SOCSoter Unfiltered

About SOCSoter Unfiltered

Cybersecurity unfiltered. Hosted by Melissa Kaiser of SOCSoter, this podcast cuts through the noise with real conversations about threats, compliance, and what it actually takes to defend a business in today's landscape. No fluff. Just the truth.

Publisher

Nathan Ng

Category

business · technology

Language

en

Explicit

Yes

First episode

8 Jun 2026

Latest episode

26 Oct 2026

Latest episodes

17 episodes in the feed.

1. 

   26 Oct 2026

   Most Companies Use Only Part of the ERP They Already Paid For, with Shawn Mayo - Ep 17

   "We get tons of people that will come to me and say, 'Hey, I want an AI platform.' And I say, okay, for what? Because it's a buzzword." Who They Brought In Shawn Mayo (https://www.linkedin.com/in/shawn-mayo1/) is the CTO of Hybrid Workforce (https://hybridworkforces.com/) and a fractional CTO of AI Workforce. He has about 20 years in technology and has implemented more than 40 platforms, mostly ERPs. He started as an accountant at New York Life, worked on bonds and investments, moved into real estate accounting, then landed at Apple, where he decided he liked the tech side. After grad school he became a consultant across banking, real estate, aviation, and healthcare. Hybrid Workforce builds automation and AI platforms. AI Workforce is focused strictly on healthcare. What Got Loud Clients say they want an AI platform, and Shawn's first question is "for what?" Many companies use only part of the ERP they already paid for. His goal is to get them to 90 percent of what they own, then build the last 10 percent. Before any build, his $5,000 assessment maps the tech stack, technical debt, and safeguards, and recommends pentesting and phishing protections. In healthcare, the platforms are HIPAA compliant, hospital data stays on the hospital's servers, and contracts bar selling the data or using it to train other models. He will walk away from a deal: "We will give you the best advice, even if it means not closing a deal." The Rundown Melissa asked what his job involves. Shawn described consulting across industries, which taught him how technology fits each one. A typical request starts with a client saying they have 20 accountants and want 10 while still growing. The answer can be AI agents or a full ERP platform. When a client says the ERP is not doing what it should, he says they are usually not using its full capabilities. Two similar companies next door to each other can run completely differently, so he works to use what they have before adding anything. On AI, he sits down with each department to look at its capabilities, its appetite for AI, and its technical debt. Many clients want AI but do not have the guardrails or security protocols for it. Melissa asked whether he finds weak security when he walks in. His answer is the $5,000 assessment, which covers what the client wants to build, which departments it touches, the IT team, the tools in use, and how to put safeguards around the build. He recommends pentesting and email phishing protections, and he works with three or four cybersecurity partners. Regional hospital CISOs do a great job, he said. The gaps show up at smaller B2B firms where nothing stops phishing and everything is open. "It's like building a house without a foundation. We want to make sure that foundation, which is security, is there first and we could build around it." Shawn's favorite industries are real estate, where multifamily ERPs often cover about 70 percent of what operators need, and healthcare. He also built a platform for a regional jet organization that had to account for fuel, food, and pilot hours. The healthcare platform handles revenue cycle management, credentialing, and scheduling. Agents work in the background to reconcile payments and check that doctors' and nurses' credentials stay current across 19 states. On data, his company owns the platforms and sells them as seats, subscriptions, or white label builds. For hospitals, the data stays on the hospital's own servers. Other clients get their own tenant with the data containerized. Contracts at the start of an engagement say the data is not sold and not used to train other models. Compliance, including HIPAA, PII, and GDPR, is part of the assessment. "We will give you the best advice, even if it means not closing a deal to make sure that our clients are getting exactly what they want." Melissa agreed that honest advice brings clients back. Shawn also described a CEO dashboard built from many disconnected systems, with a daily email tailored to what that executive cares about. His team is remote, spread across the US, El Salvador, India, and Colombia. He brings in graduates right after senior year, lets them shadow projects for months, and has them retool older projects with new ideas and AI tools. Real Talk The thread through this conversation is sequence. Understand the landscape, secure the foundation, then build. Shawn treats AI as a buzzword until it is tied to a goal and a safe starting point. His other point is practical: giving honest advice, even when it costs a deal, is how he builds referrals and long term clients. Catch It Watch the full conversation with Shawn Mayo on SOCSoter Unfiltered for more on AI strategy, healthcare platforms, data protection in contracts, and how his team trains new developers.

2. 

   19 Oct 2026

   Customers Stopped Asking for Software and Started Asking for AI, with Dr. Yomi Odedeyi - Ep 16

   "The paradox for leaders is that in being task oriented, you're also aware of yourself as a human being and of the humanity of the team members." Who They Brought In Dr. Yomi Odedeyi (https://www.linkedin.com/in/yomiodedeyi/) is the CIO of Vennote Technologies LTD (https://vennote.com/), a global technology firm with about 300 employees. He trained as a lawyer in Nigeria, practiced for five years, then followed his pull toward technology, teaching himself programming and working his way from database analyst to ERP project manager. He later earned an MBA and a doctorate in leadership and policy. The company he helped start in 2010 opened its US business in 2015. "Vennote" is an Afrikaans word for partners. What Got Loud Customer demand over about three years pushed Vennote into AI, and it now has about 30 developers building AI projects for enterprise customers. Many of those builds were made for one client. Vennote wants to commercialize them, but that means changing the architecture, hosting on its own hardware, and putting marketing money behind it. He tells people that attracting the attention of the bad guys is a matter of when, not if. His dissertation on paradoxical leadership found that women executives are held to different standards, so the same blunt words land differently coming from a woman. His leadership rule: stay task oriented and stay human, and know when to be driven and when to ease off. The Rundown Melissa opened by asking what he does at Vennote and about his ERP background. Dr. Odedeyi described a role that covers technology leadership, marketing support, and "anything that needs doing." That morning he had been on a call about a customer RFP for a learning management system. Vennote's plan has two phases: install the system, then use AI to build individual training plans from survey answers about each person's skill level, recommend courses, and administer the tests. Vennote is not a traditional MSP. He said the firm does not take service calls. It works with enterprises that have their own IT departments and want to outsource what they would rather not hire for. It resells enterprise software, including Medallia, and builds custom AI. Medallia was its first AI powered implementation, and customer conversations led to specialized builds, including an AI HR service that investigates when an employee says they did not get paid, and a self-service flow for telecom customers who bought airtime and cannot get online. Security came up in practical terms. He described jumping on a call over a GitHub access problem and working with cybersecurity on best practices. "I tell people it's a matter of when you're going to be attracting attention of the bad guys, not a matter of if." Melissa then asked why his dissertation focused on 22 women executives in Nigeria. He said the roots were his mother, a director in Nigeria's civil service who raised him as a single parent. His question was how leaders handle paradox, the idea that complex problems are not solved by picking one extreme, and that effective solutions integrate both sides. Two findings stood out. The first was support: an executive needs a team at home the way she has one at the office. The second was the double standard. "Where a man would say something very direct and blunt, same words from a woman are not received the same way." Melissa shared that her military background draws the same flak for being direct. Dr. Odedeyi said the lesson applies to men too, and that boys should be taught there are two sides to success, one driven and one communal. He practices it himself. When a deadline hits, the team works until 9 and orders dinner. After a hard week, they knock off at 2 on Friday. He also asks an AI assistant to adjust the tone of emails going to colleagues in other countries. Real Talk This is a leadership episode with a technology backbone. His AI story is demand led: customers asked, the team built, and now he wants to turn custom work into products. His research point is practical for anyone building a team: the people systems around a leader decide how well that leader can perform. On security, his message is short and direct. Assume attention is coming. Catch It Watch the full conversation with Dr. Yomi Odedeyi on SOCSoter Unfiltered for more on moving from ERP to AI builds, how Vennote works with enterprise customers, and what 22 women executives taught him about leading under pressure.

3. 

