CISO Tradecraft

11 episodes scanned. 43% of ad slots promote the show's own products.

Recent Episodes

1. The CISO Operating System | Todd Fitzgerald - #305

   Oct 29, 2026

   Todd Fitzgerald, author of The CISO Compass, recorded at the COSAC security conference in Ireland, walks through his CISO Operating System, a seven-part framework (Strategy, Structure, Systems, Staff, Skills, Style, Shared Values) adapted from the McKinsey 7S model for running security as a business. He discusses reporting structures for CISOs, how to choose among control frameworks such as NIST CSF, COSO, and ISO 27001, using incidents as lessons learned, building multi-generational teams, the choice between a technical career and an executive CISO path, and framing security investment to boards. The conversation also covers the risk of pursuing too much change too quickly.

2. How Great CISOs Negotiate: Budgets, Ransomware, & Salaries | Mark Rasch - #304

   Oct 14, 2026

   Cybersecurity attorney and negotiation expert Mark Rasch joins host G. Mark Hardy to discuss negotiation strategy for CISOs, including anchoring, shifting budget conversations from cost to business value, and using precise, process-based budget requests. The conversation also covers ransomware negotiation dynamics, intellectual property ownership in security vendor contracts, salary negotiation, and when to walk away from a deal.

3. Should you get a PhD in Cybersecurity? | Dr Char Sample - #303

   Sep 30, 2026

   Dr. Char Sample discusses the value and challenges of pursuing a PhD in cybersecurity, drawing from her decades of experience in the field and academic leadership at Marshall University. She covers practical considerations including program requirements, time commitment (typically 3-5 years), funding, research methodology, and the importance of selecting a genuinely interesting research problem. The conversation explores cybersecurity research trends, the distinction between applied and theoretical research, and emerging challenges like AI hallucination in academic work.

4. Security Awareness Tips for 2026 - #302

   Sep 21, 2026

   G Mark Hardy and Ross Young discuss practical security awareness training strategies for 2026, moving beyond tired phishing simulations to engage employees with current threat tactics. They cover credential harvesting via social engineering, token theft, MFA best practices, email authentication limitations, and creative gamified training approaches that actually resonate with users.

5. Nobody Teaches CISOs This… Until It’s Too Late - #301

   Sep 14, 2026

   G. Mark Hardy and Ross Young, co-hosts of CISO Tradecraft, discuss timeless leadership principles for cybersecurity leaders drawn from Hardy's military command philosophy. The episode covers ten core tenets including promoting talent, maintaining excellence, effective communication, recognizing achievement, growing future leaders, and building a culture where people want to work. Young shares practical examples including turning phishing awareness into a company competition with brisket parties and CEO recognition.

6. CISO Health and Accountability Dialogue - #300

   Sep 7, 2026

   G. Mark Hardy interviews Ira Winkler about health, accountability, and burnout among CISOs and security leaders. The conversation explores why brilliant security professionals sacrifice their health for career advancement, the critical importance of leading by example, and Winkler's core philosophy: "Never miss twice." Hardy and Winkler discuss the unique stressors facing C-level security officers and introduce CruiseCon, an upcoming conference focused on privacy and AI in cybersecurity.

7. Claude Code Is INSANE, But Is It Safe? - #299

   Aug 31, 2026

   Ross Young, co-host of CISO Tradecraft, discusses Claude Code's capabilities and security implications for AI-assisted software development. The conversation covers tokenomics strategies, the importance of production requirement documents (PRDs), privacy considerations with different AI licensing models, and critical security concepts including harnesses, agents, Model Context Protocol (MCP), and threat modeling for AI-generated code.

8. VCISO Tradecraft | Carlota Sage - #298

   Aug 25, 2026

   vCISO Carlota Sage joins Mark Hardy to discuss how enterprise security playbooks must be adapted for small and medium-sized businesses. Drawing on her experience at FireEye during its acquisition of Mandiant, Sage explores the critical role of leadership, emotional intelligence, and business acumen in building effective security programs for resource-constrained organizations, while addressing emerging challenges around AI adoption, data loss prevention, and the blurred line between compliance and security.

9. AI's Biggest Security Problem | Jeff Spear - #297

   Aug 17, 2026

   Jeffrey Spear, CISO at Tufin, discusses how security leaders can govern AI and network automation without scaling security mistakes at machine speed. The episode explores network governance versus management, infrastructure-as-code compliance, AI agents with proper guardrails, and the concept of 'access debt'—establishing the foundational policies and visibility required before automation can be safely deployed.

10. AI Is Breaking Out and Cybersecurity Isn’t Ready | John Strand - #296

    Aug 10, 2026

    Recorded live at Black Hat, G. Mark Hardy interviews John Strand of Black Hills Information Security about AI's impact on cybersecurity careers, skills, and the future of offensive versus defensive security. They discuss practical AI workflows for security assessments, the importance of foundational technical knowledge (TCP/IP, operating systems) even in an AI-driven world, and the business risks of over-reliance on proprietary AI models from OpenAI and Anthropic. Strand demonstrates how AI-powered tools like N8N and open-source models are reshaping security work, emphasizing that human expertise remains critical for interpreting AI outputs and maintaining security guardrails.