app_store_button

google_play_button

DK - Details page - Device banner - 894x1036

Lyt når som helst, hvor som helst 

Sean Martin

ITSPmagazine

Redefining CyberSecurity Podcast
Hosted by Sean Martin, CISSP

Have you ever thought that we are selling cybersecurity insincerely, buying it indiscriminately, and deploying it ineffectively?

For cybersecurity to be genuinely effective, we must make it consumable and usable. We must also bring transparency and honesty to the conversations surrounding the methods, services, and technologies upon which businesses rely. If we are going to protect what matters and bring value to our companies, our communities, and our society, in a secure and safe way, we must begin by operationalizing security.

Executives are recognizing the importance of their investments in information security and the value it can have on business growth, brand value, partner trust, and customer loyalty.

Together with executives, lines of business owners, and practitioners, we are Redefining CyberSecurity.

Redefining CyberSecurity

⬥EPISODE NOTES⬥

Something structural is shifting in how security work gets done. When anyone on a team can stand up a working tool in an afternoon, the constraint stops being capability and starts being coherence. John Linford, Security Portfolio Director at The Open Group, spends his time on exactly that problem, running the Security Forum, the Open Trusted Technology Forum, and the Assured Dependability Work Group, where practitioners from organizations of wildly different sizes argue their way toward standards that are supposed to survive contact with reality.

His framing of the tool question is blunt and worth stealing. When a team says it can build the thing, the first response is to ask what decision the thing informs. A dashboard showing numbers nobody was looking at before is not a security improvement, it is a new source of numbers. Standards, in this reading, are not compliance artifacts to be shown to an auditor. They are the thing that tells an organization which part of the problem a tool is supposed to solve, and how it fits alongside everything else already in place. The corollary matters just as much: when the tools themselves conform to a standard, vendors compete on the value they actually deliver rather than on the cost of switching away from them.

Linford takes the same argument up a level to architecture. Security architecture only works when it sits inside a broader enterprise and IT architecture rather than beside it, and that requires a CISO with genuine authority and a seat at the executive table. Where that authority is thin, The Open Group's Security Forum has leaned on the idea of security champions, people embedded across teams who do not need deep security skills but do need to know when to pull a specialist into the room. Getting that right moves the security conversation into the design phase, which is the only place it is cheap.

The scaling question gets an honest answer. The Open Group operates on one vote per member organization, which means a three-person shop carries the same weight in a final standard as Microsoft or RTX. That structure forces the standards to be implementable by organizations that have no security architect at all, and it shows up in deliberate choices like defining roles rather than job titles, because in a small company one person wears eight of them.

Then there is zero trust, which Linford describes with a line that circulates as a running joke inside the Security Forum: it is just what cybersecurity should have been from the beginning. The Zero Trust Commandments trace directly back to the Jericho Forum's deperimeterization work from the 1990s, and they fit on a single page on purpose. Secure assets according to their value and the damage their compromise would cause, and the spending priorities sort themselves out. The alternative, as he puts it, is announcing you will implement all five hundred-odd controls in NIST 800-53 and wishing yourself luck.

His closing point is the one most likely to sting. Security practitioners are fluent in security and frequently illiterate in business. Telling a board that twenty controls are required for conformance with the EU Cyber Resilience Act invites one question about cost. Telling them the same work opens a market and removes a year of analysis before expansion is a different conversation entirely, about the same twenty controls.

⬥GUEST⬥

John Linford, Security Portfolio Director at The Open Group | On LinkedIn: https://www.linkedin.com/in/johndouglaslinford/

⬥HOST⬥

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

⬥RESOURCES⬥

The Open Group | https://www.opengroup.org/

The Open Group Security Forum | https://www.opengroup.org/forum/security-forum-0

Zero Trust Commandments | https://pubs.opengroup.org/security/zero-trust-commandments/

Zero Trust Architecture at The Open Group | https://www.opengroup.org/forum/security/Zerotrust

The TOGAF Standard, 10th Edition | https://www.opengroup.org/togaf

Open Trusted Technology Forum | https://www.opengroup.org/forum/trusted-technology-forum

The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

⬥ADDITIONAL INFORMATION⬥

🎧 More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast

📺 Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

📰 Subscribe to The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity

✉️ Connect with Sean Martin | https://www.seanmartin.com/

⬥KEYWORDS⬥

john linford, the open group, sean martin, zero trust, security standards, enterprise architecture, togaf, security governance, ciso leadership, security architecture, open standards, security culture, supply chain security, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

When Everyone Can Build Their Own Tools, What Holds Security Together? | A Redefining CyberSecurity Podcast Conversation with John Linford, Security Portfolio Director of The Open Group

⬥EPISODE NOTES⬥

For a full year, agentic AI was the pitch. This year the conversation shifted to whether it holds up once it is actually running in production, against real work. Vendors came armed with customer-sourced numbers rather than concept demos — hours returned per analyst per week, percentages of alerts dispositioned without human review, agreement rates measured against human analyst judgment. Buyers arrived having spent the months since the previous major conference testing products and weighing what they were told against what they saw.

