Cybersecurity isn't an exact science. It's where art and science meet, informed by experience, tested in battle and reimagined to tackle evolving adversaries.
In The Art of Security, Josh Davies and Tyler Reguly break down how security actually works in practice. From zero-day exploits and emerging threats to rethinking long-standing best practices, they explore what holds up — and what doesn't — in today's rapidly changing landscape.
While the science of cybersecurity focuses on what's repeatable, the art of security is about making the right decisions in the moment.
Each episode delivers practical insights, informed perspectives, and real-world context to help security professionals and tech enthusiasts stay ahead of evolving threats and build smarter, more resilient defenses.
Who Really Holds the Cheese? Cat and Mouse, Reconsidered
In cybersecurity, attackers supposedly need to get lucky only once, while defenders must be right every time. But does that familiar idea give attackers too much credit?
In this episode of The Art of Security podcast, co-hosts Tyler Reguly and Josh Davies rethink the cat-and-mouse dynamic between attackers and defenders, exploring how layered security, deception, active defense, preparation, and threat intelligence can change the game. They also consider how the metaphor shifts between enterprise security and personal security, where the risks, resources, and ability to respond can look very different.
It is a thoughtful, wide-ranging conversation about moving beyond reactive security, making attackers work harder, and deciding who really holds the cheese.
30 Sept 2026
Are You Making It Too Easy for Cyberattackers?
Most attacks do not succeed because the attacker developed a brilliant new technique. They succeed because exposed information, weak processes, insecure credentials, and avoidable shortcuts give attackers an easier path.
For Cybersecurity Awareness Month, Josh Davies and Tyler Reguly examine how individuals, employees, security teams, leaders, and small businesses can introduce more friction into an attack. The goal is not to become invincible. It is to make every step more expensive, time-consuming, and risky for the attacker.
In this episode of The Art of Security podcast, you'll learn:
How reducing public information exposure can limit phishing, impersonation, and social engineering opportunities
Why call screening, independent verification, and stronger MFA can interrupt common attack workflows
How deception engineering, canary files, application allowlisting, and restricted PowerShell access create attacker friction
Why security culture must empower employees to question unusual requests, regardless of the apparent sender's rank
How small businesses can close significant security gaps without building a full internal security team
Listen now to learn how small, practical security decisions can make you a much less attractive target.
And make sure to subscribe so you don't miss out on any cyber insights!
16 Sept 2026
Security Theater: Feeling Safe vs. Being Secure
What happens when cybersecurity programs prioritize visible activity over meaningful risk reduction? Security theater can reassure executives and end users, but that reassurance becomes dangerous when dashboards, checkbox compliance, and inflated metrics distract teams from the controls that actually reduce exposure.
In this episode of The Art of Security, Josh Davies and Tyler Reguly examine the line between communicating security effectively and merely performing it. They challenge conventional thinking about security metrics, product marketing, threat hype, compliance, and the pressure to make security programs look productive.
Key takeaways
Why activity metrics such as alerts triaged, vulnerabilities patched, and detections created may not reflect improved security
How threat hype and named vulnerabilities can redirect limited resources away from higher-priority risk
Why security visibility and clearly assigned asset ownership provide a stronger foundation for meaningful measurement
How security teams can demonstrate control effectiveness without relying on checkbox compliance or misleading ROI calculations
Security should create confidence because controls are validated, assets are monitored, and responsibilities are clear, not because a dashboard looks impressive.
👍 Like the video if the discussion challenged how you measure security
💬 Tell us which cybersecurity metrics your team finds genuinely useful
🔔 Subscribe for practical conversations with cybersecurity practitioners and researchers
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
4 ratings
Spotify
5.0 / 5
5 ratings
Contact The Art of Security
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of The Art of Security?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
