Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not? Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely. This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian Willett TL;DR Paying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees.Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups.Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes.Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection.AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy.

Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. There are many aspects of cybersecurity that are not classified as cool or sexy, but every component plays a role in securing people, data, and businesses. One particular aspect that is often seen as a necessary evil, even more so than policies and documentation, is cyber insurance. On one hand, you have a system that forces backstops to protect the organization in the event of an incident; on the other, requirements to not only remain insured but reduce premiums encourage businesses to invest more in securing the business. This week, we chatted with Karl Sharman of Forgepoint Capital and Andy Moss of Reed Smith to better understand the role cyber insurance plays today.

Season 3, Episode 4: Forrester Principal Research Analyst on Zero Trust, David Holmes, shares his perspective on the current and future state of Zero Trust. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. Zero Trust is a concept, a strategy, a philosophy, and, for some poor souls, a solution you can buy (it’s not). Through our three seasons, we have heard about MVPs, learned from the godfather of Zero Trust, been aided by Dr Zero Trust, and even heard from current and former federal officials about their stance on the concept. However, we have yet to touch on the current an future state of Zero Trust, and for that, we look to Forrester Principal Research Analyst on Zero Trust, David Holmes. Prior to joining Forrester, David spent a decade researching, writing, and speaking about cybersecurity topics for network and application security vendors. Before entering the cybersecurity space, he was a C/C++ software developer specializing in authentication and authorization, network protocols, and cryptography. So you could say he knows a thing or two about the subject at hand. TL;DR Holmes explains that Zero Trust's core principles remain unchanged: all networks are untrusted, least privilege access is enforced, and everything is inspected and monitored.The COVID-19 pandemic has accelerated the adoption of Zero Trust as organizations were forced to work remotely and faced VPN overloads.David shares his perspective on the current and future state of Zero Trust, as well as areas he would like to see the vendor market seek to solve.The biggest example of successful Zero Trust implementation is Google. Since implementing Zero Trust, no major breaches have been reported.In addition to Google, there is a smaller organization that successfully implemented Zero Trust using existing tools, indicating that Zero Trust can be achieved without significant financial investment.However, achieving full Zero Trust is a journey rather than a destination, similar to cybersecurity itself. It's an ongoing process of adaptation and improvement.

Season 3, Episode 3: Canva’s Head of Enterprise Security, Kane Narraway, discusses how to deploy a Zero Trust strategy in under a year. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. This week on Adopting Zero Trust (AZT) we chat with Kane Narraway, the head of Head of Enterprise Security at Canva. Prior to his current role. Kane has been adopting Zero Trust for around a decade, starting with the UK government, and later to organizations like Shopify, Atlassian, and BT. You could say he’s seen a thing or two, and has absolutely been part of the evolutions occurring within cybersecurity and Zero Trust. Kane walks, crawls, and runs us through how he has built out Zero Trust strategies and recommends where organizations get started.

Season 3, Episode 2: In our conversation with Energy Solution’s CIO David Weisong we chat about how new processes, technology, and budgets are formed.   Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. It’s a mystery as old as time: the cybersecurity and technology budget and acquisition strategy. How are they formed? How are these projects prioritized? How are internal teams proposing changes and asking for new dollars (and likely not getting them)? This week, we chat with someone at the heart of the matter for their business who walks us through how they build their security and information roadmap, or in what I lovingly call: quit bugging the C-suite. David Weisong is the CIO for Energy Solutions and has a background in software development, DevOps, and managing IT functions, which makes him the perfect candidate to properly discuss the ins and outs of cybersecurity and IT roadmaps.

To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays.   A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people. People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny. And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills. Read more at adoptingzerotrust.com