   12 Oct 2026

   We Block Unapproved AI at the DNS Level, with Lorenzo Toscano - Ep 15

   "I'm probably going to lose my job, but compared to the people above me, I'm probably losing the least. They're going to lose their fortune, their wealth." Who They Brought In Lorenzo Toscano (https://www.linkedin.com/in/lorenzo-toscano/) is the Deputy CISO at MCPC (https://www.mcpc.com/), a company of nearly 500 employees across about six offices. His rise was fast. Several people above him left in a short window, with the security team already at a bare minimum, so after only three years in security he asked the CIO for a shot at the role and promised to go back where he came from if it did not work. It worked. He moved from information security officer to Deputy CISO within the past few months. He also earned a Master of Legal Studies, which pulled him into redlining customer contracts alongside the company's lawyer. This was his first podcast. What Got Loud Lorenzo believes the CISO should report to the CEO or president, not the CIO, because leadership owns the risk and security only manages it for them. A customer MSA that ran 40 pages about three and a half years ago, with roughly 15 pages of security and privacy terms, now carries about five more pages on AI. A SOC 2 report used to be the checkbox. Now customers copy the same controls into the contract and ask to audit the environment too. MCPC blocks unapproved AI tools at the DNS level and allows only paid enterprise accounts, but no control stops someone from taking a picture of their screen. On one contract under $50,000, a customer questionnaire cost his team 25 hours. The Rundown Lorenzo started with what MCPC does beyond the obvious. Data disposition is one of its offerings, and because many customers are uneasy about anyone disposing of their data, the company relies on independent audits that certify wiping, shredding, and recycling. SOC 2 is his bread and butter. As Deputy CISO, he now sits in the strategy room and helps shape the security side of the product, a change from being the person who "sits in a closed office, sees the alert, writes the report, and angrily emails the rest of the company." When Melissa asked whether the CISO should report to the CIO, Lorenzo said neither. His own CIO is a former security consultant and his IT manager is an all-star, so the relationship works. Still, he argued most compliance frameworks make leadership ultimately responsible for risk. Programs delegate the management of that risk to security, not the ownership, so security belongs under the CEO or president rather than under a middleman. His legal training shaped the next stretch. "Knowledge for the sake of knowledge means nothing," he said, which is why he started working with the company's lawyer on contracts where IT, security, and compliance were not being represented. The change he has watched since is the AI language: no AI use without consent, no training on customer data, and a definition of customer data broad enough to include a contact's name and email sitting in a vendor's ITSM tool. His redline approach is to stop the obligation at MCPC and add "commercially reasonable" safeguards for suppliers. "You can't be unreasonable. At the same time, it's a negotiation." On the control side, MCPC pairs training with AI gateway tools, DNS blocking, and enterprise accounts it pays for, and it does not let personnel use personal ChatGPT or Claude accounts. He gave the example of a new AI product that trains on user data by default and gets blocked with a warning splash screen. Beyond that, the acceptable use agreement and discipline do the rest, including when an employee posts a golf outing photo with a customer's representative. Customer diligence has also grown. A SOC 2 plus a bridge letter used to end the conversation. Now customers ask for policies, encryption configurations, and sometimes their own audit, and Lorenzo points them to the controls the SOC 2 already tested. Healthcare customers, many with HITRUST, are the most attentive. He tied the questionnaire problem to his earlier days, when a small contract cost 25 hours and the margin was gone, agreeing the juice was not worth the squeeze. From his previous SOC role, he described mid-market clients between 60 and 400 employees who came through incident response, and about one in three signed on for ongoing services. The pushback was a security manager worried about a job, or a belief they could do it cheaper. His answer is that a piece is always missing, specialized talent is hard to find, and an MSP gets better EDR licensing and real 24/7 coverage. He also described hiring an analyst from the automotive insurance-audit world who started 10 to 15 percent under market with room to grow. Real Talk Lorenzo is candid about where the pressure sits. The reporting line, the AI clauses, and the audit requests all come back to the same issue: customers want proof, and security leaders need leadership backing to deliver it. His point about "commercially reasonable" language is practical, because it keeps a contract's security demands in proportion to what the deal is worth. Catch It Watch the full conversation with Lorenzo Toscano on SOCSoter Unfiltered for more on where the CISO should sit, how AI is rewriting customer contracts, and why third party risk reviews keep getting heavier.

4. 

   5 Oct 2026

   Each Company Is a Fingerprint, So Stop Treating Compliance Like a Template - Ep 14

   "We are a revenue protector. If you go down due to this, think about how many thousands of dollars every minute you are losing." Who They Brought In Kevin Neureuter, Jr. is the President and Owner of AXE Computers USA (https://www.axecomputers.com/), an MSSP he has run for 12 years, operating alongside his wife, who is a 50 percent owner of the business. Kevin spent 17 years in federal contracting and logistics before an unexpected opening pulled him into IT, and he later served as Director of IT for Orleans County, New York, before building AXE Computers into a company focused on compliance, hardware inventory discipline, and federal contracting support. What Got Loud Kevin's business philosophy in one line: an IT function is not a cost center, it is a revenue protector, and every minute of downtime has a real dollar cost attached to it. His biggest, most overlooked compliance gap: companies have no idea what hardware is actually sitting on their network, sometimes hundreds of thousands of dollars worth of it. His hard line with customers: patching is non-negotiable and part of the package, even when a prospect pushes back. His read on AI tools like Copilot: an 80 percent solution for policy writing and proposal drafting, but a human always has to tweak the last 20 percent for that specific company. His read on risk appetite: some MSPs will not take a customer who refuses baseline security, others will, and both can build a profitable business, just with very different books. The Rundown Kevin runs AXE Computers USA the way he says every good MSP should, by starting with customer service rather than sales. He and his wife describe themselves as stewards rather than owners of the business, a mindset Kevin credits to something he heard from the owner of Hobby Lobby and adopted for his own company. His path into IT was not planned. He was working in logistics and supply chain for a federal contractor when the vice president and program manager both died the same year, leaving the organization without anyone managing its technology. As the youngest person in the office and the only one comfortable with computers, Kevin was handed the job. He rebuilt the company's IT from pirated software and Windows XP machines, and that experience, plus a home repair project on an old Dell laptop, became the start of his business. Hardware inventory is where Kevin's compliance work actually begins, and he was direct about why most companies fail at it. "They only know what they tell you, right? There could be a bunch somewhere else, or they're using something that you're unaware of because you just don't know, and they don't know either." He walked through examples from his own client visits, including a warehouse where he found laptops nobody on site knew existed, and a building where an employee of 20 years insisted there was no window in a room until Kevin asked them to go look again. His approach is to physically walk the site rather than rely on what a customer reports, a habit he traces back to military property accountability, where he had to personally verify every asset at least once a year. On patching, Kevin draws a clear line. He will build a custom solution around a client's budget and risk tolerance in almost every other area, but patching stays non-negotiable because the business carries risk along with the customer when something goes wrong. He contrasted his own middle-ground risk appetite with two of his peers: one who refuses any customer that will not commit to MFA, SIEM, and SOC coverage, and another who still struggles to get basic patching approved. Kevin sees both as viable businesses with different pricing and different risk profiles, not one right answer. On AI, Kevin uses Copilot for policy writing, proposal drafting, and decision support, but is clear about where it stops being useful on its own. "I find that it's an 80 percent solution, but that human needs to be in there to tweak it and get the nuance type of things that it won't fit or it won't work. That's where I come in, that 20 percent." He described reviewing AI-written security policies from other companies and testing them by asking specific follow-up questions, often finding the policy referenced tools or controls the business did not actually have in place. For Kevin, every policy still has to be rebuilt around the specific company, because no two clients run the same environment or face the same risk. Real Talk Kevin's framing of IT as a revenue protector rather than a cost center is a useful reframe for any MSP trying to get budget approved by a business owner instead of an IT director. But the sharper point in this conversation is his insistence on physically verifying what is actually on a network before trusting any report of what is supposed to be there. Catch It Watch the full conversation with Kevin Neureuter, Jr. on SOCSoter Unfiltered (https://www.socsoter.com/) for more on hardware inventory discipline, federal contracting and property management as MSP verticals, and where AI is actually earning its place in day-to-day IT operations.

5. 

