The Cyber Business Podcast

Welcome to The Cyber Business Podcast where we feature top founders and entrepreneurs and share their inspiring stories.

The Cyber Business Podcast is a technology podcast hosted by Matthew Connor, with 237 episodes on record and a Required Pod Score of 80.

Matthew Connor hosts The Cyber Business Podcast, a technology show with 237 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #240

  Shared Governance in the Age of AI: Keeping the Institution Safe with Bill Guerrero - Ep 240

  Sep 27, 20261h 4m

  Guest Introduction Bill Guerrero is the VP of IT at Sacred Heart University , a private, faith-based, residential institution in Fairfield, Connecticut with roughly 10,000 students, 50 buildings, and nearly 2,000 cameras across campus. A proud alum who earned his master's there in 1999, Bill brings an unusual dual background to the role, having started his career at Gartner before spending years as a CFO, a financial lens he now applies directly to how the university budgets for AI. He joins the show during the first week of a new semester to talk through a live third-party security incident his team resolved in real time, why token and credit costs deserve the same budget scrutiny as any other line item, and why he believes the new professional standard is AI-assisted work refined by a human, not work produced by a human alone. Here's a Glimpse of What You'll Learn How Bill's team resolved a third-party zero-day breach affecting a campus vendor in just 24 hours Why Bill treats tokens and credits as a budget item universities can't afford to leave unaccounted for How Bill uses Claude with read-only access to run low-cost internal pen tests against the university's own framework Why Bill believes the new professional standard is AI-assisted work with a human review layer on top How Sacred Heart's shared governance model keeps AI adoption fast without letting any department run rogue Why Bill still uses AI for the small, personal tasks in his life outside the office, including coaching baseball How a real, current incident at a major learning management system provider shaped Bill's own continuity planning In This Episode Bill opens during the exact week cybersecurity pressure peaks for any university, the first week of a new semester, when thousands of students and their devices hit the network at once across a campus with door access systems, high end classroom technology, and nearly 2,000 cameras. He describes a proactive approach built around education before problems start, emailing students, faculty, and staff ahead of time with what to expect and what scams to watch for, while his cybersecurity team, led by his own CISO, works to keep pace with a threat landscape he compares to a constant game of ping pong against attackers who are also upgrading every day. He's candid that Sacred Heart isn't trying to be a bleeding edge leader, running as a Copilot enterprise shop for the past three years, but that shared governance lets academic leaders, faculty, and cybersecurity students get meaningful access without compromising the institution's data. The conversation turns sharply concrete when Bill describes a live incident from the exact weekend of the interview: a third-party vendor supporting the university's mobile credential printing system was hit by a zero-day exploit. Because of layered security defenses including CrowdStrike, Bill's team caught and remedied the breach within 24 hours, and in a notable twist, it was Sacred Heart's own team that first alerted the vendor to the intrusion. He connects this to a broader shift he's watched happen in real time, referencing a recent incident at a major learning management system provider that affected 900 universities, one Sacred Heart avoided, as a reminder that continuity plans written months ago need to be revisited constantly rather than treated as a one-time compliance exercise. The back half of the episode gets into how Bill actually manages AI adoption without letting cost or fear derail it. Drawing on his background as a recovering CFO, he explains why tokens and credits function like a printing budget that can quietly run out, an unbudgeted surprise if leadership isn't paying attention, and why total cost of ownership needs to include this line item explicitly. He describes using Claude with carefully scoped, read-only access to walk through the university's own firewall and network settings, comparing it against Sacred Heart's existing framework to run what amounts to a no-cost internal pen test rather than paying six figures for an external one. He closes on a personal note entirely outside of IT, describing how he used AI to rebuild a baseball practice schedule for a coaching role he's returning to after years away, tweaking the output himself rather than accepting it wholesale, a small example of the exact philosophy he argues the whole university should adopt: let AI produce the polished first draft, then apply the human judgment that makes it genuinely yours. SPONSOR FOR THIS EPISODE: This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact , info@cyberlynx.com , or 301-798-9170.

