Why do so many of the advocates for AI in cybersecurity know so little about how AI actually works? Questions just one layer deep are met with blank stares. We don’t accept this with other technology sectors, yet it’s become commonplace for many AI security vendors and industry “experts.”

Check out this post by Christofer Hoff of Truist for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Caleb Sima, builder, WhiteRabbit. Joining us is Crystal Chatam, vp of cybersecurity, Speedcast.

Join the conversation on LinkedIn

Huge thanks to our sponsor, Stellar Cyber

Security tip of the week – Tenable

Jump to the full tip here.

To learn more about exposure management, go to tenable.com. 

Full Transcript

Intro

0:00.000

[David Spark] It seems like the bigger someone advocates for AI in cybersecurity, the less they know about how AI actually works. Why does it feel like the blind are leading the blind?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark. I’m the producer of the CISO Series. And joining me as my guest co-host, thrilled… By the way, we’ve had him as a guest many times, but now he’s a co-host. It’s none other than Caleb Sima, Builder over at WhiteRabbit.

Caleb, thank you so much for joining us.

[Caleb Sima] I’m glad to be here. Thank you for having me on. Very much excited to be a co-host. What is being a co-host to give me privileges of?

[David Spark] You get to speak earlier than the guest does. That’s pretty much what it is.

[Caleb Sima] Okay, great. Great. I just want to make sure I can use my privileges the best way possible.

[David Spark] All right. Our sponsor for today’s episode is Stellar Cyber, AI-driven SecOps platform purpose-built for MSSPs and lean enterprise security teams. That is Stellar Cyber. They’re our sponsor. More about just that a little bit later in the show.

But first, let me tell you about our topic.

And this is something I know is near and dear to your heart, Caleb, so that’s why I ask you to be the co-host. But let me set it up for our audience. AI is the new fabric of computing. We’re kind of all realizing that. And we’re all starting to accept it, even though our understanding of it is far from universal.

In fact, there are very few that truly understand the underpinnings. And Christofer Hoff of Truist suggested asking three basic questions that anyone who has developed an AI tool should know. And by the way, we have a link to this discussion on LinkedIn.

And he doesn’t do this in an effort to call someone up, but just to let you know you’re truly working with a person who is AI-knowledgeable, and not just someone regurgitating AI talking points. Now, by the way, Chris’s target for this post is a pseudonym called Bob, and you’ll hear that name multiple times through the day.

But Caleb, you’ve actually done something very similar to what Chris did in a post. And this is not the first time we’ve asked some basic “What do you know about this?”-type questions to make sure we’re talking to the real deal. You’ve run into this trap where you’ve heard people just regurgitate AI talking points, not really understanding.

Yes, Caleb?

[Caleb Sima] Of course. Yeah, of course. This is just the way the world works. AI is what you get budget for. So therefore, you just slap AI on everything, and then you get budget. So it’s like magic.

[David Spark] We would like it to be magic, wouldn’t we? But really, if you want to do work with someone who has an AI tool, there is some sort of, I guess, green and red flags to watch out for of, “Move towards this,” “Move away from that.” Yes?

[Caleb Sima] Yeah, I think there’s just basic things. I think both myself and Chris are probably much more around. This is not about trying to “got you” to a vendor per se. Like, let’s say you’re a buyer and you’re sort of evaluating whether a vendor truly is doing something AI-related.

It’s more about being curious and finding out truly what does make your product or solution AI, and what value does that specific capability in AI bring. That’s what’s really important to understand because… I’m just going to make random examples.

I can have a firewall. Well, I know what a firewall does today. Firewalls block bad, allow good, right, on a simplistic layer. Now, someone comes around and they say, “Well, we have an AI firewall.” It’ll be like, “Okay, can you tell me what that does?

What is so special now that makes it so that a AI firewall is better than a regular firewall? And can you help me understand?” And that, I think, is the key part that you need to question for.

[David Spark] That is a super good setup for this discussion, and I’m thrilled the guests we have, like you, hyper-passionate about this topic and hyper-passionate about getting away from the snake oil and getting to what the value is. Because there is value.

We know it is, and we want to find it. It is the VP of Cybersecurity for Speedcast, none other than Crystal Chatham. Crystal, thank you so much for joining us.

[Crystal Chatam] Hello. Thank you for having me.

How do I start?

4:07.847

[David Spark] Marcus J. Carey of ReliaQuest said, quote, “I always advise people trying to solve problems with LLMs to understand how machine learning works.” And Andreas Koch of Netskrt Systems said, quote, “There is also often a surprising tendency to gloss over the difference between predictive and generative AI.

