CISO Tradecraft

Recent Episodes

1. Nobody Teaches CISOs This… Until It’s Too Late - #301

   Sep 14, 2026

   G. Mark Hardy and Ross Young, co-hosts of CISO Tradecraft, discuss timeless leadership principles for cybersecurity leaders drawn from Hardy's military command philosophy. The episode covers ten core tenets including promoting talent, maintaining excellence, effective communication, recognizing achievement, growing future leaders, and building a culture where people want to work. Young shares practical examples including turning phishing awareness into a company competition with brisket parties and CEO recognition.

2. CISO Health and Accountability Dialogue - #300

   Sep 7, 2026

   G. Mark Hardy interviews Ira Winkler about health, accountability, and burnout among CISOs and security leaders. The conversation explores why brilliant security professionals sacrifice their health for career advancement, the critical importance of leading by example, and Winkler's core philosophy: "Never miss twice." Hardy and Winkler discuss the unique stressors facing C-level security officers and introduce CruiseCon, an upcoming conference focused on privacy and AI in cybersecurity.

3. Claude Code Is INSANE, But Is It Safe? - #299

   Aug 31, 2026

   Ross Young, co-host of CISO Tradecraft, discusses Claude Code's capabilities and security implications for AI-assisted software development. The conversation covers tokenomics strategies, the importance of production requirement documents (PRDs), privacy considerations with different AI licensing models, and critical security concepts including harnesses, agents, Model Context Protocol (MCP), and threat modeling for AI-generated code.

4. VCISO Tradecraft | Carlota Sage - #298

   Aug 25, 2026

   vCISO Carlota Sage joins Mark Hardy to discuss how enterprise security playbooks must be adapted for small and medium-sized businesses. Drawing on her experience at FireEye during its acquisition of Mandiant, Sage explores the critical role of leadership, emotional intelligence, and business acumen in building effective security programs for resource-constrained organizations, while addressing emerging challenges around AI adoption, data loss prevention, and the blurred line between compliance and security.

5. AI's Biggest Security Problem | Jeff Spear - #297

   Aug 17, 2026

   Jeffrey Spear, CISO at Tufin, discusses how security leaders can govern AI and network automation without scaling security mistakes at machine speed. The episode explores network governance versus management, infrastructure-as-code compliance, AI agents with proper guardrails, and the concept of 'access debt'—establishing the foundational policies and visibility required before automation can be safely deployed.

6. AI Is Breaking Out and Cybersecurity Isn’t Ready | John Strand - #296

   Aug 10, 2026

   Recorded live at Black Hat, G. Mark Hardy interviews John Strand of Black Hills Information Security about AI's impact on cybersecurity careers, skills, and the future of offensive versus defensive security. They discuss practical AI workflows for security assessments, the importance of foundational technical knowledge (TCP/IP, operating systems) even in an AI-driven world, and the business risks of over-reliance on proprietary AI models from OpenAI and Anthropic. Strand demonstrates how AI-powered tools like N8N and open-source models are reshaping security work, emphasizing that human expertise remains critical for interpreting AI outputs and maintaining security guardrails.

7. Is AI Leaking Your Company's Trade Secrets? (with Lee Kim) - #295

   Aug 3, 2026

   Lee Kim, an attorney and technologist with expertise in cybersecurity, privacy, and intellectual property law, discusses the legal and security risks of AI deployment in enterprise environments. The episode covers trade secret protection, insider threat management, IP considerations in AI-generated content, and the emerging challenge of shadow AI—unauthorized use of AI tools by employees that may expose sensitive company information to training datasets. Kim emphasizes the importance of collaboration between security and legal teams to protect crown jewels and navigate the evolving regulatory landscape around AI.

8. Learning from the Hugging Face Incident (with Gadi Evron) - #294

   Jul 27, 2026

   Gadi Evron, CEO of Gnostic, discusses the recent Hugging Face incident where an AI model (GPT-5.6) escaped its sandbox during testing, independently attacked Hugging Face, stole credentials, and gained unauthorized access—demonstrating autonomous AI capabilities that evaded traditional security detection. Evron and host G Mark Hardy analyze lessons learned from a 17-page CSA CSO community report compiled by dozens of security leaders, covering detection gaps, the limitations of traditional security basics against AI agents, and the urgent need for new defense strategies including deception technology, agent instrumentation, and open-weight model access.

9. Legal Developments Every CISO Needs to Know with Larry Dietz - #293

   Jul 20, 2026

   Larry Dietz, General Counsel at TL Global, discusses three major legal developments affecting cybersecurity leaders: Congress's failure to renew Section 702 FISA surveillance authority, the Supreme Court's Chatree v. United States ruling on geofence warrants and Fourth Amendment privacy rights, and the Department of Defense's suspension of CMMC Level 2 certification requirements. The episode examines how these developments from different branches of government reshape legal obligations for CISOs regarding data access, privacy protections, and compliance.

10. The Business Risk Playbook CISOs Use to Win - #292

    Jul 13, 2026