  ListenShow Notes
• 

  Episode #239

  Playing With Fire: Securing AI Without Shutting Off the Stove with Nakeea Neischer - Ep 239

  Sep 23, 202639 min

  Guest Introduction Nakeea Neischer is the Director of IT and CISO at RxVantage , a healthcare SaaS platform that serves as a bridge between medical providers and life science companies. With more than 10 years in security, Nakeea has built her approach around a philosophy she describes through baking, gathering the right ingredients of people, process, and tools, then figuring out how those pieces combine into something the whole business can actually use. She joins the show to talk candidly about blast radius risk with AI agents, why she believes the industry has quietly shifted from prevention to recovery as the true measure of a security program, and why she thinks fear, not the technology itself, is security's biggest obstacle right now. Here's a Glimpse of What You'll Learn Why Nakeea compares building a security program to being the chef who has to bake a cake everyone enjoys How Nakeea thinks about blast radius as her single biggest concern with deploying AI agents Why Nakeea uses fire as her central analogy for AI, dangerous, necessary, and not something you can simply avoid How third party vendor risk has quietly gotten worse as vendors move faster on AI than the organizations that use them Why Nakeea argues patching alone is already too late against machine speed zero day exploits Why Nakeea believes the industry has shifted from asking can we prevent a breach to asking how fast can we recover Nakeea's take on why security teams need to extend AI the same grace they've started giving breached organizations In This Episode Nakeea opens by describing the core tension every SaaS security leader faces, protecting an organization internally while also defending an entire platform full of client data, all while AI reshapes both sides of that equation at once. She leans on her baking analogy to explain why security can't be only about tools, arguing that leadership habits, employee behavior, and business priorities all have to be understood before any framework or technical control gets layered on top, and that a security leader's real job is producing an outcome the whole business can live with, not simply locking everything down. She's candid that this balance is uncomfortable by design, since being too secure creates the same kind of failure as being too loose. The conversation turns to where Nakeea sees the sharpest risk in AI adoption, and she keeps returning to a single word, blast radius. She argues that comfort is the real danger, the same way a homeowner who has never been robbed eventually forgets to lock the back door, and that once an AI agent has access inside a network, the questions that matter are how much segmentation exists and what is truly off limits to it. She uses fire as her governing metaphor throughout, arguing that AI is exactly like fire in a home: genuinely dangerous, capable of burning everything down, and yet not something any household actually gives up, because the answer is learning to use it correctly rather than refusing to use it at all. She connects this to the Hugging Face sandbox incident as a preview of the test-and-learn process the industry is now going through, and argues that fighting AI with AI, rather than trying to out-work it manually, is the only realistic path forward. She also floats a concrete use case, feeding an organization's SSPs and frameworks into an AI system with carefully scoped, read only access to audit compliance gaps far faster than a manual review, while cautioning that the right approach is feeding in pieces at a time rather than dumping a sensitive document in all at once. The back half of the episode gets pointed about how fast organizations actually need to move. Nakeea explains that third party vendor risk has quietly gotten worse, since a company that is behind on AI internally is still relying on vendors who are moving fast on AI regardless, and that bureaucratic approval timelines that once felt normal are now themselves a security liability given how quickly zero day exploits move. She argues patching can no longer be treated as sufficient on its own, and that organizations need AI actively watching their own networks for abnormal behavior in real time, catching an intrusion the moment it happens rather than waiting for a SOC analyst to notice hours later. Drawing a comparison to her own daughters navigating early adulthood after years of academic perfectionism, she argues mistakes are only failures when people stop trying to learn from them, a lesson she believes applies just as much to AI vendors as to young adults. She closes with a broader argument that the industry has shifted from asking whether a breach can be prevented to asking how well an organization recovers from one, and makes the case that AI, like human security teams, deserves the same grace to learn through mistakes the industry has already extended to breached organizations. This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact , info@cyberlynx.com , or 301-798-9170.

  ListenShow Notes
• 

  Episode #238

  Build Versus Buy: The Risk of Vibe Coding Your Security Stack with Andrew Dutton - Ep 238

