Human Signal

About Human Signal

The Briefing with Dr. Tuboise Floyd The Briefing explores artificial intelligence, cybersecurity, quantum technology, and the decisions shaping business, government, and everyday life. Hosted by Dr. Tuboise Floyd, the show brings technology leaders, executives, founders, and practitioners into candid conversations about emerging technologies and their real-world consequences. Every conversation begins with a question worth examining. What should organizations invest in? Which risks are acceptable? What evidence deserves our trust? Who has the authority to decide, and who remains accountable when conditions change? From AI governance and cybersecurity to quantum computing, post-quantum readiness, critical infrastructure, national security, and the future of work, The Briefing examines how technology changes the decisions people make and the responsibilities leaders carry. Guests share firsthand experience, challenge assumptions, and explore the tradeoffs behind consequential decisions. The conversations are grounded in practical experience, informed disagreement, and a willingness to follow the evidence wherever the discussion leads. The Briefing is for executives, technology professionals, entrepreneurs, policymakers, and curious listeners who want to understand where technology is heading and what those developments mean for their organizations, communities, and lives. Produced by Human Signal, an independent media and decision assurance platform. Find the decision. Follow the evidence. Name who owns it. Watch, listen, and explore: https://humansignal.io/thebriefing Advertising, sponsorship, and business inquiries: thebriefing@humansignal.io This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

Publisher

Dr. Tuboise Floyd

Category

news · news · technology

Language

en

Explicit

No

First episode

21 Oct 2025

Latest episode

18 Oct 2026

Latest episodes

46 episodes in the feed.

1. 

   18 Oct 2026

   Who Can You Trust? AI, Cybersecurity & Starting Over | Keisha Bent

   Who do you trust when everyone claims to be an expert? Keisha Bent has spent years working in technology, project management, and compliance. Now she's pursuing a new direction in cybersecurity and privacy, studying at Florida State University's College of Law and building her podcast, Oh Hell No, Not My Data. In this episode of The Briefing, Dr. Tuboise Floyd talks with Keisha about career transitions, AI privacy, cybersecurity, professional credibility, and the work of independent media. The conversation begins with a practical question: When an organization approves an AI tool, how do employees know what they're actually permitted to do with it? From there, we explore human oversight of AI, the risks of autonomous agents, and the difficulty of separating credible expertise from impressive credentials. Keisha shares what happened when a podcast guest couldn't answer questions about their claimed area of expertise, how she handled the conversation, and why curiosity remains central to her approach. We also discuss her decision to pursue cybersecurity and privacy law, the transferable skills that make career changes possible, and what goes into building an independent podcast. Toward the end, Keisha offers advice for anyone starting something new: “Don't follow trends. Don't follow the hype. Follow your interests.” In this conversation: Breaking into cybersecurity through compliance, privacy, and transferable skills AI governance, employee training, and appropriate use of approved AI tools Human-in-the-loop oversight and AI agents How to evaluate expertise and ask better questions Changing careers and pursuing graduate education Building an independent podcast with patience and purpose Defining success on your own terms About the guest Keisha Bent (https://www.linkedin.com/in/keisha-bent-ma-0985442a7/) is the host of Oh Hell No, Not My Data (https://www.youtube.com/channel/UCfGlnC7m08eVm9wlaMa9IbQ/about), (https://www.youtube.com/channel/UCfGlnC7m08eVm9wlaMa9IbQ/about) a podcast exploring cybersecurity, privacy, technology, and the professionals working across these fields. About The Briefing The Briefing (https://humansignal.io/thebriefing) with Dr. Tuboise Floyd (https://www.linkedin.com/in/drtuboisefloyd/) (https://www.linkedin.com/in/drtuboisefloyd/)explores artificial intelligence, cybersecurity, quantum technology, emerging technology, and the decisions shaping our future. Independent conversations at the point of decision. Find the decision. Follow the evidence. Name who owns it. Host: Dr. Tuboise Floyd Guest: Keisha Bent, Host of Oh Hell No, Not My Data Creative Director: Jeremy Jarvis (https://www.linkedin.com/in/mjeremyjarvis/) Production: A Human Signal Production Explore The Briefing: https://humansignal.io/thebriefing (https://humansignal.io/thebriefing) Human Signal: https://humansignal.io (https://humansignal.io/) #Cybersecurity #ArtificialIntelligence #CareerChange This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

2. 