   28 Sept 2026

   Training AI Agents What Not to Do 80 Percent of the Time, with Sinan Al Taie

   "The attack is not done by humans. So why are we still defending with human capability? That has put us really behind." Who They Brought In Sinan Al Taie (https://www.linkedin.com/in/sinan-al-taie/) is the Cybersecurity Manager at Master Electronics, a global electronic component distributor headquartered in Phoenix, Arizona with offices across California, Florida, Canada, and overseas. Master Electronics is family owned, serves the aerospace supply chain, and is CMMC Level One compliant and ISO 9001 certified, with ISO 27001 and SOC 2 underway. Sinan runs incident response, threat detection, and compliance for the company, and outside of his day job he researches and writes about securing AI agents, a topic that has become the center of his work. What Got Loud Gartner expects 80 percent of enterprises to have AI agents in production by the end of this year, but only 29 percent of those organizations report having security guardrails in place for them. Average breakout time dropped from 48 minutes in 2025 to 29 minutes now, and Sinan has seen an AI-driven incident break out in 27 seconds. Sinan spends 80 percent of his time training his AI agents on what not to do, and only 20 percent of the time letting them act, calling it a reverse mindset compared to how most AI tools get deployed. He pushed back hard on the industry's obsession with a single pane of glass, arguing that a dashboard that still requires a human to click the final action cannot outrun a 27 second attack. His prediction for the field: "AI will not replace people. People who use AI will replace people who don't." The Rundown Sinan opened by walking through Master Electronics itself: a global distributor of electronic components built around aerospace customers, compliant at CMMC Level One, certified to ISO 9001, and now working through ISO 27001 and SOC 2 in parallel using an automated GRC platform that maps controls, flags gaps, and helps draft policy language for the team. From there the conversation moved to the problem he has been researching. He laid out the Gartner numbers on AI agent adoption and the security gap behind them, then connected it to what he sees every day running incident response: attackers using AI to move faster than a human analyst can react. That gap is what pushed him to design what he calls an agentic defense pipeline, an autonomous system that investigates, triages, analyzes, and responds without waiting on a person for every step. "It's beyond the human capability because it's the AI attack path. It's not done by humans. So why are we staying defending with the human capability? It has put us really behind." He was careful to draw a line around what he is not proposing. Traditional security tools and SOC processes stay in place. What he wants alongside them is a system that can act at the same speed as the threat, with guardrails tight enough that it does not become its own liability. That is the 80 percent of time spent teaching the agent what not to do before it is trusted to act on the remaining 20 percent. Sinan also addressed the idea, one he has heard repeatedly, that AI will replace tier one analysts outright. His answer was that AI will not replace people, but people who use AI will replace people who don't, and that the goal of his work is to move analysts from the front of the pipeline, where alert fatigue and burnout live, to the end of it, where they review automated decisions and correct the ones that need it. Those corrections train the system to do better the next time, which is why he insists a human in the loop is not going away, only shifting position. He pointed to identity-based detections as the clearest proof this works today: disabling an account, resetting MFA, revoking a session, and forcing a password reset are consistent enough responses that a machine can already handle them, freeing analysts to focus on the detections that actually need judgment. The conversation closed on where AI security is headed next: agentic identity and permission inheritance between agents and their sub-agents, the difference between a personal ChatGPT account and an enterprise one with data protections built in, and AI security tooling that behaves like an email security gateway, screening prompts for PII and intellectual property before they leave the environment. Sinan's read on where this leaves the profession: security is shifting to become data security, because once an agent is compromised, the real exposure is whatever data it had access to. "A tier one analyst can produce tier three analyst outcomes with the AI assist." Real Talk What stands out about this conversation is how specific Sinan's timeline is. He is not speculating about AI risk in the abstract. He is watching breakout time compress in his own environment and building a response system to match it, while being honest that the guardrails have to come first or the system becomes the threat. His one-three-one rule, one problem, three possible solutions, one recommendation, is a small habit worth stealing regardless of whether AI agents are anywhere near your environment yet. Catch It Watch the full conversation with Sinan Al Taie on SOCSoter Unfiltered (https://www.socsoter.com/) for the complete breakdown of agentic defense pipelines, where human judgment still belongs in an automated SOC, and what he thinks security teams should actually be building toward.

6. 

   21 Sept 2026

   Compliance Is Not Security But It Is a Start with Bobby Barts - Ep 12

   "Compliance isn't security. But for people who have nothing, it's a start." Who They Brought In Bobby Barts (https://www.linkedin.com/in/bobby-barts-4585711/) is the CIO of VTG (https://vtgdefense.com/), a defense contractor he has been with since 2018. VTG runs the full spectrum of government work: defense programs, Intelligence Community contracts, a fabrication shop in Virginia Beach that builds physical targets, and high-end software development for systems including submarines. With around 1,700 employees nationwide and an office in Guam, VTG is the kind of prime contractor that sits in the middle of the CMMC ecosystem, taking requirements from the government and pushing them down through a supply chain that ranges from sophisticated software houses to one-person shops doing specialized fabrication work. Bobby's perspective in this episode is rare: he is not a consultant working up from the sub level. He is the prime, managing both directions at once, and he has the institutional weight and operational scale to say what the rest of the industry is thinking but might not be willing to put on record. What Got Loud The certification pause does not change your obligations under the False Claims Act. If you self-certify that you are compliant and you are not, the teeth are still there. People have gone to jail for this There are roughly 100,000 vendors in the defense industrial base that need CMMC certification. Fewer than 300 have achieved it. That math does not work on any timeline the DoD has proposed Bobby's audit story: four of five auditors were collaborative and reasonable. The fifth rejected a business continuity plan because a specific scenario was not listed by name, despite a catchall clause covering all unlisted scenarios FedRAMP equivalent versus GCC High is a risk conversation the government needs to have honestly. The actual delta in security between the two is minimal and the cost difference is enormous CUI labeling is so inconsistently applied that even the government is marking publicly available newsletters as CUI. The category is too broad to be actionable The Rundown Bobby's most important point comes early and he returns to it throughout the episode. The CMMC certification pause that hit in mid-2025 changed the timeline for third-party assessments. It did not change anything else. DFARS 7012 still applies. NIST SP 800-171 still applies. And the False Claims Act, which carries criminal liability for self-certifying compliance you do not actually have, still applies in full. His position is that the industry interpreting the pause as permission to slow down is a dangerous misread. The obligation to be a good steward of controlled unclassified information has not moved. Only the audit schedule has. The supply chain problem is where the episode gets most practically instructive for anyone doing CMMC consultant work from the sub side. Bobby describes the math problem clearly: you cannot certify 100,000 vendors when fewer than 300 have been through the process and the assessor ecosystem is still immature. His expectation, shared with Melissa, is another year of self-certification followed by a phased rollout. But the flow-down obligation from primes to subs is not paused. What VTG asks its suppliers is straightforward: how are you being a good steward of the data? The documentation and questionnaire process continues regardless of where the certification requirement lands. The CUI labeling conversation is one of the most honest moments in the episode. Bobby describes a newsletter he received that was marked CUI but was publicly available on the government's own website. Melissa shares her experience with Army training materials that were mislabeled. Bobby's framework for handling this within VTG distinguishes between CUI basic, which covers FCI and lower-sensitivity information, and CUI specified, which covers more sensitive categories like nuclear drawings or other legacy designations. Getting his own workforce to understand that distinction, across a company that spans both blue-collar fabrication work and classified software development, is an ongoing training challenge. The audit story is the most practically useful section for anyone preparing for a C3PAO assessment. Bobby had five auditors over the course of one engagement. Four were collaborative, curious, and willing to work through how VTG was solving problems. The fifth rejected policy coverage because a specific listed scenario was not called out by name in the business continuity plan, despite a catchall clause that explicitly covered all unlisted scenarios. Bobby's point is not that assessors are the enemy. It is that the personality and interpretation style of one individual auditor can have a material impact on your assessment outcome, and that the industry needs more grace in how it evaluates whether the spirit of a control is being met, not just the letter. Real Talk If you are treating the certification pause as a reason to slow down, you are accepting risk that has not actually been reduced. The False Claims Act does not pause. Keep moving. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

7. 