While GenAI requires transformer models, deep learning, including transformers, may not be the optimal predictive AI approach.”

So both Andreas and Marcus are just saying it’s good to actually know what you’re dealing with on the underpinnings, which is kind of the core to what Christofer was saying in his post. You kind to want to know that you’re dealing with the real deal.

And not often you are when you’re dealing with a salesperson, are you, Caleb?

[Caleb Sima] No. And I don’t expect that a salesperson specifically is going to be the right person to ask this. But what they should be trained enough to know, they don’t need to know which model is better or not, whether generative is predictive, predictive is generative.

These are not the important things the salesperson needs to understand.

But what they do need to understand is what is it, going back to my previous example, about the AI piece that makes the firewall better, that could not be done before two years ago? As an example. And how is that value to the customer, and why I would want to say, “You’re right, just having a firewall is not good enough.

I need that AI part to that firewall.”

And I think a sales guy should be trained enough to be able to answer that without buzzwords, without waving magic, or saying things like, “Well, that’s our IP.” They need to be able to answer that value proposition clearly. And that’s what I think most people are getting frustrated with is most of the time that doesn’t happen.

They wave their arms around, throw out a bunch of acronyms that they don’t understand, hoping you don’t understand [Laughs]. And/or if you do, then saying, “Well, that’s just IP. That’s our secret sauce. We can’t talk about that.”

[David Spark] The line that I’ve heard, and I heard this a lot when I was at Black Cat interviewing vendors, is, “Well, we’re just better.” And I’m like, “Really? I don’t know.”

[Caleb Sima] “How?” [Laughs]

[David Spark] “How?” That’s my question. So, Crystal, I’m throwing this to you. I’m assuming you’ve run into this yourself. How do you sort decipher what the good of the AI is in whatever you’re looking at?

[Crystal Chatam] I’m going to piggyback off of what Caleb was saying, which I think were great points, which is going back to the sales person. You have predictive AI, agentic AI, generative AI, and several other types of AI that’s out there right now.

I do think that it’s important for a sales person to understand what exactly they are selling. Understand the product because one of the gifts that the sales person has is being able to understand what the problem is for that customer.

Of course, making sure that you’re understanding the bottom line, getting to the number, but also being able to communicate with that customer gives them a sense of feeling that they can trust you and that you understand what it is that they need in order to help resolve that issue.

For me, being in IT and cybersecurity for over 18 years, that’s one of the things that’s helped me as being able to understand. I may not know how to build the firewall from scratch, or I didn’t start by understanding the different rules of a firewall, but I at least was able to communicate it enough for me to do the job that I had, which was more so GRC initially in the beginning, but in turn grew to become more technical over time.

Can this problem get even more complicated?

7:58.696

Christofer Hoff of Truist, the author of the post that we’re talking about, said, quote, “He’s not managing a company,” and we’re referring to the Bob pseudonym character he was talking about here. “He’s standing on stage, taking credit for implementing technology he doesn’t understand, convincing others that if they don’t do the same, they are dinosaurs and repeating indefensible sound bites he read in a tweet.”

And Varun Ambrose of Akamai said, quote, “Sound like Bob’s,” again the pseudonym, “ego and wallet are totally in with the grift. No one should trust a mechanic who doesn’t know what’s under the hood, nor how it works.” And Eric Bloch of Illumio said, quote, “Take that one step further.

These “Bobs” are the one informing VC on the tech they invest in. It explains a lot.”

So I think what’s interesting about these three quotes, Crystal, is it says a lot about the cybersecurity industry that we’ve all seen before. And we’re kind of seeing it repeat itself again in AI. Your thoughts?

[Crystal Chatam] So my thoughts are being a leader and being someone with a vision doesn’t necessarily mean that you are the one that understands the engineering, or you understand the different language models or machine learning. It doesn’t mean that you understand all the ins and outs, the technical jargon, and things like that.

Sometimes being a leader understands you see the vision, you find the team that will help you get from point A to point B, and then in hopes that you’ll be able to steer that team in order to produce a product that is worth the masses wanting to buy into it.

I do think over time, it’s kind of like Mark Cuban said, if you don’t understand the ins and outs of your product, then you won’t be able to sell at the same level or compete at the same level as someone that does. So there is a bit of responsibility that you have in order to make sure that you understand what it is that you’re offering.