   22 Sept 2026

   Post-Quantum Readiness: Can You Find Your Cryptography Before Quantum Does? | David Pollak

   Everybody keeps asking the same quantum question: When is Q-Day? But that may not be the question that matters to the person who eventually has to sign the migration plan. Before an organization can replace vulnerable cryptography, it has to know where that cryptography exists. And before leadership tells a board that the problem can be fixed, somebody has to determine whether a replacement actually exists. In this episode of The Briefing, Dr. Tuboise Floyd sits down with David Pollak, Founder and CEO of Spice Labs, for a practical examination of post-quantum readiness, cryptographic discovery, CBOMs, software supply-chain risk, and crypto agility. Pollak argues that traditional source-code and network scanning can reveal pieces of the problem without necessarily producing a complete, correlated view of the cryptography embedded across applications, libraries, containers, virtual machines, third-party components, certificates, and dependencies. The conversation gets to a larger leadership question: What evidence would you be willing to sign your name to? Pollak describes the role of a Cryptographic Bill of Materials (CBOM) in identifying cryptographic libraries, where cryptography is being invoked, how algorithms are configured, and the cryptographic material contained inside software. The discussion also examines why crypto agility matters. Pollak compares hard-coded cryptography to putting a jacuzzi motor behind drywall: when something changes, you have to tear into the system to replace it. Crypto agility creates the equivalent of an access door, allowing cryptographic algorithms to be changed with substantially less disruption. The conversation then moves from discovery to measurement. For Pollak, readiness cannot simply be a green spreadsheet or completed Jira burndown. Organizations need evidence of what has actually been compiled into software and a way to measure whether cryptographic posture changes as remediation proceeds. Floyd and Pollak also examine the procurement problem: an organization can address its own code and still inherit cryptographic exposure through someone else's software. That makes vendor evidence, supply-chain auditing, CBOMs, and third-party attestation increasingly important to buyers. And when the conversation reaches the decision a CISO, CIO, CTO, or board can make now, Pollak offers a deceptively difficult answer: Decide what can be dropped. Prioritization requires saying no. If everything is important, nothing is. Leadership therefore needs to know what matters, what does not, and document that decision. The result is a different way of thinking about post-quantum readiness. It does not begin with predicting Q-Day. It begins with knowing what you have, knowing what can be replaced, knowing what cannot, determining what evidence demonstrates that the work was actually completed, and putting a name next to the decision. IN THIS EPISODE • Why cryptographic discovery comes before post-quantum migration • Why source-code scanning alone cannot reveal the entire cryptographic estate • Why network scanning and application inventories must be correlated • SBOM vs. CBOM • What a Cryptographic Bill of Materials actually contains • Cryptography hidden inside third-party and open-source software • Software artifacts, JARs, containers, virtual machines, and dependencies • Cryptographic certificates, keys, algorithms, and material • Crypto agility and the cost of hard-coded cryptography • Measuring actual remediation instead of relying on compliance spreadsheets • Software supply-chain exposure • Vendor and procurement questions for