Cyber Smokehouse

Take your cybersecurity program to the next level with powerful insights on structuring security reporting lines, combating shadow risk, and building an engaged, transparent team culture from scratch. It’s time to move past organizational blind spots, establish top-down AI guardrails, and align vulnerability management directly with business priorities. Who better to guide you through it than Fortune 100 security leader, former CISO at Hyundai Capital America, and former VP & CISO at LIV Golf, Eddie Younker?

You will learn how reporting directly to executive leadership eliminates conflicts of interest, why effective vulnerability management relies on business support rather than just IT execution, and how to foster a "family away from family" culture that achieves industry-leading employee engagement. Get motivated to build cross-functional relationships, educate leadership teams, and take a business-first approach to security!

Takeaways:

Quote of the Show

"Building a security culture starts with the reporting structure... You need a structure that enables you to own security for the entire organization and drive governance that gets support from the business." - Eddie Younker\

Links:

Ways to Tune In:

Take your cybersecurity strategy to the next level with powerful insights on securing modern healthcare delivery, bridging the digital divide, and translating complex security tech into executive business language. It’s time to rethink patient care availability, move beyond legacy castle-and-moat models, and adopt platform-based zero trust architectures. Who better to guide you through it than U.S. Marine Corps veteran, published author, and Healthcare CISO at Zscaler, Chris Logan?

You will learn how ambient AI is transforming clinical workflows, why health systems must consolidate point solutions into platform security to speed up M&A, and how servant leadership builds resilient, high-performing security teams. Get motivated to speak the language of business executives, protect critical patient care environments, and open career doors for the next generation of cyber leaders!

Takeaways:

Quote of the Show:

"If you lead with technology when speaking to your board or CFO, you've already failed. They don't care about the technology, they care about the business outcome." - Chris Logan

Links:

Ways to Tune In:

Take your understanding of cybersecurity risk, organizational alignment, and executive career pivots to the next level with powerful insights from a 30-year industry veteran! It’s time to rethink the evolving personal liability of CISOs, how to effectively communicate cyber risk to non-technical business leaders, and what it really takes to walk away and build a successful second-act venture. Who better to guide you through it than former CISO at Finastra and Diebold Nixdorf, and co-founder and Chief Travel Officer at Sunshine Travelers Experiences, Scott Berrington?

In this episode, you will learn how the rapid influx of emerging tech like AI creates mounting operational risk, the pros and cons of different CISO reporting structures, and strategies for providing true security assurance to demanding global clients. Get motivated to build empowered, self-sufficient security teams, navigate executive burnout, and turn your lifelong passions into your next big career milestone!

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Take your cybersecurity operations to the next level with powerful insights on managing high-volume vulnerability patches, securing healthcare IT/OT environments, and applying deep reinforcement learning to autonomous defense. It’s time to move beyond reactive security measures and build resilient, zero-downtime systems in live, life-safety environments. Who better to guide you through it than healthcare CISO, critical infrastructure veteran, and University of Michigan-Dearborn researcher, Keith Lawson?

You will learn how the surge in AI coding agents is driving a "tsunami" of software patches, strategies for managing identity as the modern perimeter, and how autonomous AI agents can adapt in real time to protect critical infrastructure. Get motivated to foster a zero-blame, collaborative culture that empowers your technical and non-technical teams to solve complex security challenges together.

Takeaways:

Quote of the Show:

"In security, I think open honesty and sharing is the best thing that we can do... To me, security is a team sport." - Keith Lawson

Links:

Ways to Tune In:

Get ready to challenge everything you assume about AI's role in cybersecurity. Shannon Garcia, founder of Strategic Defense and a veteran red team leader with stops at Trustwave, SecureWorks, IBM, and Kudelski Security, joins the Cyber Smokehouse to break down why manual, human-led penetration testing still outperforms automated AI tools, and why that might not last forever.

You'll learn how shadow IT quietly drains company budgets, why remote work has changed both testing methodology and phishing success rates, and how translating technical findings into business language can protect million-dollar contracts. Plus, Shannon shares her unlikely path from 11 years as an AMD engineer to building two cybersecurity companies from scratch.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Strong cybersecurity programs aren't built through quick fixes, they're built through thoughtful leadership, patient execution, and investing in people.

In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Ward Balcerzak, Field CISO at Sentra, to discuss what effective security leadership looks like in today's rapidly evolving landscape. Ward shares lessons from building security programs, mentoring future leaders, adopting AI responsibly, and helping organizations avoid reactive decision-making.

