About Cyber & AI Perspectives — Insights on Cybersecurity and AI Governance
Cyber & AI Perspectives is a podcast for cybersecurity and AI governance professionals, covering the most important trends, risks, and strategic developments shaping organizations today.
Hosted by Dejan Kosutic, one of the leading experts in cybersecurity and AI governance, each episode delivers deep insights and independent analysis you are unlikely to hear elsewhere — helping you understand what matters now and what is coming next.
To provide feedback or suggest topics for future episodes, contact us at: podcast@advisera.com
Will AI Replace Consultants? How the Industry Will Change
Dejan Kosutic discusses whether AI will take over consulting, drawing on his experience using ChatGPT to complete an ISO 17024 exam validity assessment for Advisera that previously would have required hiring a consultant. He concludes that traditional consulting focused on guiding processes, creating documentation, and answering questions will face major pressure as AI improves. However, consulting has big advantage over AI in innovation and change management. He introduces the Consulting Evolution Matrix with four approaches—Knowledge advisors, Innovation strategists, Change enablers, and Transformation partners—arguing growth will be strongest in business transformation, and urging consultants relying on the Knowledge advisor model to shift toward other quadrants.
(00:00) - Will AI Replace Consultants?
(00:19) - How AI is taking over traditional consulting work
(02:41) - Innovation and change as the key value drivers
(04:11) - Consulting Evolution Matrix
(07:18) - What should consultants do?
19 Sept 2026
Prioritize Your AI Risks: The AI Risk Portfolio Matrix
See the video here: The AI Risk Portfolio Matrix https://www.youtube.com/watch?v=gH8jFGPOrPs (https://www.youtube.com/watch?v=gH8jFGPOrPs)
Dejan Kosutic explains how organizations can quickly identify which AI systems need attention first by using an AI Risk Portfolio Matrix based on three factors: Criticality (how serious consequences could be for people, processes, and data), Reach (how much of the organization or external world is exposed), and Autonomy (how much the system can decide or act without human approval). He contrasts low-risk examples like AI meeting-summary tools with high-risk AI agents controlling industrial equipment, and defines four quadrants - Limited, Serious, Exposed, and Amplified - to support prioritization. The matrix helps AI governance teams get a portfolio-level view, decide where to start, allocate resources, review new AI proposals, and communicate risk to management.
(00:00) - Prioritize Your AI Systems Fast: The AI Risk Portfolio Matrix
(01:05) - Challenges with AI risks
(02:17) - AI Risk Portfolio Matrix
(03:52) - Four AI risk quadrants
(04:37) - How to use the matrix
(06:30) - What this matrix is not
(07:20) - When and why to use the matrix
(08:47) - A technology-agnostic management tool
21 Aug 2026
Stop Preparing Evidence for Your ISO 27001 Audit
If you’re preparing for ISO 27001 certification, shift your focus from asking “How do we prepare the evidence?” to “Are our security processes actually working?” When risks are properly assessed, controls are appropriate, people know their responsibilities, and controls are consistently performed and monitored, the evidence will largely already exist. Build and strengthen the security processes first, and let the evidence follow - because security is about becoming more secure, not about creating documentation for its own sake.
LINK FROM THE VIDEO
► ISO 27001 Certification: What Will the Auditor Look For? | Interview with Aron Lange | EP36 https://www.youtube.com/watch?v=4HNwmgCiKyU (https://www.youtube.com/watch?v=4HNwmgCiKyU)
(00:00) - Stop Preparing Evidence for Your ISO 27001 Audit
(00:17) - How ISO 27001 Certification Audit Works
(01:35) - How Auditors Collect Evidence
(02:27) - Three Things Companies Get Wrong
(04:04) - “Push” vs “Pull” Approach
(04:30) - Evidence Does Not Improve Your Security
(05:01) - Build Security Processes Not Evidence
(06:14) - Let The Evidence Follow
7 Aug 2026
Cybersecurity is More Than AI: 3 Trends You Shouldn’t Ignore
Dejan Kosutic argues that a major cybersecurity mistake today is focusing so much on AI that companies overlook other critical trends. He highlights three non-AI areas that need attention: quantum computing and post-quantum cryptography, emphasizing the “harvest now, decrypt later” threat and why PQC matters now; supply chain security, noting that breaches often occur through vendors and that third-party risk management is difficult because it is technical, organizational, and legal; and a shift from pure prevention to cyber resilience, meaning companies must assume serious incidents will happen and prepare to continue operating and recover after attacks. He concludes that AI is important but shouldn’t become a blind spot, and points listeners to a podcast episode with Andrew Gault for more on quantum.
