<![CDATA[Distilled Security Podcast]]>Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.

]]>https://distilledsecuritypodcast.comRiverside.fm (https://riverside.com)Mon, 13 Jul 2026 03:44:10 GMTSun, 31 May 2026 23:26:31 GMT60Justin Leapline, Joe Wynn, and Rick Yocum<p>Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.</p>episodicJustin Leapline, Joe Wynn, and Rick Yocumjustin@episki.comno<![CDATA[Episode 26: How to Run a Conference, Why Most Pen Tests Fail, and HIPAA's Ransomware Reckoning]]>In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon.

🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio
🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors
🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze
🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows
🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses
🔗 Chaining vulnerabilities and what separates a checkbox test from a real one
💸 Why pen testing so often becomes an ineffective use of resources
📋 Compliance and contractual drivers vs. genuine risk reduction
🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement
🤝 Engaging pen testers as partners and maturing the process over time
🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring
🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare
🥃 Bourbon tasting and discussion

⏱️ Timestamps
00:00 Intro
01:26 Guest introduction & background
02:18 RareMed Solutions & patient assistance programs
05:01 Book writing & amateur radio
08:11 BSides Pittsburgh overview
15:04 Running a conference: planning & organization
22:05 Marketing & audience engagement
25:07 Dividing responsibilities as you grow
27:59 The value of ticket pricing
31:50 BSides & the conference model
46:11 Penetration testing & scoping
57:28 The purpose of pen testing
58:23 When pen testing goes wrong
01:00:16 Reasons for pen testing & compliance drivers
01:03:04 Continuous monitoring, testing & detection
01:06:19 Is your company ready for a pen test?
01:07:07 A risk-based approach
01:13:58 Scenario-based testing & resilience
01:17:31 Evaluating the value of pen testing
01:29:01 The constant state of change
01:31:01 Compliance & cyber insurance
01:32:19 Bourbon tasting
01:36:32 Government scoring & risk analysis
01:50:36 HIPAA compliance & ransomware
01:55:01 Wrap-up & call to action

🎧 Distilled Security Podcast

Cybersecurity, GRC, and leadership, one pour at a time.

🎙️ Hosts

  • Justin Leapline – @justinleapline
  • Joe Wynn – @wynnjoe
  • Rick Yocum – @rickyocum

🎤 Guest

📬 Send Us Your Questions!

ask@distilledsecuritypodcast.com

🌐 Connect with Us

Website: distilledsecuritypodcast.com

X: @DisSecPod

YouTube: @distilledsecurity

Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for monthly

security and compliance insights.

]]>4f25b9d3-951d-454e-9a47-9cc4369c999cWed, 08 Jul 2026 15:07:06 GMT<p>In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon. </p><p></p><p>🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio<br />🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors<br />🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze<br />🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows<br />🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses<br />🔗 Chaining vulnerabilities and what separates a checkbox test from a real one<br />💸 Why pen testing so often becomes an ineffective use of resources<br />📋 Compliance and contractual drivers vs. genuine risk reduction<br />🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement<br />🤝 Engaging pen testers as partners and maturing the process over time<br />🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring<br />🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare<br />🥃 Bourbon tasting and discussion</p><p></p><p>⏱️ Timestamps<br />00:00 Intro<br />01:26 Guest introduction &amp; background<br />02:18 RareMed Solutions &amp; patient assistance programs<br />05:01 Book writing &amp; amateur radio<br />08:11 BSides Pittsburgh overview<br />15:04 Running a conference: planning &amp; organization<br />22:05 Marketing &amp; audience engagement<br />25:07 Dividing responsibilities as you grow<br />27:59 The value of ticket pricing<br />31:50 BSides &amp; the conference model<br />46:11 Penetration testing &amp; scoping<br />57:28 The purpose of pen testing<br />58:23 When pen testing goes wrong<br />01:00:16 Reasons for pen testing &amp; compliance drivers<br />01:03:04 Continuous monitoring, testing &amp; detection<br />01:06:19 Is your company ready for a pen test?<br />01:07:07 A risk-based approach<br />01:13:58 Scenario-based testing &amp; resilience<br />01:17:31 Evaluating the value of pen testing<br />01:29:01 The constant state of change<br />01:31:01 Compliance &amp; cyber insurance<br />01:32:19 Bourbon tasting<br />01:36:32 Government scoring &amp; risk analysis<br />01:50:36 HIPAA compliance &amp; ransomware<br />01:55:01 Wrap-up &amp; call to action</p><p></p><p>🎧 Distilled Security Podcast</p><p>Cybersecurity, GRC, and leadership, one pour at a time.</p><p></p><p>🎙️ Hosts</p><ul><li><b>Justin Leapline</b> – @justinleapline</li><li><b>Joe Wynn</b> – @wynnjoe</li><li><b>Rick Yocum</b> – @rickyocum<p></p></li></ul><p>🎤 Guest</p><ul><li><b>Jon Buhagiar </b><a rel="noopener noreferrer nofollow" href="http://linkedin.com/in/jonbuhagiar" target="_blank">linkedin.com/in/jonbuhagiar</a></li></ul><p></p><p>📬 Send Us Your Questions!</p><p><a rel="noopener noreferrer nofollow" href="mailto:ask@distilledsecuritypodcast.com" target="_blank">ask@distilledsecuritypodcast.com</a></p><p></p><p>🌐 Connect with Us</p><p></p><p><b>Website:</b> <a rel="noopener noreferrer nofollow" href="http://distilledsecuritypodcast.com" target="_blank">distilledsecuritypodcast.com</a></p><p><b>X:</b> @DisSecPod</p><p><b>YouTube:</b> @distilledsecurity</p><p><b>Email:</b> <a rel="noopener noreferrer nofollow" href="mailto:hello@distilledsecuritypodcast.com" target="_blank">hello@distilledsecuritypodcast.com</a></p><p></p><p>👍 Like, comment, and subscribe for monthly</p><p>security and compliance insights.</p>no01:56:0026Episode 26: How to Run a Conference, Why Most Pen Tests Fail, and HIPAA's Ransomware Reckoningfull<![CDATA[Episode 24: 2 Years, 24 Episodes & The State of Security in the Age of AI]]>In this episode, we celebrate our 2nd anniversary and Episode 24 of Distilled Security! We cover the Vercel breach, how a Roblox script led to compromised Google Workspace credentials via an unauthorized OAuth connection. Then we dive into HackerOne, pausing their own bug bounty program, overwhelmed by low-quality, AI-generated submissions. And we close out with the State of Vibe-Coded Security—4,783 AI-assisted apps scanned, 727 critical issues found, and the real question: are you vibe coding or vibe deploying? Plus, a quick look at Claude for Security dropping into public beta and what that means for the industry.

All of that, and we crack open a Peerless Double Oak to toast two years of Distilled Security. 🥃

⏱️ TIMESTAMPS:

00:00 – Intro & 2-Year Anniversary 🎉
01:26 – Behind the Scenes & Favorite Moments
08:26 – Podcast Metrics & Global Reach
24:20 – BSides Pittsburgh 2025 Update 🛡️
34:31 – The Vercel Breach & OAuth Risk
58:57 – HackerOne Pauses Bug Bounty
1:16:05 – Spirit: Peerless Double Oak 🥃
1:20:27 – Vibe Coding vs. Vibe Deploying
1:26:46 – Claude for Security & AI News
1:41:27 – Cheers to Two Years! 🥃

🎙️ Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

📬 Send Us Your Questions!
ask@distilledsecuritypodcast.com

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for monthly security and compliance insights

]]>https://share.transistor.fm/s/c00db1db6868a08c-c21d-4bd4-907d-65ee61ca7f67Thu, 14 May 2026 13:27:00 GMT<p>In this episode, we celebrate our 2nd anniversary and Episode 24 of Distilled Security! We cover the Vercel breach, how a Roblox script led to compromised Google Workspace credentials via an unauthorized OAuth connection. Then we dive into HackerOne, pausing their own bug bounty program, overwhelmed by low-quality, AI-generated submissions. And we close out with the State of Vibe-Coded Security—4,783 AI-assisted apps scanned, 727 critical issues found, and the real question: are you vibe coding or vibe deploying? Plus, a quick look at Claude for Security dropping into public beta and what that means for the industry. </p><p>All of that, and we crack open a Peerless Double Oak to toast two years of Distilled Security. 🥃</p><p><strong>⏱️ TIMESTAMPS:</strong></p><p>00:00 – Intro &amp; 2-Year Anniversary 🎉<br />01:26 – Behind the Scenes &amp; Favorite Moments<br />08:26 – Podcast Metrics &amp; Global Reach<br />24:20 – BSides Pittsburgh 2025 Update 🛡️<br />34:31 – The Vercel Breach &amp; OAuth Risk<br />58:57 – HackerOne Pauses Bug Bounty<br />1:16:05 – Spirit: Peerless Double Oak 🥃<br />1:20:27 – Vibe Coding vs. Vibe Deploying<br />1:26:46 – Claude for Security &amp; AI News<br />1:41:27 – Cheers to Two Years! 🥃</p><p><strong>🎙️ Hosts</strong><br />Justin Leapline – @justinleapline<br />Joe Wynn – @wynnjoe<br />Rick Yocum – @rickyocum</p><p><strong>📬 Send Us Your Questions!</strong><br />ask@distilledsecuritypodcast.com</p><p><strong>🌐 Connect with Us</strong><br />Website: distilledsecuritypodcast.com<br />X: @DisSecPod<br />Email: hello@distilledsecuritypodcast.com</p><p>👍 Like, comment, and subscribe for monthly security and compliance insights</p>no01:42:3124Episode 24: 2 Years, 24 Episodes & The State of Security in the Age of AIfull<![CDATA[Episode 6: SEC Penalties, M&A Security, and Due Diligence]]>Episode 6: SEC Penalties, M&A Security, and Due Diligence


Welcome back to the Distilled Security Podcast! In this episode, hosts Justin, Rick, and Joe dive into the latest in cybersecurity, from regulatory challenges to pop culture:

Topics Covered

  1. SEC Penalties for Cybersecurity Disclosures
    Discussing recent SEC penalties due to lapses in cybersecurity disclosure, the implications for companies, and how organizations can stay compliant.
  2. Cybersecurity Materiality and Disclosure Practices
    Tips on navigating the materiality assessment of cybersecurity incidents and ensuring compliance with auditors' disclosure requirements.
  3. Preparedness Through Tabletop Exercises
    Exploring tabletop exercises as a method to enhance readiness for cybersecurity disclosures.
  4. Security in Mergers & Acquisitions
    The importance of aligning security philosophies, protecting supply chain integrity, and fast decision-making in M&A processes.
  5. Pre-Mortem Analyses for Risk Mitigation
    Utilizing pre-mortem analyses to identify risks in acquisitions and ensure security compatibility before a merger.
  6. Best Practices for Selling a Company with Strong Security
    Tips on audit readiness, maintaining a secure posture, and what security leaders should prioritize to avoid penalties or discounts during acquisitions.
  7. Information Control in Modern Warfare
    How controlling information plays a strategic role, with examples from cyberpunk themes to illustrate the power of data control.
  8. Favorite Cybersecurity Movies
    A fun review of iconic cybersecurity movies, highlighting elements like data movement, IP address inaccuracies, and common movie hacking tropes.
  9. Due Diligence Strategies for Small Businesses
    Key steps for conducting effective due diligence, including using a risk-based approach to compliance and managing contracts efficiently.

Links

Spirits

  • Barrell Seagrass - A unique blend of American and Canadian rye whiskeys, each carefully selected and finished in Martinique Rhum, Madeira, and apricot brandy barrels.

Hosts

Connect with Us

  • Website: Distilled Security Podcast
  • Twitter: @DisSecPod
  • Email: hello@distilledsecuritypodcast.com