Not one of the four questions that dominated the show is exciting, and not one of them is actually an AI question. Naming an owner before something ships is governance. Showing your work is audit. Knowing where your components came from is supply chain hygiene. Configuring a tool to reach the outcome it was bought for is the oldest plain, unrewarded work there is. AI did not create those problems — it made them impossible to keep deferring. Marketing volume held steady. Scrutiny went up.

In this edition of Lens Four:

🔹 Why the easy read on Black Hat USA 2026 — that AI arrived — is a year late, and what moving from pilot to production actually exposed underneath it

🔹 The 4 questions that replaced the whether debate: who is accountable, what is the evidence, where is the data coming from, and is the foundation configured to hold the weight

🔹 How production turned governance into a named, accountable owner assigned before an agent ships, with a documented business justification behind it

🔹 The sharpest reframe of the week: a rogue agent is usually not malfunctioning, it is doing exactly what it was told, relentlessly, until it succeeds

🔹 The Midnight in the War Room session on the gap between people authorized to take risks and people expected to mitigate them, and why burnout rather than obsolescence is the analyst risk to manage

🔹 Why "black box" became unacceptable, and the 2 ways teams are validating: reading the reasoning trail directly, and replaying historical alerts against what human analysts already concluded

🔹 Sovereignty getting repaired in real time, from a geography and compliance word into a control word about who owns the derivative value of an organization's data

🔹 AI's own supply chain, and the 2 capability gaps leaders keep naming: a basic AI inventory, and third-party visibility into which vendor products already have AI embedded in them

🔹 The Vulnerability Research in the Agentic Age keynote on a pipeline producing well over 1,000 potential local privilege escalation findings, and why discovery got cheap while absorption did not

🔹 Post-quantum timelines compressing from 10 to 15 years toward as little as 3, and why crypto-agility belongs in the refresh cycle rather than a standalone initiative

🔹 What buyers were actually shown: roughly 75 percent of 10,000+ daily alerts cleared without primary analyst review, up to 19 minutes returned per analyst per hour at 99.7 percent agreement with human verdicts, and analyst throughput moving from about 10 closed alerts per shift to 50 or 60, all vendor-reported rather than audited

🔹 The 47 AI SOC vendors counted on the floor, roadmaps compressing from 12 to 18 months down to 3 to 6, and why the market got louder exactly as buyers got more specific

🔹 Why token costs that are not falling set a ceiling on adoption pace that governance readiness cannot lift, and what that means for consumption-based pricing

🔹 Why a resurgence of value-added resellers and system integrators is the market pricing a job that has to happen somewhere: which products fit which environments, and how you connect it all

Fourth Lens: Proof does not transfer. Different analysis approaches expose different properties, which makes tool efficacy hard to compare in the abstract, and prioritization frameworks are already moving toward environment-specific attributes. A number on a vendor slide came out of someone else's alert mix and someone else's data — it is evidence of something, but it is not evidence about you. So the burden lands partly on the buyer, with a split most people get wrong. The vendor owes the apparatus: a visible chain of reasoning, audit logs, the ability to replay your own history, and hands-on access without a six-month procurement cycle in front of it. The buyer owes the environment and the baseline. Neither side can produce the answer alone, and human on the loop is what that bargain looks like once it is running. If scrutiny only works when you have built something capable of doing the checking, what have you built?

▶ Full article and references: seanmartin.com/lens-four

▶ All Black Hat USA 2026 conversations: ITSPmagazine podcasts playlist

▶ Subscribe to Lens Four: seanmartin.com/lens-four

▶ Redefining CyberSecurity Podcast: redefiningcybersecuritypodcast.com

▶ Music Evolves Podcast: musicevolvespodcast.com

▶ ITSPmagazine: itspmagazine.com

▶ Studio C60: studioc60.com

Sean Martin, CISSP is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and the Music Evolves Podcast, and the author of Lens Four, a weekly column on business, innovation, and messaging at seanmartin.com.

Keywords: Black Hat USA 2026, agentic AI, AI SOC, security operations, non-human identity, agent accountability, named accountable owner, rogue agent behavior, AI governance, chain of reasoning, human on the loop, AI supply chain, AI inventory, sovereignty, post-quantum readiness, consumption-based pricing, proof of value, CISO decision making

Marketing Volume Held Steady. Scrutiny Went Up. | Lens Four by Sean Martin | Read by TAPE9

⬥EPISODE NOTES⬥

Tidal is about to stop paying royalties on any track it judges to be fully machine-made. Frame that as a music story and you miss the shift underneath it. By Deezer's own detection, roughly 75,000 AI-generated tracks now arrive every day, about 44% of everything uploaded, yet that same AI music is only 1 to 3 percent of what people actually play, and around 85% of those streams are flagged as fraudulent. The flood is not an audience. It is an attack on a shared payout.

