CISO Series Podcast: "Step 1: Deploy New AI Tool. Step 2: Discover Security Flaws. Step 3: Repeat." (LIVE in Orlando)
Date: April 28, 2026
Hosts: David Spark, Rob Allen (ThreatLocker), Michelle Wilson (Movement Mortgage, guest co-host)
Location: Zero Trust World, Orlando
Episode Overview
This live episode dives into the complexities of security in the AI era, focusing on the rapid deployment of new tools, the realistic challenges of risk management, and the cultural and technical adjustments needed as businesses and attackers accelerate their use of AI. Through real-world anecdotes, lively games, and thoughtful debates, David, Rob, and Michelle unpack everything from the evolving role of metaphors in security communication to the future of controls, organizational trust, and human factors in incident response.
Key Discussion Points & Insights
1. Building a Real-World Risk Culture ([02:35]–[06:49])
- Daily Practice Over Annual Slides: David Spark references a CSO Online piece, emphasizing risk as a constant, everyday conversation.
- Michelle Wilson: “I'm actually talking about risk almost all the time with my team...they definitely know that it's one of the things I'm most interested in.” [03:21]
- Example: A developer proactively reported a process slip, ensuring it was tracked on the risk register [03:44].
- Open Communication & Roundtables: Rob Allen stresses the human element: “We're human beings, we communicate, and it's open. Clear communication is key...” [04:53]
- Insider Threats: Their recent roundtable illustrated how a small set of privileged users could cause massive damage—"but...it was a fairly simple solution to it." [05:28]
- Systematic Processes: Michelle details their use of monthly meetings and rolling risk tracking, not waiting for formal reviews to respond [06:30].
2. AI, Agentic Tools, and the Privacy Nightmare ([06:49]–[12:25])
- OpenClaw & Multbook as Cautionary Tales: David describes AI assistants like OpenClaw, which require deep privileges—and expose huge privacy risks.
- Rob's Response: “I flat out refused...are you absolutely insane?” (when asked to help a friend set up OpenClaw) [08:00]
- Organizational Panic: Companies are “panicking” over potential exposures—default deny policies become vital.
- Ring Fencing and Guardrails: Rob discusses “ring fencing” as a technical mitigator: “Don't let it access data you don't want it to access...that effectively solves this problem.” [10:20]
- But both acknowledge the challenge: “The cat's out of the bag...it's gone haywire.” —David [09:24]
- Kill Switches: Michelle describes incorporating kill switches into their incident response plans for piloting agentic AI. “We had to build a kill switch to be able to turn it off...” [12:06]
3. "What's Worse?" – Security Scenarios Game ([14:10]–[19:13])
- Scenario Comparisons:
- Actual breach caused by phishing, followed by accidental, panic-inducing phishing campaign.
- Phishing campaign during HR open enrollment: benefits-cancellation bait without informing HR, leading to lasting company-wide animosity.
- Universal Agreement: Both Michelle and Rob agree the first scenario (real breach) is worse, even if company-wide hatred in the second scenario could erode trust forever.
- Michelle: "I'd still rather not have the breach.” [16:41]
- Rob: “I'd still rather not be breached, thank you very much.” [18:16]
4. "Fantasy CISO" – Building Your Team of Controls ([19:13]–[23:53])
- A draft-then-defend game where Rob and Michelle each pick sets of controls and then defend their choices based on random attack scenarios.
- Controls Chosen:
- Michelle: Access Control Management, EDR, Incident Response, Controlled Use of Privileges
- Rob: Network Segmentation, Data Recovery, Application Security, Pen Testing
- Scenarios:
- Nation-state physically infiltrates an air-gapped network: Both admit they’d struggle; Michelle banks on incident response capability. [21:26]
- Deepfake CEO scam for financial fraud: Michelle’s controls fare slightly better.
- Ransomware/disgruntled insider theft: Neither’s picks offer full coverage—showcasing practical limitations.