Time Stamps

  • [00:01:25] SEC penalties for cybersecurity disclosure lapses
  • [00:05:16] Working with external auditors on cybersecurity disclosures
  • [00:09:30] Assessing cybersecurity materiality in disclosures
  • [00:11:45] Tabletop exercises to improve disclosure preparedness
  • [00:14:36] Cybersecurity considerations in M&A
  • [00:19:12] Making fast, informed security decisions
  • [00:23:06] Pre-mortems for assessing acquisition risks
  • [00:25:12] Compatibility of security philosophies in M&A
  • [00:30:20] Securing supply chains in acquisitions
  • [00:34:23] Steps to sell a company securely
  • [00:37:06] Preparing for audits in the sale process
  • [00:42:07] Hosts discuss favorite cybersecurity movies
  • [00:45:57] The strategic role of information in warfare
  • [00:48:49] Data transport themes in cyberpunk films
  • [00:52:36] The infamous fake IP addresses in movies
  • [00:56:01] Due diligence for small businesses and startups
  • [01:00:47] Centralized vs. decentralized security strategies
  • [01:02:20] Adopting a risk-based approach for security questionnaires
  • [01:06:05] Negotiating buyer risk assessments
  • [01:10:11] Leveraging compliance automation tools
  • [01:12:55] Managing contract risks effectively
  • [01:16:10] Ensuring alignment between contract terms and security questionnaires
]]>https://share.transistor.fm/s/9a773fb05489d224-da2c-4865-8273-542435baf3b0Fri, 08 Nov 2024 14:56:32 GMT<p><strong>Episode 6: SEC Penalties, M&amp;A Security, and Due Diligence</strong></p><p><br />Welcome back to the <em>Distilled Security Podcast</em>! In this episode, hosts Justin, Rick, and Joe dive into the latest in cybersecurity, from regulatory challenges to pop culture:</p><p>Topics Covered</p><ol><li><strong>SEC Penalties for Cybersecurity Disclosures</strong><br />Discussing recent SEC penalties due to lapses in cybersecurity disclosure, the implications for companies, and how organizations can stay compliant.</li><li><strong>Cybersecurity Materiality and Disclosure Practices</strong><br />Tips on navigating the materiality assessment of cybersecurity incidents and ensuring compliance with auditors' disclosure requirements.</li><li><strong>Preparedness Through Tabletop Exercises</strong><br />Exploring tabletop exercises as a method to enhance readiness for cybersecurity disclosures.</li><li><strong>Security in Mergers &amp; Acquisitions</strong><br />The importance of aligning security philosophies, protecting supply chain integrity, and fast decision-making in M&amp;A processes.</li><li><strong>Pre-Mortem Analyses for Risk Mitigation</strong><br />Utilizing pre-mortem analyses to identify risks in acquisitions and ensure security compatibility before a merger.</li><li><strong>Best Practices for Selling a Company with Strong Security</strong><br />Tips on audit readiness, maintaining a secure posture, and what security leaders should prioritize to avoid penalties or discounts during acquisitions.</li><li><strong>Information Control in Modern Warfare</strong><br />How controlling information plays a strategic role, with examples from cyberpunk themes to illustrate the power of data control.</li><li><strong>Favorite Cybersecurity Movies</strong><br />A fun review of iconic cybersecurity movies, highlighting elements like data movement, IP address inaccuracies, and common movie hacking tropes.</li><li><strong>Due Diligence Strategies for Small Businesses</strong><br />Key steps for conducting effective due diligence, including using a risk-based approach to compliance and managing contracts efficiently.</li></ol><p><strong>Links</strong></p><ul><li><a href="https://cyberscoop.com/" rel="noopener noreferrer nofollow"><strong>Cyber Scoop</strong></a></li></ul><p><strong>Spirits</strong></p><ul><li><strong>Barrell Seagrass</strong> - A unique blend of American and Canadian rye whiskeys, each carefully selected and finished in Martinique Rhum, Madeira, and apricot brandy barrels.</li></ul><p><strong>Hosts</strong></p><ul><li><a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow">Justin Leapline</a></li><li><a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow">Joe Wynn </a></li><li><a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow">Rick Yocum </a></li></ul><p><strong>Connect with Us</strong></p><ul><li><strong>Website:</strong> Distilled Security Podcast</li><li><strong>Twitter:</strong><a href="https://x.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li><strong>Email:</strong> hello@distilledsecuritypodcast.com</li></ul><p><strong>Time Stamps</strong></p><ul><li>[00:01:25] SEC penalties for cybersecurity disclosure lapses</li><li>[00:05:16] Working with external auditors on cybersecurity disclosures</li><li>[00:09:30] Assessing cybersecurity materiality in disclosures</li><li>[00:11:45] Tabletop exercises to improve disclosure preparedness</li><li>[00:14:36] Cybersecurity considerations in M&amp;A</li><li>[00:19:12] Making fast, informed security decisions</li><li>[00:23:06] Pre-mortems for assessing acquisition risks</li><li>[00:25:12] Compatibility of security philosophies in M&amp;A</li><li>[00:30:20] Securing supply chains in acquisitions</li><li>[00:34:23] Steps to sell a company securely</li><li>[00:37:06] Preparing for audits in the sale process</li><li>[00:42:07] Hosts discuss favorite cybersecurity movies</li><li>[00:45:57] The strategic role of information in warfare</li><li>[00:48:49] Data transport themes in cyberpunk films</li><li>[00:52:36] The infamous fake IP addresses in movies</li><li>[00:56:01] Due diligence for small businesses and startups</li><li>[01:00:47] Centralized vs. decentralized security strategies</li><li>[01:02:20] Adopting a risk-based approach for security questionnaires</li><li>[01:06:05] Negotiating buyer risk assessments</li><li>[01:10:11] Leveraging compliance automation tools</li><li>[01:12:55] Managing contract risks effectively</li><li>[01:16:10] Ensuring alignment between contract terms and security questionnaires</li></ul>no01:17:216Episode 6: SEC Penalties, M&A Security, and Due Diligencefull<![CDATA[Episode 3: Crowdstrike, North Korean Spies, and CISO Scapegoats]]>Episode 3 of the Distilled Security Podcast is here!


Join us this week as we jump into: 


  • CrowdStrike Incident Analysis: A deep dive into a recent mishap by CrowdStrike that led to significant financial losses and operational disruptions, including 5.4 billion in estimated losses.
  • Vendor Accountability: Exploring the legal and financial repercussions of security vendor failures.
  • Business Continuity Planning: The importance of preparing for security vendor failures, including considering alternate vendors and the complexities of implementing such strategies.
  • Kernel-Level Security Risks: A discussion surrounding kernel-level operations in security software, focusing on the controversy between CrowdStrike and SentinelOne.
  • Manual Workarounds and Legacy Systems: The challenges of maintaining business operations during security incidents.
  • Ransomware Recovery vs. Vendor Failures: Comparing ransomware attacks' impact and recovery processes with security vendor-induced failures.
  • Password Management Vulnerabilities: The risks associated with dependency on password management systems like Thycotic/Delinea and LastPass, and the potential fallout if these systems experience downtime.
  • BSides Pittsburgh Recap: the biggest BSidesPGH event yet. Hear the notes and highlights from the conference.
  • North Korean Spy Hired By KnowBe4: Hear how a spy for N. Korea got by the defenses of KnowBe4, how they caught them, and steps they implemented to avoid this in the future.
  • CISOs as Scapegoats: Are CISOs being pegged as scapegoats unfairly?


Links


Spirits


Hosts

  • Justin Leapline - https://www.linkedin.com/in/justinleapline/
  • Joe Wynn - https://www.linkedin.com/in/wynnjoe/
  • Rick Yocum - https://www.linkedin.com/in/rickyocum/


Connect with Us

  • Website: https://distilledsecuritypodcast.com
  • Twitter: @DisSecPod
  • Email: hello@distilledsecuritypodcast.com
]]>https://share.transistor.fm/s/5adb7b9c354387de-5749-4afc-95a6-4b0aedb71809Mon, 12 Aug 2024 18:32:56 GMT<p><strong>Episode 3 of the Distilled Security Podcast is here!</strong></p><p><br />Join us this week as we jump into: </p><p><br /></p><ul><li><strong>CrowdStrike Incident Analysis:</strong> A deep dive into a recent mishap by CrowdStrike that led to significant financial losses and operational disruptions, including 5.4 billion in estimated losses.</li><li><strong>Vendor Accountability:</strong> Exploring the legal and financial repercussions of security vendor failures.</li><li><strong>Business Continuity Planning:</strong> The importance of preparing for security vendor failures, including considering alternate vendors and the complexities of implementing such strategies.</li><li><strong>Kernel-Level Security Risks:</strong> A discussion surrounding kernel-level operations in security software, focusing on the controversy between CrowdStrike and SentinelOne.</li><li><strong>Manual Workarounds and Legacy Systems:</strong> The challenges of maintaining business operations during security incidents.</li><li><strong>Ransomware Recovery vs. Vendor Failures:</strong> Comparing ransomware attacks' impact and recovery processes with security vendor-induced failures.</li><li><strong>Password Management Vulnerabilities:</strong> The risks associated with dependency on password management systems like Thycotic/Delinea and LastPass, and the potential fallout if these systems experience downtime.</li><li><strong>BSides Pittsburgh Recap:</strong> the biggest BSidesPGH event yet. Hear the notes and highlights from the conference.</li><li><strong>North Korean Spy Hired By KnowBe4:</strong> Hear how a spy for N. Korea got by the defenses of KnowBe4, how they caught them, and steps they implemented to avoid this in the future.</li><li><strong>CISOs as Scapegoats:</strong> Are CISOs being pegged as scapegoats unfairly?</li></ul><p><br /><strong>Links</strong></p><ul><li>Crowdstrike Incident - <a href="https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/" rel="noopener noreferrer nofollow">https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/</a></li><li>SentinelOne Response to Crowdstrike - SentinalOne on Crowdstrike Outage -<a href="https://www.crn.com/news/security/2024/sentinelone-ceo-on-crowdstrike-outage-not-just-an-honest-mistake" rel="noopener noreferrer nofollow"> https://www.crn.com/news/security/2024/sentinelone-ceo-on-crowdstrike-outage-not-just-an-honest-mistake</a></li><li>BSidesPGH - <a href="https://www.bsidespgh.com/" rel="noopener noreferrer nofollow">https://www.bsidespgh.com/</a></li><li>TRISS - <a href="https://www.threeriversinfosec.com/" rel="noopener noreferrer nofollow">https://www.threeriversinfosec.com/</a></li><li>KnowBe4 // N. Korean Spy - <a href="https://blog.knowbe4.com/cyberheistnews-vol-14-31-how-the-whole-world-now-knows-about-fake-north-korean-it-workers" rel="noopener noreferrer nofollow">https://blog.knowbe4.com/cyberheistnews-vol-14-31-how-the-whole-world-now-knows-about-fake-north-korean-it-workers</a></li><li>CISO as Scapegoats - <a href="https://www.thestack.technology/were-becoming-scapegoats-how-have-cisos-responded-to-sec-cyber-risk-disclosure-rules/" rel="noopener noreferrer nofollow">https://www.thestack.technology/were-becoming-scapegoats-how-have-cisos-responded-to-sec-cyber-risk-disclosure-rules/</a></li></ul><p><br /><strong>Spirits</strong></p><ul><li>Rabbit Hole Cavehill // Four Grain Tripple Malt - <a href="https://www.rabbitholedistillery.com/pages/cavehill/" rel="noopener noreferrer nofollow">https://www.rabbitholedistillery.com/pages/cavehill/</a></li></ul><p><br /></p><p><strong>Hosts</strong></p><ul><li>Justin Leapline - https://www.linkedin.com/in/justinleapline/</li><li>Joe Wynn - https://www.linkedin.com/in/wynnjoe/</li><li>Rick Yocum - https://www.linkedin.com/in/rickyocum/</li></ul><p><br /></p><p><strong>Connect with Us</strong></p><ul><li>Website: https://distilledsecuritypodcast.com</li><li>Twitter: @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul>no01:10:523Episode 3: Crowdstrike, North Korean Spies, and CISO Scapegoatsfull<![CDATA[Episode 22: Is AI Good for Security, CIRCIA Starts the Clock, and the M&A Problem Nobody's Talking About]]>In this episode of the Distilled Security Podcast, we tackle four topics shaping the cybersecurity landscape — from AI's real impact on defense to a wave of regulatory and market changes every security team needs to be tracking.


🔹 Is AI Good for Security? — Anthropic's model finding hundreds of zero days, stock market panic after Claude Code's launch (CrowdStrike down 11%), the "hard things easy, easy things hard" reality of AI, why human-out-of-the-loop isn't ready yet, the coming spike in vulnerability disclosures, and how defenders should be using AI for better hygiene

🔹 CIRCIA Final Rule (May 2026) — The federal incident reporting law hitting critical infrastructure, 72-hour incident and 24-hour ransom payment notification clocks, how "substantial cyber incident" triggers differ from materiality, mid-market companies falling in scope, overlapping timelines with HIPAA/SEC/state breach laws, and building your incident response playbook now

🔹 Protecting Yourself Against a Changing Compliance Landscape — CMMC Phase 2, HIPAA overhaul, CCPA audits all converging, why a unified security program beats framework-by-framework chasing, evidence over policy in audits, engineering continuous compliance through automation, and the reality of doing this without dedicated staff

🔹 Cybersecurity M&A / Consolidation Problem — Google acquiring Wiz for $32B, 10% of the cybersecurity industry changing hands, operational benefits of fewer vendors vs. pricing pressure and talent drain, the OneTrust "sticker on the side" integration warning, Cisco's Startup Studios model, and why consolidation only works if they don't break what made the acquisition special


🥃 Spirit Review: WhistlePig 12 Year Old World Rye

PA Fine Wine & Good Spirits Select — Finished in Madeira, Sauternes & Port barrels, 86 proof

https://www.whistlepigwhiskey.com/


📬 Send Us Your Questions!

ask@distilledsecuritypodcast.com


🎙️ Hosts

Justin Leapline – @justinleapline

Joe Wynn – @wynnjoe

Rick Yocum – @rickyocum


🌐 Connect with Us

Website: distilledsecuritypodcast.com

X: @DisSecPod

Email: hello@distilledsecuritypodcast.com


👍 Like, comment, and subscribe for weekly security and compliance insights.