post-quantum readiness • External auditing and third-party attestation • Why software must be treated as a dynamic asset • Long-term technology investment and short-term organizational incentives • What CISOs, CIOs, CTOs, and boards should prioritize now • Why every migration plan eventually requires someone to decide what does not get fixed first THE BUYER'S TEST A vendor tells you: “We're quantum safe.” What should you ask next? How are you managing certificates and cryptographic inputs? Have you tested the system without classical certificates, cryptography, or keys? How have you audited your software supply chain? What evidence demonstrates what exists inside third-party and open-source components? Who independently audited the claim? Mechanics. Process. Third-party attestation. CHAPTERS 00:00 — Q-Day May Be the Wrong Question 01:00 — Meet David Pollak, Founder & CEO of Spice Labs 02:00 — Do Organizations Know Where Their Cryptography Is? 03:00 — Why an Inventory Is Not Enough 05:00 — Inspecting the Build Artifact 07:00 — What Would You Be Willing to Sign? 08:00 — What's Actually Inside Modern Software? 10:00 — Decision Assurance and Cryptographic Evidence 11:00 — SBOM vs. CBOM 12:00 — What a CBOM Actually Tells You 14:00 — Cryptographic Material and Legacy Certificates 15:00 — Inside Spice Labs' Cryptographic Analysis 17:00 — Third-Party Software and Quantum Readiness 18:00 — Migration Deadlines and the Leadership Problem 19:00 — Why Post-Quantum Migration Takes Time 20:00 — Partner Message: MCGlobalTech CMMC Assured Enclave 21:00 — Harvest Now, Decrypt Later—and Digital Trust 23:00 — What Happens When Digital Signatures Cannot Be Trusted? 27:00 — What Crypto Agility Actually Means 31:00 — Discovery Is the Starting Line 32:00 — Measurement vs. Compliance Checklists 34:00 — Measuring Ground Truth 37:00 — Software Supply-Chain Visibility 38:00 — Should Buyers Require CBOM Evidence? 39:00 — The Buyer's Test for “Quantum Safe” Vendors 41:00 — What Executives Misunderstand About Software 43:00 — Short-Term Incentives vs. Long-Term Readiness 44:00 — The One Decision Leaders Can Make Monday Morning 45:00 — What Do You Drop on the Floor? GUEST David Pollak (https://www.linkedin.com/in/bearfeeder/) Founder & CEO, Spice Labs (https://www.spicelabs.io) David Pollak has spent nearly two decades building open-source systems and examining how software is composed. He created Lift, one of the early major Scala web frameworks, helped advance Scala adoption across industry and academia, and later worked as a distinguished engineer on dependency analysis and enterprise software risk. At Spice Labs, Pollak is applying mathematical methods to software and cryptographic discovery to produce verifiable records of system composition and help organizations understand the software, dependencies, and cryptography their systems actually contain. ABOUT THE BRIEFING The Briefing with Dr. Tuboise Floyd is an independent Human Signal production examining consequential decisions across artificial intelligence, quantum technology, cybersecurity, governance, and emerging technology risk. Real conversations. Higher stakes. Find the decision. Follow the evidence. Name who owns it. Hosted by Dr. Tuboise Floyd (https://humansignal.io/mission) Creative Director: Jeremy Jarvis (https://www.linkedin.com/in/mjeremyjarvis/) A Human Signal Production PARTNER DISCLOSURE This episode includes a partner message from MCGlobalTech (https://www.mcgcyber.com), a Human Signal (https://humansignal.io) partner, for the CMMC Assured Enclave. Commercial partnerships and underwriting do not determine guest selection, questions, analysis, or editorial conclusions. This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