- Rob: "I reject the premise of this game...[these scenarios]—you're hosed." [23:48]
5. Why & When Do You Review Controls? ([23:58]–[29:27])
- Metaphor of the Printed Door Code: Used to spark a discussion on outdated controls vs. “control sprawl.”
- Michelle: Advocates for efficient, consolidated controls—"I've always had to operate with a very lean team...” [27:15]
- Rob: Asserts “more controls are better than fewer controls,” but concedes to Michelle’s point about alert fatigue and management overhead when challenged [29:12].
6. Security Metaphors – Framing the Conversation ([29:32]–[33:52])
- Impact of Language: David references Phil Venables’ work on metaphors (“beast” vs. “virus”) radically shaping policy responses.
- Michelle: Favors practical metaphors—race car (business speed) and road maintenance (security's job to ensure a smooth ride). [30:57]
- Rob: Often uses the house/lock analogy: “...lock on the door is a control...detection and response is an alarm or motion sensor...ring fencing is letting people into your house, but not all the way.” [31:29]
7. Audience Question Speed Round ([34:02]–[40:29])
- Defenses That Will Fail as AI Attacks Scale ([34:41]):
- Michelle: “Security awareness training is not going to be able to help us as much as we've always come to rely on it.”
- Rob: “Anything that involves detection and response...trying to detect and respond to 560,000 new pieces of malware every single day...is doomed to failure.” [34:49]
- Should Security Always Say Yes? ([35:21]):
- Michelle: “Yes, and”—enumerate caveats so stakeholders say no to themselves. [35:43]
- Rob: “Anyone who will not take your advice on security” should be told no; some clients refuse help then blame the provider when breached. [36:06]
- Impressing as a New Cybersecurity Graduate ([37:17]):
- Rob: Go above and beyond: self-fund attendance at events, meet people, demonstrate eagerness to learn. [37:37]
- Michelle: Community involvement, continual learning, curiosity. [38:38]
- Fun Moment: Rob was dressed as ‘Barf’ from Spaceballs during a real mentorship moment. [39:06]
- Encouraging Reporting After a Mistake ([39:29]):
- Michelle & Rob: Build non-punitive, supportive culture with rewards for transparency, not punishment for clicking. [40:02, 40:29]
Notable Quotes & Moments
- On AI tool risks:
- Rob Allen: “I flat out refused...are you absolutely insane? I am not going to be responsible for doing something that means your crypto accounts get wiped out, your bank account gets emptied, everything gets stolen.” [08:00]
- On risk culture:
- Michelle Wilson: “There's very rare occasions that I have a conversation...that risk doesn't come into play.” [03:21]
- Rob Allen: “Open, clear communication is extremely important.” [04:35]
- On security games:
- David Spark: “There are certain things, like in most games, you don't know the questions beforehand.” [17:40]
- Rob Allen: "I reject the premise of this game." [23:48]
- On metaphors:
- Rob Allen: “Detection and response is like an alarm, a motion sensor; control stops people from getting in.” [31:29]
- On 'YES' in security:
- Michelle Wilson: “Yes, and...we need to do these 82 other things to do that.” [35:51]
- On culture and mistakes:
- Michelle Wilson: “We actually give out awards when people let us know that they did something or that they saw something.” [40:02]
Timestamps for Key Segments
- Risk Culture Discussions: [02:35] – [06:49]
- AI Tools & Challenges: [06:49] – [12:25]
- "What's Worse?" Game: [14:10] – [19:13]
- "Fantasy CISO" Controls Draft: [19:13] – [23:53]
- Controls Review Debate: [23:58] – [29:27]
- Security Metaphors: [29:32] – [33:52]
- Audience Q&A Speed Round: [34:02] – [40:29]
Overall Tone & Takeaways
The episode is energetic, candid, and playful, marked by good-natured banter and audience participation—yet it remains deeply practical. As AI speeds up the attack and defense cycle, both cultural and technical agility are more essential than ever. Risk isn't a one-off; it's an everyday discipline. Controls, culture, and communication must keep evolving—sometimes with humor, and always with a willingness to rethink old assumptions.
For full episodes, live shows, and more, visit cisoseries.com.