]]>https://share.transistor.fm/s/d9902f4995d0eaf3-c55b-4a97-8845-620b308ca34bMon, 09 Mar 2026 15:41:17 GMT<p>In this episode of the Distilled Security Podcast, we tackle four topics shaping the cybersecurity landscape — from AI's real impact on defense to a wave of regulatory and market changes every security team needs to be tracking.</p><p><br /></p><p>🔹 Is AI Good for Security? — Anthropic's model finding hundreds of zero days, stock market panic after Claude Code's launch (CrowdStrike down 11%), the "hard things easy, easy things hard" reality of AI, why human-out-of-the-loop isn't ready yet, the coming spike in vulnerability disclosures, and how defenders should be using AI for better hygiene</p><p>🔹 CIRCIA Final Rule (May 2026) — The federal incident reporting law hitting critical infrastructure, 72-hour incident and 24-hour ransom payment notification clocks, how "substantial cyber incident" triggers differ from materiality, mid-market companies falling in scope, overlapping timelines with HIPAA/SEC/state breach laws, and building your incident response playbook now</p><p>🔹 Protecting Yourself Against a Changing Compliance Landscape — CMMC Phase 2, HIPAA overhaul, CCPA audits all converging, why a unified security program beats framework-by-framework chasing, evidence over policy in audits, engineering continuous compliance through automation, and the reality of doing this without dedicated staff</p><p>🔹 Cybersecurity M&amp;A / Consolidation Problem — Google acquiring Wiz for $32B, 10% of the cybersecurity industry changing hands, operational benefits of fewer vendors vs. pricing pressure and talent drain, the OneTrust "sticker on the side" integration warning, Cisco's Startup Studios model, and why consolidation only works if they don't break what made the acquisition special</p><p><br /></p><p>🥃 Spirit Review: WhistlePig 12 Year Old World Rye</p><p>PA Fine Wine &amp; Good Spirits Select — Finished in Madeira, Sauternes &amp; Port barrels, 86 proof</p><p>https://www.whistlepigwhiskey.com/</p><p><br /></p><p>📬 Send Us Your Questions!</p><p>ask@distilledsecuritypodcast.com</p><p><br /></p><p>🎙️ Hosts</p><p>Justin Leapline – @justinleapline</p><p>Joe Wynn – @wynnjoe</p><p>Rick Yocum – @rickyocum</p><p><br /></p><p>🌐 Connect with Us</p><p>Website: distilledsecuritypodcast.com</p><p>X: @DisSecPod</p><p>Email: hello@distilledsecuritypodcast.com</p><p><br /></p><p>👍 Like, comment, and subscribe for weekly security and compliance insights.</p>no01:56:2322Episode 22: Is AI Good for Security, CIRCIA Starts the Clock, and the M&A Problem Nobody's Talking Aboutfull<![CDATA[Episode 7: Certifications, Mentorship, and Auditor Missteps]]>Welcome to Episode 7 of the Distilled Security Podcast!

In this episode, hosts Justin, Rick, and Joe are joined by special guest Brandon Eckert to explore his fascinating journey in cybersecurity, share industry insights, and enjoy a fun debate on Thanksgiving favorites. Here’s what’s in store:

Topics Covered: 

🔹 Navigating a Career in Cybersecurity
Reflections on starting out in cybersecurity, overcoming challenges in small-town IT careers, and the role of certifications in shaping career success.

🔹 The Value of Certifications
How certifications like OSCP contribute to career growth, practical knowledge, and their relationship with networking and formal education.

🔹 Mentorship and the Pittsburgh Cybersecurity Community
The importance of fostering growth, mentoring local talent, and giving back to the Pittsburgh security community.

🔹 Networking vs. Certifications
A discussion on what matters more for career advancement and the unique benefits of each.

🔹 Auditor Stories and Lessons Learned
Hear hilarious and insightful tales from hospital audits, ethical dilemmas, and tips for managing challenging auditor experiences.

🔹 Business Continuity Challenges
How organizations can prepare for rare but impactful events, like solar flares, while building strong auditor relationships.

🔹 Thanksgiving Favorites
A lighthearted wrap-up featuring turkey tips, stuffing recipes, and the ultimate leftover turkey sandwich.

🔸 Links
Widow Jane Black Opal: https://widowjane.com/

🔸 Spirits
Widow Jane Black Opal
A rare blend of bourbons, each aged for at least 20 years and finished in Japanese Mizunara oak. Notes of toffee, plum, and tobacco make this whiskey an extraordinary treat.

🔸Hosts

🔸 Guest
🙋🏻‍♂️ Brandon Eckert

🎙 Connect with Us
Website: Distilled Security Podcast
X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

]]>https://share.transistor.fm/s/318c010adc6a6544-304f-4f45-b38b-1575be41c3ddTue, 10 Dec 2024 23:01:06 GMT<p><strong>Welcome to Episode 7 of the Distilled Security Podcast!<br /></strong><br /></p><p>In this episode, hosts Justin, Rick, and Joe are joined by special guest Brandon Eckert to explore his fascinating journey in cybersecurity, share industry insights, and enjoy a fun debate on Thanksgiving favorites. Here’s what’s in store:</p><p><strong>Topics Covered: <br /></strong><br /></p><p>🔹 <strong>Navigating a Career in Cybersecurity</strong><br />Reflections on starting out in cybersecurity, overcoming challenges in small-town IT careers, and the role of certifications in shaping career success.</p><p>🔹 <strong>The Value of Certifications</strong><br />How certifications like OSCP contribute to career growth, practical knowledge, and their relationship with networking and formal education.</p><p>🔹 <strong>Mentorship and the Pittsburgh Cybersecurity Community</strong><br />The importance of fostering growth, mentoring local talent, and giving back to the Pittsburgh security community.</p><p>🔹 <strong>Networking vs. Certifications</strong><br />A discussion on what matters more for career advancement and the unique benefits of each.</p><p>🔹 <strong>Auditor Stories and Lessons Learned</strong><br />Hear hilarious and insightful tales from hospital audits, ethical dilemmas, and tips for managing challenging auditor experiences.</p><p>🔹 <strong>Business Continuity Challenges</strong><br />How organizations can prepare for rare but impactful events, like solar flares, while building strong auditor relationships.</p><p>🔹 <strong>Thanksgiving Favorites</strong><br />A lighthearted wrap-up featuring turkey tips, stuffing recipes, and the ultimate leftover turkey sandwich.</p><p>🔸 Links<br />Widow Jane Black Opal: https://widowjane.com/</p><p>🔸 Spirits<br /><strong>Widow Jane Black Opal</strong><br />A rare blend of bourbons, each aged for at least 20 years and finished in Japanese Mizunara oak. Notes of toffee, plum, and tobacco make this whiskey an extraordinary treat.</p><p>🔸Hosts</p><ul><li><a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow">Justin Leapline</a> </li><li><a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow">Joe Wynn</a></li><li><a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow">Rick Yocum</a></li></ul><p>🔸 Guest<br />🙋🏻‍♂️ <a href="https://www.linkedin.com/in/brandon-eckert/" rel="noopener noreferrer nofollow">Brandon Eckert </a></p><p>🎙 Connect with Us<br />Website: <a href="https://distilledsecuritypodcast.com/" rel="noopener noreferrer nofollow">Distilled Security Podcast</a><br /> X: <a href="https://x.com/DisSecPod" rel="noopener noreferrer nofollow">@DisSecPod</a><br />Email: hello@distilledsecuritypodcast.com</p>no01:18:507Episode 7: Certifications, Mentorship, and Auditor Misstepsfull<![CDATA[Episode 18: TRISS Highlights, Cloud Chaos & SaaS Lessons Learned]]>In Episode 18 of the Distilled Security Podcast, Justin Leapline, Joe Wynn, and Rick Yokum recap their time at TRISS, share lessons on storytelling and women in tech, and break down the recent AWS us-east-1 DNS/DynamoDB outage, the Microsoft Front Door global disruption, and the F5 BIG-IP incident. 

🔍 We discuss:
- TRISS highlights: panels, community & storytelling
- “Breaking the glass ceiling” and unintentional bias in meetings
- AWS & Microsoft outages: risk, resilience & when multicloud matters
- F5 BIG-IP incident and supply chain risk
- Launching a GRC SaaS: episki’s journey, lessons & tradeoffs

🥃 Spirit of the episode
Penelope Bourbon – Project X (sherry cask finish)

⏱️ Timestamps
00:00 – 🥃 Intro & TRISS Recap — Highlights from TRISS: panels, community, and a keynote with Edward Norton

02:40 – 📖 The Power of Storytelling — Why empathy and narrative matter in cybersecurity leadership

04:40 – 👩‍💻 Women in Tech & Bias in Meetings — Real talk about unintentional bias and everyday experiences

20:34 – ☁️ AWS & Microsoft Outages — What happened and what it says about cloud resilience

49:38 - 🥃 Bourbon Break — Enjoying a glass of Penelope Project X

53:30 – 🔥 F5 BIG-IP Vulnerability — Supply chain risk and patching lessons

1:09:50 – 🚀 Launching episki (GRC SaaS) — Building simply, shipping fast, and learning from users

1:52:22 – 🧭 Reflections & Closing Thoughts — Culture, resilience, and what’s next

🎧 Hosts
Justin Leapline 
Joe Wynn 
Rick Yocum 

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X : @DisSecPod
Email: hello@distilledsecuritypodcast.com

]]>https://share.transistor.fm/s/728ba78cfdb51287-c9be-40a0-98fc-2f41aa332164Mon, 10 Nov 2025 20:47:21 GMT<p>In Episode 18 of the Distilled Security Podcast, Justin Leapline, Joe Wynn, and Rick Yokum recap their time at TRISS, share lessons on storytelling and women in tech, and break down the recent AWS us-east-1 DNS/DynamoDB outage, the Microsoft Front Door global disruption, and the F5 BIG-IP incident. </p><p>🔍 We discuss:<br />- TRISS highlights: panels, community &amp; storytelling<br />- “Breaking the glass ceiling” and unintentional bias in meetings<br />- AWS &amp; Microsoft outages: risk, resilience &amp; when multicloud matters<br />- F5 BIG-IP incident and supply chain risk<br />- Launching a GRC SaaS: episki’s journey, lessons &amp; tradeoffs</p><p>🥃 Spirit of the episode<br />Penelope Bourbon – Project X (sherry cask finish)</p><p>⏱️ Timestamps<br />00:00 – 🥃 Intro &amp; TRISS Recap — Highlights from TRISS: panels, community, and a keynote with Edward Norton</p><p>02:40 – 📖 The Power of Storytelling — Why empathy and narrative matter in cybersecurity leadership</p><p>04:40 – 👩‍💻 Women in Tech &amp; Bias in Meetings — Real talk about unintentional bias and everyday experiences</p><p>20:34 – ☁️ AWS &amp; Microsoft Outages — What happened and what it says about cloud resilience</p><p>49:38 - 🥃 Bourbon Break — Enjoying a glass of Penelope Project X</p><p>53:30 – 🔥 F5 BIG-IP Vulnerability — Supply chain risk and patching lessons</p><p>1:09:50 – 🚀 Launching episki (GRC SaaS) — Building simply, shipping fast, and learning from users</p><p>1:52:22 – 🧭 Reflections &amp; Closing Thoughts — Culture, resilience, and what’s next</p><p>🎧 Hosts<br />Justin Leapline <br />Joe Wynn <br />Rick Yocum </p><p>🌐 Connect with Us<br />Website: distilledsecuritypodcast.com<br />X : @DisSecPod<br />Email: hello@distilledsecuritypodcast.com</p>no01:53:1718Episode 18: TRISS Highlights, Cloud Chaos & SaaS Lessons Learnedfull<![CDATA[Episode 10: Navigating Budget Cuts, Talent Shortages, and Cybersecurity Resilience]]>Episode 10 of the Distilled Security Podcast is here!

Join us as we explore:

  • Security in Times of Budget Cuts: How organizations can navigate layoffs and reduced funding while maintaining a strong security posture.
  • The Cybersecurity Talent Shortage: Why security hiring remains challenging, the need for apprenticeship models, and how organizations can develop internal talent pipelines.
  • BSides Pittsburgh: Put this on your calendar and submit talks.
  • Cyber Crisis Readiness: The importance of C-suite participation in tabletop exercises and cyber incident planning.

References 

  • Early Education by David Barton - https://www.youtube.com/watch?v=io-O59eakMk
  • BSides Pittsburgh CFP - https://www.bsidespgh.com/cfp

Spirits: Lady of the Glen – A 10-year-old cask strength Scotch whisky finished in Oloroso sherry casks.

Hosts

Connect with Us

]]>https://share.transistor.fm/s/706367f1062c58cd-c5fe-4593-83ce-bda5d0a39ad2Wed, 12 Mar 2025 14:08:32 GMT<p>Episode 10 of the Distilled Security Podcast is here!</p><p>Join us as we explore:</p><ul><li>Security in Times of Budget Cuts: How organizations can navigate layoffs and reduced funding while maintaining a strong security posture.</li><li>The Cybersecurity Talent Shortage: Why security hiring remains challenging, the need for apprenticeship models, and how organizations can develop internal talent pipelines.</li><li>BSides Pittsburgh: Put this on your calendar and submit talks.</li><li>Cyber Crisis Readiness: The importance of C-suite participation in tabletop exercises and cyber incident planning.</li></ul><p><strong>References</strong> </p><ul><li>Early Education by David Barton - https://www.youtube.com/watch?v=io-O59eakMk</li><li>BSides Pittsburgh CFP - https://www.bsidespgh.com/cfp</li></ul><p><strong>Spirits:</strong> Lady of the Glen – A 10-year-old cask strength Scotch whisky finished in Oloroso sherry casks.</p><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul>no01:34:2410Episode 10: Navigating Budget Cuts, Talent Shortages, and Cybersecurity Resiliencefull<![CDATA[Episode 12: One Year of Distilled Security, Auditor Quality, and Starting Your Own Company]]>Join us as we reflect on:

  • One Year of Podcasting: The crew celebrates a full year of episodes, favorite topics, behind-the-scenes production, and where the show is headed next—including a new studio setup and future sponsors.
  • Audit Quality and Risk: A deep dive into the evolution of cybersecurity audits, the growing influence of low-cost providers, and what actually makes an audit valuable and trustworthy.
  • Third-Party Risk Management: How companies can assess vendor SOC 2 reports, triage risk among their vendors, and build defensible compliance practices.
  • Operational vs. Commercial Risk: The importance of translating audit findings into business impact and strengthening vendor partnerships for long-term resilience.
  • Bourbon Review – Jefferson’s Tropics: A tasting of a tropical-aged bourbon matured in Singapore’s climate, featuring notes of toffee and spice.
  • BSides Pittsburgh Update: Details on ticket sales, sponsor opportunities, and how to get involved with the local security community’s flagship event.
  • Entrepreneurship & Starting a Business: A thoughtful discussion on what it really takes to start your own business—when to consider it, how to prepare, and why it’s often more work (and growth) than expected.


