All About Risk

About All About Risk

Dive into the digital deep end with the c1risk podcast, your go-to stream for all things GRC and cybersecurity! Each episode, we unpack the complex world of Governance, Risk Management, and Compliance. Whether you're fortifying a finance fortress or safeguarding a startup, join us as we explore cutting-edge strategies and insider insights tailored for any industry. Tune in, turn up your cybersecurity savvy, and transform risks into rewards with your host Lily Yeoh.

Publisher

C1Risk

Category

technology

Language

en

Explicit

No

First episode

7 May 2024

Latest episode

20 Jul 2026

Latest episodes

16 episodes in the feed.

1. 

   20 Jul 2026

   Episode 10: Leadership in Cybersecurity with Mike Schiller

   Former Texas Instruments CISO Mike Schiller joins Lily Yeoh to share practical leadership lessons from a career spanning IT, internal audit, and cybersecurity. Together they discuss what it takes to build high-performing security teams, earn executive trust, communicate with the board, and balance security with business priorities. Mike also shares how embracing his introverted leadership style became one of his greatest strengths. For more on Mike Schiller's latest book, High Impact at Low Decibels: How Anxiety-Filled Introverts (and Others) Can Thrive in the Workplace, click here (https://us.amazon.com/High-Impact-Low-Decibels-Anxiety-Filled/dp/B0DP1HY14G/ref=sr_1_2?dib=eyJ2IjoiMSJ9.8ccfMd-eZePcbENWzffpEulZyKIAZbRFZsTfc5FvjZwYHl7wZkeZKmbBXe7HogfyReLruk6wV_8kps_Yjw46KPvqAN5L1LBNjyrluZEuilq0O0HFQ-UsKt8cnBMLSL8gqwqKF_Hgy7S2laibrxrlSMv8VLYoZBXcY95QffnhbohEcbmArzN-mo8pklOEbDwU6vbvRjhT7zVL5zHC-uqYROpkvj6_V9XLGDtD2ScJTRg.gKa7Mr969N5VNUVT3EA1M9DjWbd1fhaD5JsOhtA2iy8&dib_tag=se&qid=1783970389&refinements=p_27%3AMike+Schiller&s=books&sr=1-2).

2. 

   19 Apr 2026

   Episode 9: AI Is Rewriting Risk

   Chip Block joins Lily Yeoh and explains how AI is forcing organizations to rethink governance, security, and traditional control frameworks. From AI-generated software to data validation and trust, this episode explores why checklists and static controls are no longer enough for modern risk management. 00:00 - Chip Block’s Background and Why Risk Is Changing 03:12 - Why Cybersecurity Is a Business Problem, Not Just a Tech Problem 06:18 - How AI Breaks Traditional Security Models 10:05 - Why GRC Frameworks and Legacy Controls Need to Evolve 14:22 - Data Ownership vs Data Validation in the AI Era 18:40 - Shifting Risk Management Toward Business Outcomes 22:05 - Securing Data Beyond Devices, Networks, and Perimeters 27:10 - Why Many Security Controls No Longer Matter 31:08 - AI and the Future of Software Vulnerabilities 36:02 - The End of Traditional SDLC and Slower Release Cycles 40:15 - What Cybersecurity Leaders Should Invest In Now 44:05 - Why Trust May Replace Information Security as the Next Frontier

3. 

   25 Feb 2026

   Episode 8: Defensible Evidence - Say What You Do. Then Prove It.

   In this episode of All About Risk, Lily Yeoh sits down with Shayne Adler, co-founder of Aetos Data Consulting, to talk about defensible evidence, the gap between policy and reality, and why perfect compliance is a myth. They unpack compliance debt, right-sizing controls, AI overpromises, data theater, and what it really means to say what you do and do what you say. To learn more about Shayne Adler and Aetos Data Consulting visit here (https://www.aetos-data.com/) 00:00 – From Law to Chief Trust Officer 07:11 – What Defensible Evidence Actually Means 11:30 – Compliance Debt and the Policy Gap 16:15 – Who Is Compliance For? 17:43 – Right-Sizing Controls and Avoiding Overload 24:19 – AI Hype, Data Theater, and Operational Discipline

4. 

