We know human-paced security controls can’t be applied to autonomous AI agents. So what needs to change with CNAPP?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Dan Benjamin, vp product – data, identity, and AI security, Palo Alto Networks.

Join the conversation on LinkedIn

Huge thanks to our episode sponsor, Palo Alto Networks

Full transcript

Intro 

0:00.000

[David Spark] We know human-paced security controls can’t be applied to autonomous AI agents. If the attacks are automated, so in turn will the defenses. But what does that specifically mean for cloud security and CNAPP? 

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. My name is David Spark, I am the producer of the CISO Series. And joining me as my co-host, one of your favorites. I mention it all the time, but I know he’s one of your favorites because you do tell me. It is Steve Zalewski.

Steve, say hello to the audience. 

[Steve Zalewski] Hello, audience. 

[David Spark] Please feel free to greet Steve when you see him in person with that very greeting.

[Steve Zalewski] [Laughter] 

[David Spark] Our sponsor for today’s episode is Palo Alto Networks and their product Cortex Cloud, agentic security from code to cloud to SOC. We are going to be talking more about that later in the show. And in fact, our guest is from Palo Alto Networks, who I’ll introduce in a second.

But first, Steve, let’s talk about our topic. Steve, you recently outlined how the CNAPP landscape is changing in the Age of AI. CNAPP was a big leap in cloud security, unifying multiple tools for the entire lifecycle of cloud-native applications. Coverage is now a bigger blind spot than detection.

AI SOC automation is quickly becoming mandatory, and we need a new permission model for non-human identities. Any one of these is a huge heavy lift. So is this an evolution for CNAPP or do we need a complete sea change for this category? What do you think?

[Steve Zalewski] Well, I think we’re going to talk about this, but what I would say is I think this is an opportunity for the CNAPP vendors if they can pivot correctly to be able to embrace these new classes of problem. Because on one hand, it’s an extension of what the cloud was.

On the other hand, it’s creating a completely new class of problem. And that was the reason for this, which was, okay, who can we trust that we already have in-house versus are we waiting for innovation and we have to look at a new wave of innovative partners.

[David Spark] And I would just say that with something this big, to do a shift and jump somewhere else to drastically change your cloud security program seems kind of insane or ludicrous, but at the same time, we’re being sort of challenged with something that’s so different than what we’ve dealt with before.

Yes, Steve? 

[Steve Zalewski] Yes. And think about it. A year ago, AI SOC was an argument about whether we had to do it, about whether humans could keep up with machines, and all of a sudden, the tone and tenor in the last six to nine months has changed. Right? Now, it’s how do we do it?

And with what happened in AI in the last six to nine months, we went to AI agents and synthetic identities, and you’re like, “Oh, my goodness. We’re five to seven years along the path in the last six to nine months,” and which is why we’re seeing some of these problems emerging now.

[David Spark] By the way, do you know that I think the last count was 68 vendors in the AI SOC space? It’s crowded. 

[Steve Zalewski] It’s crazy. 

[David Spark] My guess is half of them appeared in the last year [Laughter] is my guess. 

[Steve Zalewski] I wouldn’t be surprised. Yeah.

[David Spark] All right. Let’s bring on our guest to help us with this discussion. Thrilled to have him on. It’s the VP of product, data, identity, and AI security over at Palo Alto Networks. It’s our sponsored guest, Dan Benjamin. Dan, thank you so much for joining us.

[Dan Benjamin] Hello, everyone, and thanks for having me.

Why is this so darn hard? 

3:41.954

[David Spark] Bil Harmer, CISO over at Supabase, said, “The real question isn’t whether CNAPP vendors can adapt. It’s whether detection-first survives when the attack surface is generated code running at machine speed. Coverage gap isn’t a tooling problem.

It’s a design problem. You can’t inspect your way to safety when a third of the code is AI generated.” And Daniel Spangenberg said, “The bottleneck was never finding the misconfiguration. It was a human loop after the finding. Add agents to that picture and the loop doesn’t scale, it inverts.

By the time a human reviews, the agent has made 20 more changes.” Yikes. “The interesting question isn’t whether CNAPP grows an AI module. It’s whether the industry finally moves policy from periodic evaluation against state to deterministic evaluation at the point of change.” So, everyone here is saying CNAPP’s not the problem.

