In Progress By Aviatrix features candid, unscripted conversations between Doug Merritt and provocative guests from business, government, and security. No scripts. No product pitches. Just frank and open dialogue about leadership, decision-making, and the realities of building organizations--naturally with some insights about the state of cybersecurity today. Designed to give you inspiration for your own career, role, and leadership execution.
In Progress: because nothing worth building is ever finished. And that's not a flaw. That's the point.
New episodes biweekly on LinkedIn, YouTube, Spotify, and Apple Podcasts.
Clint Bruce: Arrows, Archers, and the Harder Thing
Clint Bruce made the Baltimore Ravens, then walked away to become a Navy SEAL. He joins Aviatrix CEO Doug Merritt to talk about choosing the harder path, treating talent as a credit line, and why “money is bullets” for his nonprofit, Carry The Load. They also cover the shift from arrow to archer, why some leaders aren’t wrong but early, and Zero Trust as “Camelot with a SWAT team.”
Key takeaways:
When in doubt, do the harder thing. If the choice is moral, legal, and ethical, the worst outcome is learning a lot about yourself.
Talent is a credit line you steward. Gifted people often break the first time they aren’t the fastest one in the room.
Building and leading are different jobs. An arrow makes an impact wherever it hits. An archer makes a difference wherever they aim.
Command, don’t just control. Leaders move through talent, train, task, and trust so they can look up at the problem instead of down at the map.
Early isn’t the same as wrong. Business feedback can take years to arrive. And when there’s no resistance at all, it’s probably an ambush.
To connect with Clint, visit him on LinkedIn at linkedin.com/in/clintbruce/ (https://www.linkedin.com/in/clintbruce/).
8 Oct 2026
Ashish Rajan: Security for AI, Not AI for Security
In this episode of In Progress, Aviatrix CEO Doug Merritt sits down with Ashish Rajan, host of the Cloud Security Podcast and AI Security Podcast. The two discuss why security fundamentals still hold in the age of AI, how identity management became critical now that thousands of AI agents carry their own credentials, and what the OpenAI/Hugging Face breakout revealed about the need for network-layer containment.
Key Takeaways:
With every employee running ten or more AI agents, organizations now face thousands of credentialed non-human identities, and least privilege is harder to enforce than ever.
AI-enhanced security tools will be absorbed into everyday workflows, but securing AI systems themselves will remain a distinct and growing challenge.
Identity, network, and traditional security controls still apply to AI, but natural-language communication between agents creates blind spots legacy detection can't address.
When an agent goes rogue, you need the ability to revoke its identity, quarantine its compute, and cut its network access. When Hugging Face needed to stop a sandbox breakout, they reached for the network layer.
16 Sept 2026
John Qian: Building Security Programs Under Fire
In the latest episode of "In Progress," Aviatrix CEO Doug Merritt sits down with Aviatrix CISO John Qian to trace his unlikely journey from product engineer to security leader, unpack what it took to build Zoom's security program in the middle of a pandemic, and explore why AI is rewriting the rules on both sides of the fight — and why none of it matters if you haven't thought about containment.
Key Takeaways:
Security expertise doesn't come from building security products. John's career pivot began when customers started finding vulnerabilities in Cisco's own tools — and his team couldn't explain how the attacks worked.
Building security at hypergrowth means flying while you build. John grew Zoom's security team from 10 to 300 during COVID, pausing all development to fix security bugs while fending off nation-state attackers.
Shift-left only works if you show up prepared. Run risk assessments early, join design meetings for high-risk features, and tune CI/CD tooling carefully — false positives destroy credibility with developers.
AI makes design reviews more comprehensive than any human. It can also generate proof-of-concept exploits in minutes instead of days, which means attackers have that same advantage.
Think containment by default, not just patch and pray. With AI accelerating vulnerability discovery and supply chain attacks putting compromised workloads directly into your environment, the vulnerability deficit means patching alone will never be enough.
2 Sept 2026
John Kindervag: How Zero Trust Was Born
John Kindervag, creator of the Zero Trust model, joins host Doug Merritt on In Progress to trace Zero Trust's origin story — from LAN parties and firewall configurations to federal security mandates. John explains how getting fired for adding outbound rules to firewalls eventually led him to develop the framework at Forrester Research. The two dig into why trust is a vulnerability, how to protect what matters most, and why better policy — not more products — is the real fix.
Key Takeaways:
Trust is a human emotion, not a network concept — and treating it as one creates the vulnerabilities attackers exploit.
Focus on "protect surfaces," not everything at once. Defend your most critical assets individually, and Zero Trust becomes incremental and non-disruptive.
All bad things happen inside of an allow rule. If something bad happened, a policy somewhere permitted it.
Stop buying products and start building policy. One consistent policy construct — who, what, when, where, why, and how — can apply across your entire environment.
Security won't improve until CEOs change how cybersecurity is incentivized. CISOs need real authority, not just accountability when things go wrong.
19 Aug 2026
Eric McAlpine: The New Physics of Cyber
In this episode of In Progress, CEO Doug Merritt sits down with Eric McAlpine, Founder and CEO of Momentum Cyber, the cybersecurity industry's first dedicated investment bank. Eric shares how he built Momentum after stints at Citigroup and Blackstone, and what the firm's deal data reveals about a market moving faster than anyone predicted — from billion-dollar mega deals becoming routine to an AI security M&A category that went from nonexistent to white-hot in under two years. With 218 deals in the first half of this year and strategic acquirers racing to buy what they can't build fast enough, Eric maps the forces reshaping the landscape.