   29 Dec 2025

   Episode 7: The Real Risks of AI in Legal-Tech

   AI is moving fast, but in legal-tech, accuracy and trust are non-negotiable. In this episode of All About Risk, Lily Yeoh speaks with Dean Sapp, CISO and DPO at Filevine, about what happens when AI is introduced into environments where bad data and false outputs carry real consequences. Dean breaks down why enterprise AI is different from consumer tools, the risks of hallucinations, deepfakes, and AI-driven phishing, and why strong guardrails around data, permissions, and retention matter. They also explore how CISOs are using AI to improve threat detection, automate controls, and translate technical risk into business impact leaders can act on. The result is a practical look at AI, security, and risk as an operational reality, not a trend.

5. 

   15 Dec 2025

   Bonus Episode 6: Your First Role in GRC

   In this final episode of this three part bonus series, Lily Yeoh shares clear, practical insight on what it really takes to break into a career in GRC. She talks about where people often start, how different backgrounds can translate into the field, and what helps you stand out early on. She also touches on common missteps, the importance of staying curious, and what to focus on in your first months on the job.

6. 

   8 Dec 2025

   Bonus Episode 5: How Do I Get Ready? School, Certs, and Skills

   Lily Yeoh breaks down what you really need to enter GRC, from choosing between a degree or certifications to knowing which starter certs are worth your time. She explains how to get hands-on experience before your first role, the soft skills that actually help you stand out, and the one practical skill that’s shaped her own career. This episode gives you a clear, grounded starting point for building a future in GRC. 1. GRCP — GRC Professional ⁠OCEG⁠ (https://www.oceg.org/certifications/grc-professional-certification/)-Great intro to governance, risk, compliance, ethics, and audit basics. 2. CCEP — Certified Compliance & Ethics Professional ⁠SCCE⁠ (https://www.corporatecompliance.org/certification/become-certified/ccep)-Focuses on compliance, ethics, investigations, and corporate policy. 3. ISO 31000 Risk Management Certification ⁠Various accredited bodies⁠ (https://www.iso.org/standard/65694.html)-Covers organizational risk frameworks and is accessible without technical depth. 4. CompTIA Security ⁠CompTIA⁠ (https://www.comptia.org/certifications/security)-Security fundamentals that support GRC roles tied to IT and cybersecurity. 5. CGRC (formerly CAP) ⁠ISC2⁠ (https://www.isc2.org/certifications/cgrc)-Intro to governance, risk and security authorization. Good for early GRC careers. ADVANCED LEVEL CERTIFICATIONS These require experience, deeper security knowledge, or exposure to audit, risk, or governance functions. 6. CISSP — Certified Information Systems Security Professional ⁠ISC2⁠ (https://www.isc2.org/certifications/cissp)-High-level security governance, risk, architecture, and leadership. 7. CISA — Certified Information Systems Auditor ⁠ISACA⁠ (https://www.isaca.org/credentialing/cisa)-The gold standard for audit, controls, and assessment work inside GRC teams. 8. CRISC — Certified in Risk and Information Systems Control ⁠ISACA⁠ (https://www.isaca.org/credentialing/crisc)-Focused on IT risk, business risk, mitigation, and control design. 9. CISM — Certified Information Security Manager ⁠ISACA⁠ (https://www.isaca.org/credentialing/cism)-Security governance, program management, and risk management at scale. 10. CGEIT — Certified in the Governance of Enterprise IT ⁠ISACA⁠ (https://www.isaca.org/credentialing/cgeit)-Enterprise-level IT governance, strategic alignment, and performance risk.

7. 