   14 Sept 2026

   The Foundation Has to Be Strong Before You Add the Fancy Tools with Garrett Ragland-Helf - Ep 11

   "Small wins accumulate to one massive win. You look back down the mountain and realize you made it to the peak." Who They Brought In At the time of this recording, Garrett Ragland-Helf was serving as a CISO Advisory Analyst at Apollo Information Systems (https://www.apollo-is.com/), working primarily with public sector organizations across state, local, and education sectors to mature their security postures, build roadmaps, and navigate the unique resource constraints that come with operating in environments where budgets are thin and staff wear many hats. He also volunteers with the Center for Internet Security's Leadership Mentor Program, connecting cybersecurity leaders across the northeast to collaborate, share challenges, and help each other grow. He serves in the military at the Army War College at Carlisle Barracks, which gives him a front row seat to how national security thinking is evolving alongside the civilian cybersecurity landscape. His approach throughout this episode is less about tools and more about the discipline, mindset, and foundational work that makes any tool actually useful. What Got Loud Why tackling a 1,200-page CIS benchmark is exactly like climbing Mount Everest, and why the only way to do it without breaking everything is to go modular, one small section at a time The most dangerous thing you can do with a SIEM is deploy it out of the box with zero tuning, zero baseline, and nobody who knows how to read it AI is a force multiplier for resource-constrained public sector organizations, but only if you stay within governance guardrails and treat it as a starting point, not a finished product If your foundation is made of sand, any shift in the threat landscape will bring the whole castle down. The basics have to be strong before the fancy tools mean anything Collaboration is the actual force multiplier. Siloed organizations in the same sector are making themselves collectively easier to attack The Rundown Garrett's Mount Everest framework is the throughline for the entire episode. When you look at a 1,200-page CIS benchmark or a full CMMC implementation and try to do it all at once, the size of the task creates paralysis. His answer is the same answer that applies to every large security initiative: break it into modular chunks, start with a small subset of controls, get comfortable with those, and then move to the next section. The small wins accumulate. The progress compounds. And when you look back after a year of doing it that way, the distance covered is significant in a way that a sprint never produces. Melissa's experience confirmed it directly. She tried to implement the Windows Server 2022 CIS benchmark in a couple of days and had to roll everything back. The mountain does not care how fast you want to climb it. The foundation conversation is where Garrett gets most direct. He is not against advanced tools. He is against organizations acquiring advanced tools before they have the basics locked down. A next-generation SIEM deployed out of the box with no tuning, no baseline, and no one who knows how to operate it is not a security asset. It is noise. Or silence. Neither helps. Garrett's framework is to start with what you have, squeeze every bit of value out of it, make sure it is fine-tuned to your environment, and only then add the next layer. That sequencing, basics first, tools second, is what separates organizations that survive incidents from the ones that do not. The public sector resource problem runs through the entire episode. These organizations are not failing because they do not care. They are failing because they are understaffed, underfunded, and often operating with IT people who have cybersecurity added to a job description that already had no room for it. Garrett's answer is sweat equity: use every free or state-subsidized resource available, use AI to generate documentation starting points and then finish them properly, use community and peer networks to share knowledge and compress learning curves. The creativity required to do security well with almost nothing is its own skill set, and Garrett treats it as such rather than dismissing it. The collaboration section lands the hardest at the end of the episode. If one organization in a sector gets compromised, the attacker is now knocking on the doors of every similar organization nearby. Siloed security in interconnected sectors is not just a local problem. It is a collective vulnerability. Garrett's answer is community: ISACs, peer groups, word of mouth, conferences, virtual or otherwise. The organizations that share knowledge and learn from each other's incidents are harder to attack collectively than the ones that treat security as something they figure out alone. Real Talk If you are waiting until you have the perfect stack before you start securing your environment, you are already behind. Start where you are with what you have. Tune it. Baseline it. Understand it. Then add the next piece. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com (https://www.socsoter.com/).

8. 

   7 Sept 2026

   Every Identity in Your Environment Is an Attack Surface with Jason Lawrence - Ep 10

   "Attackers no longer break in. They log in. That is the entry point for every attack." Who They Brought In Jason Lawrence (https://www.linkedin.com/in/ethicalinfosec/) is the Cybersecurity Director at Yancey Bros. Co (https://www.yanceybros.com/)., the nation's oldest Caterpillar dealer, a 112-year-old Georgia institution serving the construction, roadbuilding, mining, and agricultural communities. He is also the co-founder of Security Reimagined, a community-focused advisory operation built to help small businesses and mom-and-pop shops become more cyber resilient with as little friction as possible. Jason started in cybersecurity in the mid-90s before the term cybersecurity widely existed, served in the Israeli Defense Forces, and has spent roughly 30 years building and leading security operations across some of the most recognizable names in the industry, including Ernst and Young, SunTrust Bank, LinkedIn, Silicon Valley Bank, and AT&T Managed Detection and Response where he led threat hunting. He is one of the more technically deep guests the show has had, and he brings that depth without once losing the thread back to practical application. What Got Loud Attackers no longer break in. They log in. Identity is the entry point for every attack and most organizations cannot tell you what all of their identities even are Agentic AI inside your environment is not just a productivity tool. It is an operational identity. If it is compromised, your entire operation can be compromised with it The most dangerous phrase in cybersecurity is "we've always done it that way." Jason has the IDS audit story to back that up Security should be the Department of Yes. Not the Department of No. Here is what that actually looks like in practice The Equifax breach came down to two things: an unpatched vulnerability and an exposed admin account on a website that nobody was managing The Rundown Jason's framing for how security should engage with a business is the most useful reset in the series for anyone who has ever been told security is a hindrance. His position is direct: if security is slowing the business down, security is not doing its job. His alternative is what he calls the Department of Yes. Not a blanket yes to everything, but a yes paired with a how. Yes, you can do that, and here is how to do it securely. That reframe changes the entire dynamic of the relationship between security and the rest of the organization, and it starts with understanding the business before making a single recommendation. The identity conversation is where the episode reaches its highest technical altitude and stays most accessible at the same time. Jason's definition of identity is broader than most security conversations allow. It is not just usernames and passwords. It is everything in a digitized environment: service accounts, API keys, AI agents, data itself. His central question to every organization is the same: do you have a complete inventory of all of your identities? The answer is almost always no. They point at Active Directory and call it done. Jason's follow-up is the one that lands hardest: do you have an identity in Active Directory for each agentic AI running in your environment? For every API key? For every service principle? The answer is always no. And that gap is exactly where attackers go. The Equifax breach is the case study Jason uses to make the identity argument concrete. Two entry points. One was the Apache Struts vulnerability, a known unpatched flaw. The other was an exposed admin account on a web portal that nobody had inventoried, nobody had managed, and nobody had questioned. It was just there. Logged in and accessible. Jason's point is not that the breach was inevitable. It is that both entry points were identities, one human and one not, that fell outside the scope of what the organization thought it needed to protect. That scope problem is still the most common gap he finds 30 years into doing this work. The agentic AI section is where the episode shifts from identity management into something more urgent. Jason describes a named autonomous attack from earlier this year that adjusted its behavior in real time based on the outcomes of its own actions. The defense implications are significant. But the internal risk he is more focused on is the one organizations are introducing themselves. Every AI agent deployed internally needs permissions to operate. Most organizations are overprovisioning those permissions without thinking through what happens if the agent is compromised. A sufficiently privileged AI agent is no longer just a non-human identity. It is an operational identity. Its compromise is not a credential problem. It is a business continuity problem. Real Talk If you cannot answer the question of what identities exist in your environment, who created them, why they were created, and when they were last used, you are not managing your attack surface. You are hoping nobody notices the gaps. Start the inventory. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com (https://www.socsoter.com/).

9. 

   31 Aug 2026

   Your Company Is Paying for the Same Tool Four Times and Nobody Knows with Chris Nurse - Ep 9