However, a leader cannot do everything. You can’t be the specialist at everything. You can’t be the best at marketing and then turn around to be the best at programming. It’s like you have to pick your battles. But understanding how all the pieces work together is what will help you to have a great company.

[David Spark] But I like how you mentioned the competitive nature of this. Like, with the Mark Cuban quote of, “You cannot know everything, but it’s going to put you at a disadvantage.” And I’m not saying you have to know everything. But it’s interesting, the character that Christofer describes is kind of someone who’s bullying you on stage, like, “You better use AI or else,” kind of a thing.

Does that really work, Caleb? For you, has it ever? Someone pushing you into believing them? Like, “Oh, I guess so”? [Laughs]

[Caleb Sima] I understand sort of what that feels like. I mean, again, we are seeing that across the board. It’s, “Use AI or get out of the company,” right? This is sort of an adapt or die mentality. Is that the way that it should be? I don’t know. I will say that I agree with it, honestly.

[Laughs]

You know, to me, there are clearly sort of hypes, and AI is hyped. But just because it’s hyped, does that mean that it’s not material, or that it’s not going to be extremely impactful to our world and to our industry? Absolutely not.

[David Spark] This is very key because both are happening at the same time, I think, yes?

[Caleb Sima] Exactly. Even if you take a look at AI today and you say, “Let’s just make an example where models never get any better. We’re at the peak. It’s not going to get any better than where it is today,” it will still take us years, decades. We have so much farther to go.

And if you want examples of that, just look at cloud. When cloud first came out, and the hype around cloud, and everyone was doing the exact same thing, saying their cloud, [Inaudible 00:11:53] cloud on top. But it wasn’t until 10, 12 years down the road when you started first truly seeing cloud-first companies where business models were built on the cloud.

Business models were built around the cloud.

And that’s when you started seeing massive transformations in the way technology was created. And so we’re at the infancy of just AI where it is today. If you can’t see in 10 years that it’s going to be massively transformable, then I think you’re ignorant.

And so I can see where there are CEOs of companies who say, “If you do not get on board, it’s because you refuse to accept the truth. And I don’t want that kind of personality or that kind of culture in my company. I want people who can see the possibilities, the optimism, dig in, and go through it.

It’s not going to be great. It’s not going to be as amazing. It’s going to be overhyped. But it’s also going to do amazing things. And I want you to realize that.” So I can understand it.

Sponsor – Stellar Cyber

12:52.715

[David Spark] Well, before I go on any further, let me tell you about Stellar Cyber. Great. It’s the only AI-driven SecOps platform purpose-built for MSSPs and lean enterprise security teams. Now, since 2015, this is 10 years, they have been illuminating the darkest corners of cybersecurity to help organizations see every threat, know what matters most, and act with speed and confidence, always with a human in the loop.

Now, by applying the right tool to the right problem, Stellar Cyber combines machine learning to uncover hidden anomalies, agentic AI to guide responses in real time, and human-augmented decision-making where expertise is essential.

So the result is real-world impact, analyst productivity improved by more than 80%, false positives reduced by over 90%, and security teams free to focus on what matters. Their award-winning open SecOps platform unifies SIEM, NDR/OT, ITDR/UEBA, detection, investigation, triage, response, and Multi-Layer AI™ under one license.

Stellar Cyber is trusted by one-third of the world’s top 250 MSSPs and over 14 thousand organizations worldwide. You can learn more if you go to their website. Go to stellarcyber.ai. Go check them out. And when you do, let them know you learned about them from the CISO Series.

What else is required?

14:28.762

Abhay Kulkarni of WideField Security said, quote, “There are still surprisingly very few people who have trained a neural network.” I would agree with that. He goes on to say, “You do not need an H100 to train a neural network and then to experiment with a few tweaks in training.

Something like this should be a basic requirement.”

Now, Fred Wang of Surge AI said, quote, “This is a big problem in security. Another example is security telling engineering what to do, even though many can’t write code or design good software themselves. You miss a lot of the nuances this way.”

So, this is going back to something you talked about earlier, Caleb is, well, you can’t really expect the salesman to be doing this. But at the same time, like what Crystal said, quoting Mark Cuban, the more you know, the better you’re going to sell.

So where is the right balance here in terms of convincing a buyer that you know what you’re talking about to what I as an individual can handle in terms of getting deep in AI?

[Caleb Sima] You know, I kind of took that quote a little bit of both, maybe not just the buyer, but also the internal security team talking to the engineers or talking about AI too.