   2 Dec 2025

   Bonus Episode 4: Careers in GRC - What a Career in GRC Looks Like

   In this bonus episode (1 of 3), we zoom out and unpack what a career in GRC actually looks like. Lily Yeoh explains the field in simple terms, talks through the types of challenges GRC professionals help organizations navigate, and highlights the mix of backgrounds that thrive here. We touch on what early roles focus on, how government and commercial paths differ, and what someone should understand before jumping in. If you’re curious about GRC as a profession, this first of three episode gives you a clear, approachable starting point. 1. GRCP — GRC Professional OCEG (https://www.oceg.org/certifications/grc-professional-certification/)-Great intro to governance, risk, compliance, ethics, and audit basics. 2. CCEP — Certified Compliance & Ethics Professional SCCE (https://www.corporatecompliance.org/certification/become-certified/ccep)-Focuses on compliance, ethics, investigations, and corporate policy. 3. ISO 31000 Risk Management Certification Various accredited bodies (https://www.iso.org/standard/65694.html)-Covers organizational risk frameworks and is accessible without technical depth. 4. CompTIA Security CompTIA (https://www.comptia.org/certifications/security)-Security fundamentals that support GRC roles tied to IT and cybersecurity. 5. CGRC (formerly CAP) ISC2 (https://www.isc2.org/certifications/cgrc)-Intro to governance, risk and security authorization. Good for early GRC careers. ADVANCED LEVEL CERTIFICATIONS These require experience, deeper security knowledge, or exposure to audit, risk, or governance functions. 6. CISSP — Certified Information Systems Security Professional ISC2 (https://www.isc2.org/certifications/cissp)-High-level security governance, risk, architecture, and leadership. 7. CISA — Certified Information Systems Auditor ISACA (https://www.isaca.org/credentialing/cisa)-The gold standard for audit, controls, and assessment work inside GRC teams. 8. CRISC — Certified in Risk and Information Systems Control ISACA (https://www.isaca.org/credentialing/crisc)-Focused on IT risk, business risk, mitigation, and control design. 9. CISM — Certified Information Security Manager ISACA (https://www.isaca.org/credentialing/cism)-Security governance, program management, and risk management at scale. 10. CGEIT — Certified in the Governance of Enterprise IT ISACA (https://www.isaca.org/credentialing/cgeit)-Enterprise-level IT governance, strategic alignment, and performance risk.

8. 

   31 Oct 2025

   Episode 6: Making Cyber Human. Why Risk Starts with People, Not Technology

   Dr. David Mussington, former member of the White House National Security Council and Professor at the University of Maryland, joins Lily Yeoh on All About Risk to challenge how we think about cybersecurity. He argues that the biggest threat isn’t just in the network, it’s in how we communicate, govern, and make decisions. From national policy to AI’s growing role in cyber defense, this episode explores what real resilience looks like when people, not just systems, are at the center of security.

9. 

   22 Sept 2025

   Bonus Episode 3: Understanding GRC - Choosing the Right GRC Tools

   In this final installment of our bonus series Understanding GRC, we explore the practical side of adopting GRC tools. From the limits of spreadsheets to the advantages of integrated platforms, this episode highlights what to look for in a solution, how ROI is measured, and why phasing in processes with a “crawl, walk, run” approach sets organizations up for long-term success.

10. 

    12 Sept 2025

    Bonus Episode 2: Understanding GRC - Where to Start

    In our second bonus episode, we dig into the first steps of building a GRC program with our expert Lily Yeoh. We cover why it starts with people, process, and technology, and the importance of documenting what you’re protecting. You’ll hear how to make policies meaningful instead of just templates, when to bring in expert guidance, and how to get leadership buy-in. We also touch on the real risks of skipping GRC, from regulatory fines to reputation loss.

11. 