LINK FROM THE VIDEO
► What CISOs Must Do Now About Quantum? | Interview with Andrew Gault | EP34 https://www.youtube.com/watch?v=QEwaCY1OPhY (https://www.youtube.com/watch?v=QEwaCY1OPhY)
(00:00) - Cybersecurity is More Than AI
(01:03) - 1. Quantum Computing and Post-Quantum Cryptography
(02:19) - 2. Supply Chain Security and Third-Party Risk
(03:44) - 3. From Cybersecurity to Cyber Resilience
(04:39) - The Bigger Picture
24 Jul 2026
Who Will Win the Software Vulnerability Race? Five Scenarios
Dejan Kosutic explains how increasingly powerful AI models will be accessible to both attackers and defenders, accelerating the software vulnerability race. He outlines five scenarios: permanent defender advantage, permanent attacker advantage, a two-tier world where well-resourced organizations improve while SMEs and under-resourced sectors become prime targets, a “catch-up” period where breaches spike then decline as patching catches up, and “drowning the defenders,” where AI-generated code, more low-skill attackers, and overwhelming vulnerability reports strain weak teams. He concludes AI changes speed, not fundamentals, and recommends a related podcast episode on Mythos and vulnerability management.
LINK FROM THE VIDEO
► Anthropic’s Mythos and the Future of Vulnerability Management | Interview with Thom Langford | EP35 https://www.youtube.com/watch?v=axLwXoUYOak (https://www.youtube.com/watch?v=axLwXoUYOak)
(00:00) - Who Will Win the Software Vulnerability Race?
(00:19) - Five Key Trends
(01:32) - Permanent Defender Edge Scenario
(01:50) - Permanent Attacker Edge Scenario
(02:10) - Two-Tier Security Scenario
(02:48) - Catch Up Scenario
(03:28) - Drowning Defenders Scenario
(04:18) - Takeaways and Wrap Up
10 Jul 2026
Security vs. Compliance: Are We Asking the Wrong Question?
Dejan Kosutic discusses whether security or compliance is more important and argues that this is the wrong question. He explains how compliance can support security through three “Bs”: acting as a booster by unlocking budgets when regulations or client requirements make security obligatory; providing a baseline via standards like ISO 27001 and technical security standards; and enabling a business case when ROI is hard to measure by showing avoided penalties, reduced liability, and potential revenue gains. He concludes that security is the ultimate goal while compliance is an enabler.
LINK FROM THE VIDEO
► Report: Compliance and information security - How are they related? https://advisera.co/InfoSecCompliance
(00:00) - Security vs. Compliance Are We Asking the Wrong Question?
(00:12) - Different People See Security Differently
(01:07) - How Compliance Helps Security
(02:35) - Compliance as Enabler, Security as a Goal
26 Jun 2026
The Missing Half of Cybersecurity: Security Management
Dejan Kosutic explains a common bias in cybersecurity: focusing on implementing controls but not managing them. Using backups as an example, he outlines why effective security requires planning (e.g., setting objectives like RPO and backup frequency), monitoring to ensure controls work in production, internal audits to verify tasks are performed, continual improvement to prevent recurring issues, and management review to escalate unresolved problems, funding needs, or rule changes. He notes these elements reflect security management practices described in ISO standards such as ISO 27001 and ISO 42001, which he argues help organizations understand how to manage security beyond implementation. He adds that security management will become increasingly important due to regulations like NIS2 and DORA, rising cybersecurity complexity, and incidents caused by overlooked details or trends.