   "AI was never built to replace us. It was built to enhance us. Let it do the heavy lifting and free yourself to do other things." Who They Brought In Chris Nurse is a Principal Consultant at ISOutsource with close to three decades in technology. He started when computers still took up entire rooms and has spent the last 15 to 20 years working on large-scale projects from both the consulting and delivery side. His previous clients were enterprise-level organizations running 20,000 to 100,000 servers, and his work has spanned banking, insurance, legal, medical, and manufacturing across the US and globally. He is currently deep in the AI automation space, helping organizations figure out how to eliminate repetitive work, right-size their technology spending, and build the governance structures that make both possible. He is also the person who saved a 25,000-user corporation $2.5 million in Microsoft licensing in a single assessment and grew a consulting department from 3 people and $3,000 in monthly revenue to 47 people and over $20 million. What Got Loud A task that used to take Chris 45 minutes to an hour now takes five minutes because he built an AI automation tool for it. That is the whole AI argument in one sentence Most organizations are paying for the same AI tool four times simultaneously because nobody did the groundwork before employees started adopting on their own Chris's licensing assessment for a 25,000-user Microsoft environment saved them $2.5 million. The culprit: hundreds of unused licenses and duplicate tools nobody had audited in years Why data is now the competitive differentiator, not the product or the service. Everyone can build the building. The question is what data you bring to the table about how you will build it The data seepage problem: personal devices connecting to corporate environments are moving data in ways nobody is tracking, and most of it is completely unintentional The Rundown Chris's framing on AI resistance is the most practical in the series. His position is not that AI is inevitable and people need to get over it. His position is that AI was designed as a tool for humans, not a replacement for them, and the fear goes away the moment you experience what it actually does to your workload. He built an automation tool for his own client reporting process. What used to take 45 minutes to an hour now takes five minutes. He did not build it to reduce headcount. He built it so he could spend that recovered time on things he actually wants to do. That reframe, from threat to multiplier, is the one that lands with people who are stuck in fear. The AI licensing conversation is where Chris gets direct about something most organizations are quietly ignoring. Companies are not managing their AI tool adoption. Employees see something that works and start using it without any governance in place. The result is organizations running Microsoft Copilot, ChatGPT, Claude, and one or two other platforms simultaneously, paying full licensing costs across all of them, for work that one properly configured tool could handle. Chris's audit framework makes it visible. He builds into a client's licensing stack and asks the question nobody has asked: when was the last time this user touched this product? The answer is almost always damning. A 25,000-user Microsoft environment turned out to be carrying hundreds of untouched licenses and duplicate tool subscriptions that had been running for years. One assessment. $2.5 million saved. The data protection framework Chris uses is structured but accessible. He describes it as a castle. The moat, the turrets, the drawbridge, the guards inside. What he is actually describing is a layered approach that starts with understanding where data lives and who touches it, adds data loss prevention to monitor what moves and where, and wraps it in a business continuity plan so that when something goes wrong, the organization does not stop operating. His pointed observation: most companies do not care about disaster recovery because it sits on the balance sheet as a liability, not an asset. It costs money with no visible return. Until it is the only thing standing between continued operations and a catastrophic shutdown. By then it is too late to care. The change management piece is what Chris circles back to throughout the episode. He has walked into manufacturing facilities where employees have been running the same processes for 50 years and have zero appetite for anything new. He describes wearing them down through persistence, patience, and repetition. He frames security not as an IT issue but as a business survival issue. If CMMC compliance is required to keep government contracts and you refuse to implement MFA because it feels like too much, you are making a business decision that ends the company. Chris puts it plainly: pick your poison. Real Talk Every organization has back work that never gets done because the people who would do it are buried in repetitive tasks. AI does not take the job. It clears the queue so the job gets better. That is the conversation worth having. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com (https://www.socsoter.com/).

10. 

    24 Aug 2026

    The Heavy Door Why Protecting Data Starts with Knowing What It's Worth with James Gorman - Ep 8

    "The door is heavy to remind you of the importance of what you're trying to protect. That's what I've taken for my whole career." Who They Brought In James Gorman is the Fractional CISO and CTO at Hard2Hack, and the author of two books: "Security in the Age of AI Agents: A Practitioner's Journey from Cold War Crypto to Autonomous Threats" and "The IT Leader's Guide to Cybersecurity Programs: From Basics to AI." His path into cybersecurity started 40 years ago when he reported aboard a Navy ship as a freshly minted cryptographic technician, responsible for the fleet-wide encryption keys that secured communications across an entire naval operation. From there he learned TCP/IP in 1988 when the Navy deployed an encrypted satellite network running at 115kbps, got out in 1992 when DARPA net was becoming the internet, was recruited by GE to help open their systems to this new thing, started one of the first ISPs in 1994, and has spent the decades since doing fractional CISO work across SaaS startups, healthcare organizations, government contractors, and mid-market manufacturers. He has helped approximately 30 companies build or rebuild their security programs, and he brings the kind of practitioner perspective that most compliance documentation specifically does not. What Got Loud The heavy door story: the reason a crypto locker door is that heavy is not just security. It is a physical reminder of the weight of what you are protecting. James has carried that framework for 40 years CMMC being delayed does not change your legal obligation. You are still required to self-attest, still required to meet NIST 800-171, and still exposed to contract penalties if you get breached and it was your fault McKinsey built an internal AI trained on all 57,000 employees' work history and left 18 API endpoints with no authentication. A researcher got in through SQL injection in under three hours and could have exported everything A $500 million ISO 27001-certified manufacturer opened their entire Active Directory to fix a VPN issue, forgot to close it, and got ransomware dropped through a print service account using an easy-to-guess password. While ISO 27001 certified. Why presenting cybersecurity as a math problem is the only way to get a CEO or CFO to actually engage with it. 96% of small and mid-sized businesses that suffer a severe cyberattack are out of business within four years The Rundown James's entry framework has not changed since a chief petty officer named Chief Smith asked him why he thought that door was so heavy. The answer is not that the door is heavy because the stuff inside is important. The answer is that the door is heavy to make you feel the importance every time you touch it. James has applied that to every engagement since. What are you trying to protect? Sales records are one level of heaviness. Healthcare data is another. Government contractor CUI is heavier still. Water treatment terminals, where lives are at stake, are something else entirely. The framework for everything that follows, the architecture, the controls, the budget conversation, starts with that question. And most organizations have never seriously answered it. The compliance versus security conversation is where James is most direct. His position is that a compliance checkbox has never once made a company secure. He walked into a company processing billions of dollars a year in transactions and found their disaster recovery policy sitting on a shelf in the server room. Nobody knew it existed. He watched another company click through security awareness training modules and call it done for the year. He has seen SOC 2 audit firms issuing boilerplate reports where no controls were tested. His line is consistent throughout the episode: by being genuinely secure, compliance follows on its own. The reverse has never worked. The McKinsey story is the AI security argument in one incident. McKinsey built an internal LLM trained on the entire work history of their organization, including client deliverables, strategy documents, and consulting processes for 57,000 employees. A researcher built an AI tool to probe it from the outside. He got in through a single API endpoint with no authentication requirement using SQL injection, a technique documented for decades. Once inside he could have exfiltrated hundreds of thousands of documents and, more critically, could have manipulated the prompts that drive McKinsey's consulting recommendations. A tweaked prompt on a buy-sell decision could redirect billions in client capital. McKinsey's CISO responded correctly. But the point James makes is the quiet one underneath: he may not have been the first person in. The manufacturer story runs a parallel track. ISO 27001 certified, policies documented, controls in place on paper. IT opens Active Directory to the full VPN during a troubleshooting session and never closes it. Service accounts pick up the exposure. Ransomware comes through a print service account using a password that was basically the company name with a number and an exclamation point. Shipping shuts down. $15 million in losses in two days. Cyber insurance covers $5 million. The other $10 million is on the company. And six months after James is brought in for incident response, the same executives who were writing any check necessary start asking whether they can cut the security budget. Real Talk If you cannot answer the question of what you are actually protecting and why it matters, you do not have a security program. You have a policy document and a hope. Start with the door. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

11. 

    3 Aug 2026

    CMMC From Scratch: What No One Tells a Non-Security Hire with Danielle Palmer - Ep 7