This edition follows one pattern across six industries: when the cost of generating something collapses toward zero, platforms stop paying for output and start paying for proof of human origin. Tidal cuts AI royalties. The Authors Guild sells a "Human Authored" badge for ten dollars a title. YouTube demonetizes "inauthentic" content. curl killed its bug bounty after a flood of AI slop, then reopened when the slop got good. And where no gatekeeper owns the payout, hiring, the open web, the scientific record, the flood just degrades the mechanism until no one trusts it.

In this edition of Lens Four:

🔹 Tidal's July 15 policy ends royalty attribution and direct-to-fan sales for fully AI-generated tracks, a payout decision, not a content ban.

🔹 Deezer takes in about 75,000 AI tracks a day (44% of uploads), up from roughly 10,000 a day at the start of 2025, while human uploads barely moved.

🔹 The paradox that reframes the debate: AI music is 44% of uploads but 1 to 3 percent of listening, and about 85% of those streams are fraudulent.

🔹 The first US criminal AI streaming-fraud case: Michael Smith pleaded guilty after collecting more than 8 million dollars in royalties from hundreds of thousands of AI songs and roughly 1,000 bot accounts.

🔹 curl shut down its bug bounty under a flood of AI vulnerability reports, then reopened a month later because the AI reports got good enough to read. Cutting the money did not cut the volume.

🔹 The counter-case: recruiters see about 11,000 job applications submitted to LinkedIn every minute, up 45% in a year, with no single payout to switch off.

🔹 Provenance becomes a product: Suno (2 million subscribers, about 7 million songs a day) adds identity-verified voice cloning while the Authors Guild sells human certification.

🔹 The danger tier: roughly 20% of AI-recommended software packages do not exist (slopsquatting), and close to 10% of cancer papers show paper-mill signatures.

🔹 The language turned first: Merriam-Webster made "slop" its 2025 word of the year, and YouTube quietly renamed "repetitious" content to "inauthentic."

🔹 Human filters see it clearest: DJ Sam Young asks why we need fifty versions of the same thing, and producer Gregoire Gensollen says he will remember the human moments, not the tool.

Fourth Lens: The three lenses meet at one move. Platforms re-price payouts around human origin, the market builds products that certify it, and the language teaches us to want it. That is not a defense of artists, it is a paywall around authenticity, sold as virtue, and it is arriving before audiences even asked for it. Reality has come at a premium, exactly as predicted in 2017. So the real question is not whether the real is worth more. It is this: when proof of human becomes a product, who is making the money, and who handed them the right to decide what counts as real?

▶ Read the full article and references

▶ Subscribe to Lens Four

▶ Redefining CyberSecurity Podcast

▶ Music Evolves Podcast

▶ ITSPmagazine

▶ Studio C60

Sean Martin, CISSP, is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and Music Evolves Podcast, and writes Lens Four at seanmartin.com.

Keywords: AI-generated music, Tidal, Deezer, streaming fraud, provenance, content authentication, Human Authored, Authors Guild, Suno, slopsquatting, curl bug bounty, AI slop, paper mills, AI job applications, Merriam-Webster slop, DJ Sam Young, Gregoire Gensollen, Sean Martin, Lens Four

The Flood Made Everything Free. So Now We Pay for Proof. | Lens Four by Sean Martin | Read by TAPE9

⬥EPISODE NOTES⬥

Almost every booth at Infosecurity Europe 2026 had settled on the same four words. Outcomes. Resilience. Sovereignty. Human in the loop. The messaging had grown up, more tempered than RSAC, more honest in its European register. The tell was quieter — almost none of it could connect those words to a definition of success a buyer could actually verify.

Strip away the polish and the show floor was a working argument about what the cybersecurity market is for, at the exact moment the clock that governs it collapsed to seconds. The go-to-market caught up to the language. The capability did not. This is the prove-it problem, and it is worth pulling apart clearly.

In this edition of Lens Four:

🔹 Why the quiet vocabulary convergence mattered more than any single product launch — outcomes, resilience, sovereignty, and human in the loop became the words everyone said, and almost none could tie them to a definition of success a buyer could verify

🔹 The number that should reorganize every SOC — the jump from initial access to the next stage collapsing from 8 hours to 22 seconds, with ransomware finishing in under an hour, most often on a Wednesday night

🔹 How Qualys reframed measurement itself — a client environment of 62 million risk findings cut to under 1% that could actually be executed, because the dashboard was never the deliverable, remediation was

🔹 Why Corelight put the same test on the detection itself — a black box tells you little, so keep the data behind every alert in the open and let an analyst prove what it actually is, the way one proof of value surfaced unencrypted sensitive traffic in 30 minutes

🔹 How Sumo Logic showed the repeatable version — prove a fix once, then let an agent apply that proven fix across 599 identical machines under human oversight, and its move into the AWS European Sovereign Cloud put something concrete under the week's sovereignty talk

🔹 What the criminal economy revealed as the honest mirror — an underground market for AI attack tools that went from 38 posts to over 1,400 in two months, tiered and redundant, an AI call center for hire that sounds like SaaS