From creating realistic AI roadmaps to developing cybersecurity talent and leading through change, this conversation offers practical guidance for security leaders focused on building resilient organizations for the long term.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Most security programs are built around understanding what has already happened, but what if organizations could begin anticipating cyber threats before they materialize? In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Tim and Suzanne O'Neil, founders of AigisPoint Predictive Intelligence. Drawing on decades of experience spanning enterprise security architecture, military leadership, entrepreneurship, and business strategy, they discuss their approach to predictive cyber risk, how AI and machine learning are reshaping threat modeling, and the realities of building an innovative cybersecurity startup.

From balancing innovation with security to understanding AI's limitations, this conversation explores how organizations can begin thinking beyond reactive cybersecurity while remaining grounded in practical risk management.

 Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Cybersecurity leaders today face a challenge that extends far beyond technology: keeping pace with constant change. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with John Rogers, Chief Information Security Officer and Head of Technology Risk at MSCI. Drawing on experience spanning consulting, financial services, and executive security leadership, John shares his perspective on AI governance, third-party risk management, board communication, and the growing complexity facing security teams.

Listeners will gain practical insights into how organizations can approach AI governance, communicate cyber risk effectively to executives and boards, rethink traditional third-party risk practices, and prepare for a future where security leaders must balance innovation with increasingly complex threats.
 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Most cybersecurity conversations start with technology. Michael Myint starts with the foundation. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Michael Myint, a cybersecurity executive whose thirty year career spans Big Four consulting, global enterprises, and high growth healthcare startups. He has built programs from scratch, led organizations through public incidents, and mentored security leaders who have gone on to surpass him. You will walk away with a sharper view of where AI is genuinely changing the threat landscape, why vendor consolidation is coming, whether organizations are ready or not, and what separates the security professionals who rise from the ones who stall.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Cybersecurity careers are rarely linear, and building effective security leadership requires more than technical expertise alone. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mea Clift, CISO at Cengage, for a conversation about cybersecurity career growth, leadership, curiosity, and risk management.

Mea shares insights on how professionals can find their place within the cybersecurity industry, why curiosity is essential for long-term success, and how passion drives deeper expertise. The discussion also explores misconceptions about the CISO role, business impact assessments, security risk, and the realities of operating modern security programs. Outside of cybersecurity, the conversation shifts into Mea’s approach to smoking and grilling, including charcoal setups, smoking techniques, and favorite recipes. 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

What happens when organizations scale rapidly through acquisition while simultaneously navigating AI adoption and evolving cyber risk?

In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Matthew Mudry, CISO at Alera Group, to discuss the operational realities of securing large-scale acquisitions, integrating fragmented environments, and managing cybersecurity risk during periods of aggressive growth.

Matthew shares firsthand experiences standardizing security across acquired organizations, balancing business pressure with security due diligence, and navigating the growing complexity introduced by AI technologies. The conversation explores M&A integration challenges, data loss prevention, access control, AI governance, leadership communication, security roadmaps, and the future of the CISO role. 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Cybersecurity is evolving faster than ever, and leaders are being forced to rethink how they approach risk, resilience, and modern defense strategies. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne sit down with Mike Salem to discuss today’s rapidly changing cyber landscape and the growing influence of AI on both attackers and defenders.

Throughout the conversation, Mike shares insights on emerging cyber threats, operational challenges facing security teams, and the importance of adaptability in modern cybersecurity leadership. The discussion also explores how organizations can better prepare for evolving risks while balancing innovation, visibility, and practical security execution.

This episode offers valuable perspective for cybersecurity leaders, IT professionals, and organizations navigating constant technological change and increasing security complexity.

 Takeaways:

• AI is rapidly changing the cybersecurity landscape. The conversation explores how AI is accelerating both offensive and defensive cybersecurity capabilities and increasing the speed of change across the industry.

• Security teams must continuously adapt. Mike discusses the operational challenges organizations face as threats evolve faster than traditional security processes.

• Visibility and awareness remain critical.The episode highlights the importance of understanding environments, risks, and potential gaps before incidents occur.

• Cybersecurity leadership requires flexibility. The discussion emphasizes the need for leaders to remain adaptable while balancing business priorities and security objectives.

• Threat actors are evolving quickly. Mike shares perspectives on how modern attackers are becoming more sophisticated and accessible through emerging technologies.