It’s the problem of how we have been historically dealing with this problem. Steve? 

[Steve Zalewski] Yes, because it’s been human attack against human defense. And to a certain extent, we can fool ourselves that we can hire enough humans and apply enough technology to keep the playing field relatively level. And that just fundamentally is broken now, right?

We lost control of the defensive perimeter, AI is climbing the walls left and right. And if we continue to use human defense only, we’ve effectively lost. And that’s what people, I think, are saying is we do have to weaponize AI for defense, and it’s not just vulnerability management.

It’s not just incident response, okay? It’s that we have to look at the detection engineering. All of these functions now need to be brought together. We need to figure out how we bring machine speed to defense, and that includes code generation for vulnerability identification.

[David Spark] Dan, you’re nodding your head through all of this, and I had also mentioned how many vendors are in this space. I guess my question is, this is like it’s kind of a do or die situation. You need to move in this direction, but the fear is they don’t know what that direction is.

What are the things we need to be thinking about when we’re dealing with machine-fighting machines? Dan? 

[Dan Benjamin] I’ll share a couple of my thoughts and maybe let’s color it in kind of the context of cloud security as was kind of our original discussion, but I believe that all CNAPP solutions kind of evolved from doing posture only, and then posture plus kind of runtime detection, and then posture, runtime detection, and a little bit of automation.

The missing piece here up until now was, okay, I found a problem. I want to automate a solution. What is the process inside the organization that I need to follow in order to fix it, right? And most organizations did the easy lifting first, right? The obvious solutions first, and most organizations try to kind of automate some pieces of it, maybe only the critical vulnerabilities and so on.

I believe that in today’s world, you have to automate everything. I think you have to do the harvesting of those processes, eliminate bottlenecks inside the organization for remediation. And I believe that any CNAPP solution that does not offer first off kind of runtime and also remediation capabilities is not going to be in the market in the next couple of years.

All of us need to understand that that assumed reach that we used to say a couple of years ago is now obvious because all of us are having attackers that are using AI, utilizing it super, super quickly. So, we need to adapt to a world that’s automation is key, harvesting of these different types of processes is key, making agents with access to how the organization should remediate these types of processes automatically, and push on that aspect of it.

Why is this so darn hard? 

7:47.332

[David Spark] Andrew Wilder, CSO over at Vetcor, said, “The permission model for AI agents doesn’t exist yet. Let that sink in. We have autonomous systems browsing, querying, writing, and executing cloud ops, and we’re governing them with tools designed for humans doing those things manually.

This isn’t a CNAPP gap. It’s a category gap.” Good point. And Jason Elrod, CISO over at MultiCare Health System said, “We’re not just scaling security challenges. We’re shifting from human-executed decisions to system-driven decisions at machine speed.

Coverage and detection matter, but the real and growing gap is accountability. Who owns the decision when it’s made by an agent? Non-human identity, emergent behavior, and AI-driven SOCs aren’t extensions of what we have today.”

 So, this has been a topic that’s come up again and again. Who do you blame when it goes wrong? So, for example, Steve could set up the system, move to a different department, leave the company. Now who’s responsible? Like who knows right now? [Laughter] It is a kind of the whole gap on how we manage people and manage security.

What do you think, Dan?

[Dan Benjamin] I do believe that this is an industry gap today, by the way. I see multiple approaches to this, whether it is kind of gateways that redact some identity permissions, whether it is kind of sending it to a human to approve, periodic kind of IGA-style approach, user access reviews are now agent access reviews, right?

So, we’re trying to kind of solve this in old methods that we used to do for identity, which I’m not sure that will scale in the near future. I’ve seen multiple vendors in this category. I’ve seen what kind of Palo is now building in this specific category.

I believe it will mix between identity old-style solutions like IGA and newer approaches like identity gateways and kind of a mix between those types of capabilities today. 

[David Spark] Steve, the part I’m trying to understand is, because I think we all know what the problem is, but attacking it is like really confusing. 

[Steve Zalewski] Yes, and I find it fascinating. The first topic was “Why is it so darn hard?” today, and the second topic is “Why is it so darn hard?” We’re doubling down on the facets for why it’s so hard, and I think it’s accurate. The way I would characterize it is we’ve got two things going on.