    "I asked them at least 15 times over the years: are we sure we still want to do this? And they kept saying yes. So here we go." Who They Brought In Danielle Palmer is the Senior Operations Manager at Fraym, a geospatial analytics company based in Arlington, Virginia with a fully remote global team spanning Canada, Ireland, Germany, and beyond. Fraym works with clients like the Gates Foundation on gender equity and economic development in Africa, and with the federal government including the National Geospatial Agency on defense-related analytics. The company is approaching its tenth year and has grown from delivering PowerPoint decks to building interactive, manipulable data dashboards at a global scale. Danielle came to Fraym from over a decade at Apple in technical support, with no cybersecurity background and no compliance experience. She has spent the last three-plus years inside one of the messiest, most instructive CMMC journeys a small company can have, and she is still standing. What Got Loud What it actually looks like to navigate CMMC as a team of one with no security background, no predecessor documentation, and a scope that keeps shifting under you Fraym's original MSP got acquired mid-journey, decided not to pursue CMMC, and employed non-US-based technicians. Danielle had to pivot immediately or stay stuck Why being entirely cloud-based with a 75/25 Mac-PC split makes Fraym nearly impossible for most consultants to work with, and how that narrows the vendor pool fast CMMC scope is not a document. It is a living argument. Google was in scope, then it was not. Workstations were in scope, then they were not. The line keeps moving Two leadership changes in one year, including a CEO departure and the loss of the primary security officer, forced a full reassignment of admin responsibilities with no roadmap The Rundown Danielle's CMMC story starts in January 2022 when she was hired specifically for her Mac technical experience and handed an additional task on day one: figure out whether Fraym needed to comply with CMMC, what that would require, and how to get there. She had never heard of CMMC. She had no security background. What she did have was the technical instincts from a decade at Apple and the operational discipline to start asking the right questions even when nobody could give her straight answers. The first major problem was scope. Fraym is not a traditional enterprise. They are entirely cloud-based with no on-premise servers. Their product runs on AWS. Their storage moved from Dropbox to Box. Their team runs 75 percent Mac and 25 percent PC, and they are global. Most CMMC consultants are built for Microsoft-heavy, on-premise environments and simply do not know what to do when faced with a setup like Fraym's. "Very few people were familiar with our setup," Danielle says. "Some people are just absolutely only Microsoft and that's all they know. So they're just not going to be able to work with us." Finding a thought partner who could actually see their environment clearly took longer than it should have. The MSP transition is where the episode gets operational. Fraym's original MSP was pursuing CMMC. Then they were acquired by a larger organization that decided not to pursue it and employed non-US-based technicians. Both of those facts made them immediately incompatible with what Fraym needed. The pivot had to happen fast, right as their contract was expiring. What made it harder is that the acquired MSP had not documented what they had done. The technician who had set up most of Fraym's systems was gone. Danielle describes the transition as archaeology. "They were finding tools on our computers from the old MSP, installed and not even known about." Cyberlynx came in through a conference introduction from Matt Connor and has been the right fit since. The scope conversation is the one that anyone navigating CMMC for a non-traditional organization will recognize immediately. Is Google in scope because contract information arrives via email? It was, then it was not. Are workstations in scope? That answer moved too. FCI, Federal Contract Information, sounds clear until someone describes all their quality data as FCI and it is not. Danielle is direct about what this costs: "I've been on version 22.5 of my documentation." The DoD keeps moving and the organizations following it have to move with it, often mid-implementation. The personnel piece is what takes this episode beyond a standard compliance story. Two leadership changes in rapid succession, including a CEO departure and the exit of the person who had effectively been the security officer, forced Danielle to restructure the entire approval and implementation chain with no overlap and no documentation handoff. She is now the implementer. The VP of finance is the approver. Neither role was designed for this. Her honest take: "I'm a team of one. There is no other team with me. And that's not enough for division of admin responsibilities." Real Talk If your CMMC journey is messy, inconsistent, and more expensive than anyone told you it would be, Danielle's experience is not a warning. It is a map. The companies that make it through are the ones who stay in the room and keep asking the question even when the answer keeps changing. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

12. 

    24 Jul 2026

    The Question Every Business Owner Should Ask Their MSP with Unique Computing Solutions - Ep 6

    "Every business owner who hires an MSP should ask one question: what are you doing to protect me from your own tools?" Who They Brought In Anthony Gerasch and Ryan Carter run Unique Computing Solutions out of the Chicagoland area, an MSP Anthony founded in January 1997 that is approaching its 30th year in business. Anthony started as a programmer and moved into managed services around 2003. Ryan has been with the company for close to a decade. Together they built a security-first operation before leading with security was the standard, and they have the CMMC journey and the decade-long SOCSoter partnership to back it up. They also co-host the Business Owners IT Podcast, which gives them a second channel for educating the clients their direct work reaches. Between them they cover the full stack: Anthony on operations, tooling, and the business of running a clean MSP, and Ryan on compliance, frameworks, and the gap between what companies think their security looks like and what it actually is. What Got Loud The one question every business owner should ask their MSP and almost never does: what are you doing to protect me from your own tools Anthony's Active Directory walk-through: the moment a client says we are fine, he opens the directory and starts asking who each user is, and the answers are always bad A one-man electrician shop let a stranger into his Microsoft 365 in exchange for a free website build. What happened next is the clearest possible argument for not skipping the basics AI governance does not exist yet and companies are using 14 different AI agents in a single meeting with zero policy around any of them Why AI for compliance is an 80% solution at best, and the 20% it cannot do is the part that gets you in court The Rundown Anthony's security-first position is not a tagline. It is a condition of being a client. If a business does not have the basic security stack in place, Unique Computing Solutions does not bring them on. He is direct about why: an MSP that is not secure does not just put itself at risk, it puts every client it touches at risk. His analogy is as clean as it gets. A bad doctor can kill someone. A bad MSP can do serious damage at scale and most business owners have no idea. The question he wants every business owner to be asking before they sign with an MSP is not what can you do for me. It is what are you doing to make sure your access to my systems cannot be turned against me. The identity conversation is where the episode gets granular. Ryan walks through what it actually looks like when a company says they are good and he opens Active Directory. Former employees still active. Accounts renamed instead of disabled. Five domain admins including Jennifer, who left. No one knows why she had domain admin rights in the first place. The companies that are most confident tend to have the most exposure, and the small ones are not exempt. Five users can have just as much wrong as five hundred. The reason is always the same: nobody is watching and nobody knows what right looks like. Anthony's fix is a baseline. If you do not know what your environment is supposed to look like, you will never catch a deviation. And a deviation is exactly how a breach starts. The electrician story is the episode in a single anecdote. A one-man shop was offered a free website in exchange for access to his Microsoft 365. He said yes. The attacker used his account to register impersonation domains using his credit card, assigned Exchange licenses to themselves, and started sending phishing emails impersonating major companies. The victim had no idea until he was locked out of his own account. Anthony's team recovered his access through an old account that had never been cleaned up. The point is not just that it happened. It is that it happens because Microsoft 365 is handed to people who do not know what securing it actually requires. Out of the box the security score starts at around 40 percent and the target is 70. Most small businesses buy it for email and stop there. The AI governance discussion is where Anthony and Ryan agree most sharply. Every meeting Anthony joins has AI agents attending from every participant's company, all different brands, all different configurations, with no organizational policy governing any of it. Ryan's position on AI for compliance is consistent with what Melissa sees from the SOCSoter side: it is an 80 percent solution and the 20 percent it cannot handle is the nuanced, business-specific piece that compliance actually requires. An AI tool will search your email and return answers it thinks are correct. If you do not know what the correct answer actually is, you will submit a compliance document with errors and not know it until something goes wrong. Real Talk If you have not walked through your own Active Directory recently and asked who every user is and whether their access level makes sense, do that before your next client meeting. The most confident organizations are almost always the most exposed. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

13. 

    21 Jul 2026

    Why AI Gives Defenders a Map They Have Never Had Before with Nathan Case - Ep 5

    "Everything that was wrong last week is still wrong this week. The difference is now you get to see it." Who They Brought In Nathan Case is the CTO of TPO Group, a security and policy firm whose partners include some of the most credentialed names in the industry: a former CSO of Azure, a chief lawyer from Cisco, and the person who wrote the cybersecurity policy for the United States. Nate's own path started in the mid-90s writing C-sharp and experimenting with early internet protocols, moved into facial recognition software in 1998 and 1999, then shifted toward encryption work for the Department of Energy and hardware pentesting on firewalls. He helped build the data centers that became AWS US West and US East, spent years doing incident response and security architecture across government and private sector clients, and still codes today. He is also faculty at an AI institution and brings a rare combination of builder, breaker, and responder to every conversation he enters. What Got Loud The cybersecurity apocalypse people are afraid of already happened. It happened 35 years ago when basic hygiene got abandoned. AI just turned the lights on Why nation states are no longer targeting just governments and enterprises. Small companies are now in the blast radius and AI is what made that scale possible A defense contractor was using Social Security numbers as the primary ID in a grill ordering app at a facility near the Pentagon. Nate found it during a database migration Why AI for incident response is a trap: your attacker's AI is going to talk to your AI, and cheaper is not a strategy The logistics company that did not know its crown jewels were the shipping routes for dangerous chemicals that could be weaponized. That is what attackers actually want The Rundown Nate's framing for where AI sits in the security conversation right now is the sharpest in the series so far. His argument is not that AI creates new threats. It is that AI illuminates the threats that were already there. The map was always that big. You just could not see the edges. "There were bad things that were coming to get you last week," he says, "but now you can see them." For a lot of organizations that means the news is bad. The work ahead is significant. But at least now you know what the number is. The FUD era of security selling, where fear was the product because nobody could quantify the actual exposure, is over. AI makes the negative space visible for the first time. The nation state conversation is where the episode gets uncomfortable fast. Nate is working on a paper about unrestricted warfare, specifically what it looks like when nation states target civilian entities with no rules of engagement. What he is seeing in incident response right now is that scale has removed the friction. AI and cloud infrastructure make it trivially easy for attackers to go after everybody at once. The small logistics company, the water treatment facility, the five-person critical infrastructure team. "If you're the unlucky deer and you stumble in the forest and everybody else is running a little faster than you, you're the one that gets jumped on." The answer is not panic. It is the basics: MFA, endpoint protection, zero trust. Not because they solve everything but because they remove the easy targets from the herd. The crown jewels story is one of the most instructive moments in the episode. A logistics company brought Nate in for incident response and did not think of themselves as a high-value target. They moved chemicals. What they did not fully reckon with was that they held the logistics data for those chemicals across the entire planet, including chemicals that could be used in weapons development. The attackers were not after money. They were after the map of where those materials move and who controls the routes. Nate's point is that most companies have no idea what their actual crown jewels are, and the attacker has usually already figured it out before the company has. The AI and human labor debate comes up toward the end and Nate does not hedge. AI is exceptional at synthesizing vast amounts of data. It is not good at understanding second and third order impacts, at creative problem-solving inside a unique business context, or at knowing when to turn over the next rock in an incident investigation. "I've done a couple incidents over my lifetime," he says, where the key insight came from thinking like the attacker, asking a question nobody had asked yet, and following a thread that no automated tool would have surfaced. A bank that laid off 20,000 people and then discovered its AI token costs were lower than those salaries is the cautionary tale he drops at the end. The humans are still the answer. The question is what you are giving them to work with. Real Talk If you do not know where your sensitive data lives, how it moves, and who would want it, you cannot protect it. Ask the stupid questions now. The attacker already has. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit SOCSoter.com (https://www.socsoter.com/).

