams more effective * The emotional manipulation tactics scammers rely on * Why seniors are disproportionately targeted * How to have practical, respectful conversations with loved ones * The role of shame in underreporting scams and how to change it * Why “urgency” is the biggest red flag Cat also shares how ZoraSafe is working to stop scams in real time while educating users through micro-learning and community reporting.   This is one of those conversations that may feel uncomfortable but is necessary. 👉 Resources mentioned: ZoraSafe (https://zorasafe.com)   ⏱️ CHAPTERS: 00:00 – Intro: A “tough but necessary” conversation 01:00 – Meet Cat Karow and ZoraSafe 02:00 – How real-time scam detection works 03:00 – Why scams go unreported (and why that matters) 05:00 – Real-life scam targeting a senior family member 08:00 – How scammers use purchased personal data 10:00 – Why you should stop answering unknown calls 11:00 – AI voice cloning & impersonation scams 13:00 – Hyper-targeting based on vulnerability 14:30 – Why reporting scams is critical 15:30 – The data broker ecosystem explained 18:00 – “You are the product”: data collection reality 20:30 – Living in a surveillance economy 23:00 – Information manipulation & fractured realities 26:00 – Forced digitization and its risks 27:00 – How to talk to family about scams 29:00 – The power of pausing and recognizing urgency 31:00 – Why scams are harder to detect today 32:30 – Long-con scams and crypto fraud 34:00 – Fake influencers, bots, and manipulation at scale 36:30 – The evolution of the internet (then vs now) 38:00 – Big Tech incentives and scam advertising 39:30 – Convenience vs privacy tradeoffs 40:30 – Data overcollection and “honeypot” risks 42:00 – Real-world security failures 45:00 – What happens to your data when companies fail 46:00 – Why data breach notifications come too late 48:00 – Real example: vehicle data exposure 49:00 – Can this problem actually be solved? 50:00 – Forced consent & loss of privacy 51:30 – Small business cybersecurity gaps 53:00 – Final thoughts: talk about it, remove the shame   🔑 KEYWORDS: cybersecurity podcast, scams targeting seniors, AI impersonation scams, voice cloning fraud, data brokers explained, identity theft prevention, cyber awareness, online safety for families, fraud prevention tips, ZoraSafe, Cat Karow, cyber threats 2026, digital privacy risks, scam prevention strategies #CyberSecurity #ScamPrevention #AIFraud #DataPrivacy #CyberAwareness #OnlineSafety #IdentityTheft #CyberMettle #FraudPrevention #TechEthics

Breaking into AI governance, privacy, or cybersecurity isn’t about where you start, it’s about how you think. Dr. Kyle David went from historian to AI governance leader and shows exactly how others can do it too.   In this episode of The Cyber Mettle Podcast, Omar Sangurima and Alyson Laderman sit down with Dr. Kyle David, founder of Dr. David Privacy and creator of leading IAPP certification training programs. Dr. David shares his unconventional path from academia to privacy and AI governance, offering a practical roadmap for career changers and professionals looking to future-proof their careers. The conversation explores: * Why AI governance is growing—but hasn’t hit “hockey stick” job growth yet * How privacy professionals are becoming AI governance leaders * The real impact of regulation vs innovation * What organizations are struggling with when adopting AI * Tactical ways to break into cybersecurity, privacy, or AI governance today   Whether you’re preparing for certifications like AIGP or exploring a transition into tech-adjacent roles, this episode delivers grounded, actionable insights.   ⏱️ CHAPTERS 00:00 – Intro & welcome to the episode 00:53 – Meet Dr. Kyle David (origin story) 02:02 – From academia to privacy: career pivot during COVID 05:41 – Discovering gaps in certification training 07:19 – Building Dr. David Privacy & AIGP success 09:47 – Entry-level challenges in privacy & AI governance 12:12 – Why AIGP is growing in demand 15:28 – Career pathways after AIGP (3 tracks) 18:21 – Regulation vs innovation in AI 23:32 – Legal perspective on fragmented regulation 24:41 – Innovating inside government systems 29:27 – Theory vs practice in learning 31:01 – How to break into cyber, privacy, or AI (3 strategies) 33:41 – Volunteering, networking, and real-world experience 36:28 – Risks and realities of “working for free” 41:18 – Learning styles and practical application 44:16 – Leveraging your current organization 46:26 – Where to find Dr. David 47:09 – Closing thoughts   KEYWORDS: AI governance careers, privacy career transition, cybersecurity entry level, AIGP certification, IAPP training, AI regulation vs innovation, privacy jobs, governance risk compliance careers, breaking into cybersecurity, Dr Kyle David, AI governance certification, privacy professional path   #CyberMettlePodcast #AIGP #AIGovernance #PrivacyCareers #CybersecurityJobs #GRC #CareerTransition #TechCareers #IAPP #AIRegulation