LINK FROM THE VIDEO
► What is an Information Security Management System (ISMS)? https://advisera.com/27001academy/blog/2016/05/23/information-security-management-system-isms-according-iso-27001/ (https://advisera.com/27001academy/blog/2016/05/23/information-security-management-system-isms-according-iso-27001/)
(00:00) - The Missing Half of Cybersecurity: Security Management
(00:14) - Cybersecurity implementation vs management
(02:02) - The missing piece: Security management
(02:43) - The rising importance of security management
(03:27) - Further reading
12 Jun 2026
The Dangerous Illusion of Cyber Readiness | Cyber & AI Perspectives
Dejan Kosutic explains that while many companies believe they are prepared for disruptive incidents, their continuity and recovery plans alone are often insufficient. He argues that plans cannot replace missing resources such as redundant systems, properly secured backups, or replacement staff, and that unclear recovery time and data loss tolerances lead to misaligned preparations. He also notes that complex dependencies across people and systems can cause recovery steps to fail, and that real incidents create chaos where people may react irrationally. Kosutic recommends defining business continuity strategies using RTOs and RPOs, mapping dependencies across processes, systems, suppliers, and regularly exercising plans with realistic scenarios involving senior management and key suppliers, referencing frameworks like ISO 22301.
LINKS FROM THE EPISODE:
► Responding to Ransomware Attack [Case Study] | Interview with Yannick Hirt | EP29 https://www.youtube.com/watch?v=V3DhNF9-wfc (https://www.youtube.com/watch?v=V3DhNF9-wfc)
► Cyber Ranges, Attack Simulations & AI: Proving Cyber Readiness | Interview with Lee Rossey | EP32 https://www.youtube.com/watch?v=zId18MlZeKM (https://www.youtube.com/watch?v=zId18MlZeKM)
(00:00) - The Dangerous Illusion of Cyber Readiness
(00:45) - Why plans alone are not enough?
(03:09) - How to build true cyber resilience
(04:21) - The real goal: Resilience
29 May 2026
Lessons From the C-I-A Triad to Build Trustworthy AI | Cyber & AI Perspectives
Dejan Kosutic explains how cybersecurity’s CIA Triad—confidentiality, integrity, and availability—has guided risk identification, prioritization, and control selection for decades, and argues that AI governance needs a similarly clear guiding principle: trustworthiness. Citing the OECD AI Principles, the EU AI Act, and the NIST AI Risk Management Framework, he describes trustworthiness as central to broader AI adoption because AI systems are non-deterministic and can produce different outputs from the same inputs. He shows how trustworthiness can steer AI risk management by helping organizations identify risks like biased outputs, assess impact through trust and reputational damage, and choose controls such as trusted training data or human review.
LINK FROM THE EPISODE
► AI Goals and Objectives: Why is Trustworthiness Important? | AI Literacy Series https://www.youtube.com/watch?v=AnZLw9IRh4E
(00:00) - What the C-I-A Triad can teach us about AI
(00:32) - Why is the C-I-A Triad important for cybersecurity?
(02:15) - Importance of trustworthiness for AI
(03:30) - Applying cyber logic to AI
(04:56) - Addressing larger AI challenges
14 May 2026
How Apple Uses Cybersecurity as a Competitive Advantage
Dejan Kosutic explains how cybersecurity can create a real competitive advantage and uses Apple as a key example. He notes many companies pursue ISO 27001 and similar certifications mainly for sales and market access, but questions whether certificates provide a lasting advantage since competitors can obtain them with relatively little time and money. He defines competitive advantage as having something competitors lack and find hard to replicate, illustrating this with SpaceX’s reusable rocket technology. Kosutic argues long-term advantage comes from integrating security and privacy into product design and brand, as Apple has done through features like advanced biometric authentication, built-in malware protection, and resisting government access to user data. He concludes that cybersecurity must be driven strategically, with CISO involvement in business strategy and security embedded throughout product development.
LINK FROM THE EPISODE
► How to achieve sustainable competitive advantage through cybersecurity https://advisera.co/CyberSecAdvantage (https://advisera.co/CyberSecAdvantage)
(00:00) - How Apple Uses Cybersecurity as a Competitive Advantage
(00:11) - Do certificates provide a competitive advantage?
(01:01) - An example of a competitive advantage
(02:12) - How Apple uses cybersecurity?
(03:52) - What should you do?
Contact Cyber & AI Perspectives — Insights on Cybersecurity and AI Governance
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Cyber & AI Perspectives — Insights on Cybersecurity and AI Governance?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