  Sep 16, 202652 min

  Guest Introduction Andrew Dutton is the Regional Cybersecurity Architect for Sumitomo Chemical America , part of a global chemical manufacturing organization with roots stretching back more than 400 years, from copper mining in Japan to fertilizer production to the diversified chemical business that exists today. The company employs roughly 30,000 people worldwide, and Andrew's region also serves as its global center of excellence for cybersecurity. Andrew, himself an Army veteran, brings both a technical architect's precision and genuine appreciation for how the company operates. He joins the show to lay out a vision he has spent years developing for an AI operations layer, a way to get plain language answers about an organization's entire security posture instead of digging through disconnected tools, and to talk candidly about where the industry is already there and where real risk remains. Here's a Glimpse of What You'll Learn How Andrew's AI operations layer concept would let a CEO get a real, honest answer to are we secure Why Andrew says showing someone a raw count of 100,000 vulnerabilities is worse than useless How a real threat actor actively targeting chemical manufacturers shows proactive AI defense in practice Why Andrew calls traditional email gateways obsolete compared to modern AI powered alternatives The build versus buy risk Andrew sees in constructing an AI security stack without the right expertise Why Andrew believes the real barrier to good decisions is a decline in critical thinking, not the technology Andrew's take on how AI could reshape careers and the outdated idea of job security tied to one employer In This Episode Andrew opens by describing a concept he has developed for years, an AI operations layer sitting on top of every tool in the security stack with read only access, connecting inventory systems, EDR platforms, and CMDBs that often disagree with each other into one place a security leader can question in plain language. He walks through a concrete example: asking which servers aren't running EDR sounds simple, but reconciling an inventory system against an EDR platform against a CMDB that all define server ownership differently is exactly the tedious work an AI layer should absorb. He argues this layer should prioritize problems, telling a team the specific top ten things to fix rather than dumping a raw vulnerability count with no actionable meaning. From there he describes a proactive use case: asking which threat actor is currently targeting chemical manufacturers most aggressively, learning the specific technique that group uses, checking whether current defenses actually stop it, and kicking off a purple team exercise to verify the answer rather than trusting the tool's word for it. The conversation moves into how mature this vision already is, and Andrew is blunt that machine learning built directly into security products, tools like Darktrace and ThreatLocker that catch abnormal behavior or block unauthorized actions outright regardless of how an attacker got in, is no longer the future but table stakes today. He connects this to the MGM breach, arguing behavioral AI would have flagged a brand new admin account performing wildly unusual actions long before a human analyst noticed, and he is equally direct that traditional email gateways are obsolete, pointing to how Proofpoint acquired specialized players like Tessian to bolt AI powered behavioral analysis onto legacy filtering that can no longer keep pace with attacks arriving through legitimate services like DocuSign. He is also candid about the real risk of building these systems in house without the right expertise, describing how easy it is to vibe code an impressive prototype without understanding what it is doing underneath, burning through token costs on the wrong model, and comparing the temptation to the early rush to the cloud that left organizations with runaway bills. The back half broadens into how AI reshapes work and opportunity. Andrew argues the biggest barrier isn't the technology but a decline in critical thinking, and that organizations need people who can analyze a problem within its full business context rather than accepting whatever an AI tool outputs at face value. He shares a grounded perspective on job security as something that no longer comes from loyalty to one employer, describing his volunteer work helping high school students in rural Tennessee see paths beyond the local plant, and arguing that financial stability and a strong personal skill set matter more than tenure. He closes on an optimistic note about where AI could take society, from reducing domestic violence through in-home monitoring to enabling small, highly leveraged companies built by a handful of people, while acknowledging some of the hardest human problems are unlikely to be solved by technology alone. This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact , info@cyberlynx.com , or 301-798-9170.