14. 

    12 Jul 2026

    Built to Last: One MSP CEO's Blueprint for Clients Who Never Leave with Matthew Connor - Ep 4

    "It's not like I'm afraid of commitment. I want to earn your business every single month, not one month a year." Who They Brought In Matt Connor is the CEO and Founder of Cyberlynx, an MSP he started sixteen years ago in Lexington, Virginia, after a stint on Wall Street that, by his own admission, cost him a lot of money. He built the company from the ground up under the name Your IT Department, grew it into a thriving managed services operation, and rebranded to Cyberlynx as the business moved deeper into cybersecurity. Today Cyberlynx runs both an MSP arm and a value-added reseller side, serving clients ranging from small businesses to some of the largest companies in the world. He is also the host of The Cyber Business Podcast, where he covers cybersecurity, IT, and the business of running an MSP. What Got Loud Why Matt deliberately does not want to grow his MSP and why that counterintuitive decision has made it more profitable, not less The physician model for MSP client relationships: why asking the right questions earns more trust than delivering the right answers Cyberlynx has never lost a client to "you guys suck" in sixteen years. Matt explains exactly how that happens on a month-to-month contract The sweet spot for SOCSoter deployments: why companies between 200 and 500 employees are where the tool fits best and why going bigger gets complicated fast Why AI is not replacing your level one tech. It is turning them into a level three and if your MSP is not using it for everything, you are already behind The Rundown Matt's philosophy on MSP client relationships comes down to one analogy he keeps returning to throughout the episode: the physician. When you go to a doctor who skips the questions and writes the prescription in thirty seconds, you leave uneasy even if the prescription was right. The same thing happens when an MSP pitches a security stack without walking the client through why. The bedside manner is not filler. It is the whole trust-building exercise. "They don't know enough," Matt says about clients, "and those that do know some, they may have ChatGPT, they may have Googled it. So they've got some stuff. Cool. Just like going to the doctor." His point is that MSPs who treat every client touchpoint as a sales opportunity are doing the opposite of building trust. The ones who occasionally say "you don't actually need that" are the ones who keep clients for sixteen years. The month-to-month contract model is where Matt genuinely diverges from most of the industry. He does not believe in locking clients in. His position is that the moment you sign a three-year agreement, the incentive to earn the relationship every day quietly disappears. He has watched it happen on both sides. The energy that builds through the sales process evaporates the moment the ink dries and the account gets filed away until renewal. "You can cash those checks for three years," he says, "but at the end, you know, you're probably going to be looking for a new partner." Cyberlynx has retained every original client from sixteen years ago. Two were lost to acquisitions. Zero to dissatisfaction. On the question of where SOCSoter fits in the market, Matt is precise. The sweet spot is companies between 200 and 500 employees who have not yet hired a CISO or CIO. They have budget, they trust their MSP completely, and they are not running procurement through a committee. Once you get into the 500 to 2,000 employee range, more decision makers enter, more competition shows up, and the buying behavior shifts toward name-brand recognition. "Nobody's ever been fired for buying Cisco" is the enterprise logic Matt is describing, and it is the wall that makes the mid-market so important to own well before organizations scale past it. The AI conversation is where Matt gets direct about what he thinks MSPs are still getting wrong. He is not worried about AI replacing people. He watched Amazon lay off 30,000 employees and then rehire because they overcorrected. His take is that AI is not a headcount replacement. It is a capability multiplier. A level one helpdesk tech using AI to troubleshoot is solving problems at a level three rate. "Supervision is so much faster and easier than creation," he says, and that reframe applies to every support ticket, every client email, and every security alert that comes through the queue. Real Talk If your retention strategy depends on contract length instead of relationship quality, Matt's sixteen-year track record is the argument against you. Month-to-month is not a risk. It is the accountability structure that keeps you sharp. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

15. 

    6 Jul 2026

    HIPAA 2.0 Is Coming and Most MSPs Are Not Ready for It with Janine Medina - Ep 3

    "For me, healthcare is the center of all 16 critical infrastructures. Because if you can fix healthcare, you can fix everything else." Who They Brought In Janine Medina is the Director of Operations at SOCSoter, and she might have the most varied path to cybersecurity of anyone in this series. She started in tech twenty years ago as an administrative assistant at a nursing home for nuns, moved into industrial control systems managing building infrastructure, then spent years doing clinical informatics across most of the hospitals in New York. She built electronic medical record workflows for surgical oncology, navigated the Meaningful Use era in healthcare IT, worked in banking and finance, consulted for the government on healthcare cybersecurity, and spent time in the medical device manufacturing space focused on regulatory compliance across the 16 critical infrastructures. She joined SOCSoter as Director of Operations and now functions as the connective tissue between sales, marketing, tech, and cybersecurity. Her job, in her own words, is to make one hand understand what the other is doing. What Got Loud Why MSPs telling their healthcare clients they are HIPAA compliant with just an antivirus and a firewall is not just wrong, it is putting those clients on a federal breach list they do not know exists HIPAA 2.0 is already being drafted and it is not just about privacy anymore. It is about your full cybersecurity stack, your devices, your redundancy, and whether you can survive an incident The Three Little Pigs framework for explaining MSP security posture to clients who do not speak cyber. Straw, sticks, or brick. Most organizations think they have brick What happens to your healthcare data, your house deed, and your financial accounts when you die and nobody is watching Why healthcare is the Rosetta Stone for all of cybersecurity and the industry that gets attacked most because of it The Rundown Janine's entry point into the episode is a framework she arrived at the morning of the recording. She calls it the Three Little Pigs model and it is exactly what it sounds like. A company with no real protection is a house of straw. Add some tools without cohesion and you have sticks. A properly architected security posture is brick. The big bad wolf, automated, fast-moving, and indifferent to your business size, can level the first two. The third one makes him work. It is a blunt and effective way to explain to any client why tooling without architecture is not security. The HIPAA conversation is where Janine gets direct. She is watching MSPs tell their dental and optometry clients they are HIPAA compliant while running nothing more than basic endpoint protection and a firewall. Those clients are not compliant. They just do not know it yet. When something goes wrong they end up on the HHS Office of Inspector General breach list, facing per-record fines, billing disruption, and reputational damage that is very hard to recover from. Janine's position is that the MSPs doing this are not being malicious. They just have not read the regulation. "Talk to me," she says, "or just read the regulation." HIPAA 2.0 raises the stakes further. The incoming framework is not just about data privacy. It extends to medical devices, security perimeters, redundant systems, and incident response timeframes. The Joint Commission is developing a cyber readiness accreditation for hospitals on top of that. Janine's read is that the smaller independent practices, dentists, optometrists, private clinics, are the most exposed because they have no hospital system infrastructure behind them and no clear roadmap for what compliance is supposed to look like at their scale. One of the sharper moments in the episode comes when Janine reframes the entire cybersecurity communication problem through language. Healthcare and cybersecurity already share a vocabulary. A virus behaves the same way whether it is biological or digital. It enters a system, duplicates, spreads. Her argument is that if the industry just started using that shared language, the normalization of security conversations in healthcare settings would move significantly faster. "If we just had better conversations of what a virus is, it's almost the same thing. Everybody will understand each other." The episode closes on something most security conversations skip entirely: what happens to your data after you die. House deeds are being signed over to strangers who read obituaries and file fraudulent paperwork. Loans are being taken out against properties. Medical records sit in systems for seven years after your last visit with no one actively protecting them on your behalf. Janine's point is not to induce panic. It is that survivability, the protection of your data and your assets across your entire life, is a cybersecurity conversation the industry has not started having loudly enough yet. Real Talk If you are an MSP and you have ever told a healthcare client they are HIPAA compliant without a thorough controls review, this episode is worth your time before the next audit finds that out for you. HIPAA 2.0 is coming and it will not be optional. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let's talk. Visit socsoter.com.