Hosts

Connect with Us

]]>https://share.transistor.fm/s/1ca210ed288c449c-8ce5-4182-809c-6fe502492dd3Fri, 02 May 2025 15:06:29 GMT<p><strong>Join us as we reflect on:</strong></p><ul><li><strong>One Year of Podcasting</strong>: The crew celebrates a full year of episodes, favorite topics, behind-the-scenes production, and where the show is headed next—including a new studio setup and future sponsors.</li><li><strong>Audit Quality and Risk</strong>: A deep dive into the evolution of cybersecurity audits, the growing influence of low-cost providers, and what actually makes an audit valuable and trustworthy.</li><li><strong>Third-Party Risk Management</strong>: How companies can assess vendor SOC 2 reports, triage risk among their vendors, and build defensible compliance practices.</li><li><strong>Operational vs. Commercial Risk</strong>: The importance of translating audit findings into business impact and strengthening vendor partnerships for long-term resilience.</li><li><strong>Bourbon Review – </strong><a href="https://jeffersonsbourbon.com/whiskeys/jeffersons-tropics-bourbon/" rel="noopener noreferrer nofollow"><strong>Jefferson’s Tropics</strong></a>: A tasting of a tropical-aged bourbon matured in Singapore’s climate, featuring notes of toffee and spice.</li><li><strong>BSides Pittsburgh Update</strong>: Details on ticket sales, sponsor opportunities, and how to get involved with the local security community’s flagship event.</li><li><strong>Entrepreneurship &amp; Starting a Business</strong>: A thoughtful discussion on what it really takes to start your own business—when to consider it, how to prepare, and why it’s often more work (and growth) than expected.</li></ul><p><br /></p><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul>no01:38:1012Episode 12: One Year of Distilled Security, Auditor Quality, and Starting Your Own Companyfull<![CDATA[Episode 20 : 2026 Kickoff: Security Resolutions, Key Deadlines, and Don’t Mislead the Feds]]>
In the first episode of 2026, the Distilled Security team kicks off the year with a practical discussion on security priorities, key compliance dates to watch in 2026, and why misleading the government on cybersecurity compliance can have serious consequences.

The conversation focuses on simplifying security programs, returning to core fundamentals, and learning from real-world enforcement and regulatory cases. The episode closes with a holiday pour and a preview of format changes coming next.

⏱️ Timestamps

  • 0:00 Intro & episode overview
  • 0:33 2026 security resolutions: simplify & back to basics
  • 5:45 “Science projects”: removing emotion from decisions
  • 8:36 Justin’s goals: family, travel, business & AI workflows
  • 17:52 EOS + Atomic Habits workbook (goal planning)
  • 23:54 Key compliance dates to watch in 2026
  • 31:45 California privacy updates & risk assessments (CCPA)
  • 35:39 EU AI Act + NIS2 enforcement ramp-up
  • 42:48 Drink break: High West “A Midwinter Night’s Dram.”
  • 45:04 Don’t mislead the feds: FedRAMP, SolarWinds, CMMC—wrap-up to 1:20:12

 🎙️ Hosts

  • Justin Leapline – @justinleapline
  • Joe Wynn – @wynnjoe
  • Rick Yocum – @rickyocum


🌐 Connect with Us

  • Website: distilledsecuritypodcast.com
  • X:  @DisSecPod
  • Email: hello@distilledsecuritypodcast.com


🥃 Drink of the episode: High West A Midwinter Night’s Dram

]]>https://share.transistor.fm/s/6424117815e0c7a7-efea-4448-94f6-ae7c7a3ead3cMon, 26 Jan 2026 15:24:56 GMT<p><br />In the first episode of 2026, the Distilled Security team kicks off the year with a practical discussion on security priorities, key compliance dates to watch in 2026, and why misleading the government on cybersecurity compliance can have serious consequences.</p><p>The conversation focuses on simplifying security programs, returning to core fundamentals, and learning from real-world enforcement and regulatory cases. The episode closes with a holiday pour and a preview of format changes coming next.</p><p>⏱️ <strong>Timestamps</strong></p><ul><li>0:00 Intro &amp; episode overview</li><li>0:33 2026 security resolutions: simplify &amp; back to basics</li><li>5:45 “Science projects”: removing emotion from decisions</li><li>8:36 Justin’s goals: family, travel, business &amp; AI workflows</li><li>17:52 EOS + Atomic Habits workbook (goal planning)</li><li>23:54 Key compliance dates to watch in 2026</li><li>31:45 California privacy updates &amp; risk assessments (CCPA)</li><li>35:39 EU AI Act + NIS2 enforcement ramp-up</li><li>42:48 Drink break: High West “A Midwinter Night’s Dram.”</li><li>45:04 Don’t mislead the feds: FedRAMP, SolarWinds, CMMC—wrap-up to 1:20:12</li></ul><p><strong> 🎙️ Hosts</strong></p><ul><li>Justin Leapline – @justinleapline</li><li>Joe Wynn – @wynnjoe</li><li>Rick Yocum – @rickyocum</li></ul><p><br /><strong>🌐 Connect with Us</strong></p><ul><li>Website: distilledsecuritypodcast.com</li><li>X:  @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul><p><br />🥃 <strong>Drink of the episode: </strong>High West A Midwinter Night’s Dram</p>no01:20:2520Episode 20 : 2026 Kickoff: Security Resolutions, Key Deadlines, and Don’t Mislead the Fedsfull<![CDATA[Episode 15: Community Building, Art of Convincing, and GTD Strategies]]>🎙️ Welcome back to the Distilled Security Podcast!

In this episode, hosts Justin Leapline, Joe Wynn, and Rick Yocum sit down with James Ringold (Senior Security Cloud Solution Architect at Microsoft and President of ISSA Pittsburgh) to talk all about building stronger cybersecurity communities.

From the behind-the-scenes of BSides Pittsburgh 2025 to engaging the next generation through mentorship and student-led talks, this episode offers practical insights on how to grow inclusive, vendor-neutral spaces that truly support people in security.

Topics Covered

  • BSides Pittsburgh 2025 Highlights

What made this year’s event stand out — from arcade machines and pastries to great speakers and a welcoming atmosphere.

  • Running an Inclusive Security Chapter

Insights into leading ISSA Pittsburgh, maintaining momentum, and building a vendor-neutral space that feels open to everyone.

  • The Power of Consistency

Why showing up regularly and following through matters when growing a security community.

  • Mentoring the Next Generation

The importance of mentorship chains, student-led initiatives, and creating low-pressure environments for future leaders.

  • Engaging Students Beyond Attendance

How to get students truly involved, from submitting talks to building long-term relationships that support career growth.

  • Authenticity and Community Building

Why empathy, storytelling, and invitation—not pressure—are essential for creating lasting, supportive security ecosystems.

Timestamps:

00:00:00 – Intro & Guest Welcome
00:02:20 – BSides Pittsburgh 2025 Preview
00:24:10 – Building Inclusive Security Communities
00:41:20 – Mentorship & Student Talks
01:11:00 – Whiskey Tasting: Grand Traverse Distillery
01:33:00 – Growing Through Empathy & Local Leadership
01:48:30 – Final Reflections & Outro

Links

Hosts

Guest 


Connect with Us


]]>https://share.transistor.fm/s/00fd0bc1d718ab9c-92f0-4b8f-97af-42f3b9dc1167Wed, 06 Aug 2025 13:15:00 GMT<p><strong>🎙️ Welcome back to the Distilled Security Podcast!</strong></p><p>In this episode, hosts Justin Leapline, Joe Wynn, and Rick Yocum sit down with James Ringold (Senior Security Cloud Solution Architect at Microsoft and President of ISSA Pittsburgh) to talk all about building stronger cybersecurity communities.</p><p>From the behind-the-scenes of BSides Pittsburgh 2025 to engaging the next generation through mentorship and student-led talks, this episode offers practical insights on how to grow inclusive, vendor-neutral spaces that truly support people in security.</p><p><strong>Topics Covered</strong></p><ul><li><strong>BSides Pittsburgh 2025 Highlights</strong></li></ul><p>What made this year’s event stand out — from arcade machines and pastries to great speakers and a welcoming atmosphere.</p><ul><li><strong>Running an Inclusive Security Chapter</strong></li></ul><p>Insights into leading ISSA Pittsburgh, maintaining momentum, and building a vendor-neutral space that feels open to everyone.</p><ul><li><strong>The Power of Consistency</strong></li></ul><p>Why showing up regularly and following through matters when growing a security community.</p><ul><li><strong>Mentoring the Next Generation</strong></li></ul><p>The importance of mentorship chains, student-led initiatives, and creating low-pressure environments for future leaders.</p><ul><li><strong>Engaging Students Beyond Attendance</strong></li></ul><p>How to get students truly involved, from submitting talks to building long-term relationships that support career growth.</p><ul><li><strong>Authenticity and Community Building</strong></li></ul><p>Why empathy, storytelling, and invitation—not pressure—are essential for creating lasting, supportive security ecosystems.</p><p><strong>Timestamps:</strong></p><p>00:00:00 – Intro &amp; Guest Welcome<br /> 00:02:20 – BSides Pittsburgh 2025 Preview<br /> 00:24:10 – Building Inclusive Security Communities<br /> 00:41:20 – Mentorship &amp; Student Talks<br /> 01:11:00 – Whiskey Tasting: Grand Traverse Distillery<br /> 01:33:00 – Growing Through Empathy &amp; Local Leadership<br /> 01:48:30 – Final Reflections &amp; Outro</p><p><strong>Links</strong></p><ul><li><a href="https://pittsburghissa.org/" rel="noopener noreferrer nofollow">ISSA Pittsburgh</a></li><li><a href="https://www.bsidespgh.com/" rel="noopener noreferrer nofollow">BSides Pittsburgh</a></li></ul><p><strong>Hosts</strong></p><ul><li><a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow">Justin Leapline </a></li><li><a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow">Joe Wynn </a> </li><li><a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow">Rick Yocum </a></li></ul><p><strong>Guest </strong></p><ul><li><a href="https://www.linkedin.com/in/jamesringold/" rel="noopener noreferrer nofollow">James Ringold</a></li></ul><p><br /><strong>Connect with Us</strong></p><ul><li>Website: <a href="https://distilledsecuritypodcast.com/" rel="noopener noreferrer nofollow">distilledsecuritypodcast.com</a></li><li>Twitter: @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul><p><br /></p>no01:54:2115Episode 15: Community Building, Art of Convincing, and GTD Strategiesfull<![CDATA[Distilled Security Podcast Trailer]]>Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.

]]>https://share.transistor.fm/s/893e842bb5a39468-b8a6-4924-a7de-48b989e6d06eSun, 02 Jun 2024 00:52:35 GMT<p>Join us on Distilled Security as we delve into the fascinating world of cybersecurity. Each episode, we break down intriguing topics, analyze the latest news, and engage in in-depth conversations with our hosts and invited guests. Whether you're a seasoned professional or just curious about cybersecurity, our podcast offers valuable insights and thought-provoking discussions to keep you informed and entertained. Tune in and stay ahead of the curve in the ever-evolving landscape of cybersecurity.</p>no00:00:451Distilled Security Podcast Trailertrailer<![CDATA[Episode 5: Resume Reviews, Counter-Espionage, and Incident Response]]>Join hosts Justin, Rick, and Joe as they cover:

  • Resume Review Insights: Joe offers valuable tips on resume writing, focusing on showcasing accomplishments and using metrics to stand out.
  • Passion Projects and Hobbies: The team discusses how personal projects and volunteer work can make resumes more compelling by demonstrating a passion for the field.
  • Community Engagement at TRISS: The hosts invite listeners to their booth at the upcoming Three Rivers Information Security Symposium (TRISS), where they will be offering resume reviews and engaging with attendees.
  • Counter-Espionage and Pagers: A fascinating look at the use of pagers in recent counter-espionage operations, analyzing their effectiveness and ethical concerns.
  • Supply Chain Security Concerns: A discussion on the risks tied to supply chain vulnerabilities, focusing on hardware inspections.
  • Tabletop Exercises in Cybersecurity: The hosts highlight the importance of tabletop exercises to prepare organizations for security incidents, contrasting them with current trends in incident response training.
  • School Violence Threats: An examination of the rise in school violence threats and the challenges schools face in managing these situations.

Links

Spirits

  • Boone 1833 12-Year-Old, Snyder's Flask (discontinued) - https://boonedistilling.com/

Hosts

Connect with Us


]]>https://share.transistor.fm/s/1fdca557c0e394bd-00bf-414a-b9a7-cb666bad576cWed, 02 Oct 2024 22:50:22 GMT<p>Join hosts Justin, Rick, and Joe as they cover:</p><ul><li><strong>Resume Review Insights:</strong> Joe offers valuable tips on resume writing, focusing on showcasing accomplishments and using metrics to stand out.</li><li><strong>Passion Projects and Hobbies:</strong> The team discusses how personal projects and volunteer work can make resumes more compelling by demonstrating a passion for the field.</li><li><strong>Community Engagement at TRISS</strong>: The hosts invite listeners to their booth at the upcoming Three Rivers Information Security Symposium (TRISS), where they will be offering resume reviews and engaging with attendees.</li><li><strong>Counter-Espionage and Pagers</strong>: A fascinating look at the use of pagers in recent counter-espionage operations, analyzing their effectiveness and ethical concerns.</li><li><strong>Supply Chain Security Concerns:</strong> A discussion on the risks tied to supply chain vulnerabilities, focusing on hardware inspections.</li><li><strong>Tabletop Exercises in Cybersecurity</strong>: The hosts highlight the importance of tabletop exercises to prepare organizations for security incidents, contrasting them with current trends in incident response training.</li><li><strong>School Violence Threats:</strong> An examination of the rise in school violence threats and the challenges schools face in managing these situations.</li></ul><p><strong>Links</strong></p><ul><li><a href="https://www.threeriversinfosec.com/" rel="noopener noreferrer nofollow">Three Rivers Information Security Symposium (TRISS)</a></li><li><a href="https://www.dhs.gov/sites/default/files/2024-09/2024aepphasellusmaritimetradeandportcybersecurity.pdf" rel="noopener noreferrer nofollow">US Maritime Trade and Port Cybersecurity</a></li></ul><p><strong>Spirits</strong></p><ul><li>Boone 1833 12-Year-Old, Snyder's Flask (discontinued) - https://boonedistilling.com/</li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com</li></ul><p><br /></p>no01:03:395Episode 5: Resume Reviews, Counter-Espionage, and Incident Responsefull<![CDATA[Episode 11: Encrypted Messaging, Data Breaches, and Vulnerability Management]]>Episode 11 of the Distilled Security Podcast is here!