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. PS, we're giving away a Flipper Zero on our site as a little season finale gift. Check out details on our site. You know what they say, you save the best for last. As we wrap season two of Adopting Zero Trust, we take a shift from our standard conversations about modern cybersecurity strategies and look back at some of the history that got us to where we are today. This week we chat with Hector Monsegur, Co-Founder of LulzSec, and current Director of Research for Alacrinet, who discusses his journey from hacktivism to white hat pen testing. In May of 2011, a series of cyber attacks swept the globe. Starting with Fox News, after a broadcaster called rapper Common ‘vile’, then an attack on X Factor (yes, the show Joe Rogan used to host) leaking contestant data, and through to taking down the Sony Playstation network. A, at the time, black hat hacking group was founded and picked off targets for laughs (lulz) rather than financial gain. Among the group was co-founder Hector Monsegur, better known by his alias Sabu, who shaped the movement into cause-based cyber attacks or hacktivism. But the story starts well before the formation of Lulzsec, and before the FBI knocked on Hector’s door. It stretches back to a time when there weren’t resources for people to learn how to hack, pen test, and become cybersecurity practitioners didn’t exist, unlike the endless amount of certs and higher education programs that exist today. Key Takeaways The evolution of one's ethical stance: Hector's journey highlights the importance of questioning and reassessing one's actions and beliefs.Collaboration and collective impact: Working together can amplify efforts and create positive change, even in the realm of cybersecurity.Balancing curiosity and responsibility: Exploring technology and hacking skills should be accompanied by a sense of responsibility and ethical considerations. Editor’s Note The season finale of AZT is here, and we couldn’t have found a more interesting way to wrap things up. Hector has such a unique and storied past, and we can’t recommend his own series enough. The very agent who knocked on his door joins him as the cohost on Hacker and the Fed. We also can’t thank you, our listeners, enough for another year of the show. Neal and I do this as a passion project first and foremost, but as we seek to attract harder-to-reach guests, we are also building in some ad opportunities. We are ensuring that doesn't impact how we highlight the practitioner's perspective on modern cybersecurity strategies, too. Speaking of growing, that other podcast I mentioned last episode? Mastering the Art of Failing can now be found at failingpod.com or on your favorite podcast app. The pilot series will highlight people who have found success in their lives, but not without some challenges along the way. Our first guest, Glen Hellman, was part of several successful exits… and quite a few not-so-successful flops. As the series progresses we’ll expand beyond just career-oriented stories and dig into physical, mental, and other states of pushing boundaries and levels of success.

Season two, episode 18: Evgeniy Kharam, a founder, CISO, architect, and podcast producer discusses the rise of Enterprise (Secure) browsers. You can read the show notes here and subscribe to updates. In the latest episode of AZT, Evgeniy Kharam, a founder, CISO, architect, and podcast producer, joins the discussion to talk about the rise of Enterprise (Secure) browsers. The conversation explores the importance of browser security and its relevance to the Zero Trust framework. Key Takeaways The birth of the enterprise browser - Remote Browser Isolation: Evgeniy explains the concept of remote browser isolation, which creates a layer of separation between users and potentially harmful websites. By browsing through a remote browser, users can mitigate the risks associated with malware and other online threats.Customized Browser Profiles: The conversation delves into the idea of using customized browser profiles to enhance security and control access. By providing contractors or temporary workers with specific browser profiles, organizations can ensure that only authorized individuals can access certain applications or data.Managed Device and Compliance: The discussion highlights the trend of using managed devices and the impact on compliance requirements. With the ability to enforce the use of specific browsers through Mobile Device Management (MDM), organizations can strengthen security measures and simplify compliance audits.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.   The word AI, much like Zero Trust, has come with a lot of baggage in the past few years. It’s a term that’s been misused, slapped on the front of startups’ overpriced booths at RSA and Black Hat, and it feels like every cybersecurity product under the sun now supports it in some flavor or fashion. It's the same cycle we’ve been in the past, but this time everyone is jumping in. This week we are getting in front of the bandwagon and chat with a pioneer in the cybersec AI space who has seen how the technology has been evolving over the past decade, Oliver Tavakoli, the CTO of Vectra AI.   “My contemporaneous definition of AI at any given moment in time is there's got to be enough pixie dust in it for people to view it as somewhat magical; so that's my incredibly technical definition. I'd say over the past 10-15 years, that is typically meant neural nets-that has those have been a stand in-and and obviously, neural nets can be used for discrimination [As opposed to a generative AI model]. Again, the example of cat (You search “Cat” on Google images, and it returns results that show images, in theory, of only cats) is an example of how they can be used in a generative sense, which is really the latest revolution that you see. And then the other thing is how broadly applicable they are and how well read they are.   Tavakoli’s definition of AI provides the context for how AI is primarily applicable today in cybersecurity. But, in the past, typically these concepts were held back by technology. There is also a stark difference between what has been referred to as AI, or a discriminative AI model, and what is most popular today, or generative AI. It turns out in these large language models, as you make them bigger, there was always kind of the question of if you make them big enough. Will they just plateau or will they take off? It really wasn't a foregone conclusion that if you made them big enough they would take off, but it was a bet that was placed and a bet that turned out to have some merit to it. And that is the crux of today’s interview: what was and will be the past and future impact of AI on cybersecurity? Key Takeaways AI plays a significant role in both offensive and defensive cybersecurity strategies.Threat actors use AI to enhance their attacks, making them more believable and harder to detect.Defensive uses of AI include improving workflow and making SOCs more productive.Organizations must always assume that compromise is possible and focus on minimizing the impact of breaches.