One, given what Dan said, we’re trying to be brilliant at the basics. We’re trying to double down right now on identity and access management, on data security. We’re trying to understand the service edge. So, we’re reaching back to what we know, role-based access control, to do better.

But the challenge with that is we’re giving it to AI agents, and now as they’re automating and taking actions, we don’t understand how to build a trust model around trusting them to do something. We talk about it’s non-deterministic. We talk about accuracy.

We talk about timeliness. We talk about cost. But we want to be able to trust them because if they get it wrong, then bad things can happen even faster, right, when we’re trying to figure out blast radius. 

And so I think a lot of what Dan was saying too is that’s just it. IGA and those types of things we’ve done for humans, we’re going to apply to AI agents, and we’re going to try to make sure it’s just the right data, just the right information, but we can’t assign the trust to them.

And so to your point, what happens when something goes wrong? I think that’s the elephant in the room right now is boy, is there going to be a blame game going on as we’re going to resiliency and withstanding the attack as to who gets blamed because there is actually no logical owner of the problem yet.

[Dan Benjamin] But doesn’t it go to our previous discussion of the problem of harvesting the process that the organization needs to go through whenever we have an issue? And I think that’s kind of something that a lot of the discussions that I kind of hear online and when I talk to customers is this company brain, this kind of hub for agents that are trying to distill what are the processes that an agent can follow and act upon as a human, right?

That most of these organizations for the last 10, 15, 20 years have never written down and have never formalized. And now we’re expecting an agent to make those decisions that were never formalized in the past 20 years. 

So, those are kind of the issues that I see that most of these organizations are now facing. They’re expecting an agent to do something that they haven’t been able to do in the last 20 years. Now we as vendors can help guide them through this process, can help give them the suggested playbooks, the suggested processes.

This is what other organizations are doing. This is what’s been successful. In Hebrew, we have a saying called Tushba, [Phonetic 00:13:03] which is kind of the Bible of the mind, what we learn throughout the years, right? And I think vendors should do more of that to be able to help organizations automate and install and utilize more AI agents as we move forward.

[Steve Zalewski] Okay. Brutal truth on that, Dan, right? Which was the way we characterize that is we say insights, that the humans bring insights, and therefore we can automate the rote basic workflows, processes. But what we’re realizing now, Dan, you, me, 60, 70% of what we do that are insights are actually just complex workflows that till now, we either haven’t been able to automate, or we hide that because we want to keep our jobs.

Okay? And that’s now what’s on the table is we’re going to start to drain the human of more and more of those “insights” as we ask them to understand how to do that, and we demonstrate that AI can do it quicker. It can do it more consistently. And I think that’s part of the rub that you and I are seeing.

Sponsor – Palo Alto Networks 

14:08.952

[David Spark] Cloud risk moves at machine speed. Security teams still work ticket by ticket. That gap is where attackers win. This is what we’ve been talking about. Exposure happens in seconds, while most platforms still depend on dashboards, manual handoffs, and brittle workflows stretched across disconnected tools.

Security teams are left chasing fragments of the story, trying to piece together what happened, what matters, and who needs to act. 

None of that was built for the cloud you’re running today. Cortex Cloud was. As the world’s first agentic cloud security platform, Cortex Cloud unifies code, cloud, and SOC in one system, carrying the full context of risk from code to runtime to incident response.

So, instead of forcing teams to swivel between tools and translate findings by hand, Cortex Cloud turns disconnected signals into a single operational flow from content to prevent, prioritize, investigate, and respond. All key elements. So, one platform, one data layer, one risk model from the moment a vulnerability enters your pipeline to the moment it’s resolved.

AI agents don’t just surface risk. They prioritize it, they route it and help resolve it with enterprise guardrails that keep humans in control. Real-time protection, AI-powered guardrails, and unified workflows give defenders a new operational advantage.

You need a speed-of-AI solution to beat a speed-of-AI threat. It’s what we’ve been talking about. Go to paloaltonetworks.com, search Cortex Cloud on their site, go check them out. Paloaltonetworks.com, Cortex Cloud, check them out. 

There must be a better solution.

15:58.077

[David Spark] Erik Bloch over at Illumio said, “If we accept that humans can’t match AI speed or scale, then defense has to evolve too. Just as we’re making code more resilient, we need to make networks more resilient. So, assume an AI bot gets in. The question now becomes how do you limit the blast radius or what that AI can access.