🔹 Why the board's only real question, are we okay, now lands on the CISO as personal liability, just as AI moves from experimentation to deployment inside the organization

🔹 How consolidation and absorption are sorting the floor — 40-plus tools in silos, "make us relevant" becoming an executive hire, and the 12-to-18-month reckoning where AI absorbs functions that fill today's expo hall

🔹 The tell underneath all of it — when every booth converges on the same three or four words, the words stop doing the one job language has at a trade show: helping a buyer tell two things apart

Fourth Lens: The vocabulary moved faster than the products underneath it. The industry repositioned around outcomes without ever defining the outcome, and the bill comes due over the next 12 to 18 months, not because AI arrives, but because AI removes the last place to hide the question. Naming the outcome was the easy part. Proving it repeats, across environments and teams and budgets that share nothing but the problem, is the part the vocabulary skipped. When the story can no longer be rounded up, are we okay, and can you prove it twice?

🥁 🎶 A very big THANK YOU to our Infosecurity Europe 2026 Full Coverage Sponsors: Corelight · Qualys · Sumo Logic 👏 👏 👏

▶ Full article and references

▶ Full Infosecurity Europe 2026 coverage

▶ Subscribe to Lens Four

▶ Redefining CyberSecurity Podcast

▶ Music Evolves Podcast

▶ ITSPmagazine

▶ Studio C60

Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine and Studio C60, host of the Redefining CyberSecurity Podcast and Music Evolves Podcast, and co-host of On Location and Random and Unscripted. Learn more at seanmartin.com.

Keywords: Infosecurity Europe 2026, cybersecurity go-to-market, security marketing, vendor positioning, machine-speed attacks, agentic AI, ransomware economics, post-quantum cryptography, boardroom liability, digital sovereignty, security tool consolidation, network detection and response, mean time to resolve, threat intelligence, resilience, Sean Martin, Lens Four

We Made Everything Faster. We Never Defined Better. | Lens Four by Sean Martin | Read by TAPE9

⬥EPISODE NOTES⬥

At Infosecurity Europe 2026, Sean Martin sits down with Rik Ferguson, Vice President of Security Intelligence at Forescout, a day before Rik Ferguson takes the keynote stage with a deliberately provocative title: "Post-Quantum Cryptography Is a Way Off. We Can Wait, Can't We?" The honest answer, he says, is that waiting is a choice, and it is the wrong one.

The threat is neither theoretical nor distant. Rik Ferguson walks through why the infrastructure for harvest-now, decrypt-later attacks already exists, pointing to Salt Typhoon, to BGP rerouting by unfriendly nations, and to intelligence agencies stockpiling encrypted data they cannot read yet but expect to read later. With NIST placing Q Day around 2035, Google pointing at 2029, and IBM's fault-tolerant Starling system slated for 2029, the distance between "someday" and "the hardware you purchase this year" has effectively closed.

Sean Martin keeps steering the conversation back to the business. The parallel both of them keep returning to is Y2K, which became a non-event precisely because people did the work. The quantum question, Rik Ferguson argues, is not only about security or resilience, it is a budget and procurement question: which data has a long enough shelf life to still matter when it is finally decrypted? Pharmaceutical R&D, merger and acquisition strategy, sovereign debt positions, and legal negotiations all live under an assumed umbrella of privacy that encryption may not hold.

The most unsettling point is what a harvest-now attack does to incident response. There is no time-bounding. Adversaries could have been collecting for a decade, and the first sign of trouble arrives only when the data is weaponized or made public, leaving the investigation disabled by chronology alone.

Rik Ferguson closes with a message that reaches past cryptography itself: as attacks move toward autonomy, defense has to as well, which is why he wants the industry to move past Assume Breach and into Assume Autonomy.

⬥HOST⬥

Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/

⬥GUEST⬥

Rik Ferguson, Vice President of Security Intelligence, Forescout | https://www.linkedin.com/in/rikferguson/

⬥RESOURCES⬥

Infosecurity Europe 2026 is taking place June 2-4, 2026 | ExCeL London -- Follow our coverage: https://www.itspmagazine.com/infosecurity-europe-2026-infosec-london-cybersecurity-event-coverage

 The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

 Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast

 On Location | https://www.itspmagazine.com/on-location

⬥KEYWORDS⬥

sean martin, rik ferguson, infosecurity europe, post-quantum cryptography, pqc, harvest now decrypt later, hndl, q day, quantum computing, encryption, salt typhoon, quantum agility, crypto agility, post-quantum migration, procurement, on location, itspmagazine

The Quantum Threat Is Already a Business Decision You're Making Today | An On Location Conversation at Infosecurity Europe 2026 with Rik Ferguson, Vice President of Security Intelligence

⬥EPISODE NOTES⬥

From the show floor at Infosecurity Europe 2026, Sean Martin sits down with James Morris, Director of The CSBR (Centre for Cyber Security and Business Resilience) and a former UK Member of Parliament who spent fourteen years in the House of Commons and chaired the All-Party Parliamentary Group for Cyber Security. His work now lives at the intersection of cybersecurity and resilience, translating evidence and expert roundtables into policy that Parliament can actually use.