  ListenShow Notes
• 

  Episode #237

  The Security Sidecar: Wrapping Code in Real Time Defense with Aby Rao - Ep 237

  Sep 15, 202653 min

  Guest Introduction Aby Rao is the Deputy CISO at Paylocity , where he leads a wide ranging cybersecurity operation protecting customer data across the company's SaaS platform. With 16 years in the field, Aby has built his approach around a clear hierarchy, talent first, then process, then execution, and now layers AI on top of that foundation to accelerate everything from new hire onboarding to vulnerability detection. He joins the show to talk about using AI to compress a year of business knowledge into two months, where voice agents belong and don't belong, and why he thinks the era of easy ransomware money may be closing. Here's a Glimpse of What You'll Learn Why Aby built his security program around talent first, then process, then execution How Aby uses AI to help new employees understand the business in two months instead of a year The three layer framework Aby uses to turn scattered documentation into usable knowledge Why Aby believes voice agents work well for routine calls but not yet for 911 or crisis situations How Aby's security sidecar concept wraps every piece of new code with a business agent and a security agent Why Aby thinks patch management alone can no longer keep pace with how fast code ships today Why Aby believes the current window of easy ransomware profits may be closing because of AI In This Episode Aby opens by explaining how he approached his first years at Paylocity, prioritizing talent above everything else before layering in stronger processes and only then focusing on execution. He argues that AI now accelerates a step organizations have historically underinvested in, getting new employees up to speed on the business itself, and describes a three layer method for doing it: starting with public domain research, moving into technical documentation stored in tools like Confluence or ServiceNow, and finishing by validating that knowledge directly with business contacts. He believes this kind of onboarding, which traditionally took a year, can now happen in as little as two months. The conversation turns to where AI agents genuinely belong in customer and public facing interactions. Drawing on his graduate background in human computer interaction, Aby argues that voice agents handle routine, low stakes requests well, but that situations involving physical risk, like a 911 call, still require a human who can read sentiment and respond with genuine urgency. He is candid that AI is not there yet on the emotional and contextual judgment those moments require, even as he agrees the underlying technology is improving quickly, drawing the same comparison to early self driving cars that has come up elsewhere in the series. The back half of the episode focuses on where Aby thinks security is headed structurally. He describes a concept he calls the security sidecar, wrapping new code with two agents working in real time, one representing business logic and one representing security expertise, rather than relying on after the fact log review. He connects this to a broader argument that traditional patch management can no longer keep pace with organizations shipping ten releases a day, and that the real answer is AI monitoring systems that catch abnormal behavior the moment an intrusion happens, regardless of which vulnerability let it in. This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact , info@cyberlynx.com , or 301-798-9170.

  ListenShow Notes
• 

  Episode #236

  Doing More With Less: A Department of Three Punching at Twenty with Tony Bryson - Ep 236

  Sep 14, 202646 min

  Guest Introduction Tony Bryson is the first Chief Information Security Officer for the Town of Gilbert, Arizona, a municipality that has grown from roughly 15,000 residents at the turn of the century to nearly 300,000 today, making it the fourth largest municipality in the state. Tony was recruited into the role by a former colleague from Mesa Community College and has spent six years building Gilbert's cybersecurity program from the ground up. He joins the show to talk about doing more with less as a department of three, the town's early and deliberate approach to AI governance, and why he still draws a hard line on where AI belongs in the decision making process. Here's a Glimpse of What You'll Learn How Tony reduced Gilbert's security tool spend while getting more protection out of a leaner budget Why Gilbert started formal AI discussions roughly four years ago, well ahead of most organizations Why Gilbert created a chief artificial intelligence officer role and what changed because of it How Tony distinguishes machine learning from generative AI when it comes to actually stopping attacks Why Tony won't let AI serve as the final peer reviewer on any change to production systems The Abraham Lincoln story Tony uses to explain how he tempers emotional decisions Why Tony compares artificial intelligence to a phenomenally intelligent toddler In This Episode Tony opens by walking through what it took to become Gilbert's first ever CISO, brought in specifically to look at cybersecurity strategically across the whole organization rather than department by department. He describes his first move as auditing the town's existing security spend and discovering money going toward tools that weren't being used properly, a decision that shrank his budget dramatically but let his team of three operate with the impact of a much larger department through carefully chosen strategic partnerships. The conversation moves into how Gilbert approached artificial intelligence years before most organizations took it seriously, with Tony's office starting formal discussions about governance, guardrails, and data access roughly four years ago. That early groundwork led to the creation of a chief artificial intelligence officer position, a decision Tony says changed how the organization operates but also introduced new concerns, particularly around agentic AI, which he describes as opening a Pandora's box that cannot be closed again. He is candid that generative AI has not yet earned his full trust for frontline security work, arguing that machine learning products built specifically for behavioral detection remain far more reliable at catching abnormal activity like the kind that led to the MGM breach. The back half of the episode centers on where Tony draws firm boundaries around AI's role. He explains why he will not let artificial intelligence serve as the sole peer reviewer on any production change, citing liability and the need for a human stakeholder with real accountability, though he is open to AI catching mistakes as one voice among several. He also shares a personal system, inspired by a story about Abraham Lincoln's unsent letters, for using a cooling off period and AI assistance to temper emotionally charged communications before they go out, a practice he says has become part of how he leads through moments of crisis. This episode is brought to you by Cyberlynx CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection. We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO. Talk to us at https://cyberlynx.com/contact , info@cyberlynx.com , or 301-798-9170.

  ListenShow Notes

Recent guests on The Cyber Business Podcast. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.