Welcome to Audience 1st. A podcast for tech marketers looking to break out of the echo chamber to better understand their audience and turn them into loyal customers. Every week, Dani Woolf is having brutally honest conversations with busy tech buyers about what really motivates them, the things they hate that vendors do, and what you can do about it. You’ll get access to practical information on how to build authentic relationships with your audience, listen to and talk with your buyers, and apply real customer insights to your strategies and tactics. You owe it to the world to unmute your mic. Are you ready?
audience1st.substack.com (https://audience1st.substack.com?utm_medium=podcast)
What OpenClaw Going Sideways Reveals About How Humans Interact with Technology
Alex Yampolskiy walked back into my studio, sat down, complimented the pillow, and then spent the next hour telling me things that kept me up that night.
It hasn't been long since our first conversation. But in the weeks between sessions, an open-source AI agent called OpenClaw went viral and then went sideways. Tens of thousands of people rushed to install a personal AI assistant that connects to their email, calendar, WhatsApp, and terminal. Almost nobody thought about security before they hit deploy.
SecurityScorecard's research team scanned the entire internet and found over 40,000 exposed instances. No authentication. No encryption. Named in ways that let you identify the person and the company they worked for. Hackers found them before the organizations did.
In this episode, we unpack what OpenClaw reveals about how humans interact with technology and why the problem is much bigger than one tool.
AY explains why people click first and think second in the digital world, even though they'd never walk into a dark alley without looking over their shoulder. He describes AI agents as ephemeral interns with root access who disappear before you can fire them. He walks through why the speed of exploitation has dropped from days to microseconds and why human-speed defense against machine-speed offense is no longer viable.
We get into territory that most cybersecurity conversations avoid. AY is blunt about AI budgets exploding while security budgets stay flat and what that means for CISOs being asked to govern technologies they had no say in adopting. He tells me that most third-party risk programs operate one day a year, leaving 364 days where nobody is verifying anything.
He walks me through Security Scorecard's maturity framework from static, point-in-time assessments to continuous monitoring to threat-informed detection and response and is honest about where most organizations actually sit on that curve versus where they think they sit. The gap between those two points is where the real risk lives.
He makes the case that compliance and security are best friends, not twins, and that the forcing function of regulation is often the only thing that unlocks budget. He explains why the Ukrainians deliberately hacked their own infrastructure before the Russians could. And he says, plainly, that if you can't afford the secure tools, you accept the risk. No soft landing.
Listen in and enjoy.
A special thanks to our friends at Security Scorecard for partnering with us to tell this story.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit audience1st.substack.com (https://audience1st.substack.com?utm_medium=podcast&utm_campaign=CTA_1)
18 Mar 2026
Why Human Risk Will Define the Next Decade of Security
Three decades. Billions of dollars in security investment. And the human element still sits behind 68% to 72% of every breach that happens. If that statistic does not make you uncomfortable, you have probably been in this industry long enough to have accepted it as inevitable. Masha Sedova has not accepted it, and this episode is the result of a career spent refusing to.
Masha co-founded Elevate Security, built it into the leading human risk management platform in the space, and watched it get acquired by Mimecast - where she now leads human risk strategy and product across a portfolio that combines email security, DLP, collaboration security, and behavioral risk intelligence under one roof. She is one of the most rigorous thinkers working at the intersection of people and security, and this conversation left me genuinely rattled in the best possible way.
We talk about what human risk management actually is and why calling it a rebrand of security awareness is a disservice to both categories.
We get into the 8/80 rule - the finding that 8% of your workforce is responsible for 80% of your incidents - and what it means for how security budgets should actually be allocated.
We cover the four personas framework, the open ecosystem bet, the board conversation, and the cultural debt that the phrase 'humans are the weakest link' has accumulated over thirty years.
I push back where I think the industry has not fully reckoned with what it is building, and Masha pushes right back.
If you work in cybersecurity in any capacity - whether you are a CISO, a founder, an investor, or a marketer trying to understand what your buyers actually care about - this episode will change how you think about the human element problem.
Listen and enjoy.
A special thanks to our friends at Mimecast for partnering with us to tell this story.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit audience1st.substack.com (https://audience1st.substack.com?utm_medium=podcast&utm_campaign=CTA_1)
1 Mar 2026
The Kid Who Googled "How to Become a Hacker" and Ended Up Wrecking Real Ones
John Hammond was a kid who Googled "how to become a hacker" and took it seriously. He learned Python, found his way into the Coast Guard Academy, and remembers squaring down a stairwell at two in the morning - rigid military posture, full indoctrination protocol - vibrating with excitement because he was about to sit next to smart people and solve security problems for a living.
That visceral, middle-of-the-night certainty became the foundation of everything that followed.
Today he's a principal security researcher on the Adversary Tactics team at Huntress, employee number twenty-eight at a company that's now over six hundred people.
He's also one of the most recognized cybersecurity educators on the internet, producing hour-long exploit deep dives on YouTube that get more genuine engagement than most vendors' entire content budgets combined.
In this episode, John talks about why the cybersecurity industry is stuck on a treadmill it may never get off and whether the business model actually depends on that treadmill keeping pace.
He explains why Huntress is deliberately slow about integrating AI into their human-led SOC and why that uncertainty is more credible than the confident claims coming from thousands of other cybersecurity vendors in the space.
We also get into territory that most cybersecurity conversations gloss over.
John makes the case that the security awareness gap isn't informational - the information exists, he's made it free on YouTube - it's motivational, and most training programs are built around what the security team thinks is important rather than what the end user actually cares about.
He talks about why checklists function as a ceiling on curiosity, and why the discoveries that actually matter are the ones that never make it onto the procedure document.
And he gets real about burnout - the arc from obsessive passion to unsustainable output that the industry celebrates in keynotes and ignores in its operational expectations.
There's a moment near the end where I asked him to describe Huntress in three words and he gave me an internal mantra - ethical badasses - that says more about how the company thinks about culture as a competitive weapon than any mission statement ever could.
This is a conversation about what happens when someone who never optimized for credibility becomes one of the most credible voices in the room.
Listen and enjoy.
A special thanks to our friends at Huntress for partnering with us to tell this story.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit audience1st.substack.com (https://audience1st.substack.com?utm_medium=podcast&utm_campaign=CTA_1)
Who has been a guest on Audience 1st
Names identified in recent episode analyses. Showing up to five guests.
Chris Thomas
David Doyle
Cybersecurity experts
Val Popke
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
3,529
Score snapshot 15 Sept 2025
Apple Podcasts (US)
5.0 / 5
6 ratings
Spotify
5.0 / 5
10 ratings
Podcast Authority Score: 60 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
70
Social presence
0
YouTube
74
Engagement
51
Host of Audience 1st?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