Season two, episode 16: Zack Butcher discusses building upon NIST’s Zero Trust policies and standards, and ZT’s influence on a service mesh as it relates to microservices.   Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.   There are several guiding concepts that make it easier for organizations to build a Zero Trust strategy. The first that typically come to mind come from CISA and NIST. These core elements, ranging from the five pillars through to building a ZT architecture, offer a vendor-neutral path towards removing implicit trust. Organizations like CSA also do a great job of expanding upon this knowledge with more contributions from technology and service providers. This week, we take our first step towards understanding what goes on behind these policies, standards, and recommendations, and for that we have a well-equipped guest to walk us through it.   Zack Butcher is one of the founding engineers over at Tetrate, a vendor that provides a consistent way to connect and protect thousands of individual microservices and deliver Zero Trust security operations across any environment. They also have their roots stemming from a team that worked at Google, which many of you are likely familiar with their connection to Zero Trust through BeyondCorp. However, he is also the co-author on NIST special publication 800-207A. If that looks familiar, it’s because it’s an expansion of the earlier mentioned core NIST resource, 800-207.   NIST SP 800-207A builds upon that core architecture piece and hones in on access controls in cloud-native applications in multi-cloud environments. That is a bit of a mouthful, so here is Zack on what you need to know.   When we talk about Zero Trust at runtime, there's a lot of FUD and a frustrating amount of FUD in the in the marketplace and a lot of vendors claiming certain things are Zero Trust and not. And you know, in that landscape, I wanted to really kind of push for people to have a very clear definition of Zero Trust at runtime, and it's a minimum definition. Let me be clear. You can do a whole lot more than what we talk about in the SP, but I try and give a very, very simple minimum definition. And that is five policy checks at runtime, and we call that identity based segmentation. Butcher also co-authored NIST SP 800-204A that focuses on building secure microservices-based applications using service-mesh architecture. So this week, Neal and Butcher ran down the rabbit hole of expanding upon these core Zero Trust resources, implications of a more secure environment at runtime, and identity-based segmentation.

Season two, episode 15: We talk ZT History and API security with the godfather of Zero Trust, Dr Zero Trust, and Richard Bird. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. In the past few years, supply chain attacks and their impacts have or will soon overtake that of the damage done by ransomware. It’s of no surprise then that APIs are a critical attack vector that threat actors like to exploit, yet many organizations do not have a good understanding of how many doors they have running into their data. This week we chat with the godfather of Zero Trust, Dr. Zero Trust, and a chief security officer about the current state of API security maturity. Considering our guests, we, of course, also took the opportunity to chat a bit about Zero Trust's history. This week we have three very special guests: John Kindervag, the creator (godfather) of Zero TrustChase Cunningham, AKA Dr Zero Trust, and the now VP of Market Research for G2Richard Bird, Traceable AI’s Chief Security Officer Key Takeaways Like any other cybersecurity concept, APIs must have an asset inventoryThere is enough margin of error tied to the intended use of APIs that require continuous monitoring/verificationThere is a current maturity gap associated with securing the use of APIs in the name of speed and innovation, and often there is not a well-established owner Editors Note We will be taking a publishing break for the month of September as my daughter has arrived, and I will need to catch up on all the sleep I can get. We should be back in October and run through until the holiday break before we wrap season two. I’m also working on a few experimental podcast series during my parental leave, so stay tuned. At least one in particular should be of interest to our audience here. Also, if you work for a cybersecurity org and are interested in launching a podcast, slide into my inbox if you need a hand.

The illusion of going passwordless with Derek Hanson, Vice President Solutions Architecture and Alliances at Yubico. You can read the show notes here.   True or False: The concept of passwordless is new. False.   This is shocking, we know.   Considering the amount of hype around the concept, it certainly can feel like a new concept since the masses are becoming more familiar with it; however, the message is a bit jumbled.   For ages, we’ve used things like biometrics (fingerprints or iris scans) and even a PIN to access money on a debit card, but more recently, there has been an increase in misrepresentations about how secure passwordless technology is, simply because there is not a password involved. As cybersecurity practitioners, we know that the simple removal of passwords alone won’t prevent a successful phishing attack, which means multifactor authentication needs to play a role in getting us closer to the Zero Trust concept.   Fortunately, we have a guest this week who is well-equipped to help us navigate the ins and outs of passwordless concepts, passkeys, and the split between identification and authentication. Derek Hanson is the Vice President of Solutions Architecture and Alliances at Yubico, who has spent the last 8 years contributing to the shaping of a physical piece of hardware, Yubikeys, designed to improve authentication. Prior to that, he worked at Costco, focusing on identification and IAM. But first, let’s improve your personal security stack…   Giveaway - Yubikeys! If you already have a Yubikey, you already know there is always an opportunity for one more in your stack. If you’re new to Yubico’s offering, this is the perfect time for you to grab your very own YubiKey 5C NFC and gain phishing-resistant MFA. It even works with most password managers, too.   To enter, we’ve given you a bunch of options on how you can increase your odds of winning one of two keys. You must be based in the US, though.   [**Enter the giveaway here](https://www.rafflecopter.com/rafl/display/c9435e741/?).** We’ll close the giveaway in about two weeks and announce it in our next episode.