[David Spark] Right, right. In the second quote, Fred Wang’s quote, yes.

[Caleb Sima] Yeah, for Fred’s, for example. First of all, I think I’m more aligned with what Crystal said earlier, which is you don’t need to train a neural network in order to be able to speak educationally about it. And you don’t need to understand that level of detail in order to understand the impacts or value that it brings at a certain level.

At the end of the day, the fact that someone has either trained a neural network or not does not mean that they do or do not understand the value of AI. That to me is so far disconnected, and that is a silly requirement to even state that. I think that from my perspective, there is value in understanding the topic, understanding the impacts at a level that is good enough for you to understand the repercussions, the sort of cause and effect that that technology can have.

Those, I think, are important.

You can easily have a CISO, as an example, who’s never trained a neural network, but can clearly understand that, “Hey, if we put AI in this area of our company, we can have a risk of this thing, let’s say, making bad decisions. Because I understand enough about AI.

I’ve seen enough of the patterns to know the cause and effect this creates, which means we need to manage that risk.”

I think having that level of knowledge is good. You need to understand that, but you absolutely do not need to go and try to figure out how to train a neural network. That just is absurd.

[David Spark] I think we’re in agreement on that. So, Crystal, knowing enough when something can be dangerous, I think it’s also the big issue of knowing what questions ask. But I think a lot of knowing what questions to ask is having a certain level of education about what that would be.

Crystal?

[Crystal Chatam] One of the things that I’m huge on is you don’t know everything, but you should know where to go to find out. When it comes to being a CISO, being in cybersecurity, one of the things that you heavily depend on are frameworks, whether you’re going for an ISO or a NIST or SOC 2 or something like that, you should have something that you are able to benchmark against the different security controls in order to see if you’re aligned, or if you at least have a good baseline.

I think that’s a good starting point. NIST already has a framework out there that would help you understand some of the risk of AI. So being able to leverage what is out there, the data that’s out there currently, and being able to assess, “Okay, how am I going to implement this into my workplace, into the different tools and the systems that we’re using currently, and understand what risk that presents?

And how I would be able to, one, protect the data, protect the systems, protect the organization?” Those are all things that you can get by looking into frameworks and leveraging your experience within cybersecurity.

Security tips of the week – Tenable

18:53.657

[David Spark] This week’s exposure management tip is all about time. Coming up now.

[Voiceover] This week’s security tip is brought to you by Tenable, the exposure management company.

[David Spark] When it comes to exposure management, time itself can be a force multiplier, and that’s in both ways. The longer an exposure lingers in your environment, the more dangerous it becomes. Now, this drives home the very real fact that attackers don’t need thousands of vulnerabilities to achieve their goals.

They just need one that stays open just a little too long.

So to defend against this, measure two things together. Mean time to remediate and mean time to exploit. So most security professionals are familiar with the first. Mean time to remediate or remediation: the speed by which companies can fix the security issues.

But the second is potentially more serious since it measures how fast attackers are known to weaponize those issues. The gap between those numbers is a window of risk, and for many organizations, that window is far wider than they realize.

Some vulnerabilities can be exploited within days or hours. Others quietly sit on an exploit exchange forum for months before showing up in the wild. Understanding that timing helps you prioritize what needs immediate action versus what can fit into normal patch cycles.

Look for a purpose-built exposure management platform that can show you exactly how long exposures have been active, how close they are to known exploit activity, and where your remediation delays are creating unnecessary risk.

[Voiceover] This has been your weekly security tip. To learn more about exposure management, go to tenable.com.

This isn’t just a security issue.

20:53.562

Drew Simonis of HPE said, “Your reliance on technology you don’t understand puts your company and your customers at risk. I sort of think this isn’t limited to AI. I suspect as the older, quote, “we build it” generation is supplanted by the newer “we use it” one, this is increasingly true.”

And Richard Blech of XSOC Corporation said, quote, “When leaders evangelize what they don’t understand, they institutionalize blind trust in opaque systems.” That’s a doozy right there. “That’s not just negligence, it’s an open invitation for AIDA: AI-driven Data Attacks to exploit and infiltrate.

Even “Bob” is a live vulnerability. Every unchallenged narrative embeds endemic, operational, and national security debt deeper into our critical infrastructure.”

All right, Crystal, these are two doozy of quotes. These are big quotes here, saying that if you don’t know, you’re going to put everybody in danger. So this isn’t just a conversation of know enough so you know what to buy, you know what to sell, but know enough not to hurt people and yourself here.