Join us as we cover:

  • Signal, Encrypted Messaging, and Corporate Policy: A deep dive into the use of Signal in sensitive discussions—including a political mishap—and the implications for corporate communication policies, discovery, and compliance.
  • Oracle Cloud Breach Allegations: Evaluating breach claims, early response tactics, and the value of proactive key and credential rotation.
  • DNA Data, 23andMe, and Privacy Concerns: With 23andMe filing for bankruptcy, the team explores risks associated with sharing genetic data and broader privacy implications when personal information changes hands.
  • Hospital Data as Business Assets: A surprising look at how some companies are buying bankrupt hospitals—primarily for access to their medical datasets.
  • Vulnerability Management in the Real World: Tips on building practical, risk-based vulnerability management programs, understanding scanner severity versus real-world risk, and developing responsive processes that scale.

Spirits: 

  • Calumet Farm Small Batch Bourbon Whiskey https://www.calumetbourbon.com/smallbatch

Hosts

Connect with Us

]]>https://share.transistor.fm/s/8076fdc044253fb4-b339-4dee-8254-de1eb2078102Mon, 14 Apr 2025 13:45:00 GMT<p><strong>Episode 11 of the Distilled Security Podcast is here!</strong></p><p><br /><strong>Join us as we cover:</strong></p><ul><li>Signal, Encrypted Messaging, and Corporate Policy: A deep dive into the use of Signal in sensitive discussions—including a political mishap—and the implications for corporate communication policies, discovery, and compliance.</li><li>Oracle Cloud Breach Allegations: Evaluating breach claims, early response tactics, and the value of proactive key and credential rotation.</li><li>DNA Data, 23andMe, and Privacy Concerns: With 23andMe filing for bankruptcy, the team explores risks associated with sharing genetic data and broader privacy implications when personal information changes hands.</li><li>Hospital Data as Business Assets: A surprising look at how some companies are buying bankrupt hospitals—primarily for access to their medical datasets.</li><li>Vulnerability Management in the Real World: Tips on building practical, risk-based vulnerability management programs, understanding scanner severity versus real-world risk, and developing responsive processes that scale.</li></ul><p><strong>Spirits: </strong></p><ul><li>Calumet Farm Small Batch Bourbon Whiskey https://www.calumetbourbon.com/smallbatch</li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul>no01:30:0211Episode 11: Encrypted Messaging, Data Breaches, and Vulnerability Managementfull<![CDATA[Episode 19: Cloudflare Outage, AI-Powered Attacks & The Rise of GRC Engineering | Distilled Security Podcast]]>In this episode, we break down a major Cloudflare outage, explore how a nation-state used AI agents to automate a cyberattack, and discuss the growing risks around MCP integrations. We also highlight why GRC Engineering is becoming essential to modern security programs and wrap up with key regulatory updates, including CMMC changes affecting thousands of contractors.

Topics covered:
• Cloudflare outage impact and root cause
• Nation-state attack using AI agents to automate intrusion steps
• MCP (Model Context Protocol): power, risks, and examples
• Why GRC Engineering is the future of compliance and automation
• Updates on GDPR, ISO 27701, California AB 5866, and SEC rules
• CMMC assessor shortages and what organizations must prepare for

Spirit of the Episode
• Knob Creek 21-Year Limited Release, rich caramel notes, heavy char, smooth for 100 proof

Timestamps

  • 0:02—Cloudflare Outage Stories & Global Impact
  • 3:07—Root Cause, Not a Cyberattack & Third-Party Risk Reality
  • 10:38 - China Uses Anthropic’s Claude + MCP for Automated Cyberattacks
  • 14:17 - Full AI Attack Lifecycle Explained
  • 27:18 - MCP: The API for AI & Its Security Risks
  • 44:05 - Bourbon Break: Knob Creek 21-Year Review
  • 50:02 - GRC Engineering Deep Dive: Automation & Controls-as-Code
  • 1:24:13 - Regulatory Roundup: GDPR, ISO 27701, California AB 566, SEC SP
  • 1:44:27 - CMMC 2.0 Crisis: Auditor Shortages & DoD Contract Impact
  • 2:11:20 - Closing Thoughts & Episode Wrap-Up

Hosts

  • Justin Leapline – @justinleapline
  • Joe Wynn – @wynnjoe
  • Rick Yocum – @rickyocum

Guest

  • Matthew J. Schiavone - @Sikitch

Connect with Us

  • Website: distilledsecuritypodcast.com
  • X:  @DisSecPod
  • Email: hello@distilledsecuritypodcast.com
]]>https://share.transistor.fm/s/4bf68cf9cdca3c1c-aadb-40f8-992a-99aaae719e02Mon, 08 Dec 2025 14:00:00 GMT<p>In this episode, we break down a major Cloudflare outage, explore how a nation-state used AI agents to automate a cyberattack, and discuss the growing risks around MCP integrations. We also highlight why GRC Engineering is becoming essential to modern security programs and wrap up with key regulatory updates, including CMMC changes affecting thousands of contractors.</p><p><strong>Topics covered: </strong><br />• Cloudflare outage impact and root cause<br />• Nation-state attack using AI agents to automate intrusion steps<br />• MCP (Model Context Protocol): power, risks, and examples<br />• Why GRC Engineering is the future of compliance and automation<br />• Updates on GDPR, ISO 27701, California AB 5866, and SEC rules<br />• CMMC assessor shortages and what organizations must prepare for</p><p><strong>Spirit of the Episode</strong><br />• Knob Creek 21-Year Limited Release, rich caramel notes, heavy char, smooth for 100 proof</p><p><strong>Timestamps</strong></p><ul><li>0:02—Cloudflare Outage Stories &amp; Global Impact</li><li>3:07—Root Cause, Not a Cyberattack &amp; Third-Party Risk Reality</li><li>10:38 - China Uses Anthropic’s Claude + MCP for Automated Cyberattacks</li><li>14:17 - Full AI Attack Lifecycle Explained</li><li>27:18 - MCP: The API for AI &amp; Its Security Risks</li><li>44:05 - Bourbon Break: Knob Creek 21-Year Review</li><li>50:02 - GRC Engineering Deep Dive: Automation &amp; Controls-as-Code</li><li>1:24:13 - Regulatory Roundup: GDPR, ISO 27701, California AB 566, SEC SP</li><li>1:44:27 - CMMC 2.0 Crisis: Auditor Shortages &amp; DoD Contract Impact</li><li>2:11:20 - Closing Thoughts &amp; Episode Wrap-Up</li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline – @justinleapline</li><li>Joe Wynn – @wynnjoe</li><li>Rick Yocum – @rickyocum</li></ul><p><strong>Guest</strong></p><ul><li>Matthew J. Schiavone - @Sikitch</li></ul><p><strong>Connect with Us</strong></p><ul><li>Website: distilledsecuritypodcast.com</li><li>X:  @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul>no02:12:0919Episode 19: Cloudflare Outage, AI-Powered Attacks & The Rise of GRC Engineering | Distilled Security Podcastfull<![CDATA[Episode 2: Tailoring Security Frameworks & Leveraging AI]]>Episode 2 of the Distilled Security Podcast is here!


Join us this week as we jump into: 

  • Exploring the critical importance of tailoring security frameworks: Aligning with an organization's specific goals and objectives
  • Highlighting frameworks like NIST CSF and CIS to advance security programs effectively
  • Insights on aligning KPIs with the NIST CSF framework
  • Complementary use of frameworks like CIS to enhance security control measurement
  • Perspective on compliance and regulatory requirements
  • The role of AI in security programs
  • Threats posed by deepfakes: Incorporating safeguards to protect organizations from deepfake risks and effectively leverage AI within security programs

Chapters
00:00:00 - Introduction and Episode Overview
00:00:44 - Discussion on Security Frameworks
00:05:43 - Tailoring Frameworks
00:08:19 - Mapping and Compliance Challenges
00:17:16 - Tailoring for Small Organizations
00:19:15 - Upcoming Conferences
00:21:30 - Bourbon Review
00:25:00 - Audit Preparation Tips
00:27:02 - AI in Security
00:35:09 - Privacy Concerns with AI Toys
00:41:22 - Deepfakes in Security
01:05:59 - Closing Remarks

Links and references
https://securecontrolsframework.com

https://www.nist.gov/cyberframework

https://csrc.nist.gov/pubs/sp/1300/final

https://www.cisecurity.org/insights/white-papers/cis-controls-sme-guide

Drink
Whiskey Thief Door Knocker


Hosts

Connect with Us

]]>https://share.transistor.fm/s/e819c16734b0f39f-3807-4399-ad3d-932dfe5d2d41Mon, 08 Jul 2024 14:00:00 GMT<p><strong>Episode 2 of the Distilled Security Podcast is here!</strong></p><p><br />Join us this week as we jump into: </p><ul><li><strong>Exploring the critical importance of tailoring security frameworks:</strong> Aligning with an organization's specific goals and objectives</li><li><strong>Highlighting frameworks like NIST CSF and CIS</strong> to advance security programs effectively</li><li>Insights on aligning KPIs with the NIST CSF framework</li><li>Complementary use of frameworks like CIS to enhance security control measurement</li><li>Perspective on compliance and regulatory requirements</li><li>The role of AI in security programs</li><li><strong>Threats posed by deepfakes:</strong> Incorporating safeguards to protect organizations from deepfake risks and effectively leverage AI within security programs</li></ul><p><strong>Chapters</strong><br />00:00:00 - Introduction and Episode Overview<br />00:00:44 - Discussion on Security Frameworks<br />00:05:43 - Tailoring Frameworks<br />00:08:19 - Mapping and Compliance Challenges<br />00:17:16 - Tailoring for Small Organizations<br />00:19:15 - Upcoming Conferences<br />00:21:30 - Bourbon Review<br />00:25:00 - Audit Preparation Tips<br />00:27:02 - AI in Security<br />00:35:09 - Privacy Concerns with AI Toys<br />00:41:22 - Deepfakes in Security<br />01:05:59 - Closing Remarks</p><p><strong>Links and references</strong><br />https://securecontrolsframework.com</p><p>https://www.nist.gov/cyberframework</p><p>https://csrc.nist.gov/pubs/sp/1300/final</p><p>https://www.cisecurity.org/insights/white-papers/cis-controls-sme-guide</p><p><strong>Drink</strong><br />Whiskey Thief Door Knocker</p><p><a href="https://www.nist.gov/cyberframework" rel="noopener noreferrer nofollow"><br /></a><strong>Hosts</strong></p><ul><li>Justin Leapline - <a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/justinleapline/</a></li><li>Joe Wynn - <a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/wynnjoe/</a></li><li>Rick Yocum - <a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/rickyocum/</a></li></ul><p>Connect with Us</p><ul><li>Website: <a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow">https://distilledsecuritypodcast.com</a></li><li>Twitter: @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul>no01:05:202Episode 2: Tailoring Security Frameworks & Leveraging AIfull<![CDATA[Episode 4: Ethics in Cybersecurity, Career Development, and Data Protection]]>Episode 4: Ethics in Cybersecurity, Career Development, and Data Protection

In Episode 4, we are joined by Doug Salah to explore some critical topics in cybersecurity and career growth.


Key Topics

  • Doug Salah’s Cybersecurity Journey: His transition into cybersecurity and current role in the industry.
  • Networking in Cybersecurity: The value of building connections at cybersecurity conferences.
  • TRISS (Three Rivers Information Security Symposium): Insights into TRISS, its scholarships, and its impact on the community.
  • Mid-Career Development: Doug’s thoughts on transitioning mid-career, setting goals, and maintaining integrity.
  • Cybersecurity Ethics: A deep dive into ethics in the industry, ethical decision-making, and creating a Cyber Code of Honor.
  • The Four Agreements: How Doug relates his personal ethics to the principles in The Four Agreements.
  • Featured Spirit – Compass Box Spice Tree Scotch: A review of this week’s featured Scotch.
  • National Public Data Background Check Breach: Discussion of the recent breach and its implications for data protection.
  • Data Protection Tips: Tips on freezing credit and using services like Delete Me to protect personal data.