Building resilient networks like we will with code will reshape defense and place more on upfront design versus today’s reactive measures. This comes up again and again. Secure by design, we hear it all the time.” 

Debra A. Anderson from Made in Texas said, “Security will need to shift from static posture management to real-time risk adaptive control systems.” Yes, yes. “That likely extends beyond CNAPP into something closer to autonomous security governance. If one-third of the code is AI-generated, then security has to operate at machine speed or become irrelevant.” Okay.

These quotes are just doubling down on what we’ve been saying right now, Steve. I think this whole idea though of secure by design, what is it we’re not doing now that has to change? In the secure by design element, I’m sorry. 

[Steve Zalewski] So, I would say there are two guiding factors here, right? There is zero trust, right? And then there’s secure by design. We’re trying to bake it in. On one hand, we’re talking about building applications. On the other hand, we’re talking about running business infrastructure.

Now that we have citizen developers, and we’re basically letting them build incredibly functional capability, we actually have to think about how do we make it secure at inception because there is no process to follow, right? How do I realize that as the AI agents are writing the code based on oral functional requirements, that security, maintainability, and sustainability are included at inception by AI agents to AI agents?

And I go, that’s the part that has us all shaking our heads because we can’t stop the functional deliverables. The business finds it too valuable, but from a security perspective, we’ve now kind of blown the doors open on the problem to be secure at inception.

[David Spark] All right. I mentioned this in the read for Palo Alto Networks, that you are dealing with stuff at the code level. Dan, explain to me because Steve brought this up too. What is changing at the code level, being that so much of it is generated by AI?

[Dan Benjamin] I just believe that most organizations are not utilizing the basics. I’m super excited about where Palo Alto is going in this specific direction. I mean, first off, we have combined code security with the general posture management of everything in the cloud.

We’ve combined that with runtime, and we brought it to the SOC. No other vendor in the market has done this. The problem is is that most solutions today are fragmented. They buy the posture solution from one vendor. They buy the runtime solution from a different vendor.

They have a different SOC. They have a different code security solution. None of them kind of stitch together. 

And I believe that if you combine those processes together into a solution that doesn’t push code that has vulnerabilities and issues with them from the get-go, and you automate the responses to all the different types of problems that you already see from your CNAPP solution, you monitor it in real time, both from human identities, non-human identities, any type of workload, any type of insight that essentially comes in.

And of course, you bring it to the SOC in an interface that they know how to consume and prioritize, whether it is an AI SOC or not an AI SOC. I think that’s the fundamentals. It’s just that most organizations have gone through the process and are now kind of in all these different types of fragmented solutions.

So, I’m super excited about where Context Cloud is in the market today and where it’s going to be. I think we challenged the market and kind of the fragmentation there, and I believe that if organizations do the basics here, utilize code security, put the right guard rails in, whether it is humans writing the code or AI agents writing the code, I think we’re in a very, very good spot.

What aspects haven’t been considered? 

20:22.424

[David Spark] Dutch Schwartz of Nisos said, “CNAPP was built for human-scale threats. An agent without an owner is an insider threat with no face at machine speed.” I love that quote. “We have methodologies that we apply to humans every day, but we simply haven’t built all of the defense responses for agents yet.” That is as simple and on the money as you can get right there.

Aniketh Maddipati of AgentMint said, “The NHI…” – non-human identity – “…permission gap is real, but it’s only really half the problem. Even with the right permission model, you still can’t answer the fundamental question of, ‘Prove what the agent actually did.’ Detection assumes you can inspect fast enough.

With agent workflows, by the time you detect, the action has already happened. The missing piece is evidence that’s generated at execution time, not reconstructed after the fact from logs the operator controls.” I’m getting the sense, Dan, that the new SOC is constantly managing agents, and it is not watching the board of what’s coming in.

What do you think, Dan? 

[Dan Benjamin] I agree. I believe that in at least a large organization, an organization that has kind of a fragmented environment, on-prem, cloud, SaaS, the basics of what we see today in kind of the larger ones, right? You can’t process the volume that essentially comes in without automating agents.