• Organizations must focus on practical execution. The conversation reinforces the importance of operationalizing security strategies rather than relying solely on theoretical frameworks.

Quote of the Show:

Links:

Ways to Tune In:

Tired of the buzzword bingo flooding the cybersecurity industry? So is Zlatko Unger. In this episode of Cyber Smokehouse, Ernie Anderson and Graeme Payne welcome Zlatko Unger, CISO Expert at Wiz, for a no-nonsense conversation that cuts straight through the AI noise and gets back to what actually matters in security. With over 18 years of experience spanning security, risk, privacy, and compliance, Zlatko brings the kind of hard-earned perspective that only comes from building and scaling security programs in the real world.

From the growing complexity of identity and access management to the supply chain gaps that keep him up at night, Zlatko lays it all out plainly. You will walk away with a clearer picture of where AI is genuinely useful in security programs, where technical debt is quietly piling up while everyone chases the next shiny thing, and what it takes to lead remote security teams and communicate risk to a board that may not want to hear it. This one is packed with substance, humor, and the kind of candid insight you rarely get on a stage at RSA.

 Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

How is AI changing both the threat landscape and the way security teams operate? Today’s guest is a seasoned cybersecurity leader navigating these changes at scale. Introducing David Cross, CISO at Atlassian. David joins Ernie Anderson and Graeme Payne to share how AI is reshaping cybersecurity, from attacker capabilities to internal defense strategies.

He discusses how AI is lowering the barrier for attackers, why security teams must adapt to an increasingly fast-moving environment, and how organizations should think about managing risk as new technologies emerge. David also touches on the importance of understanding evolving threats, maintaining strong fundamentals, and ensuring teams are prepared to respond to continuous change. 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

How do you secure an environment when the technology is evolving faster than teams can keep up? Today’s guest is a cybersecurity leader operating at the intersection of AI, product security, and enterprise scale. Introducing Jason Loomis, CISO at Freshworks. Jason joins Ernie Anderson and Graeme Payne to share why the speed of AI innovation is becoming one of the biggest challenges in cybersecurity today.

He dives into how AI is accelerating both development and risk, the growing difficulty of maintaining guardrails in AI-generated code, and why organizations are still struggling to implement governance at scale. Jason also shares a candid perspective on how AI may impact the future of cybersecurity talent, particularly at the entry level, and why continuous learning is becoming non-negotiable for security professionals. 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Why do organizations still struggle with cybersecurity despite more tools and innovation than ever before? Today’s guest is a seasoned cybersecurity executive with deep experience across enterprise and public sector environments. Introducing Merlin Namuth, CISO for the City and County of Denver. Merlin joins hosts Ernie Anderson and Graeme Payne to share why foundational security practices continue to be the biggest challenge for organizations today.

He dives into why core disciplines like asset management and vulnerability management are often overlooked despite being critical, how AI is both a force multiplier and a growing threat, and why leadership, communication, and continuous learning are essential in cybersecurity. Merlin also shares practical insights on building high-performing teams, developing talent, and staying relevant in an industry that is constantly evolving.
 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550

How do you translate cybersecurity from a technical function into a true business priority? Today’s guest is a seasoned cybersecurity leader with deep enterprise experience. Introducing Chris Correia, CEO of CGS CyberDefense. Chris joins hosts Ernie Anderson and Graeme Payne to share how cybersecurity leaders must evolve from technologists into business storytellers who can align security with organizational priorities.

He dives into why security conversations need to shift from tools to outcomes, how risk quantification enables better executive decision-making, and why organizational resiliency goes far beyond traditional cyber playbooks. Chris also shares leadership lessons from building teams, investing in the next generation, and creating long-term client relationships rooted in trust and value.

Takeaways

• Cybersecurity must be communicated in business terms. Chris emphasizes that security leaders need to translate technical concepts into business language to effectively engage executives and boards.

• Risk quantification enables better decisions. He explains that framing security investments in terms of financial impact helps shift conversations from emotion to fact-based decision-making.

• “Rules before tools” should guide security strategy. Organizations often overinvest in technology without building the right programs. Chris highlights the importance of designing the strategy first, then aligning tools to support it.

• Organizational resiliency must extend beyond IT. Resiliency is not just a cybersecurity function. It requires coordination across the entire business, including roles like HR and operations, to ensure preparedness in real scenarios.

• Testing and readiness must be continuous. Many organizations test disaster recovery or response plans too infrequently. Chris stresses the need for ongoing, practical testing to build real readiness.