3. 

   15 Sept 2026

   Passing the Test Is Not Staying Compliant | CMMC, AI & Governance with William McBorrough

   Passing the test and staying compliant are two different jobs. A defense contractor can spend months preparing for an assessment, pass it, and begin losing ground almost immediately. Why? Because assessment readiness is not the same thing as operating a sustainable compliance program. In this episode of The Briefing (The Briefinghttps://humansignal.io/thebriefing), Dr. Tuboise Floyd (https://humansignal.io/mission) sits down with William McBorrough (https://williammcborrough.com), CISO and Lead CMMC Assessor, MCGlobalTech (https://www.mcgcyber.com) for a conversation about what happens every day after assessment day. William has seen the problem from both sides: building cybersecurity compliance programs and assessing whether organizations can actually operate what they documented. The conversation starts with CMMC and the Defense Industrial Base, then moves into governance, evidence, executive accountability, technology procurement, and AI. Because whether the system is a cybersecurity compliance program or an AI use case, the underlying question is remarkably similar: Can you prove that what you say is happening is actually happening? FULL SHOW NOTES Passing the test is not staying compliant. A company can spend a year preparing for an assessment, pass it, and watch the program begin coming apart afterward. The people who built it return to their regular jobs. The documentation stops matching the work. The next assessor may discover an organization that was compliant once. That is the problem at the center of this episode of The Briefing. Dr. Tuboise Floyd sits down with William McBorrough, CISO and Lead CMMC Assessor, to examine what happens when organizations build cybersecurity compliance programs around assessment day instead of the operating capability required for every day after it. William describes this as a sustainability problem. Organizations frequently buy audit-readiness services, tools, consulting, and managed services designed to get them through a point-in-time assessment. But when the audit becomes the goal, organizations can immediately begin drifting once the assessment is over because the ongoing activities required by the compliance program were never built into normal operations. That leads to one of the central arguments of the conversation: CMMC is a governance problem. Cybersecurity compliance requires more than a mandate. Governance is a discipline requiring people, skills, processes, accountability, and the capability to perform the work repeatedly. And an assessor can see the difference. If an organization's policy says access is reviewed every month, an assessor doesn't simply want to read the policy. Where are the records? What process was followed? Who performed the work? Can the organization demonstrate that the activity actually occurred? An assessor is looking for evidence that the program is operating, not merely evidence that somebody documented one. Then the conversation crosses into AI. William explains why security leaders increasingly find themselves responsible for AI risk because AI is already entering organizations. Rather than serving as the traditional "voice of no," he describes the security leader's job as finding a secure path to legitimate business objectives. That raises another governance problem: How do you use AI without simply turning it loose? William explains how MCGLOBALTech approaches AI inside its compliance operations. The organization governs AI by use case, not simply by declaring a particular AI product acceptable. Different uses of the same tool can create very different risks. There are also boundaries. AI is not used on client data inside MCGLOBALTech's client environments. AI is instead used for specific approved operational purposes outside those prohibited uses. And there is an important operating rule: Do it manually first. William's team develops the process manually, operates it, validates that the process produces the desired outcome, and only then determines how AI can accelerate or automate it. The process is not created by AI. AI is applied after the organization understands the process and knows what a valid outcome should look like. That distinction matters because AI can produce something that looks convincing even when it is wrong. As William explains in the conversation, asking AI for a heart-surgery plan may produce something that looks excellent to someone who isn't a heart surgeon. Expertise is what allows someone to recognize whether the output is actually valid. The same discipline required for sustainable cybersecurity compliance begins appearing again in AI: Defined processes. Clear boundaries. Validated outputs. Evidence. Human judgment. Accountability. The episode also gets personal for executives. CMMC and federal cybersecurity requirements eventually reach the people whose names stand behind what the organization says is true. William advises CEOs operating in the federal space to examine their contracts, understand the security obligations contained in them, and determine whether their organizations actually possess the capability to meet those obligations. He also discusses the responsibility of the senior official affirming an organization's compliance information and the importance of having evidence behind what leadership is being asked to stand behind. The question isn't simply: Did we pass? It is: Can we prove we're still doing what we said we do? The assessment is a day. The program is every day after. IN THIS EPISODE • CMMC and the compliance sustainability gap • Passing an assessment versus sustaining compliance • CMMC Level 2 • What CMMC assessors actually look for • Evidence versus documentation • Governance versus audit readiness • NIST 800-171 requirements • Cybersecurity inside the Defense Industrial Base • Small-business compliance challenges • Governance as an operating discipline • Executive accountability and attestation • Security obligations inside federal contracts • AI governance • The CISO as an AI governance leader • Governing AI by use case • ChatGPT, Claude and Microsoft Copilot • Separating AI experimentation from controlled environments • Manual validation before AI automation • Validated outputs versus convincing outputs • Continuous review of AI use cases • Why technology-first procurement fails • What CEOs should examine now GUEST William McBorrough CISO, Lead CMMC Assessor MCGLOBALTech William McBorrough is a cybersecurity and compliance leader whose work spans building, operating, and assessing security governance programs. He has spent more than 16 years building security compliance programs and has supported defense contractors around NIST 800-171 requirements and cybersecurity compliance. His work has included organizations ranging from five employees to 5,000 employees, while MCGLOBALTech also serves federal government organizations. William is also an associate professor of cybersecurity at the University of Maryland Global Campus, serves on the EC-Council Global Advisory Board, publishes the SMB CISO Insights newsletter, and is the author of Beyond Compliance, a governance roadmap focused on sustainable CMMC. ABOUT THE BRIEFING The Briefing with Dr. Tuboise Floyd is independent media examining the decisions underneath consequential technology. AI. Quantum. Cyber. The technology is only the beginning of the story. Find the decision. Follow the evidence. Name who owns it. Independent media. Real conversations. Higher stakes. A Human Signal Production Hosted by Dr. Tuboise Floyd Creative Director: Jeremy Jarvis Watch and listen: humansignal.io/thebriefing EDITORIAL / PARTNER DISCLOSURE MCGLOBALTech is a paying Human Signal partner, and Dr. Tuboise Floyd has performed contract advisory work with the firm. The partnership does not determine guest selection, questions, editorial conclusions, favorable treatment, or endorsement. Editorial questions and conclusions remain independent. This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

3 ratings

Contact Human Signal

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.