Palo is very heavy on kind of automating the SOC and putting a lot of AI controls into the SOC. With AgentiX that we recently launched as well. But I completely agree. I think that first off, discovering the NHI is hard. 

Second, reacting to what the machine does is not the right approach. Again, like the approach that Palo took here with acquiring a proxy or a gateway, as we call it here, I think we will need to put in a lot of these different types of controls into these gateways.

I think the market has not kind of seen a standardization of how we want to protect agents from doing something. But I think a gateway is the right approach and essentially bundling up multiple different types of controls, whether it is identity controls, data controls, posture controls, remediation controls, on top of these different types of gateways is a very cool manner of how we want to tackle this as an industry.

[David Spark] Steve, your take on this of what the new SOC will look like. 

[Steve Zalewski] Yeah. So, we’ve talked about three different types of problems through this. So, we’ve talked about we need to do AI. We’ve talked about brilliant at the basics, right? We’ve talked about these new agents. I think what I would suggest is that brilliant at the basics because that concept, that’s what Dan said, is we’ve got to look at every facet of how we’ve traditionally run security.

Vulnerability management, AIAM, okay, incident response, detection engineering, GRC. We fundamentally have to look at those basics and think about how AI is being introduced to be able to reestablish resilience. I think that’s what brilliant at the basics means right now.

And then when we look at AI agents themselves, whether they’re writing code, whether they’re helping, what we have to do is bring visibility to where they are right now because there’s not a lot we can do about the problem yet. Because management of knowledge, which is this non-deterministic insight, is something we’re still trying to understand because we weren’t supposed to be here for another five years.

But by bringing visibility to where they are, we can bring brilliant at the basic controls. We can block things. We can do some basic monitoring of the input and the output, and that’s the current best capability we have. 

So, we just need to be honest with the limits of what we can do. Which is, I think, why we came back to is CNAPP, right, the place that’s going to adapt to what we just talked about as the logical extension from cloud to something that’s just 100 times different.

Or is there going to be some blend between fundamental innovation that’s going to result in the next thing, or the platforms bringing in the right technology? And I think that’s my best way of saying, this is how we take a breath, how we understand the problem, how we realize what brilliant at the basics is, and where we have to just let innovation for the next two to three years occur.

[David Spark] Really good.

Closing 

25:12.755

[David Spark] All right. We’re going to bring this to a close here, but I’m going to start with you, Dan. We like to go back to our quotes, pick our favorite quote, explain why we like this quote. I thought there were a lot of great quotes throughout this show.

So, Dan, your favorite quote and why? 

[Dan Benjamin] I’ll go back to Daniel Spangenberg, I think that was the way that you pronounce that. I completely agree. I think that the bottleneck was never finding the actual misconfiguration. It’s a human loop after the finding. We have to bring in a different way to tackle this type of problem because otherwise, we won’t be able to automate.

We won’t be able to operate at machine speed or agent speed, if you want to call it like that, and I believe that this is “the” main problem to solve in the next two or three years. 

[David Spark] Very good. Because this is so people-focused, this is going to be a tough lift, I think, because this is not a technology fix. Is it, Steve? 

[Steve Zalewski] Yes. Agreed. Which was it’s not just the technology lift. It’s appreciating something like a synthetic identity or a digital twin as an accountability to an equivalence to a human that we’ve never talked about before. And so coming to grips with some new concepts about how we think about these things because they’re not just privilege access management as a proxy.

I think there’s a lot of what’s happening now is we’re trying to build the language. We’re trying to… Assigning a human identity to a non-human agent is not the right thing, but the only thing we know how to do, but we’re also then quick to call out why it doesn’t work.

Right? That’s why I said the innovation isn’t just so much hurry up and do the technology, it says we actually have to understand what that technology looks like, and that’s why I called it knowledge management. Okay? So, that’s my, to Dan, we’re agree, but we need the right language to let people to be comfortable with the journey to know what insurance policies we can take.

[David Spark] All right. Your favorite quote. 

[Steve Zalewski] My choice is Dutch Schwartz, Dutch is a good guy, and he said CNAPP was built for human-scale threats. And I’m willing to go with that because in the cloud back then trying to just reestablish visibility was close enough. But what he said, “An agent without an owner is an insider threat with no face at machine speed.” And now that’s what we’re talking about is machine speed, how do we trust?