Links

Spirits

Hosts

Guest

Connect with Us

]]>https://share.transistor.fm/s/dfb0b1c76c9e6963-fad9-4692-82e7-42f39eb267c0Mon, 09 Sep 2024 15:02:18 GMT<p><strong>Episode 4: Ethics in Cybersecurity, Career Development, and Data Protection<br /></strong><br /></p><p>In Episode 4, we are joined by <strong>Doug Salah</strong> to explore some critical topics in cybersecurity and career growth.</p><p><br /><strong>Key Topics</strong></p><ul><li><strong>Doug Salah’s Cybersecurity Journey</strong>: His transition into cybersecurity and current role in the industry.</li><li><strong>Networking in Cybersecurity</strong>: The value of building connections at cybersecurity conferences.</li><li><strong>TRISS (Three Rivers Information Security Symposium)</strong>: Insights into TRISS, its scholarships, and its impact on the community.</li><li><strong>Mid-Career Development</strong>: Doug’s thoughts on transitioning mid-career, setting goals, and maintaining integrity.</li><li><strong>Cybersecurity Ethics</strong>: A deep dive into ethics in the industry, ethical decision-making, and creating a Cyber Code of Honor.</li><li><strong>The Four Agreements</strong>: How Doug relates his personal ethics to the principles in <em>The Four Agreements</em>.</li><li><strong>Featured Spirit – Compass Box Spice Tree Scotch</strong>: A review of this week’s featured Scotch.</li><li><strong>National Public Data Background Check Breach</strong>: Discussion of the recent breach and its implications for data protection.</li><li><strong>Data Protection Tips</strong>: Tips on freezing credit and using services like <em>Delete Me</em> to protect personal data.</li></ul><p><strong>Links</strong></p><ul><li><a href="https://www.threeriversinfosec.com/" rel="noopener noreferrer nofollow">Three Rivers Information Security Symposium (TRISS)</a> - <a href="https://www.threeriversinfosec.com/" rel="noopener noreferrer nofollow">https://www.threeriversinfosec.com/</a></li><li><a href="https://www.amazon.com/Four-Agreements-Practical-Personal-Freedom/dp/1878424319" rel="noopener noreferrer nofollow">The Four Agreements</a> - <a href="https://www.amazon.com/Four-Agreements-Practical-Personal-Freedom/dp/1878424319" rel="noopener noreferrer nofollow">https://www.amazon.com/Four-Agreements-Practical-Personal-Freedom/dp/1878424319</a></li><li><a href="https://joindeleteme.com/" rel="noopener noreferrer nofollow">Delete Me Service</a> - <a href="https://joindeleteme.com/" rel="noopener noreferrer nofollow">https://joindeleteme.com/</a></li><li><a href="https://cybercodeofhonor.com/" rel="noopener noreferrer nofollow">The Code Of Honor - Embracing Ethics in Cybersecurity</a></li></ul><p><strong>Spirits</strong></p><ul><li><a href="https://www.compassboxwhisky.com/products/the-spice-tree" rel="noopener noreferrer nofollow">Compass Box Spice Tree Scotch</a> - <a href="https://www.compassboxwhisky.com/products/the-spice-tree" rel="noopener noreferrer nofollow">https://www.compassboxwhisky.com/products/the-spice-tree</a></li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline - <a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/justinleapline/</a></li><li>Joe Wynn - <a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/wynnjoe/</a></li><li>Rick Yocum - <a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/rickyocum/</a></li></ul><p><strong>Guest</strong></p><ul><li>Doug Salah - <a href="https://www.linkedin.com/in/dougsalah/" rel="noopener noreferrer nofollow">https://www.linkedin.com/in/dougsalah/</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul>no01:13:254Episode 4: Ethics in Cybersecurity, Career Development, and Data Protectionfull<![CDATA[Episode 8: Whiskey, Quantum Computing, and Executive Protection]]>
🎙️ Episode 8 of the Distilled Security Podcast is here! 🔐🥃

🔎 Join us as we explore:

  • The Whiskey Rebellion and Craft Distilling: A dive into the history of the Whiskey Rebellion and what it means for today’s distillers. Learn about Iron City Distilling, creating national brand-quality spirits, and the significance of the Bessemer brand name.
  • Whiskey Craftsmanship: Insights into chamber still distillation, the balance of maturation versus aging, and premium craft whiskey production.
  • Executive Protection and Privacy: Strategies for workplace safety, reducing online risks, and managing personal branding in crises.
  • Quantum Computing Risks: A look at Google's Willow chip, the implications of quantum computing on cybersecurity, and the need for post-quantum cryptographic protocols.
  • Modern Password Challenges: Discussing the future of passwordless login, phishing risks, dark web breaches, and the evolving standards of password compliance.

🌟 Spirit: Iron City Distilling Distillers Reserve – A 6-Year Craft Masterpiece!

🎙️ Hosts

🤝 Guest


📲 Connect with Us

🕐 Time Stamps

[00:00:00] Introduction
[00:00:09] Eddie’s Career Transition
[00:03:00] Whiskey Rebellion and Craft Distilling
[00:06:00] Joining Iron City Distilling
[00:10:00] Unique Approach at Iron City Distilling
[00:19:00] Traditional Whiskey Making Process
[00:28:30] Executive Protection and Privacy
[00:39:00] Practical Security Measures for Executives
[00:50:00] Google’s Quantum Computing and Cybersecurity Risks
[00:57:00] Post-Quantum Cryptography
[01:06:00] Modern Password Practices
[01:20:00] Closing Thoughts

]]>https://share.transistor.fm/s/a9ba5dad398893b4-dcd3-4473-98a1-97800586bf36Tue, 07 Jan 2025 15:16:50 GMT<p><br />🎙️ Episode 8 of the Distilled Security Podcast is here! 🔐🥃</p><p>🔎 Join us as we explore:</p><ul><li><strong>The Whiskey Rebellion and Craft Distilling</strong>: A dive into the history of the Whiskey Rebellion and what it means for today’s distillers. Learn about Iron City Distilling, creating national brand-quality spirits, and the significance of the Bessemer brand name.</li><li><strong>Whiskey Craftsmanship</strong>: Insights into chamber still distillation, the balance of maturation versus aging, and premium craft whiskey production.</li><li><strong>Executive Protection and Privacy</strong>: Strategies for workplace safety, reducing online risks, and managing personal branding in crises.</li><li><strong>Quantum Computing Risks</strong>: A look at Google's Willow chip, the implications of quantum computing on cybersecurity, and the need for post-quantum cryptographic protocols.</li><li><strong>Modern Password Challenges</strong>: Discussing the future of passwordless login, phishing risks, dark web breaches, and the evolving standards of password compliance.<p></p></li></ul><p>🌟 <strong>Spirit: </strong>Iron City Distilling Distillers Reserve – A 6-Year Craft Masterpiece!</p><p><strong>🎙️ Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn<br /></a><br /></li></ul><p>🤝 <strong>Guest</strong></p><ul><li>Eddie Kubit -<a href="https://www.linkedin.com/in/eddie-kubit-28122b3/" rel="noopener noreferrer nofollow"> LinkedIn </a></li></ul><p><br /></p><p><strong>📲 Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul><p>🕐 Time Stamps</p><p>[00:00:00] Introduction<br />[00:00:09] Eddie’s Career Transition<br />[00:03:00] Whiskey Rebellion and Craft Distilling<br />[00:06:00] Joining Iron City Distilling<br />[00:10:00] Unique Approach at Iron City Distilling<br />[00:19:00] Traditional Whiskey Making Process<br />[00:28:30] Executive Protection and Privacy<br />[00:39:00] Practical Security Measures for Executives<br />[00:50:00] Google’s Quantum Computing and Cybersecurity Risks<br />[00:57:00] Post-Quantum Cryptography<br />[01:06:00] Modern Password Practices<br />[01:20:00] Closing Thoughts</p>no01:21:348Episode 8: Whiskey, Quantum Computing, and Executive Protectionfull<![CDATA[Episode 23: Nobody read the report]]>In this episode of the Distilled Security Podcast, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.

We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.

 Topics Covered

  • The Delve scandal—leaked reports, copy-pasted audits & pervasive deficiencies
  • The AICPA peer review process & AC Corp's adverse findings
  • SOC 2 vs ISO 27001—oversight models, witness audits & accreditation
  • The incentive structure driving compliance to the bottom
  • Compliance automation — what works, what doesn't & AI's real role
  • What to ask your auditor before signing anything
  • Trust centers — done right vs. compliance theater
  • Is SOC 2 dead? What needs to change & who has to change it


Hosts

  • Justin Leapline – @justinleapline
  • Joe Wynn – @wynnjoe
  • Rick Yocum – @rickyocum

Hosts

  • Matthew J. Schiavone - (Sikich) 


Connect with Us

  • Website: distilledsecuritypodcast.com
  • X:  @DisSecPod
  • Email: hello@distilledsecuritypodcast.com
]]>https://share.transistor.fm/s/2188c59d613b0d65-6a3e-4658-bdb0-4278efbfe070Tue, 14 Apr 2026 12:55:48 GMT<p>In this episode of the <em>Distilled Security Podcast</em>, we break down the Delve scandal—flawed SOC 2 reports, copy-pasted content, and oversight failures that expose deeper issues in compliance-as-a-service. Joined by Matthew J. Schiavone, we examine auditor accountability, quality review gaps, and key differences between SOC 2 and ISO 27001.</p><p>We also cover what companies should demand from auditors, the role of automation, and whether this scandal will drive real change in the industry.</p><p><strong> Topics Covered</strong></p><ul><li>The Delve scandal—leaked reports, copy-pasted audits &amp; pervasive deficiencies</li><li>The AICPA peer review process &amp; AC Corp's adverse findings</li><li>SOC 2 vs ISO 27001—oversight models, witness audits &amp; accreditation</li><li>The incentive structure driving compliance to the bottom</li><li>Compliance automation — what works, what doesn't &amp; AI's real role</li><li>What to ask your auditor before signing anything</li><li>Trust centers — done right vs. compliance theater</li><li>Is SOC 2 dead? What needs to change &amp; who has to change it</li></ul><p><br /></p><p><strong>Hosts</strong></p><ul><li>Justin Leapline – @justinleapline</li><li>Joe Wynn – @wynnjoe</li><li>Rick Yocum – @rickyocum</li></ul><p><strong>Hosts</strong></p><ul><li>Matthew J. Schiavone - (Sikich) </li></ul><p><br /><strong>Connect with Us</strong></p><ul><li>Website: distilledsecuritypodcast.com</li><li>X:  @DisSecPod</li><li>Email: hello@distilledsecuritypodcast.com</li></ul>no02:10:1023Episode 23: Nobody read the reportfull<![CDATA[Episode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRC]]>
Episode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRC



Episode 16 of the Distilled Security Podcast is here!


In this episode, Justin, Joe, and Rick christen the new studio and dive into some of the trickiest challenges in measuring, reporting, and governing security programs. From maturity models to board reporting, the conversation unpacks how scoring systems can mislead, how to communicate bad news effectively, and why boards need more than just “checkbox” cyber expertise.

The team also explores the rise of vGRC (Virtual GRC) services—what they are, how they differ from vCISO offerings, and when organizations should consider fractional models. And of course, no episode would be complete without a pour: this week, a rich Woodford Reserve Double Double Oaked bourbon.


Topics Covered

  • New Studio Upgrade: Behind-the-scenes on mics, cameras, and why the couch had to go.

  • Measuring to the Score: The dangers of chasing maturity numbers instead of real security outcomes.

  • Scoping, Rubrics & Auditor Whim: Why assessments are subjective and how leadership often misunderstands the results.

  • Cultural Incentives: How bonuses, compliance checkboxes, and “auditor shopping” distort security reporting.

  • Prepping for New Tools: Setting expectations with leadership when visibility spikes after deploying monitoring or vulnerability tools.

  • Boards and Cybersecurity Expertise: Should cyber knowledge be mandated at the board level—or does it risk creating the illusion of safety?

  • Virtual GRC vs. vCISO: What fractional GRC services really deliver, how they differ from vCISO roles, and why naming clarity matters.

  • Bourbon Review: Woodford Reserve Double Double Oaked — syrupy, smooth, and perfect for a holiday pour.

Hosts

  • Justin Leapline
  • Joe Wynn
  • Rick Yocum

Connect with Us
 🌐 Website: distilledsecuritypodcast.com
 🐦 Twitter: @DisSecPod
 📧 Email: hello@distilledsecuritypodcast.com


]]>https://share.transistor.fm/s/4999b41179330c8f-1b12-47e6-b529-6f1d085ae9d1Mon, 08 Sep 2025 13:58:00 GMT<p><strong><br />Episode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRC<br /></strong><br /></p><p><br /></p><p><strong><br />Episode 16 of the Distilled Security Podcast is here!</strong></p><p><br />In this episode, Justin, Joe, and Rick christen the new studio and dive into some of the trickiest challenges in measuring, reporting, and governing security programs. From maturity models to board reporting, the conversation unpacks how scoring systems can mislead, how to communicate bad news effectively, and why boards need more than just “checkbox” cyber expertise.</p><p>The team also explores the rise of <strong>vGRC (Virtual GRC) services</strong>—what they are, how they differ from vCISO offerings, and when organizations should consider fractional models. And of course, no episode would be complete without a pour: this week, a rich <strong>Woodford Reserve Double Double Oaked</strong> bourbon.</p><p><strong><br />Topics Covered</strong></p><ul><li><strong>New Studio Upgrade</strong>: Behind-the-scenes on mics, cameras, and why the couch had to go.<p></p></li><li><strong>Measuring to the Score</strong>: The dangers of chasing maturity numbers instead of real security outcomes.<p></p></li><li><strong>Scoping, Rubrics &amp; Auditor Whim</strong>: Why assessments are subjective and how leadership often misunderstands the results.<p></p></li><li><strong>Cultural Incentives</strong>: How bonuses, compliance checkboxes, and “auditor shopping” distort security reporting.<p></p></li><li><strong>Prepping for New Tools</strong>: Setting expectations with leadership when visibility spikes after deploying monitoring or vulnerability tools.<p></p></li><li><strong>Boards and Cybersecurity Expertise</strong>: Should cyber knowledge be mandated at the board level—or does it risk creating the illusion of safety?<p></p></li><li><strong>Virtual GRC vs. vCISO</strong>: What fractional GRC services really deliver, how they differ from vCISO roles, and why naming clarity matters.<p></p></li><li><strong>Bourbon Review</strong>: Woodford Reserve Double Double Oaked — syrupy, smooth, and perfect for a holiday pour.<p></p></li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline</li><li>Joe Wynn</li><li>Rick Yocum<p></p></li></ul><p><strong>Connect with Us<br /></strong> 🌐 Website:<a href="http://distilledsecuritypodcast.com?utm_source=chatgpt.com" rel="noopener noreferrer nofollow"> distilledsecuritypodcast.com<br /></a> 🐦 Twitter:<a href="https://twitter.com/DisSecPod?utm_source=chatgpt.com" rel="noopener noreferrer nofollow"> @DisSecPod<br /></a> 📧 Email: hello@distilledsecuritypodcast.com</p><p><br /></p>no01:53:5716Episode 16: When Metrics Mislead: Security Scoring, Board Gaps, and vGRCfull<![CDATA[Episode 13: Insider Threats, the CISO's Role, and Reporting Lines]]>Episode 13 of the Distilled Security Podcast is here!