And this is true even before AI came about.

[Caleb Sima] Can I just say that the troll meter count on those are the top? [Laughter] This is clearly just trolls.

[David Spark] They’re baiting us to jump on it. So I’m jumping on it. I’m taking the bait. And Crystal, I want you to take the bait with me. How dangerous is it to just not be aware?

[Crystal Chatam] I think with everything that you do, even looking at tech, just going back to… Okay, so let’s take it a step further. 1995, there is a show, David Letterman. Not sure if you heard of it.

[David Spark] I’m a big fan.

[Crystal Chatam] Right. So let’s take it a step back. In 1995, Bill Gates was on the David Letterman show, and he was talking about the internet, and how it was this new thing, and they are going to broadcast the show. And David Letterman was saying, “Well, you could broadcast on the radio.

You can broadcast…” Whatever technology that we had back in 1995.

[David Spark] Right. He wasn’t aware and he was doing it for humor too, I remember. I remember this interview, yes.

[Crystal Chatam] Right. And so during that time, everyone was so excited to have the internet. I mean, we had AOL, we had so many different things, you know. It was new to us. But cybersecurity was not something that we were thinking about at the time.

I remember when I first got into cyber, we had a team of maybe five people, and each person had a different function. One was network, one was identity and access management. And eventually that team grew. But the biggest challenge, it wasn’t the processes that we had.

It was getting it to the point where cybersecurity or information security was considered in the beginning during the change management process, during a software build.

 And so that’s what we’re seeing right now. Fast forward to today is right now we have AI. AI has the ability to possibly replace the internet. We don’t know. However, it is important that we need to make sure that we’re understanding information security, cybersecurity, all the different security aspects within AI as we’re going about building out these different systems and applications.

And whether we’re looking at agentic, we need to consider the safety as we’re going through this. There are going to be moments when maybe looking at the business side or failing first and try, try again, we may be going through that. But I do think that it is important that we consider the information security and the cybersecurity, and just all around security and data protections as we’re going through this new phase and learning AI.

Because there is a bit of a double-edged sword to it, just like technology, but we can’t run from it. We have to kind of lean in at this point and make sure that we do our due diligence to make sure that we’re also protected as we’re trying new things.

[David Spark] That’s kind of a key thing you just said there at very end of make sure we’re protected as we’re trying new things. Because for years, like in other technologies, you brought up the cloud, Caleb, I remember interviewing lots of people who had this “wait and see” attitude.

Well, we’re all kind of aware, and like what you said of, you can’t really wait and see here because things are going to change. And if you wait and see, you’re going to be left behind. But at the same time, there’s this fear the security has. I’m one of the situation, and again, not all businesses can do this, think banking, think health, things like this, but go try, break a few things, move on kind of a thing.

You’re going to have to do this. You’re going to make some mistakes, but you’re going to have to move forward, and make some experiments where you can. Caleb, I’ve got to think that you’re in the same level of philosophy.

[Caleb Sima] Oh, yeah, for sure. This brings up a deeper subject maybe for another, but I’ll hint at it. It’s interesting because AI is one of the first areas where security is actually doing preventative versus reactive, where safety and security, security vendors, budget is being applied to security before the actual threats have really emerged, which is a first, really, in my mind, of this happening.

[David Spark] Yeah. Because, for example, we didn’t think about that way with cloud.

[Caleb Sima] We didn’t think of that way with cloud. And what’s also interesting is there’s a pro and a con to this. Which is the pro is we are doing what security we should, which is, “Hey, we have the budget. Let’s be preventative. Let’s put in the right things.”

But the con of this is it actually intends to overhype security and AI even more than it really is because we actually haven’t even seen what the real threats are yet. And yet now we have multi-billion dollar AI security industries selling products that may or may not protect against the threat that we don’t know about yet.

So there’s an interesting sort of battle between these two.

[David Spark] Let me close with this. And quick responses from both of you. I’ve been interviewing a lot of people about this. And that is we have to accept the fact that we’re going to make a lot of mistakes. Do you think more so than any other technology before?

Can you think businesses can accept that? That we’re going to have to experiment and make lots of mistakes on all levels with trying AI, with securing AI? Is this just like, “Ah, we can’t go there”? I’ll start with you, Crystal, your thoughts.

[Crystal Chatam] I cannot remember who said this statement, but they said if you’re not on your second or third version already, then you’re already behind. So, yes, we’re going to make mistakes. No one is perfect. We are all learning this together. We might be at different stages.