We have methodologies that we apply to humans every day, but we simply haven’t built all of the defensive responses for agents yet. So that’s glass half-full, and that’s where I would go. 

[David Spark] I think also, let me just throw this out at you – I’m extending the show just for the here-here – the reason that we don’t let agents go whole hog, I guess, here is I think there’s a greater fear of friendly fire than of what the bad guys could do to us.

I think there’s a greater fear of what are we going to set up to screw ourselves up, to shoot ourselves in the foot, than prepping it for the attack that’s coming in at machine speed. Steve, you’re nodding your head. 

[Steve Zalewski] Yeah. So, here’s what we say, right? Which was the bad guys don’t have to worry about collateral damage, and I hate to use a war mentality, but they don’t care. And what this thing is, if you think about it, is we’ve just built an 11-year-old savant.

Okay? Not a 6-year-old savant, not a 30-year-old savant. It’s an 11-year-old savant. It’s an early teenager and it’s incredibly intelligent and bright, and it can do things we never appreciated that it could do, but we don’t know when it does the wrong thing, how to characterize that and bring it back.

And so therefore, when it makes a mistake, we call it hallucination or whatever, that’s what we said is how do we trust it? How do we train it and trust it? When in reality, from a technical perspective, that’s kind of its stage of capability. 

[David Spark] I’m going to let you have the last word on this, Dan. I get the feeling that a lot of this movement is not happening mostly because of the fear of friendly fire, shooting yourself in the foot. 

[Dan Benjamin] I agree. I agree. I think that as Steve mentioned, we’re in our toddler years, at least of adopting these new types of technology. I’m raising a toddler here at home. 

[David Spark] You may have heard him in the background. 

[Laughter] 

[Dan Benjamin] I’m also a bit cautious and sometimes walk on eggshells when I’m not sure. And I think most organizations are not sure, and they’re worried that they’re going to break something, that they’re going to slow down the business, that they’re going to break the status quo.

I think those are the same challenges as raising a toddler. 

[David Spark] We’ll figure out which one. We’ll have parents write in and tell us which one’s more difficult. All right?

[Dan Benjamin] [Laughter] 

[David Spark] All right. Well, thank you so much, Dan. Thank you very much, Steve. Dan, I’m going to let you have the very last word. But first, I do want to thank your company, Palo Alto Networks, for sponsoring this very episode of the show. Remember, this comes from Cortex Cloud, agentic security from code to cloud to SOC.

Just go to paloaltonetworks.com, search for Cortex Cloud. Just search for that on Palo Alto Network site. You’ll see all the information about it and what we’ve been talking about today. Dan, any last words, any offer you want to make to our audience, anything like that?

By the way, are you hiring at Palo Alto Networks? Got to assume you are, yes? 

[Dan Benjamin] We are hiring across the U.S. and India and Israel and across other locations as well. And maybe kind of the last words that I will say is I think we are at a paradigm shift in how we treat cloud security. I think that posture solutions are not enough.

I think that fragmented solutions are not enough. As we mentioned, we’re operating now at agent speed. Not only machine speed, agent speed. And I’m super excited about what we have brought to the table and what we keep on innovating. I think the ability to essentially combine code sensors and everything from the SPMs, whether it is CSPMs and DSPMs and AISPMs and vulnerability management, and bring that into the runtime context, into the SOC with prioritization is unmatched today in the industry.

Definitely, if you’re looking at innovating in cloud security, upgrading your stack, check out Palo Alto Networks. We have something cool built for you. 

[Steve Zalewski] So, Dan, I have to say this. So, as a parent of four children myself, right, with you, I go, if we use the parenting analogy, okay, I go, we as CISOs, leveraging our lines of business as our children, is that we have to stop thinking like helicopter parents and forcing behavior.

And what we have to now do is we have to understand what free-range parenting looks like because we’re going to have to let them make mistakes. We just have to be careful about how they do it. 

[David Spark] And control the blast radius. [Laughter] 

[Dan Benjamin] Absolutely, right. 

[David Spark] That is a great metaphor to close on! All right. Well, thank you so much, Steve. Thank you so much, Dan. And thank you to Palo Alto Networks. And thank you to our audience, as I always say and do mean it, we greatly appreciate your contributions and for listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.