The Brief with Charles Denyer

About The Brief with Charles Denyer

The Brief with Charles Denyer is your guide to cybersecurity, AI, compliance, risk, and data privacy. Each week, Charles brings sharp insights and practical strategies to help you reduce risk, cut costs, and protect what matters most. From regulatory chaos to AI uncertainty, Charles breaks down the issues leaders face today — with real answers and real solutions. Listen on Apple, Spotify & more. Learn more: charlesdenyer.com Contact: info@charlesdenyer.com

Publisher

Charles Denyer

Category

technology

Language

en

Explicit

No

First episode

2 Jun 2025

Latest episode

29 Oct 2026

Latest episodes

34 episodes in the feed.

1. 

   29 Oct 2026

   Is Security Awareness Training a Waste of Money? What a 20,000-Person Study Found | EP 36

   In this episode of The Brief, Charles Denyer challenges a ritual nearly every organization in America performs without question — the annual security awareness training — and asks whether the billions spent on it actually make anyone safer. He opens with the ritual everyone recognizes: the yearly email, the cartoon villain in a hoodie, a few slides, a short quiz, and a certificate declaring the employee a “human firewall.” Hospitals, banks, and police departments all run some version of it, in part because regulations like HIPAA, PCI DSS, and the FBI’s CJIS policy require it. The promise underneath is simple — train the human, and you close the hole. Then Charles turns to the evidence. Researchers at the University of California, San Diego ran one of the most rigorous tests ever attempted: a randomized controlled trial across nearly 20,000 employees of a major health system, over eight months, with ten real phishing campaigns. The findings are sobering. The training delivered right after someone failed a simulated phishing test reduced future clicking by about 2 percent — a rounding error. Whether an employee had recently completed their mandatory annual training had no meaningful relationship with whether they fell for a phishing email at all. And when researchers looked at how people actually engaged, roughly 75 percent spent a minute or less on the material, and a third closed it immediately without reading a word. But he raises the deeper, more uncomfortable question: if the training barely works, why does every organization keep buying it? Part of the answer, Charles argues, is that much of it isn’t really purchased to change behavior — it’s purchased to transfer liability, so that when an employee inevitably clicks, the organization can point to the training records and say the fault was theirs. Over the full eight months of the study, more than half of the workforce clicked at least one phishing link. The lesson isn’t that people are careless; it’s that humans are human, and an attacker only has to win once. He’s careful to be fair — teaching people to report a suspicious email genuinely helps, and the rules still require awareness training — but “required to do it” and “allowed to rely on it” are two very different things. His message is clear, and it’s the same one the researchers reached: stop trying to turn your people into a firewall, and start building systems that survive them being human. The controls that actually move the needle are technical — multi-factor authentication so a stolen password alone can’t open the door, and password managers that fill credentials only on the real website and stay silent on the fake one. Keep the training lean and honest for compliance; put the real money where the evidence points. Stop trying to win the argument with your own employees. Start building a system that doesn’t need to. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com (http://charlesdenyer.com/) | Instagram: @denyer.charles (https://www.instagram.com/denyer.charles/) | LinkedIn: https://www.linkedin.com/in/charlesdenyer (https://www.linkedin.com/in/charlesdenyer) Questions/Topics/Advertising: info@charlesdenyer.com (mailto:info@charlesdenyer.com) Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

2. 

   29 Oct 2026

   Why HIPAA Can’t Protect Your Medical Records — a Billion Breached and Counting | EP 35