The conversation opens on a hard problem: legislation moves slowly, and technology does not. The UK's Cyber Security and Resilience Bill has been working through Parliament for fifteen months and may not be operational for the better part of a year, even as AI moves from the margins to the center of national infrastructure. James Morris describes how the government has responded by giving itself powers to designate organizations and sectors as threats emerge, a top-down approach that he argues only works if business is brought along from the bottom up.

What counts as resilience is changing too. For years the word pointed narrowly at critical national infrastructure such as power and rail. James Morris makes the case that resilience now means economic resilience, pointing to high-profile UK breaches at Marks and Spencer and JLR that paralyzed major businesses yet would not be captured by the very bill moving through Parliament. Sean Martin pushes the thread into the supply chain, where the legislation starts to designate critical suppliers for the first time, with new expectations around transparency, incident reporting, and hardening, though financial services sits outside under its own regime.

The closing turn is the one business owners should sit with. Cyber resilience is no longer a peripheral technical task to hand to IT. It is a board-level issue tied to strategy, reputation, and the survival of the organization itself, and the leaders who treat it that way, rehearsing breaches before they happen and planning for the media scrutiny that follows, are the ones positioned to recover.

Resilience, in the end, is not only technical. It is economic, managerial, and political, and getting it right is becoming inseparable from how a modern society protects itself.

⬥HOST⬥

Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/

⬥GUEST⬥

James Morris -- Director, The CSBR (Centre for Cyber Security and Business Resilience); former UK Member of Parliament; former Chair of the All-Party Parliamentary Group for Cyber Security | https://uk.linkedin.com/in/james-morris-obe-787a2b17

⬥RESOURCES⬥

Infosecurity Europe 2026 is taking place June 2-4, 2026 | ExCeL London -- Follow our coverage: https://www.itspmagazine.com/infosecurity-europe-2026-infosec-london-cybersecurity-event-coverage

The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast

On Location | https://www.itspmagazine.com/on-location

🥁 🎶 A very big THANK YOU to our Infosecurity Europe 2026 Full Coverage Sponsors: Corelight · Qualys · Sumo Logic 👏 👏 👏

⬥KEYWORDS⬥

sean martin, james morris, infosecurity europe 2026, cyber resilience, cybersecurity policy, cyber security and resilience bill, uk cybersecurity, supply chain security, critical national infrastructure, economic resilience, board level security, csbr, on location, itspmagazine

Redefining Cyber Resilience | An On Location Conversation at Infosecurity Europe 2026 with James Morris, Former UK Member of Parliament

⬥EPISODE NOTES⬥

What does it take to lead a 200-person security organization without coming up through the technical ranks? Tera Ladner, Deputy Global Chief Information Security Officer at Aflac, answers that question by describing a path that runs through information management, e-discovery, and a law degree before it ever reaches the security org chart. The result is a leader who looks at a program through the lens of controls, evidence, and defensibility, and who treats security as a people problem before a technology one.

Host Sean Martin and Tera Ladner dig into what that orientation changes in practice. Rather than opening a stakeholder conversation with controls or threats, Tera Ladner starts by listening: what are the business goals, and how does security enable them? Working inside an insurance company helps, because risk is already the shared language of every leader in the building. The job, as she frames it, is translation, turning a technical event into a business and resiliency impact that the people who own the decisions can actually act on.

The conversation turns to hiring and team building, where Tera Ladner names curiosity as the first trait she screens for, the instinct to ask the second, third, and fourth question until the real problem surfaces. From there she argues for a broader "tool belt": storytelling, relationship building, influence without authority, and the ability to navigate ambiguity, a skill she sees tested daily as boards and technology leaders press for answers on frontier AI. Technical skills alone, she suggests, were enough years ago and are not enough now.

Culture sits at the center of how she leads. "Your team lives in the house that you build," she tells her people leaders, and she describes the team norms, transparency, integrity, and care, that hold a security organization together in the hard moments. That same relationship-first instinct extends outward, to a seat at the executive table that has to be earned by giving stakeholders a seat at yours, and downward into the talent pipeline through Aflac's Cyber Inspire and Empower Girls programs, which grew from 200 girls in their first local year to 815 in the second.

For security and risk leaders, the throughline is hard to miss: the future of the field depends less on finding more technologists and more on building leaders who can listen, translate, and bring people who never saw themselves in cyber to the table.