• AI must be used, but carefully validated. He notes that while AI is becoming essential, organizations must fact-check outputs and implement guardrails to avoid risk and misuse.

• Relationships are central to consulting success. Chris highlights that long-term value comes from relationships, not transactions, and that trust is foundational in the consulting world. 

Quote of the Show:

Links:

Ways to Tune In:

Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550

How do you secure environments that are constantly changing, distributed, and increasingly difficult to see? Today’s guest is a forward-thinking cybersecurity leader focused on tackling modern visibility and infrastructure challenges. Introducing Clete Taylor, Senior Security Architect at Frost. Clete joins hosts Ernie Anderson and Graeme Payne to explore how evolving environments are reshaping the way organizations approach security.

He shares how the shift to cloud and hybrid infrastructure has created blind spots that traditional tools struggle to address. The conversation dives into why visibility is foundational to security, how attackers exploit gaps in awareness, and what organizations must do to adapt. Clete also highlights the importance of proactive strategy, continuous monitoring, and aligning security practices with how modern systems actually operate.

Takeaways:

• You cannot secure what you cannot see. Modern environments are dynamic and distributed, making visibility the foundation of any effective security strategy. Without clear insight into systems and access, risk increases significantly.

• Traditional security models are falling behind.Perimeter-based approaches were built for static environments. Today’s cloud and hybrid infrastructures require adaptive, continuously evolving security strategies.

• Complexity creates opportunity for attackers. As systems grow more complex, gaps naturally emerge. Attackers are increasingly targeting these blind spots where monitoring and control are weakest.

• Continuous monitoring is no longer optional. Security must operate in real time. Point-in-time assessments are not enough to detect or respond to threats in fast-moving environments.

• Alignment between infrastructure and security is critical. Security strategies must reflect how systems are actually built and used. Misalignment creates inefficiencies and increases vulnerability.

• Proactive thinking outperforms reactive defense. Organizations that anticipate risks and design for them early are far better positioned than those constantly reacting to incidents.

Quote of the Show:

Links:

Ways to Tune In:

Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

How do organizations stay secure when identity, access, and infrastructure are more distributed than ever before? Today’s guest is a seasoned cybersecurity leader focused on modern identity and cloud security challenges. Introducing Joe Mendygral, Senior Director at TBD Cyber. Joe joins hosts Ernie Anderson and Graeme Payne to explore how identity has become the core battleground in cybersecurity. He also delves into how cloud environments, AI, and evolving attack methods are forcing organizations to rethink how they detect and respond to threats.

Joe shares practical insights on visibility, detection, and why traditional security approaches are struggling to keep up with modern environments. The conversation highlights the growing importance of understanding user behavior, securing identities, and building adaptive security strategies that evolve alongside threats.

Takeaways:

• Identity is now the primary attack surface. As organizations move to cloud-first environments, attackers are increasingly targeting identities instead of infrastructure. Securing who has access is now more important than securing where access happens.

• Visibility gaps create the biggest risks. Many organizations lack a clear understanding of who has access to what across systems. Without visibility, it becomes nearly impossible to detect or respond to threats effectively.

• Detection must evolve beyond traditional methods. Signature-based and perimeter-focused security models are no longer sufficient. Modern environments require behavior-based detection that can identify anomalies in real time.

• Cloud complexity increases security challenges. As infrastructure becomes more distributed, security becomes harder to manage. Organizations must adapt their strategies to account for dynamic environments and decentralized access.

• AI is changing both offense and defense. AI is enabling faster detection and response, but it is also being used by attackers to scale and automate threats. Security teams must evolve just as quickly to stay ahead.

• Security requires continuous adaptation. There is no static solution to cybersecurity. Organizations must continuously refine their strategies, tools, and processes to keep up with an ever-changing threat landscape.

Quote of the Show:

Links:

Ways to Tune In:

How do cybersecurity leaders manage risk, talent, and rapid innovation as AI transforms both threats and defenses? Today’s guest is a seasoned cyber intelligence leader and strategic risk advisor. Introducing Steve Bay, Vice President of Cybersecurity and Chief Information Security Officer at Coretelligent. Steve joins hosts Ernie Anderson and Graeme Payne to share how AI is reshaping the cybersecurity landscape and what leaders must do to stay ahead. He also delves into talent challenges, evolving threat dynamics, and the importance of balancing innovation with governance in a rapidly changing environment.