[David Spark] Because they’re so rapidly changing and we don’t know what we’re getting out of it all the time. But that’s a good point of you’ve got to be at the later stages. If you’re starting now, you’re already behind others for that matter.

[Crystal Chatam] Right. I think there’s so many AI tools and they have come out with updated models, updated versions. You know, chat GPT is on, what, number five? There’s constant updates. There’s continuous improvement. And a company should expect that…

It’s a living approach. That’s the best way that I can explain it.

I mean, the policy that you may have wrote a year ago is no longer applicable because a year ago we were focused on generative AI. Now, there’s a whole other new niche or new hype out now with agentic AI. And so agentic AI now has access to the same things that you have access within your organization.

How do you go about protecting that?

[David Spark] This is the preventative model that Caleb was referring to of the fact that it has access to it, let’s start preventing. All right. Again, Caleb, I want you to close this out. Your thoughts of, do you think that working in this environment, we have no choice but be willing to make lots of mistakes?

Or is that not something we have to accept? What do you think?

[Caleb Sima] I’m going to speak to you as a security person. And the answer is absolutely you have to iterate fast. You have to be willing to make mistakes. However, the job, unfortunately and fortunately, of a CISO or a security team is to allow that to happen safely.

And so we can’t just say, “Hey, just go,” because that doesn’t make a lot of sense, even though everybody wants to. And we don’t want to be the team of no, but at the same time, that is part of our job, is to also say, “How do we iterate and make mistakes, but do it so the damage can be contained, so the mistakes can be contained?” And so I think that’s an important part.

Closing

29:58.067

[David Spark] Well, that brings us to the tail end of the show. Before we truly close up, I’m going to start with you, Crystal. Please look at the quotes that were all mentioned today, and tell me which quote is your favorite and why.

[Crystal Chatam] So my favorite quote is by Eric Bloch. And the reason why is because I like the fact that he’s calling out that Bob is informing VCs and informing the engineers, but may not know everything about AI. Only because I understand that to build a team, you may not know everything, but the fact that you know how to put the puzzle together is good to me.

However, I still, like I said, think that someone should know their product in and out.

[David Spark] Good point. All right. Caleb, your favorite quote and why?

[Caleb Sima] I’ll be very blunt. I don’t know if I really have a favorite quote [Laughs] out of all of these quotes. I feel like I read all of them, and I’m like, “Ehh.”

[David Spark] Could you go with Christofer Hoff, the one who started this conversation?

[Caleb Sima] You know, Hoff knows this too. I will argue the crap out of Hoff. I would say, if I had to pick one, maybe I’ll pick Frank Wang.

[David Spark] Frank Wang said, “This is a big problem in security. Another example is security telling engineering what to do even though many can’t write code or design good software themselves.” That’s your favorite, yes?

[Caleb Sima] Yeah. And I think he added a thing in there that he goes, “There’s a nuance.”

[David Spark] Yes, “You miss a lot of the nuances.” Correct.

[Caleb Sima] And I think that maybe gets the reason why I would make it my favorite quote, is that he is correct. He’s correct in the sense that if you did have someone in security who understands software engineering and how to build a product and what it takes, then he can understand the nuances of what is important and why.

Versus someone who just comes along and says, “Well, this is what the security rulebook says, therefore you must follow it.” I would sense I have a little bit more agreement with Frank there.

[David Spark] Good point. All right. Well, that brings us to the tail end of the show. I want to thank our sponsor. And that would be Stellar Cyber. Remember, go to their website, stellarcyber.ai. Remember, let them know you heard about them from the CISO Series.

They’re the AI-driven SecOps platform purpose-built for MSSPs and lean enterprise security teams. Crystal, I know you have an event coming up in April and do want you to mention it. What is that event and where can people find it?

[Crystal Chatam] My event is called The AI Experience. This is AI for everyone. It’s help bringing everyone to the table in order for us to learn AI, experience it, and understand how it would apply to you, whether you are a founder, creator, you need to use it in your everyday work, or if you want to invest in it.

It’s not something that everybody knows, but maybe you have the capital, or you have a great idea and you need the capital. So that’s April 14th through the 16th. It’s in Houston, Texas, premiering for the first time in 2026. You can find us theaixp.com, or you can find us on LinkedIn, Instagram, all social media platforms.

[David Spark] Thank you very much, Caleb. Thank you very much, Crystal, as well. And thank you to our audience. We greatly appreciate your contributions and for listening to the Defense in Depth podcast.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review. Leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.