Cyber Sessions with Joan Goodchild

Cybersecurity is constantly evolving, and so are the leaders who shape it. Hosted by veteran journalist Joan Goodchild, Cyber Sessions brings candid conversations with top CISOs, strategists, and industry influencers. Each episode cuts through the noise to explore the trends, challenges, and leadership insights that define the future of security.

Ep.19

Why Email Still Works for Attackers

Despite years of awareness training and security investment, email remains one of the most effective attack vectors in cybersecurity. In this conversation, Ryan Toscano discusses why organizations continue struggling with phishing, impersonation, and social engineering at scale. The interview examines the tension between security, usability, and customer trust, the operational fatigue created by overwhelming security telemetry, and whether organizations are still treating email security too much as a technical problem instead of a human one.

Ep.19

ByJoan Goodchild

1 Oct 2026 6 mins

Email Security

Ep.18

The Evolving CISO: AI, Leadership and the Future of Cybersecurity

Gary Harbison, CISO at Johnson & Johnson and CSO Hall of Fame inductee, joins CSO’s Joan Goodchild to discuss how the CISO role has evolved, the growing importance of cybersecurity in business decision-making, and how AI is reshaping the industry. He shares his perspective on using AI to strengthen security, address emerging threats, and help cybersecurity teams work more effectively while keeping human talent at the center. https://www.linkedin.com/in/garyharbison/

Ep.18

ByJoan Goodchild

25 Sep 2026 6 mins

CSO and CISO

Ep.17

Why Security Debt May Be a Bigger Risk Than Security Spend

Organizations continue investing heavily in cybersecurity, yet many are simultaneously increasing operational complexity and long-term security fragility. In this interview, Selim Aissi explains the concept of security debt and why it may be a more meaningful measure of cyber risk than security budget size alone. The conversation explores how organizations unintentionally create risk through tool sprawl and operational complexity, how boards should think about long-term cyber resilience, and why AI and cloud expansion are accelerating security debt faster than many enterprises can manage. Nominate the companies setting the standard for innovation, resilience, and leadership in security. Submit your CSO Awards nominations by September 16 and celebrate the organizations shaping the future of cybersecurity at the 2026 CSO Cybersecurity Awards & Conference. Follow CSO for more Business IT and Web Security News!

Ep.17

ByJoan Goodchild

11 Sep 2026 16 mins

Cybercrime

Ep.16

Cybersecurity on the Front Lines of Critical Infrastructure

Critical infrastructure operators are facing a rapidly evolving threat landscape where cyberattacks can create real-world operational disruption with national and economic consequences. In this conversation, Vaughn Hazen explores the growing convergence of cybercrime, geopolitics, and operational technology risk across transportation and logistics environments. The discussion examines the unique security challenges of protecting large-scale operational systems, the realities of resilience and incident response in critical infrastructure, and whether private industry is truly prepared for its expanding role in national cyber defense. Nominate the companies setting the standard for innovation, resilience, and leadership in security. Submit your CSO Awards nominations by September 16 and celebrate the organizations shaping the future of cybersecurity at the 2026 CSO Cybersecurity Awards & Conference. #CSOconference #cybersecurity #csoonline Learn more and submit a nomination today. 2026 CSO Conference: Awards

Ep.16

ByJoan Goodchild

13 Aug 2026 10 mins

Cyberattacks

Ep.15

Cloud Security at a Breaking Point: AI, Complexity, and the Future of Trust

As enterprises race to integrate AI, SaaS, APIs, and multi-cloud environments, cloud security complexity is accelerating faster than many organizations can realistically govern. In this conversation, Jim Reavis discusses where enterprise cloud strategy continues to break down, why shared responsibility models still create dangerous accountability gaps, and how AI adoption is exposing weaknesses in identity, trust, and risk management. The discussion also explores the long-term implications of increasingly interconnected cloud ecosystems and the security debt organizations may be unknowingly accumulating. Nominate the companies setting the standard for innovation, resilience, and leadership in security. Submit your CSO Awards nominations by September 16 and celebrate the organizations shaping the future of cybersecurity at the 2026 CSO Cybersecurity Awards & Conference. #CSOconference #cybersecurity #csoonline

Ep.15

ByJoan Goodchild

7 Aug 2026 17 mins

Cybercrime

Ep.14

Moving Beyond the Checkbox in Human Risk Management

Security awareness programs are evolving beyond compliance exercises into broader human risk management strategies designed to change behavior and reduce organizational exposure. In this conversation, Jason Harper discusses the goals behind Uber’s Beyond the Checkbox program, the problems the organization was trying to solve, and the lessons learned during implementation. The interview also explores leadership feedback, employee engagement, and how organizations can rethink security awareness as a measurable business risk reduction strategy.