Steve shares insights from his journey into cybersecurity, his experience in intelligence and enterprise security, and his perspective on how organizations can navigate uncertainty while building resilient security programs.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

How can cybersecurity leaders translate technical threats into real business decisions without losing executive alignment or strategic clarity? Today’s guest is a thoughtful cybersecurity strategist and business-focused security leader. 

Introducing Jimmy Lummis, Director and Business Information Security Officer at IHG Hotels & Resorts. Jimmy joins hosts Ernie Anderson and Graeme Payne to discuss how modern security leaders must bridge the gap between technical teams and executive leadership. He also explores the realities of cyber risk quantification, the role of AI in modern threat landscapes, and why translating cybersecurity into business language is essential for effective decision making.

Takeaways

Quote of the Show:

Links:

Ways to Tune In:

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with David Nolan, Principal Advisor at Apex Advisors, to explore how organizations must rethink cybersecurity as digital environments grow more complex and interconnected.

David shares why the traditional concept of a network perimeter is rapidly disappearing as organizations adopt cloud platforms, distributed workforces, and connected technologies. As a result, security leaders must move beyond reactive defense and focus on building resilience, visibility, and strategic alignment across the entire digital ecosystem. The conversation explores how cybersecurity must evolve from a purely technical discipline into a business leadership priority, how organizations can anticipate emerging threats, and why security culture plays a critical role in protecting modern systems.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Healthcare cybersecurity is no longer just about compliance, it’s about resilience.

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Hugo Lai, Chief Information Security Officer at Temple Health, to explore how healthcare organizations can protect patient care in an era of AI adoption, ransomware threats, and relentless budget pressure.

Hugo shares practical insights from leading enterprise security programs inside one of the most operationally complex industries. From managing medical device risk to embedding daily threat intelligence briefings into team culture, this conversation dives deep into what modern cyber leadership looks like when lives are on the line.

Key Takeaways

Quote of the Show:

Links:

Ways to Tune In:

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Wade Myers to explore the leadership discipline required to navigate modern cyber risk. Wade shares why complexity is the enemy of effective security programs, how executives must think about tradeoffs instead of perfection, and why clarity, not control, is the real advantage in today’s threat landscape.

The conversation dives into decision-making under uncertainty, aligning cybersecurity with business priorities, and the importance of building teams that can operate confidently in high pressure environments. Wade unpacks how security leaders can move beyond compliance thinking and instead focus on meaningful risk management that strengthens resilience across the organization.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550 

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Damian Apone, cybersecurity executive and practitioner with deep experience building and operating security programs inside complex organizations.

Damian brings a grounded, real-world perspective on why cybersecurity initiatives often fail, not because of missing tools, but because of misalignment between people, process, and technology. He shares hard-earned lessons on operationalizing cyber resilience, managing risk in imperfect environments, and helping leaders move beyond checkbox compliance toward security programs that actually work in practice. The conversation covers executive communication, prioritization, realistic threat modeling, and why resilience, not perfection, is the goal.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

In this episode of Cyber Smokehouse, hosts Ernie and Graeme sit down with Gregg Barrow, a global cybersecurity leader at the forefront of quantum-safe computing, to explore one of the most underestimated threats facing organizations today: the coming impact of quantum computing on data security.

The conversation dives into crypto-agility, inventorying cryptographic assets, leadership accountability, and the real risks of waiting too long. This episode challenges cybersecurity leaders to rethink long-term resilience in a world where yesterday’s “secure enough” quickly becomes tomorrow’s breach. 

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

How can organizations cut through security tool sprawl and focus on what truly reduces cyber risk? Today’s guest is a veteran cybersecurity leader with more than 25 years of experience helping global enterprises protect their data and operations. Introducing Erik Hart, Chief Information Security Officer at Cushman & Wakefield and former security leader at organizations including CrowdStrike and Mimecast. Erik joins the show to discuss why vulnerability management must become more data-driven, how identity has emerged as the new firewall, and where AI and automation can meaningfully reduce risk. He also shares leadership insights on challenging outdated security practices, prioritizing what matters most to the business, and building security programs that scale with modern, cloud-first organizations.

Takeaways:

Quote of the Show:

Links:

Ways to Tune In:

This is Cyber Smokehouse. Join Ernie and Graeme as they grill the minds, dig into the experience, and serve up the stories of leaders in cybersecurity. Cyber Smokehouse is sponsored by TBDCyber, a cybersecurity strategy consulting firm.