Season two, episode 13: Cybersecurity prevention on a global scale with Janey Heins, Global CISO for iHeartMedia.   At the heart of Zero Trust is the idea of prevention. If you don’t trust anything or any person, you are playing in the same pool as risk avoidance. While total risk avoidance isn’t feasible, Zero Trust gets us closer to reality. Now, map this up to an organization with a global footprint, with significant infrastructure sprawl, and you’ve got one very complex scenario on your hands.   This brings us to this week’s guest, Janet Heins, iHeartMedia's Global CISO, who will help us navigate the philosophy of cybersecurity prevention on a global scale.   Putting The Conversation Into Context With more than a decade behind her as a CISO, Heins’ experience stems from working with some massive brands. As a leader, she’s particularly passionate about translating business needs into technology processes or solutions, while at the same time bridging the language barriers that often stem between IT, cybersecurity, and the other adjacent areas.   iHeartMedia has over 11,000 employees and a vast physical and digital footprint. With 860 radio stations across the US and 20,000 events annually, the company is part of the emergency broadcast system and has to be ready to respond to threats quickly.   At a global level, Heins makes it clear that strong detection and response capabilities, as well as prevention measures, are critical elements of prevention. And while prevention can take many forms, in the context of today’s episode, we dig into security tools, hiring security professionals, and the basics, such as providing security awareness training to employees.   One challenge of securing a large organization like iHeartMedia is consolidating the tech stack. iHeartMedia has a blended architecture of OT and IT, with legacy hardware and systems that need to be secured. Heins stresses the importance of communication and collaboration between the IT and OT teams, as well as being open to new tools and automation.

Over the past two years, we’ve explored the ins and outs of Zero Trust, ranging from the concept as a strategy down to the more technical components, such as how it impacts the physical world as found in IoT devices. However, what is often missed in these conversations, is at what point an organization can actually build trust. Not just crawling up from the baseline of zero but achieving continuous trust. The short answer? Defense in depth, building security in layers, and ensuring every 1 and 0 is secure at the offset while continuously monitored through automation. And this is where we get to introduce this week’s guests, who were kind enough to be pulled away from a busy conference. This is also a special episode for us, too, as it’s the first in-person interview we’ve done since launching this series. Live (June 22, 2023) from Drataverse, we have Daniel Marashlian, the co-founder and CTO of Drata, Ty Sbano, the CISO for Vercel and an angel investor at Silicon Valley CISO Investment Group (SVCI), and Matt Hilary, the Vice President of Security and CISO at Drata. You can read the show notes here.

Last episode, we brought to you a wild story of a victim who was SIM-swapped four times, and this week we’re back to basics with some fresh research and a closer look at a critical piece of Zero Trust: Non-federated applications.   Cerby’s Chief Trust Officer, Matt Chiodi, was kind enough to add a bit of color to a research report they released at RSA that helps validate what they’ve been building the past 3 years. Before we get to that, it’s worthwhile to define what nonfederated applications are, as, like many cybersecurity concepts, it’s going through an identity crisis.   Nonfederated applications are essentially the opposite of how organizations should be inventorying, tracking, and providing access to applications (SaaS platforms are a good example). To align with Zero Trust, or really any modern cybersecurity strategy, SSO, SAML, and other solutions designed to scale are necessary so IT and security teams can properly manage access. However, there are always outliers, which the business still needs access to, such as managing admin access to a social media profile.   This brings us back to Matt and the Ponemon Institute, who produced the recent research report: The Hidden Cybersecurity Threat in Organizations: Nonfederated Applications.

Taking a break from our usual format, this week we chat with a victim-turned-CEO who was hit by SIM-swapping attacks. However, not all harsh starts have to end that way, and Haseeb Awan made the best of a bad situation. After being compromised not once… nor twice, but four times, Haseeb eventually took matters into his own hands and developed a new solution and company, Efani. Haseeb was kind enough to share his personal experience of being SIM swapped where he describes the fear and anxiety felt as a result of the attacks and explained how easy it is to compromise a phone number.