Ep.14

ByJoan Goodchild

31 Jul 2026 9 mins

Cyberattacks

Ep.13

The Security Debt Crisis Inside AI-Generated Code

AI coding assistants are rapidly changing how software is built, but they are also introducing new forms of application risk and technical debt. In this interview, John Strait examines how organizations are adopting AI-generated code, the impact on software quality and vulnerability management, and the growing challenge of balancing development speed with secure coding practices. The conversation also explores governance gaps, remediation limitations, and the blind spots many CISOs still have around application security in the age of AI-assisted development.

Ep.13

ByJoan Goodchild

21 Jul 2026 8 mins

Cybercrime

Ep.12

AI-Generated Code and the Expanding Application Security Challenge

Development teams are increasingly relying on AI coding tools to accelerate software delivery, but many organizations still lack visibility into the risks introduced by AI-assisted development. In this conversation, Sohail Iqbal discusses how AI-generated code is changing software quality, vulnerability detection, and application security governance. The interview also explores remediation challenges, growing security debt, and the leadership decisions CISOs must make to prevent application risk from compounding over time.

Ep.12

ByJoan Goodchild

16 Jul 2026 15 mins

Cybercrime

Ep.11

The AI Security Problem Most Organizations Still Aren’t Talking About

AI adoption is accelerating inside enterprises, but many organizations are still struggling to define what a mature AI security program actually looks like. Lamont Orange discusses the foundational principles of AI security, the risks hiding in plain sight, and the governance decisions organizations need to make now to reduce exposure before AI risk compounds. The conversation also examines practical controls, organizational accountability, and how CISOs can prioritize action when time and resources are limited.

Ep.11

ByJoan Goodchild

3 Jul 2026 8 mins

Cybercrime

Ep.10

Defining Trustworthy AI Before AI Scales Beyond Control

As enterprises move rapidly toward AI and agentic systems, questions around governance, trust, and accountability are becoming increasingly urgent. In this interview, Malcolm Harkins explores what trustworthy AI actually means, what organizations need to achieve it, and how existing cybersecurity and compliance frameworks are struggling to address the realities of AI model security. The discussion also examines the gaps emerging around governance, risk management, and accountability as organizations deploy increasingly autonomous systems.

Ep.10

ByJoan Goodchild

19 Jun 2026 14 mins

Generative AI

Ep.09

Rethinking Security Awareness Through Human Risk Management

Traditional security awareness programs often struggle to create lasting behavioral change inside organizations. In this interview, Missy Bentzen discusses how Docusign approached security awareness and human risk management through its partnership with Hoxhunt. The conversation explores the organizational challenges the program was designed to address, the results that stood out most during implementation, and how leadership and employees responded to a more behavior-focused approach to cybersecurity education.

Ep.09

ByJoan Goodchild

12 Jun 2026 8 mins

Risk Management

Ep.08

Why AI Is Forcing a Rethink of Data Security

Traditional security models were not designed for environments where AI systems continuously access, process, and learn from enterprise data. In this interview, Todd Moore explains why organizations are shifting toward more data-centric security strategies and what that change means in practice. The conversation explores unified data awareness, the growing importance of crypto-agility, and why organizations need to prepare now for both AI-driven risk and the coming realities of post-quantum security.

Ep.08

ByJoan Goodchild

5 Jun 2026 7 mins

Data and Information Security

Ep.07

Security Blind Spots: What the Louvre Heist Reveals About Your Organization

What happens when the risks you ignore become the ones that hurt you most? In this episode of Cyber Sessions, Foundry’s Joan Goodchild is joined by Colin Zick, partner at Foley Hoag, to unpack two headline-making examples of security blind spots: The Louvre museum heist, including the now-infamous “Louvre” password The rise of AI note-takers inside sensitive corporate meetings Together, they explore how convenience, default settings, and overlooked fundamentals create security liabilities for organizations of every size. Colin explains why these incidents were predictable, preventable, and rooted in leadership decisions, culture gaps, and under-prioritized investments. What You’ll Learn in This Episode: - Why attackers always target your slowest control - How “kicking the can down the road” creates cumulative security failures - The cost of treating security as a “cost center” instead of loss prevention - Why AI note-takers are a litigation and confidentiality minefield How management blind spots—not technology—cause the biggest breaches Practical guidance on MFA adoption, accountability, and security culture How to redesign processes for hybrid/remote work so nothing “falls through the cracks” If you’re a CISO, CSO, security leader, or IT decision maker, this episode delivers actionable lessons on strengthening organizational resilience before the next attack. Like, comment, and subscribe for future episodes of Cyber Sessions, where we break down the technologies, trends, and threats shaping today’s security landscape. Follow CSO for more Business IT and Web Security News! ---------------------------------- SUBSCRIBE: http://www.youtube.com/subscription_center?add_user=CSOonline FACEBOOK: https://www.facebook.com/CSOonline/ X: https://x.com/CSOonline WEBSITE: http://www.csoonline.com/