⬥GUEST⬥

Tera Ladner, Deputy Global Chief Information Security Officer at Aflac

 On LinkedIn: https://www.linkedin.com/in/teraladner/

⬥HOST⬥

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

⬥RESOURCES⬥

Aflac: https://www.aflac.com/

Cyber Inspire and Empower Girls (Aflac community programs introducing students and seniors to cybersecurity): https://www.linkedin.com/company/cyberinspire

The Future of Cybersecurity Newsletter: https://www.linkedin.com/newsletters/7108625890296614912/

More Redefining CyberSecurity Podcast episodes: https://www.seanmartin.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

⬥ADDITIONAL INFORMATION⬥

🎙️ Redefining CyberSecurity Podcast: https://www.seanmartin.com/redefining-cybersecurity-podcast

 📺 ITSPmagazine on YouTube: https://www.youtube.com/@itspmagazine

 📰 The Future of Cybersecurity Newsletter: https://itspm.ag/future-of-cybersecurity

 🌐 Connect with Sean Martin: https://www.seanmartin.com/

⬥KEYWORDS⬥

tera ladner, aflac, sean martin, cybersecurity leadership, security culture, risk management, ciso leadership, women in cybersecurity, cybersecurity careers, non-traditional cybersecurity paths, building security teams, security as business enabler, cybersecurity talent pipeline, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

Cybersecurity Leadership Is a People Problem, Not a Technology Problem | A Redefining CyberSecurity Podcast Conversation with Tera Ladner, Deputy Global Chief Information Security Officer of Aflac

⬥EPISODE NOTES⬥

Almost nothing got said on the stages at Global Citizen NOW 2026 without a number behind it. $47 million toward a $100 million education fund. 27 organizations funded. 1,500 jobs from a single restoration effort. 18 million lives reached in one campaign. The headline was the money. The tell was quieter — a pilot to verify, record, and monitor every donated dollar with AI and blockchain, from the moment it is given to the point it makes impact on the ground.

Strip away the wattage — Adam Lambert and Ayra Starr opening, Hugh Jackman working the room, heads of state beside Fortune 500 CEOs — and Global Citizen NOW 2026 was a working argument about what technology is for when the objective is a social outcome rather than a shareholder return. In a sector whose standing pitch has been "trust us, the money helps," building the infrastructure to prove where every dollar goes inverts the pitch. The claim now comes with a receipt. This is the Proof of Impact pattern, and it is worth pulling apart clearly.

🔍 In this edition of Lens Four:

— Why the quiet AI-and-blockchain donation-tracking pilot mattered more than the headline fundraising number — accountability built in as a feature, not bolted on as a disclaimer, with the fund's independent review chair Benedetta Audia calling it "essential to our work"

— How the FIFA Global Citizen Education Fund put $47 million of a $100 million goal to work across 27 organizations, with grants of $50,000 to $150,000 and new commitments from Pharrell and the Varkey Foundation

— What Solar Freeze's farm-gate solar cold storage shows about outcomes-first technology — smallholders grow roughly 30% of the world's food and receive under 1% of climate finance, and 2026 Global Citizen Prize recipient Dysmus Kisilu describes the unit as "like an Airbnb, but for vegetables"

— Why energy access framed the day: around 750 million people live without electricity, 600 million in Africa — a continent holding roughly 60% of the world's renewable resources, where investment has tripled in five years

— How a Bezos Earth Fund restoration effort turned roughly 150 farmers into 1,500 jobs with 80% of businesses profitable over five years — and Tom Taylor's blunt financing logic: a million is philanthropy's job, a billion is government's, a trillion needs private industry

— What "The AI Powered Workforce" panel revealed — 88% AI adoption per Stanford's 2026 index, real productivity gains — and the asterisk it kept burying: 82% of small businesses know AI is critical, while roughly 75%, in PayPal's Amy Bonitatibus's words, "don't feel that we have the tools and training"

— Why "democratizing" is a deliverable someone has to fund and distribute, not a property of the technology — the same wave that lets a fund trade billions on autonomous models is the one that disrupts the business that never got the training

— What the Amazon campaign's 4.4 million actions, more than $1 billion in commitments, 31 million hectares protected, and 18 million lives reached prove about outcomes at scale, on Marcelo Thomé's principle that "the forest has value when it is standing"

Fourth Lens: Technology is finally good enough to keep the receipts. The harder question is whether the sector will like what they show. When every dollar is traceable from gift to ground, the test stops being whether impact can be proven and becomes whether the story survives once it can no longer be rounded up. When the rounding stops, how much of the impact story survives the data?

🔗 Full article and references: https://seanmartin.com/lens-four/global-citizen-now-2026-technology-trust-outcomes

📧 Subscribe to Lens Four: https://seanmartin.com/lens-four

🎙 Redefining CyberSecurity Podcast: https://redefiningcybersecuritypodcast.com

🎧 Music Evolves Podcast: https://musicevolvespodcast.com

🌐 ITSPmagazine: https://itspmagazine.com

🎬 Studio C60: https://studioc60.com

Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine (itspmagazine.com) and Studio C60 (studioc60.com), host of the Redefining CyberSecurity Podcast (redefiningcybersecuritypodcast.com) and Music Evolves Podcast (musicevolvespodcast.com), and co-host of On Location (itspmagazine.com/on-location) and Random and Unscripted (randomandunscripted.com). Learn more at seanmartin.com.