Season two, episode nine: Featuring Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon.   Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.   What does implementing a Zero Trust strategy actually look like in an organization? Nearly a year into our podcast’s journey covering how practitioners view, define, and apply zero trust, it’s time to look under the hood at how a notable organization put its strategy into motion. This week we chat with Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon, about how they transformed their security organization with Zero Trust.   Most interestingly though, while many organizations are just now exploring how they will start their zero trust journey, Bloomberg was ahead of the curve even before covid thrust the concept into the limelight. “I will always say it is continuing to be a journey. It's not a destination,” said Vachon. Key Takeaways Zero Trust Principles Zero trust is not a new concept but has been repackaged and branded as a solid ideology.Zero trust involves three principles: trust but verify, assume compromise, and strong posture. Zero Trust Journey Zero trust is a continuing journey, not a destination.Zero trust requires a good mindset about how to implement controls and how to reason about security architecture.Zero trust is not just about securing the corporate IT estate but also about securing the data center estate and the communications between components. Challenges in Implementing Zero Trust Balancing security with usability is a challenge that must be addressed to enable a high-collaboration, low-friction workflow.Bloomberg leverages many SaaS services for collaboration, but they also have their own core services that are still on-premises. They focus heavily on their offerings on-premises and have a big drink-your-own champagne culture around them.

There’s no avoiding it, the headlines have not been kind to the ways we access systems today. Users are still using 1234, password, and even their dog's name. Not just using these weak passwords but also reusing them across multiple platforms, making it incredibly easy to breach someone once they’ve been caught up in a previous breach. On the vendor side, well we all know what’s happened there in the past 12 months, and now more than ever, password management platforms have growing targets on their back as high-value assets.   But we are not here to throw rocks in the glass house nor try to dissect what goes well or goes wrong in these situations; however, we should all focus on what we can take away from them and ensure they are not repeated. This concept aligns well with Zero Trust, where we should assume systems are already breached, that your users - be it intentionally to shitpost in a discord channel or accidentally fall for a phishing lure- and we should remove as much implicit, unchecked trust as possible. At least until Skynet takes us all out, but we have a few good years ahead.    Jokes aside, we have a great episode for you and appreciate Bitwarden lending us two of their C-suite members who cover a range of topics, including how they navigate these challenges. This week we chat with Bitwarden’s CEO Michael Crandell and Chief Customer Officer Gary Orenstein. Bitwarden offers an integrated open-source password management solution for individuals, teams, and business organizations. It also offers a self-hosted solution, which appeals to those who want greater control over their secrets. Key Takeaways The use of a Zero Knowledge architecture means that the company, whether cloud-hosted or self-hosted, should not be able to access sensitive information without the user's permission.Open-sourced solutions offer additional layers of trust as there are more eyes are on the product and can vet it for securityPasswordless authentication is the future

For many, cybersecurity is seen as a cost center that reduces risk to the business. This can be oversimplified to something akin to how HR reduces people-related risks but comes with layer on top of layer of complexities ranging from technology to physical buildings and, of course, people. Regardless of organizational size, cybersecurity leadership requires a top-down approach, leaving room for discussion at the board level and aligning it with business goals. This week on AZT, Neal and I chat with Kris Lovejoy, Kyndryl’s (IBM spinoff) Global Security and Resilience Leader, former CEO of Virginia-based BluVector, and a former IBM CISO prior to being made GM of their security division. Having danced the line between startups and mega-enterprise organizations, there are few others who could so adequately discuss the role of cybersecurity leadership within modern organizations and why having a competent person at the helm is critical to the business (not just to reduce risk). We also play a bit of RSA buzzword bingo.

For more than a decade, Zero Trust as a concept has moved from a philosophy and now into a practical architecture and strategy that organizations can adopt. While Zero Trust encapsulates much of what has gone well in cybersecurity for the past 30 years or so, does it truly offer an innovative approach or just iterative change? Is the concept positioned well so others can adapt it to their needs and prevent greater cyber-related risks? While we know it’s certainly not a silver bullet, and use cases are still reasonably immature, there is a firm argument for it helping to drive cybersecurity innovation forward. This week on AZT, Neal and I chat with Andrew “AJ” Grotto, current Stanford University Fellow and Director of Security at Turtle Rock Studios (makers of Back 4 Blood and other popular video games). Prior to his current roles, AJ was an advisor at NIST and was the Senior Director for Cybersecurity Policy for The White House National Security Council. As a practitioner and academic who danced the line between public and private sectors, AJ is well suited to help us navigate the question of what drives innovation around cybersecurity if the federal government is behind the curve or creates chain reactions, and where policy comes into play.