Ep.07

ByJoan Goodchild

22 May 2026 34 mins

Cybercrime

Ep.06

How Intelligence and AI Are Changing Cyber Defense | Erin Whitmore, Former CIA

What if you could stop cyberattacks before they happen? In this episode of Cyber Sessions, host Joan Goodchild sits down with Erin Whitmore, former CIA case officer and current Head of the CYNTURION Group for CYPFER, to discuss how her team uses intelligence and AI to anticipate and prevent attacks before adversaries strike. Whitmore reveals how proactive cybersecurity is blending human intuition, artificial intelligence, and offensive tactics to predict threats — while balancing the line between privacy and protection.

Ep.06

ByJoan Goodchild

5 Feb 2026 28 mins

Cyberattacks Cybercrime

Ep.06

Inside the SMB Threat Landscape: AT&T’s Senthil Ramakrishnan on Why Small Businesses Are Cybercrime’s Favorite Target

In this episode of Cyber Sessions, Senthil Ramakrishnan, Head of Cyber Product Strategy at AT&T, talks about why small and midsize businesses have become prime - and often unprepared - targets for cyberattacks and what they can do to improve their security posture.

Ep.06

ByJoan Goodchild

14 Jan 2026 23 mins

Cybercrime Small and Medium Business

Ep.05

Inside Visa’s Cyber Defense: CISO Subra Kumaraswamy on blending AI and Human Defense

In this episode of Cyber Sessions, Visa CISO Subra Kumaraswamy takes us inside the company’s 24/7 Cyber Fusion Centers, where AI-driven defenses block 90 million attacks and 11 million phishing emails each month. He shares how his team achieves “zero breach, zero disruption” across 200+ countries—and what lessons other security leaders can learn from Visa’s global approach to resilience.

Ep.05

ByJoan Goodchild

16 Dec 2025 26 mins

Application Security

Ep.04

CISO Reality: Record Pay, Rising Pressure, and Retention Risk

In this edition of Cyber Sessions, host Joan Goodchild talks with IANS researcher Nick Kakolowski about why midmarket CISOs now earn record-high pay but are still are stretched thin by expanding responsibilities and limited resources.

Ep.04

ByJoan Goodchild

11 Dec 2025 27 mins

CSO and CISO Security Infrastructure

Ep.02

The Future of Cybersecurity Leadership: AI, Governance & Education | Kevin Powers, Boston College

How is cybersecurity education changing — and what skills do tomorrow’s security leaders really need? In this episode of Security Sessions, host Joan Goodchild talks with Kevin Powers, Faculty Director and Lecturer at Boston College Law School, about how cybersecurity has evolved from a technical problem to a core business and legal function.

Ep.02

20 Nov 2025 23 mins

Cyberattacks Cybercrime Risk Management

Ep.01

Inside Black Hat: Andy Ellis on vendor buzzwords, AI hype, and the future of the CISO role

In this debut episode of Cyber Sessions, host Joan Goodchild sits down with Andy Ellis, veteran CSO and member of the CSO Hall of Fame, to learn about his State of the Security Vendor report from the Black Hat show floor. From AI flooding vendor taglines to the real challenges of code security and identity, Ellis shares sharp insights on what’s hype, what matters, and where the CISO role is headed next.

Ep.01

13 Nov 2025 30 mins

Black Hat CSO and CISO Cybercrime

Show me more

Google makes Gemini 4 AI model available to a trusted few

By Nidhi Singal

1 Oct 20265 mins

Artificial IntelligenceSecurity

Cisco SD-WAN Manager hit by zero-day admin access attack

By Shweta Sharma

1 Oct 20264 mins

Network SecurityVulnerabilitiesZero-Day Vulnerabilities

Why AI agents are like the dog that pushed kids into the Seine

1 Oct 20266 mins

Access ControlData and Information SecurityIT Governance

Why Email Still Works for Attackers

By Joan Goodchild

1 Oct 20266 mins

The Evolving CISO: AI, Leadership and the Future of Cybersecurity

By Joan Goodchild

25 Sep 20266 mins

Why Security Debt May Be a Bigger Risk Than Security Spend

By Joan Goodchild

11 Sep 202616 mins

Why Email Still Works for Attackers

By Joan Goodchild

1 Oct 20266 mins

The Evolving CISO: AI, Leadership and the Future of Cybersecurity

By Joan Goodchild

25 Sep 20266 mins

Why Security Debt May Be a Bigger Risk Than Security Spend

By Joan Goodchild

11 Sep 202616 mins