    3 Sept 2025

    Bonus Episode 1: Understanding GRC

    Bonus Episodes: Understanding GRC is a special bonus series designed for anyone who’s new to governance, risk, and compliance. Each episode breaks down core concepts into simple, practical insights, helping you understand not just what GRC is, but why it matters and how it impacts everyday business decisions. Whether you’re starting your career, leading a small team, or just curious about the field, this series will give you a solid foundation to build on. In our first bonus episode, we kick things off with the fundamentals: What does GRC really stand for, and how do governance, risk, and compliance actually work together? We’ll also look at why GRC is a framework every business can benefit from.

12. 

    11 Aug 2025

    Episode: 5 What an Audit Really Looks Like from Plante Moran's Yiping Sun

    Yiping Sun is a leader within Plante Moran’s cybersecurity compliance group. Her expertise includes SOC, ISO 27001, STAR, DPR, and more. She’s a CPA, a CISA, and one of the most trusted voices in cyber audit. In this episode, Yiping takes us inside the real world of audit. She speaks with Lily Yeoh about her career path in cybersecurity, breaking down what an effective audit truly looks like—and why it’s far more than just checking boxes. Yiping shares insights on the importance of collaborating with auditors early, how to identify red flags, and the evolving role of auditors. Whether you're in audit, work with auditors, or simply want to understand how assurance really works, this episode offers a practical look behind the scenes. More about Yiping Sun (https://www.plantemoran.com/get-to-know/people/yiping-sun), Principal at ⁠Plante Moran (https://www.plantemoran.com/)

13. 

    3 Jun 2025

    Episode 4: Flipping the Mic: Lily Yeoh on Leadership, Cyber Risk, and the Future of Security

    In this episode, guest host John Paul Tran sits down with Lily Yeoh, CEO of C1Risk, to hear her hot takes on recent GRC events. They dive into insider threats such as the Coinbase hacking, public sector risks, and why faster, smarter governance is more critical than ever.

14. 

    6 May 2025

    Episode 3: From War Rooms to Cyber Frontlines, Terry Roberts on Leadership and Inspiring Women in Tech.

    Lily Yeoh is joined by Terry Roberts, Founder, President & CEO of WhiteHawk. Terry served as a senior leader in the US government; her career in public service includes Director at the Secretary of Defense for Intelligence (USDI) and Deputy Director of Naval Intelligence. She’s led Military Intelligence Programs and the global defense, information-warfare, and technology strategies. In addition, our guest also served as an Executive Director at the Software Engineering Institute at Carnegie Mellon University, where she led technology innovations between Cyber & IT across US Department of Defense and the US Intelligence Community.

15. 

    12 Nov 2024

    Episode 2: ISO 42001 the New standard for AI Governance

    Today, Lily Yeoh is joined by Patrick Sullivan who brings over 25 years of experience in IT security and compliance, making him a trusted voice on AI governance and the new standard ISO 42001. He also provides insights into the work of ISO’s SC 42 subcommittee, which is shaping global standards for AI, including governance, ethics, and trustworthiness—making this essential knowledge for anyone engaged with AI technologies. Hear more from Patrick where he hosts The Business of Compliance, Podcast Edition: https://open.spotify.com/show/2N1aPuS0FFYzYXiXqxvef3?si=6e52ec974c7f4e79

16. 

    7 May 2024

    Episode 1: Risk, AI, and the Evolution of Cybersecurity Roles

    Join C1Risk's CEO, Lily Yeoh and Joe Sullivan as they delve into the confluence of GenAI and Cybersecurity at Ilta Evolve 2024 Joe Sullivan Ex Uber, Cloudflare & Facebook CSO, brings unmatched cybersecurity insights from his extensive career in the private sector. His contributions are further distinguished by his public service, including his appointment by President Obama to the Cybersecurity Commission and his role as a board member of the National Cybersecurity Alliance. Lily Yeoh is the founder and CEO of C1Risk. She is a leading risk management practitioner, recognized for her design and implementation of information security technology solutions for fortune 500 companies, federal and state governments, big four consulting, and Silicon Valley startups.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

2 ratings

Spotify

5.0 / 5

4 ratings

Contact All About Risk

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.