🔎 Keywords: Global Citizen NOW, technology for good, impact measurement, donation transparency, AI and blockchain, FIFA Global Citizen Education Fund, climate finance, Solar Freeze, energy access, Bezos Earth Fund, AI powered workforce, democratizing AI, small business AI, Amazon conservation, social impact, Sean Martin, Lens Four

Proof of Impact | Lens Four by Sean Martin | Read by TAPE9

⬥EPISODE NOTES⬥

The healthcare system is, by some measures, the most targeted sector in cybersecurity. Patient records get lifted, hospitals get held for ransom, and the supposed protections often look more like antiquated friction than modern defense. Gil Bashe, Chair of Global Health and Purpose at FINN Partners, joins Sean Martin to explore why the systems meant to protect people's most sensitive information are, in many cases, the same systems holding back better care. A former combat medic, agency CEO, private equity operator, and now author of Healing the Sick Care System: Why People Matter, Gil Bashe brings a rare composite view of how information, technology, and human judgment collide in healthcare.

The conversation moves quickly from ransomware and HIPAA-covered entities into the harder questions about AI. With an estimated 80 percent of doctors already using OpenAI tools to assist with diagnosis or treatment patterns, the line between "in the zone" and "precision" information has become a clinical safety issue. Gil Bashe reframes hallucinations as what they really are in his world: wrong facts. And wrong facts, fed back into a system that increasingly trusts the output, create a feedback loop that no one is accountable for. The machine doesn't sleep, doesn't worry, doesn't carry responsibility. The humans on either side of it do.

That accountability gap is where the cybersecurity audience comes in. Gil Bashe draws a direct parallel between great coders and great clinicians: both work inside-out and outside-in, interviewing the people who use the system and the people the system serves. He argues that the cybersecurity professional protecting an EMT's routing system, a hospital's power grid, or an MRI data pipeline is saving lives on the same continuum as the paramedic. The skillset is different. The stakes are not.

Sean Martin and Gil Bashe also press on the leadership question raised by AI. If clinicians are freed up by 15 percent of their day, what does the system ask them to do with that time? See two more patients on the conveyor belt of sick care, or actually treat the underlying cause of disease? With 18.7 percent of U.S. GDP going to healthcare and 35 percent of that consumed by administration, the answer is not technical. It is a leadership decision about what the technology is for.

This conversation asks cybersecurity practitioners, CISOs, and technology leaders to widen the frame. Protecting data is the floor. Protecting the human relationships, the clinical judgment, and the dignity of the patient on the other end of the system is the work.

⬥GUEST⬥

Gil Bashe, Chair, Global Health and Purpose at FINN Partners | On LinkedIn: https://www.linkedin.com/in/gilbashe/

⬥HOST⬥

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

⬥RESOURCES⬥

Healing the Sick Care System: Why People Matter (book by Gil Bashe) | https://www.finnpartners.com/news-insights/healing-the-sick-care-system-why-people-matter/

FINN Partners | https://www.finnpartners.com/

The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast

Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

⬥ADDITIONAL INFORMATION⬥

Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast

Redefining CyberSecurity on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity

Connect with Sean Martin | https://www.seanmartin.com/

⬥KEYWORDS⬥

gil bashe, finn partners, sean martin, healthcare cybersecurity, hospital ransomware, ai in medicine, chatgpt clinical use, patient data protection, hipaa business associates, health information leadership, sick care system, non-communicable diseases, human leadership in ai, medical misinformation, prompt accountability, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

When Patient Records, Powerlines, and Prompts All Lead to the Same Risk | A Redefining CyberSecurity Podcast Conversation with Gil Bashe, Chair, Global Health and Purpose of FINN Partners

⬥EPISODE NOTES⬥

The most dangerous sentence in cybersecurity disclosure right now is "no evidence of unauthorized access to our network." It is technically true. It is also operationally hollow. The customer whose data is on a leak site does not care which network it left from. The plaintiff in Bexar County does not care. The regulator about to receive a federal incident report under a 72-hour clock that starts at suspicion, not confirmation, will not care.

In April 2026, two U.S. banks disclosed an incident at the same unnamed third-party vendor. Six class action lawsuits followed in two weeks. The vendor still has not been publicly named. The plaintiffs sued the banks anyway. In a separate situation, an alleged Adobe breach surfaced through a threat actor's claims about a third-party business process outsourcing firm -- and as of the coverage reviewed for this analysis, no public confirmation or denial from Adobe had surfaced. This is the Common Point of Failure pattern, and it is arriving with enough frequency that it deserves to be named clearly.