The conversation turns to a fundamental problem: detection alone isn't closing the gap. Doug and Eric argue that the industry's default playbook — detect faster, patch faster — misses the point, and that security needs an architectural reset. They lay out three runtime control points where threats can actually be stopped in progress: identity, compute, and network. Eric closes with a prediction: follow the talent moving between hyperscalers and AI labs, and follow the capital behind them.
Key Takeaways
AI security M&A is moving at unprecedented speed. A category that didn't exist two years ago jumped from 10 deals last year to a projected 50–60 by year-end, as companies like CrowdStrike, Palo Alto Networks, and Akamai spend hundreds of millions to fill AI roadmap gaps.
The mega deal era is accelerating. Cybersecurity M&A is on pace to exceed last year by 10%, yet most deal values remain undisclosed, making the market harder to read than it appears.
Detection without prevention is a dead end. The industry excels at seeing threats but struggles to stop them. Investors are responding, backing prevention-oriented companies with outsized funding rounds.
Security needs to go back to first principles. Three runtime control points — identity, compute/endpoint, and network — are the foundational layers where organizations can stop attacks in progress.
5 Aug 2026
Keith Wojcieszek: Cybercrime Runs Like a Fortune 500 Company
In this episode of In Progress, CEO Doug Merritt sits down with Keith Wojcieszek, former Chief of the Secret Service's Cyber Intelligence Section, to unpack what modern cybercrime actually looks like. Keith draws on his career-defining case against Roman Seleznev, once one of the world's most prolific credit card data traffickers, to show how cybercriminal operations now run like Fortune 500 companies or cartels, with developers, brokers, and money launderers each playing a defined, well-compensated role. He also traces how ransomware economics have shifted, why many groups have dropped encryption altogether in favor of simpler extortion, and how AI is making both attackers and defenders faster.
Doug and Keith also dig into what separates organizations that handle breaches well from those that don't: preparation. Drawing on incidents like the Colonial Pipeline shutdown and the Stryker attack, they argue the real vulnerability isn't how attackers get in, but how fast and far they can move once inside. It's a conversation about treating cybersecurity as a business risk rather than a purely technical one, and why boards need answers to hard questions before, not during, a crisis.
Key Takeaways
Cybercrime is organized like a business. Roles are specialized and clearly compensated, from malware developers to money launderers, making these networks resilient and hard for law enforcement to dismantle.
Ransomware economics are shifting. The cost of storing and servicing stolen data has led many groups to abandon encryption entirely in favor of extortion alone.
Lateral movement, not initial access, is the real threat. Incidents like Colonial Pipeline and Stryker show that how fast attackers spread internally matters more than how they got in.
Preparation is non-negotiable. Boards should know who's responsible for which decisions in the first 24 hours of an attack, well before one happens.
22 Jul 2026
Nick Reva: Assume Containment, Not Breach
Nick Reva's path to becoming Global Director of Engineering Security at DoorDash started with a high schooler's curiosity about getting around network restrictions to reach Napster — a rabbit hole that turned into a career spanning Wrigley, PwC, SpaceX, and Snap, where he went from analyst to Snap's 32nd security hire and eventually turned what he learned into a Udacity course on cloud-native security and an upcoming book.
In this episode of In Progress, Nick and Doug dig into why "assume breach" might be the wrong mindset for the cloud era, what it actually takes to build guardrails developers will use without a fight, and how Elon Musk's first-principles thinking reshaped the way Nick leads security teams — a conversation about engineering discipline, practical risk management, and why a cracked-open window in your cloud environment might matter more than the breach itself.
Key takeaways:
Why Nick argues the industry should shift from "assume breach" to "assume containment" — and what that changes about incident response
The guardrails-not-gates philosophy that lets developers move fast without becoming security experts
How Nick's team found a workable path through an "impossible" secure-SDLC mandate on SpaceX's Falcon codebase
Applying Elon Musk's first-principles reasoning to break security problems down to their core "whys"
Why Nick sees cloud security footholds as a societal and economic risk, not just a technical one
8 Jul 2026
Chris Hughes: Not Prevention, But Resiliency
In the inaugural episode of In Progress, Aviatrix CEO Doug Merritt talks with Chris Hughes — CISA Cyber Innovation Fellow, author of Software Transparency, Effective Vulnerability Management, and Securing AI Agents, and founder of Resilient Cyber — about the forces reshaping security: exponential CVE growth, AI as both attacker and defender, the limits of "human in the loop," and why resilience now matters more than prevention.
Key Takeaways:
CVEs are exploding — over 40,000 in 2025, with 2026 projections near 60,000 (some estimates up to 100,000) — while AI makes vulnerabilities easier to find and exploit.
Patching capacity has long lagged below 10% of the backlog; broken production risk and competing business priorities keep it there.
Security should shift from trying to prevent every incident to containing and recovering from the ones that happen.
"Human in the loop" doesn't scale against AI-driven attack volume — defenders need to fight AI with AI.
Security teams that act as collaborators, not blockers, avoid the shadow-IT workarounds that punitive policies create.
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
1 ratings
Spotify
5.0 / 5
1 ratings
Contact In Progress By Aviatrix
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of In Progress By Aviatrix?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