AI isn’t just another tool — it’s changing risk, liability, and how businesses operate. If you’re treating AI like SaaS, you’re already behind. In this episode of  @TheCyberMettlePodcast , Omar Sangurima and Alyson Laderman sit down with Graeme Rudd (former Green Beret, recovering lawyer, and founder of Assessed Intelligence) to unpack one of the most urgent issues in modern business: the convergence of AI governance and cybersecurity. Graeme explains why organizations are misjudging AI risk, how “move fast and break things” fails in regulated environments, and why governance is no longer optional—it’s a business survival strategy. From token burn risks and autonomous agents behaving unpredictably to legal liability, insurance gaps, and the future of certification standards, this conversation connects the dots across cybersecurity, legal, HR, and executive leadership. You’ll also learn about the Arise Framework, designed to unify cybersecurity and AI governance into a practical, usable model for organizations of any size. Key topics include: * Why AI risk is fundamentally different from traditional software * Token consumption as a financial and governance issue * The danger of “set it and forget it” AI workflows * AI agents as insider threats * Why cybersecurity and AI governance can no longer be separated * Legal and ethical implications of AI failures * The future of AI regulation, insurance, and certification * How organizations can start building governance today * The Arise Framework and how to use it Resources mentioned: Arise Framework (free): https://ariseframework.com Assessed Intelligence: https://assessedintelligence.com *Disclaimer: This podcast shares general insights and experiences. It is not to be construed as legal or cybersecurity advice.* 🔹 CHAPTERS 00:00 – Intro & guest welcome (Graeme Rudd) 02:02 – Why recent AI risks are accelerating 02:50 – Token burn: hidden cost & governance issue 04:55 – “Tokens as fuel” explained for business leaders 05:04 – Misconfiguration risk across AI systems 06:20 – AI introduces new legal, HR, and ethical risks 06:53 – Why AI is fundamentally different from SaaS 07:52 – AI drift and “set it and forget it” danger 09:35 – Leadership lessons from military backgrounds 10:24 – AI agents as insider threats 11:13 – Future: AI businesses will require certification 11:50 – “Muscle car with no driver training” analogy 13:07 – Veteran talent gap in cybersecurity 14:17 – Transition challenges from military to industry 18:05 – Founding Assessed Intelligence 19:49 – AI hype vs real-world limitations 21:14 – Snake oil in AI and why it persists 23:04 – Cybersecurity + AI governance must merge 24:29 – Why organizations don’t know where to start 25:25 – The problem with fragmented frameworks 26:18 – Arise Framework explained 27:34 – Ethical responsibility in AI deployment 28:47 – “Skynet’s idiot cousin” risk 30:50 – Speed vs understanding in AI development 32:32 – Why harm won’t stop adoption immediately 34:06 – Cyber insurance realities and gaps 35:25 – Why AI standards are inevitable 36:48 – Investment and copyright risks in AI 37:42 – Real-world risks: agents, deletion, manipulation 39:13 – Acceptable error rates in healthcare AI 41:29 – Cutting through hype: practical AI use 43:26 – Governance as competitive advantage 45:18 – Real incident: AI deleting critical data 47:28 – Vibe coding & IP leakage risks 49:27 – Human-in-the-loop limitations 50:22 – Free Arise Framework & maturity tool 52:20 – Final thoughts & closing   #Cybersecurity #AIGovernance #ArtificialIntelligence #RiskManagement #CyberRisk #AICompliance #Infosec #Leadership #DataGovernance #CyberMettle   Keywords: AI governance framework, cybersecurity and AI, AI risk management, Arise framework, Graeme Rudd, assessed intelligence, AI compliance, token burn AI cost, AI security risks, enterprise AI governance, AI legal risk, AI insurance risk, insider threat AI, AI maturity model, cybersecurity leadership