🔍 In this edition of Lens Four:

— Why "no evidence of unauthorized access to our network" leaves the data, the contract, and the customer out of the picture — and why that omission is doing real damage as regulators, plaintiffs, and customers all collapse the distinction between "our network" and "their network"

— How the proposed CIRCIA rule's "reasonable belief" trigger changes the operating math when the suspected source is a third party: the 72-hour clock starts when the SOC analyst flags, not when the legal team confirms

— What the NYDFS October 21 2025 industry letter on third-party service providers tells covered entities to do — and how the regulator's prescriptive guidance becomes the de facto checklist for audits, examinations, and enforcement

— Why the cyber insurance market, per Woodruff Sawyer's annual Cyber Looking Ahead Guide, is now functioning as a verification mechanism — and why the underwriter and the regulator are now the ones shaping what gets bought, not the threat

— Verizon's own analysis of its 2025 Data Breach Investigations Report — drawing on more than 22,000 incidents — found the share of breaches involving a third party doubled year over year, from 15% to 30%

— Three things the network sentence leaves out: the data (where it lived, how it was stored, what controls applied), the operating model (how a vendor came to have enough access to produce customer harm), and the chain of accountability (the contractual relationship between named brand and unnamed vendor)

— Why the vendor concentration the industry has been selling as "consolidation" for two decades is also the thing concentrating blast radius — and why discovery in the class actions, not voluntary disclosure, is the most likely path to actually naming the vendors

— Two CISO conversations the Fourth Lens draws on: Tim Brown on what carries a security leader through the worst day of their career (trust built before the trust was needed, context, perspective, communication), and Joe Sullivan on building cyber teams the way fire departments are built — one team on the go, one on standby, one resting

— The Fourth Lens: the program reality is that the named brand is accountable for things happening at a vendor it cannot directly control; the market reality is that the regulator and the insurer have already written the checklist; the messaging reality is that the disclosure language has not caught up to either

Fourth Lens: The vendor whose name you do not know is the vendor whose risk you cannot manage. The fix is not in the disclosure language. It is in the operating model the disclosure language is currently helping to obscure. The next twelve to eighteen months — through the first CIRCIA enforcement action, the first court-ordered discovery that names a CPOF vendor, and whatever the next shared-vendor breach turns out to be — will start writing the answer to what a security program is actually for when the breach happens somewhere you cannot reach.

🔗 Full article and references: https://seanmartin.com/lens-four/the-vendor-you-cannot-name

📧 Subscribe to Lens Four: https://seanmartin.com/lens-four

🎙 Redefining CyberSecurity Podcast: https://redefiningcybersecuritypodcast.com

🎧 Music Evolves Podcast: https://musicevolvespodcast.com

🌐 ITSPmagazine: https://itspmagazine.com

🎬 Studio C60: https://studioc60.com

Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine (itspmagazine.com) and Studio C60 (studioc60.com), host of the Redefining CyberSecurity Podcast (redefiningcybersecuritypodcast.com) and Music Evolves Podcast (musicevolvespodcast.com), and co-host of On Location (itspmagazine.com/on-location) and Random and Unscripted (randomandunscripted.com). Learn more at seanmartin.com.

🔎 Keywords: Common Point of Failure, third-party risk, vendor breach, breach disclosure, CIRCIA, NYDFS, cyber insurance, CISO accountability, supply chain security, Tim Brown, Joe Sullivan, operational resilience, Sean Martin, Lens Four

The Vendor You Cannot Name | Lens Four by Sean Martin | Read by TAPE9

HITRUST, leader in information security and third-party risk management (TPRM), has announced significant enhancements to its HITRUST Assessment XChange. This comprehensive solution addresses longstanding challenges in TPRM by integrating with leading TPRM platforms to streamline vendor risk management processes. These integrations solve the "last mile" challenge by enabling organizations to efficiently capture, consume, and analyze detailed assurance data.

The HITRUST Assessment XChange operationalizes third-party risk management through end-to-end workflows that cover the entire vendor lifecycle—from initial evaluation to results analysis. This approach significantly improves information security risk capabilities, reducing time, costs, and complexity. It also allows organizations to manage risk with updated threat-adaptive controls, broad assessment options, and real-time updates on risk mitigation.

Legacy approaches to TPRM have proven inefficient, with many organizations relying on outdated methods like spreadsheets or self-assessment questionnaires. In contrast, HITRUST’s solution offers a practical, effective, and comprehensive approach, making TPRM more manageable and secure across industries.

HITRUST’s first planned integration with ServiceNow’s TPRM solution is set for release by the end of 2024, allowing users to leverage HITRUST's capabilities within the ServiceNow platform. This integration marks a new era in operationalizing information security TPRM, providing organizations with unprecedented visibility into vendor risk.

Learn more about and stay up to date by visiting hitrustalliance.net/news.

Note: This story contains promotional content. Learn more.

Resources

Learn more and catch more stories from HITRUST: https://www.itspmagazine.com/directory/hitrust

Learn more about 2 Minutes on ITSPmagazine Short Brand Story Podcasts: https://www.itspmagazine.com/purchase-programs

HITRUST Achieves Major Milestone with Availability of Solution Making it Practical to Manage Third-Party (Information Security) Risk | 2 Minutes on ITSPmagazine

HITRUST Achieves Major Milestone with Availability of Solution Making it Practical to Manage Third-Party (Information Security) Risk | 2 Minutes on ITSPmagazine

Lyt når som helst, hvor som helst

Other podcasts you might like ...