Join us as we explore:

  • The Coinbase Breach: A breakdown of Coinbase’s recent insider-driven breach, including social engineering, bribery of offshore contractors, and how the company responded publicly and operationally.
  • Building Insider Threat Programs: The crew shares practical approaches to detecting insider misuse, behavioral monitoring, and the potential for "job descriptions as code."
  • CISO Liability and Insurance: Discussion on the evolving legal exposure for CISOs, personal liability, and whether directors and officers (D&O) insurance is a must-have.
  • Board-Level Cyber Risk: Should cybersecurity roll up to the audit committee or its own risk committee? The team explores where security leadership best fits in organizational governance.
  • Communication and Legal Risk: How careless comments—public or internal—can be used against organizations, and why CISOs and leaders must strike a balance between transparency and caution.
  • Modern Risk Management: Turning technical issues into business risk conversations, why documentation matters, and how strong risk communication can help CISOs avoid being scapegoated.
  • BSides Pittsburgh Update: With over 600 tickets already sold, the team gives updates on ticket tiers, t-shirts, speaker schedules, and why you should register by June 13.
  • Bourbon Review – Widow Jane Lucky 13: To celebrate episode 13, the crew samples Widow Jane Lucky 13—a smooth, toffee-forward bourbon aged 13 years.
  • Reporting Lines: Where and how security should be structured within the organization, from effectiveness to liability and more.

Hosts

Connect with Us

]]>https://share.transistor.fm/s/cfee33e43728a387-02d3-46af-8c4a-a70911b67d04Fri, 13 Jun 2025 12:37:31 GMT<p><strong>Episode 13 of the Distilled Security Podcast is here!</strong></p><p>Join us as we explore:</p><ul><li><strong>The Coinbase Breach</strong>: A breakdown of Coinbase’s recent insider-driven breach, including social engineering, bribery of offshore contractors, and how the company responded publicly and operationally.</li><li><strong>Building Insider Threat Programs</strong>: The crew shares practical approaches to detecting insider misuse, behavioral monitoring, and the potential for "job descriptions as code."</li><li><strong>CISO Liability and Insurance</strong>: Discussion on the evolving legal exposure for CISOs, personal liability, and whether directors and officers (D&amp;O) insurance is a must-have.</li><li><strong>Board-Level Cyber Risk</strong>: Should cybersecurity roll up to the audit committee or its own risk committee? The team explores where security leadership best fits in organizational governance.</li><li><strong>Communication and Legal Risk</strong>: How careless comments—public or internal—can be used against organizations, and why CISOs and leaders must strike a balance between transparency and caution.</li><li><strong>Modern Risk Management</strong>: Turning technical issues into business risk conversations, why documentation matters, and how strong risk communication can help CISOs avoid being scapegoated.</li><li><strong>BSides Pittsburgh Update</strong>: With over 600 tickets already sold, the team gives updates on ticket tiers, t-shirts, speaker schedules, and why you should register by June 13.</li><li><strong>Bourbon Review – Widow Jane Lucky 13</strong>: To celebrate episode 13, the crew samples Widow Jane Lucky 13—a smooth, toffee-forward bourbon aged 13 years.</li><li><strong>Reporting Lines</strong>: Where and how security should be structured within the organization, from effectiveness to liability and more.</li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com</li></ul>no01:22:4213Episode 13: Insider Threats, the CISO's Role, and Reporting Linesfull<![CDATA[Episode 1: College, Exec Comp, and New CISOs]]>Welcome to the first episode of Distilled Security!

Join us as we dive into a variety of exciting topics, including:

  • Is College Worth It?: We explore the value of higher education in today's world.
  • Microsoft and Executive Compensation: Analyzing cybersecurity in executive pay at Microsoft.
  • BSides Pittsburgh: Exciting talks are coming to BSidesPGH.
  • Starting as a New CISO: Things to do first coming into a new company.

Grab your favorite cocktail and tune in for an engaging and fun-filled discussion!


Hosts

  • Justin Leapline - https://www.linkedin.com/in/justinleapline/
  • Joe Wynn - https://www.linkedin.com/in/wynnjoe/
  • Rick Yocum - https://www.linkedin.com/in/rickyocum/

Connect with Us

  • Website: https://distilledsecuritypodcast.com
  • Twitter: @DisSecPod
  • Email: hello@distilledsecuritypodcast.com
]]>https://studio.youtube.com/video/6V0iXsWwdJ4771fcbbf-12a2-4d29-b7a9-b4fdfa7a101aFri, 07 Jun 2024 16:30:58 GMT<p><strong>Welcome to the first episode of Distilled Security!<br /></strong><br /></p><p>Join us as we dive into a variety of exciting topics, including:</p><ul><li><strong>Is College Worth It?</strong>: We explore the value of higher education in today's world.</li><li><strong>Microsoft and Executive Compensation</strong>: Analyzing cybersecurity in executive pay at Microsoft.</li><li><strong>BSides Pittsburgh</strong>: Exciting talks are coming to BSidesPGH.</li><li><strong>Starting as a New CISO</strong>: Things to do first coming into a new company.</li></ul><p>Grab your favorite cocktail and tune in for an engaging and fun-filled discussion!</p><p><br /><strong>Hosts</strong></p><ul><li>Justin Leapline - https://www.linkedin.com/in/justinleapline/</li><li>Joe Wynn - https://www.linkedin.com/in/wynnjoe/</li><li>Rick Yocum - https://www.linkedin.com/in/rickyocum/</li></ul><p><strong>Connect with Us</strong></p><ul><li><strong>Website:</strong> https://distilledsecuritypodcast.com</li><li><strong>Twitter:</strong> @DisSecPod</li><li><strong>Email:</strong> hello@distilledsecuritypodcast.com</li></ul>no01:05:091Episode 1: College, Exec Comp, and New CISOsfull<![CDATA[Episode 21: AI Notetakers Are Illegal, GRC Tools Are Lying, and ISO 42001 Changes Everything]]>In this episode of the Distilled Security Podcast, we break down three converging forces reshaping how organizations manage AI risk — and what you need to do about it now.

🔹 BIPA + AI Notetakers — A class action lawsuit exposes unauthorized biometric data collection, why a single Illinois meeting participant creates liability, the Shopify wiretapping dismissal, and the steps you should take today to audit your AI tools
🔹 GRC Engineering Meets AI — Real AI compliance tools vs. vaporware, using LLMs for policy drafting and control mapping, the hallucination accountability problem, building AI guardrails as code, and the NIST RFI on AI Agent Security (comments due March 9, 2026)
🔹 ISO 42001 Deep Dive — The first AI Management System standard, how it differs from ISO 27001, AI Impact Assessments vs. traditional risk assessments, stakeholder engagement requirements, and why certification is becoming essential for EU AI Act compliance

🥃 Spirit Review: Redbreast 12 Cask Strength
https://www.redbreastwhiskey.com/en-us/whiskey-collections/redbreast-cask-strength-whiskey/

⏱️ Timestamps

0:00 Intro & Episode Overview
2:04 BIPA & AI Notetakers
25:08 GRC Engineering Meets AI
1:07:15 🥃 Spirit Review: Redbreast 12 Cask Strength (Irish Whiskey)
1:11:17 ISO 42001
1:49:30 Outro & wrap-up

🎙️ Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for weekly security and compliance insights.

]]>https://share.transistor.fm/s/82f35a0ef34f64f0-5570-4f33-a35a-2a6ae93da6bcWed, 18 Feb 2026 14:54:37 GMT<p>In this episode of the Distilled Security Podcast, we break down three converging forces reshaping how organizations manage AI risk — and what you need to do about it now.</p><p>🔹 BIPA + AI Notetakers — A class action lawsuit exposes unauthorized biometric data collection, why a single Illinois meeting participant creates liability, the Shopify wiretapping dismissal, and the steps you should take today to audit your AI tools<br />🔹 GRC Engineering Meets AI — Real AI compliance tools vs. vaporware, using LLMs for policy drafting and control mapping, the hallucination accountability problem, building AI guardrails as code, and the NIST RFI on AI Agent Security (comments due March 9, 2026)<br />🔹 ISO 42001 Deep Dive — The first AI Management System standard, how it differs from ISO 27001, AI Impact Assessments vs. traditional risk assessments, stakeholder engagement requirements, and why certification is becoming essential for EU AI Act compliance</p><p>🥃 Spirit Review: Redbreast 12 Cask Strength<br />https://www.redbreastwhiskey.com/en-us/whiskey-collections/redbreast-cask-strength-whiskey/</p><p>⏱️ Timestamps</p><p>0:00 Intro &amp; Episode Overview<br />2:04 BIPA &amp; AI Notetakers<br />25:08 GRC Engineering Meets AI<br />1:07:15 🥃 Spirit Review: Redbreast 12 Cask Strength (Irish Whiskey)<br />1:11:17 ISO 42001<br />1:49:30 Outro &amp; wrap-up</p><p>🎙️ Hosts<br />Justin Leapline – @justinleapline<br />Joe Wynn – @wynnjoe<br />Rick Yocum – @rickyocum</p><p>🌐 Connect with Us<br />Website: distilledsecuritypodcast.com<br />X: @DisSecPod<br />Email: hello@distilledsecuritypodcast.com</p><p>👍 Like, comment, and subscribe for weekly security and compliance insights.</p>no01:50:3821Episode 21: AI Notetakers Are Illegal, GRC Tools Are Lying, and ISO 42001 Changes Everythingfull<![CDATA[Episode 9: Security Budgets, AI Risks, and Data Sovereignty]]>
Episode 9 of the Distilled Security Podcast is here!

Join us as we explore:

  • Security on a Budget: How teams can optimize tools, manage resource constraints, and build an effective security strategy with limited funding.
  • AI and Efficiency: The impact of AI on job performance, along with the risks of AI-powered note-taking and data classification.
  • Data Breaches & Industry Challenges: Lessons from Marriott’s data breaches, security concerns in the hospitality industry, and evolving consumer protection mandates.
  • Regulatory Shifts & Compliance: A discussion on HIPAA’s 2023 overhaul, required vs. addressable regulations, and the role of dual audits in compliance assurance.
  • Data Sovereignty & Government Oversight: How security teams navigate data sovereignty risks, government requests for information, and evolving security standards.
  • Multi-Factor Authentication & Risk Mitigation: The importance of MFA and its role in strengthening security posture is increasing.

Spirits

Hosts

References

2025 HIPAA Security Rule Guide and Compliance Checklist // https://www.seisollc.com/insights/2025-hipaa-rule-guide


Connect with Us

]]>https://share.transistor.fm/s/92dad8b8c6a7720b-5bcc-4839-bf28-4aefa4cfa308Thu, 06 Feb 2025 13:58:00 GMT<p><br /><strong><em>Episode 9</em></strong><strong> of the Distilled Security Podcast is here!</strong></p><p><strong>Join us as we explore:</strong></p><ul><li>Security on a Budget: How teams can optimize tools, manage resource constraints, and build an effective security strategy with limited funding.</li><li>AI and Efficiency: The impact of AI on job performance, along with the risks of AI-powered note-taking and data classification.</li><li>Data Breaches &amp; Industry Challenges: Lessons from Marriott’s data breaches, security concerns in the hospitality industry, and evolving consumer protection mandates.</li><li>Regulatory Shifts &amp; Compliance: A discussion on HIPAA’s 2023 overhaul, required vs. addressable regulations, and the role of dual audits in compliance assurance.</li><li>Data Sovereignty &amp; Government Oversight: How security teams navigate data sovereignty risks, government requests for information, and evolving security standards.</li><li>Multi-Factor Authentication &amp; Risk Mitigation: The importance of MFA and its role in strengthening security posture is increasing.</li></ul><p><strong>Spirits</strong></p><ul><li><a href="https://www.rabbitholedistillery.com/pages/single-barrel-release" rel="noopener noreferrer nofollow">Heigold Single Barrel Cask Strength </a>https://www.rabbitholedistillery.com/pages/single-barrel-release</li></ul><p><strong>Hosts</strong></p><ul><li>Justin Leapline -<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn -<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum -<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn</a></li></ul><p><strong>References</strong></p><p>2025 HIPAA Security Rule Guide and Compliance Checklist // https://www.seisollc.com/insights/2025-hipaa-rule-guide</p><p><br /><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> Distilled Security Podcast</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com<p></p></li></ul>no01:18:109Episode 9: Security Budgets, AI Risks, and Data Sovereigntyfull<![CDATA[Episode 17: TPRM Is Worthless?! NY DFS Part 500, Security Negotiation Tips & Mezcal]]>🎙️ Welcome back to the Distilled Security Podcast - Episode 17!