   In this episode of The Brief, Charles Denyer takes on one of the most trusted names in American law — HIPAA — and asks an uncomfortable question: how did the law written to protect your medical records end up presiding over the largest leak of them in history? He opens with a number that is hard to believe. Since 2009, when the federal government first began keeping count, more than one billion health records have been exposed in large breaches in the United States — nearly three times the country’s population. The law most Americans assume is guarding that data, the Health Insurance Portability and Accountability Act, was passed in 1996, and its Security Rule — the part meant to force hospitals to actually protect electronic records — has not had a serious update since 2013. Charles breaks down three failures hiding behind the acronym. The scale: 2024 was the worst year on record, with more than 240 million health records exposed — a single attack on a little-known claims processor, Change Healthcare, accounted for roughly 192.7 million of them, nearly two-thirds of the country. The enforcement: in that same record-breaking year, federal regulators imposed their most penalties ever and collected about $10 million — roughly four cents for every person exposed — while HIPAA gives individuals no right to sue on their own behalf. And the coverage gap: HIPAA governs doctors, hospitals, and insurers, but not the mental-health apps, fertility trackers, prescription-discount services, and DNA-testing companies where an estimated 160 million Americans now pour their most intimate information. But he raises the harder point: the data HIPAA doesn’t touch is often the most sensitive of all. Federal regulators caught two major health platforms — the prescription-savings service GoodRx and the online therapy company BetterHelp — sharing users’ health information with advertisers, conduct HIPAA had nothing to say about because the law drew its boundary in 1996, for a world without smartphones. A long-promised overhaul of the Security Rule — mandatory encryption, multi-factor authentication, real recovery testing — has been proposed, but as of late 2026 it remains only a proposal, with the deadline to finalize it already slipped to 2027. His message is clear: HIPAA did real good — it gave patients rights they never had and dragged breaches into the daylight — but on both its reach and its teeth, it has fallen behind the threat it was built to stop. The organizations that leaked a billion records mostly had the paperwork. And a credit card can be reissued; a medical history cannot. “HIPAA compliant” was never the same thing as safe. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com (http://charlesdenyer.com/) | Instagram: @denyer.charles (https://www.instagram.com/denyer.charles/) | LinkedIn: https://www.linkedin.com/in/charlesdenyer (https://www.linkedin.com/in/charlesdenyer) Questions/Topics/Advertising: info@charlesdenyer.com (mailto:info@charlesdenyer.com) Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

3. 

   21 Oct 2026

   Inside the FBI CJIS Security Policy — the Biggest Overhaul in a Decade | EP 33

   In this episode of The Brief, Charles Denyer takes listeners inside one of America's most powerful and least understood information systems — the FBI's Criminal Justice Information Services (CJIS) — and the sweeping security overhaul changing how the nation's most sensitive criminal justice data is protected. He opens in 1967, when a New York City police officer ran a stolen license plate through the brand-new National Crime Information Center (NCIC). Nearly sixty years later, that system and the databases surrounding it handle approximately 14 million queries a day, connecting more than 90,000 agencies to criminal histories, warrants, missing-person records, and other sensitive information. Charles breaks down the FBI's CJIS Security Policy Version 6.0, its expansion from 13 to 20 policy areas, new authentication requirements, and the September 2027 implementation deadline. But he raises a more troubling question: what happens when the greatest threat isn't a hacker trying to break in, but someone who already has authorized access? Drawing on an Associated Press investigation documenting hundreds of cases of law enforcement personnel misusing criminal justice databases, Charles exposes the uncomfortable reality that stronger passwords, encryption, and multi-factor authentication cannot prevent an authorized insider from abusing the system. He's careful to distinguish the overwhelming majority of officers who use these tools responsibly from those who exploit them. His message is clear: modernizing the rulebook is essential, but without meaningful oversight, continuous auditing, and accountability, even the strongest security policy is little more than paper. The rulebook is the floor. Public trust is what you're actually protecting. The Brief is a Charles Denyer Productions podcast hosted by Charles Denyer. Learn More: charlesdenyer.com (http://charlesdenyer.com/) | Instagram: @denyer.charles (https://www.instagram.com/denyer.charles/) | LinkedIn: https://www.linkedin.com/in/charlesdenyer (https://www.linkedin.com/in/charlesdenyer) Questions/Topics/Advertising: info@charlesdenyer.com (mailto:info@charlesdenyer.com) Disclaimer: The Brief is a podcast produced by Charles Denyer Productions. The views and opinions expressed by the host and any guests are their own and do not constitute legal advice.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

2 ratings

Podcast Authority Score: 14 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

28

Social presence

0

YouTube

0

Engagement

0

Contact The Brief with Charles Denyer

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.