16. 

    22 Jun 2026

    What a SOC Manager Wishes Every Customer Knew with Angie Broadwater - Ep 2

    "If you can't reach us, it doesn't mean we're ignoring you. It might mean all hands are on deck for a major incident. And honestly? If it were your company we were fighting for, you'd want every one of us on that call." Who They Brought In Angie Broadwater is SOCSoter's SOC Manager, and she got here the hard way. A career in the spa industry, a pandemic, a husband who has been in cybersecurity since age 16, and a decision to go back to school at West Virginia University for her MBA while simultaneously earning three cybersecurity certifications including the CEH. She came in as a SOC analyst and operational admin. Two and a half years later, she runs the team. She also participated in the NATO Locked Shields exercise alongside the Department of Defense, CISA, and the National Guard. Not your typical career path. That's the point. What Got Loud Ticket volume swings from hundreds to thousands depending on the day, and Angie is still in the queue herself Bad actors are now using Axios user agents for bot activity and scripting, and when the SOC sees it, it is 99.9% always malicious Free personal VPNs are not protecting your company. They share infrastructure with the same threat actors trying to get in AI is being positioned in the industry as a tier one SOC analyst. Angie has thoughts on that. If your admin password is "admin," this episode is specifically for you Compliance and security are not the same thing, and checking the box is not the same as being protected The Rundown Angie didn't come up through a traditional IT pipeline, and she makes no apologies for it. The skills she built in the spa industry translated more than people might expect: managing operations, staying calm under pressure, handling a lot of moving pieces at once. When COVID shut everything down, she made a decision. Get the MBA, get the certifications, get into cybersecurity. Three certs later, including passing the Certified Ethical Hacker on her first attempt with great scores, she landed at SOCSoter and has not slowed down since. The day-to-day inside a 24/7 SOC is not what most people picture. Angie describes it as looking for a needle in a haystack where there might not even be a needle. The team handles hundreds to thousands of tickets on any given day across priority, general, maintenance, and help queues. Patch Tuesday means more volume. Weekends mean maintenance windows. And through all of it, Angie is still in the queue herself, still running vulnerability scans, still fielding calls. The SOC manager who stays in the work is a different kind of manager. Two things Angie flagged that every MSP and IT team should hear. First, on VPNs: free personal VPNs share IP infrastructure with known malicious actors. The SOC catches logins coming from IPs flagged for malicious activity thousands of times over, and those same IPs belong to the free VPN pools your users think are protecting them. The data being transmitted through those VPNs, including usernames and passwords, can be intercepted. Business VPNs cost more. The breach they prevent costs more than that. Second, on speed: when a bad actor gets into a cloud environment, they are not browsing around. They are running automated scripts that can read hundreds of emails, exfiltrate files, and set up persistence in under ten minutes. Every minute SOCSoter cannot reach someone to authorize a block is another minute of access. Give the SOC the permissions it needs to act fast. Angie closed with practical recommendations that sound simple and still get skipped constantly. Patch and actually remediate vulnerabilities, not just scan for them. Run phishing training because even security professionals get fooled now. Back up your data offsite, not just locally and not just with snapshots. Change default admin credentials. And communicate with your SOC when anything in your environment changes, because the team is not clairvoyant. Real Talk Compliance checks boxes. Security protects your business. Angie knows the difference because she lives in both worlds every day. The controls that feel pointless often matter more than the ones that feel obvious, and the ones that feel obvious, like not using "admin" as your admin password, still need to be said out loud apparently. Work with your SOC like a partner, not a vendor. The ones who call the most are usually the ones who care the most. Catch It Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If you want to know whether your security setup would pass the Angie test, let's find out together. Visit socsoter.com.

17. 

    8 Jun 2026

    10x More Attacks: What a SOC Tech Account Manager Sees Every Day - EP 01

    _*]:min-w-0 gap-3"> "Two to three high alerts a day, some weeks. And when they get in? Eight minutes. In eight minutes, a threat actor read over 200 emails, uploaded malicious files to SharePoint, set up a malicious survey, downloaded from OneDrive, and added a malicious app to the tenant." Who They Brought In: Isaac Anderson is SOCSoter's Technical Account Manager, five years in and probably the person on the team who has touched more customer environments than anyone else. He sits at the intersection of the SOC, engineering, account management, and the clients themselves. If something goes wrong in a customer's environment, Isaac is in the room. He also designed SOCSoter's reporting. Left brain, right brain. Don't sleep on him. What Got Loud: • Attacks are up roughly 10x since Isaac started, and that's his conservative estimate • The Nigerian Prince email is dead. AI-crafted spear phishing now targets CEOs with flawless English for under $1,000 in tools • Microsoft's built-in "risky sign-in detection" is, in Isaac's words, almost worse than useless • Four specific things most companies aren't doing in Microsoft 365, and why not having them is basically leaving the door open • Every industry is a target. Isaac's wife works at a printing company. They got hit too. • 60% of small and mid-sized businesses that take a ransomware hit end up closing. Full stop. The Rundown: Five years ago, SOCSoter's alert volume was manageable. Today Isaac is fielding two to three high alerts a day, some weeks. The driver isn't mystery. It's math. AI has made it cheap, fast, and easy to launch sophisticated attacks at scale. The old tells are gone. Broken English, weird logos, obvious spoofing. Threat actors have moved past all of it. Spear phishing targeting C-suite executives now runs on tools that cost a few hundred dollars, tops. The return on investment for attackers is enormous. The risk of getting caught is minimal. The conversation zeroed in on Microsoft 365 because that's where most of the damage is happening. Isaac made a point worth writing down: Microsoft does a great job reassuring you their product is safe. They do a poor job making sure you actually understand your own responsibilities in managing it. The gap between those two things is where breaches live. Most of what Isaac's team sees comes down to improperly configured conditional access policies. Four fixes cover the majority of incidents: block unmonitored devices from accessing your 365 environment, enforce MFA globally without exceptions, set up geo-filtering, and require frequent re-authentication. None of this is exotic. All of it gets skipped constantly. Then Isaac described a real incident. Eight minutes of access on a compromised admin credential. In that window, the threat actor read 200+ emails, uploaded malicious files to SharePoint, set up a phishing survey using Microsoft's own tools, downloaded files from OneDrive, and added a malicious application to the tenant. All scripted. All automated. SOCSoter's engineering team had a full incident report ready within 30 minutes. Soon that drops to under a minute. That remediation, the walkthrough, the cleanup, the follow-up, is included in the service. No extra charge. Melissa closed with something that doesn't get said enough: SOCSoter is not clairvoyant. If your environment changes, new firewall, new VPN policy, new anything, you have to communicate it. Security is a partnership. The SOC can only protect what it can see. Real Talk: Microsoft 365 is where your business lives. It's also where attackers are spending most of their time. The four things Isaac laid out, unmonitored device access, MFA enforcement, geo-filtering, and forced re-authentication, aren't advanced. They're table stakes. If you don't have them in place, you're not saving money. You're just deferring a very expensive conversation. Catch It: Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If your Microsoft 365 environment hasn't been reviewed lately, let's fix that before someone else does it for you. Visit SOCSoter.com (https://socsoter.com)

Contact SOCSoter Unfiltered

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.