In this episode, Justin, Joe, and Rick break down several major cybersecurity and compliance updates shaping the landscape this fall. From regulatory deadlines to the futility of checkbox TPRM exercises, the crew dives deep into what actually matters for security leaders and business owners navigating today’s risk environment.


Also, join us at TRISS in Pittsburgh, PA, at the David this October 29,2025! We have our own booth and will be doing something fun there. Also, we are sponsoring the After Party! Please come say hi!


🔹 Topics Covered


NY DFS Part 500: Final Requirements Take Effect November 1

The hosts unpack the final phase of New York’s cybersecurity regulation, what’s changing, and what companies must have in place before the enforcement deadline.


Negotiating Security

How smaller companies can push back or reframe due diligence requirements—substituting a SOC 2 or ISO 27001 certification with custom questionnaires, summaries, or shared evidence that reflect real security maturity instead of checklists.


“TPRM Is Worthless”

A candid discussion on the state of third-party risk management: why it’s often broken, what needs to change, and how to make it meaningful rather than bureaucratic.


Department of War Announces New Cybersecurity Risk Management Construct

The team explores the DoD’s latest cybersecurity framework announcement—what it means for contractors, how it overlaps with CMMC and NIST 800-171, and whether it will actually simplify or complicate compliance.


🥃 Spirit Review


One of Us Mezcal — This small-batch mezcal impresses with its earthy smoke, hints of citrus, and smooth finish. The guys compare it to other craft agave spirits they’ve tried and debate whether it pairs better with a quiet evening or post-recording celebration.


Find it here:

https://oneofusmezcal.com/products/cuishe-mezcal-the-wild-one


⏱️ Timestamps


0:00 – Introduction & Travel Mishap

6:25 – New Laptop Twins & Backup Strategies

11:35 – NY DFS Part 500 Updates

27:30 – DFS Reporting & Organizational Accountability

33:30 – Negotiating Security Requirements

47:46 – Cultural Nuances in Negotiation

50:20 – Spirit Review: One of Us Mezcal

52:55 – TPRM Is Worthless?

57:50 – Fixing Broken Vendor Risk Workflows

1:08:21 – Vendor Resilience vs. Security

1:18:20 – New DoW/DoD Cybersecurity Risk Management Construct

1:35:06 - BSides Pittsburgh Planning & Sponsorship

1:38:35 - DSP at TRISS

1:39:51 – Closing Remarks & Outro


🎧 Hosts


Justin Leapline – @justinleapline

Joe Wynn – @wynnjoe

Rick Yocum – @rickyocum


🌐 Connect with Us


Website: distilledsecuritypodcast.com

🐦 Twitter: @DisSecPod

📧 Email: hello@distilledsecuritypodcast.com

]]>https://share.transistor.fm/s/cc06dded3590a4f4-a182-4738-87c8-7269289c4d79Mon, 13 Oct 2025 14:40:15 GMT<p>🎙️ Welcome back to the Distilled Security Podcast - Episode 17!</p><p><br /></p><p>In this episode, Justin, Joe, and Rick break down several major cybersecurity and compliance updates shaping the landscape this fall. From regulatory deadlines to the futility of checkbox TPRM exercises, the crew dives deep into what actually matters for security leaders and business owners navigating today’s risk environment.</p><p><br /></p><p>Also, join us at TRISS in Pittsburgh, PA, at the David this October 29,2025! We have our own booth and will be doing something fun there. Also, we are sponsoring the After Party! Please come say hi!</p><p><br /></p><p>🔹 Topics Covered</p><p><br /></p><p>NY DFS Part 500: Final Requirements Take Effect November 1</p><p>The hosts unpack the final phase of New York’s cybersecurity regulation, what’s changing, and what companies must have in place before the enforcement deadline.</p><p><br /></p><p>Negotiating Security</p><p>How smaller companies can push back or reframe due diligence requirements—substituting a SOC 2 or ISO 27001 certification with custom questionnaires, summaries, or shared evidence that reflect real security maturity instead of checklists.</p><p><br /></p><p>“TPRM Is Worthless”</p><p>A candid discussion on the state of third-party risk management: why it’s often broken, what needs to change, and how to make it meaningful rather than bureaucratic.</p><p><br /></p><p>Department of War Announces New Cybersecurity Risk Management Construct</p><p>The team explores the DoD’s latest cybersecurity framework announcement—what it means for contractors, how it overlaps with CMMC and NIST 800-171, and whether it will actually simplify or complicate compliance.</p><p><br /></p><p>🥃 Spirit Review</p><p><br /></p><p>One of Us Mezcal — This small-batch mezcal impresses with its earthy smoke, hints of citrus, and smooth finish. The guys compare it to other craft agave spirits they’ve tried and debate whether it pairs better with a quiet evening or post-recording celebration.</p><p><br /></p><p>Find it here:</p><p>https://oneofusmezcal.com/products/cuishe-mezcal-the-wild-one</p><p><br /></p><p>⏱️ Timestamps</p><p><br /></p><p>0:00 – Introduction &amp; Travel Mishap</p><p>6:25 – New Laptop Twins &amp; Backup Strategies</p><p>11:35 – NY DFS Part 500 Updates</p><p>27:30 – DFS Reporting &amp; Organizational Accountability</p><p>33:30 – Negotiating Security Requirements</p><p>47:46 – Cultural Nuances in Negotiation</p><p>50:20 – Spirit Review: One of Us Mezcal</p><p>52:55 – TPRM Is Worthless?</p><p>57:50 – Fixing Broken Vendor Risk Workflows</p><p>1:08:21 – Vendor Resilience vs. Security</p><p>1:18:20 – New DoW/DoD Cybersecurity Risk Management Construct</p><p>1:35:06 - BSides Pittsburgh Planning &amp; Sponsorship</p><p>1:38:35 - DSP at TRISS</p><p>1:39:51 – Closing Remarks &amp; Outro</p><p><br /></p><p>🎧 Hosts</p><p><br /></p><p>Justin Leapline – @justinleapline</p><p>Joe Wynn – @wynnjoe</p><p>Rick Yocum – @rickyocum</p><p><br /></p><p>🌐 Connect with Us</p><p><br /></p><p>Website: distilledsecuritypodcast.com</p><p>🐦 Twitter: @DisSecPod</p><p>📧 Email: hello@distilledsecuritypodcast.com</p>no01:40:4217Episode 17: TPRM Is Worthless?! NY DFS Part 500, Security Negotiation Tips & Mezcalfull<![CDATA[Episode 14: AI Risks, Threat Modeling, and The Future of Vibe Coding]]>Episode 14 of the Distilled Security Podcast is here!

This week, the team welcomes guest John Zeolla, a cybersecurity expert and AI enthusiast, for a deep dive into the risks, realities, and potential of artificial intelligence.


Topics include:

  • Shadow AI in the Enterprise: Why business leaders are adopting AI faster than CISOs can assess the risks—and how features are outpacing controls.

  • Third-Party AI Risk: Understanding vendor integrations with ChatGPT and others, and how contracts alone can’t guarantee security.

  • Data Sprawl and Provenance: How uncontrolled data flows and poor identity scoping create dangerous exposure in generative AI platforms.

  • Threat Modeling for AI: Why traditional frameworks like STRIDE still apply—and how techniques like “LLM as a judge” are reshaping modern risk analysis.

  • Hallucinations, Misuse, and Insider Access: From AI-summarized HR documents to leaked board data, the team explores how improper permissions are amplified by intelligent agents.

  • AI in Real Business Use: From customer support chatbots to code review tools, where AI adds value—and where it creates new points of failure.

  • Governance and Culture: The role of CISOs, legal, and finance leaders in aligning AI ambition with responsible oversight.

  • Bourbon Review – Elijah Craig Private Barrel Pick: A smooth 94-proof selection sponsored by Liberty Liquors (MD), bringing sweet caramel and balance to this week’s pour.

  • BSides Pittsburgh Preview: With nearly 1,000 tickets sold, the team teases event highlights, panel interviews, and John's upcoming talk on "vibe coding."


Timestamps

00:00 – Welcome & Introductions
02:20 – What’s “Shadow AI”?
06:45 – Third-Party Risk & AI Integrations
11:10 – Contracts ≠ Security
14:00 – Data Sprawl & Identity Challenges
19:05 – Threat Modeling for AI
23:40 – “LLM as a Judge” in Risk Analysis
28:15 – Hallucinations & Misuse Scenarios
33:00 – Insider Access Amplified by AI
36:30 – Real-World Use Cases (Chatbots, Code Review, etc.)
41:55 – Governance, Culture & CISO Alignment
48:20 – Bourbon Review: Elijah Craig Private Barrel
52:30 – BSides PGH Preview & John’s “Vibe Coding” Talk
57:00 – Final Thoughts & Wrap-Up


Hosts

Guest

Connect with Us


]]>https://share.transistor.fm/s/d3155aef82e985a3-fc5d-4255-8173-f0934c0f5c14Tue, 08 Jul 2025 14:30:23 GMT<p><strong>Episode 14 of the Distilled Security Podcast is here!</strong></p><p>This week, the team welcomes guest <strong>John Zeolla</strong>, a cybersecurity expert and AI enthusiast, for a deep dive into the risks, realities, and potential of artificial intelligence.</p><p><br />Topics include:</p><ul><li><strong>Shadow AI in the Enterprise</strong>: Why business leaders are adopting AI faster than CISOs can assess the risks—and how features are outpacing controls.<p></p></li><li><strong>Third-Party AI Risk</strong>: Understanding vendor integrations with ChatGPT and others, and how contracts alone can’t guarantee security.<p></p></li><li><strong>Data Sprawl and Provenance</strong>: How uncontrolled data flows and poor identity scoping create dangerous exposure in generative AI platforms.<p></p></li><li><strong>Threat Modeling for AI</strong>: Why traditional frameworks like STRIDE still apply—and how techniques like “LLM as a judge” are reshaping modern risk analysis.<p></p></li><li><strong>Hallucinations, Misuse, and Insider Access</strong>: From AI-summarized HR documents to leaked board data, the team explores how improper permissions are amplified by intelligent agents.<p></p></li><li><strong>AI in Real Business Use</strong>: From customer support chatbots to code review tools, where AI adds value—and where it creates new points of failure.<p></p></li><li><strong>Governance and Culture</strong>: The role of CISOs, legal, and finance leaders in aligning AI ambition with responsible oversight.<p></p></li><li><strong>Bourbon Review – Elijah Craig Private Barrel Pick</strong>: A smooth 94-proof selection sponsored by <strong>Liberty Liquors (MD)</strong>, bringing sweet caramel and balance to this week’s pour.<p></p></li><li><strong>BSides Pittsburgh Preview</strong>: With nearly 1,000 tickets sold, the team teases event highlights, panel interviews, and John's upcoming talk on "vibe coding."</li></ul><p><br /><strong>Timestamps</strong></p><p><a href="https://www.youtube.com/watch?v=L12uZJBGE7A" rel="noopener noreferrer nofollow">00:00</a> – Welcome &amp; Introductions<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=140s" rel="noopener noreferrer nofollow">02:20</a> – What’s “Shadow AI”?<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=405s" rel="noopener noreferrer nofollow">06:45</a> – Third-Party Risk &amp; AI Integrations<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=670s" rel="noopener noreferrer nofollow">11:10</a> – Contracts ≠ Security<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=840s" rel="noopener noreferrer nofollow">14:00</a> – Data Sprawl &amp; Identity Challenges<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=1145s" rel="noopener noreferrer nofollow">19:05</a> – Threat Modeling for AI<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=1420s" rel="noopener noreferrer nofollow">23:40</a> – “LLM as a Judge” in Risk Analysis<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=1695s" rel="noopener noreferrer nofollow">28:15</a> – Hallucinations &amp; Misuse Scenarios<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=1980s" rel="noopener noreferrer nofollow">33:00</a> – Insider Access Amplified by AI<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=2190s" rel="noopener noreferrer nofollow">36:30</a> – Real-World Use Cases (Chatbots, Code Review, etc.)<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=2515s" rel="noopener noreferrer nofollow">41:55</a> – Governance, Culture &amp; CISO Alignment<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=2900s" rel="noopener noreferrer nofollow">48:20</a> – Bourbon Review: Elijah Craig Private Barrel<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=3150s" rel="noopener noreferrer nofollow">52:30</a> – BSides PGH Preview &amp; John’s “Vibe Coding” Talk<br /><a href="https://www.youtube.com/watch?v=L12uZJBGE7A&amp;t=3420s" rel="noopener noreferrer nofollow">57:00</a> – Final Thoughts &amp; Wrap-Up</p><p><strong><br />Hosts</strong></p><ul><li>Justin Leapline –<a href="https://www.linkedin.com/in/justinleapline/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Joe Wynn –<a href="https://www.linkedin.com/in/wynnjoe/" rel="noopener noreferrer nofollow"> LinkedIn</a></li><li>Rick Yocum –<a href="https://www.linkedin.com/in/rickyocum/" rel="noopener noreferrer nofollow"> LinkedIn<br /></a><br /></li></ul><p><strong>Guest</strong></p><ul><li>John Zeolla –<a href="https://zenable.io" rel="noopener noreferrer nofollow"> Zenable.io<br /></a><br /></li></ul><p><strong>Connect with Us</strong></p><ul><li>Website:<a href="https://distilledsecuritypodcast.com" rel="noopener noreferrer nofollow"> distilledsecuritypodcast.com</a></li><li>Twitter:<a href="https://twitter.com/DisSecPod" rel="noopener noreferrer nofollow"> @DisSecPod</a></li><li>Email: hello@distilledsecuritypodcast.com</li></ul><p><br /></p>no01:22:3014Episode 14: AI Risks, Threat Modeling, and The Future of Vibe Codingfull