The Business of Cybersecurity

About The Business of Cybersecurity

The Business of Cybersecurity is a podcast from the Tech Talks Network that explores where security and business strategy converge. Hosted by Neil C. Hughes, creator of the Tech Talks Daily Podcast, this series examines how today’s enterprises are managing cyber risk while still moving fast and innovating. Through insightful conversations with industry leaders, CISOs, product strategists, and security architects, the podcast brings clarity to the real-world decisions shaping cybersecurity in modern business. Each episode dives into how companies are responding to regulatory pressure, increasing complexity in cloud environments, and rising expectations from boards and customers. From AI-driven defense and zero trust to skills gaps and risk quantification, we go beyond technical jargon to explore what actually works—and what doesn’t—on the road to building resilient organisations. Whether you're leading a security team, sitting at the executive table, or simply want to understand the business impact of cybersecurity, this podcast offers honest, grounded perspectives designed to help you make better decisions in an environment that never stands still. Search Tech Talks Network to discover more shows covering the voices at the heart of enterprise technology.

Publisher

Neil C. Hughes

Category

business · technology

Language

en

Explicit

No

First episode

16 Apr 2025

Latest episode

26 Oct 2026

Latest episodes

54 episodes in the feed.

1. 

   26 Oct 2026

   When the Perfect Job Candidate Is a Deepfake With Cyberr

   Would your hiring process recognize a convincing deepfake candidate before that person received access to company systems and data? In this episode of Business of Cybersecurity, I speak with Samantha Swift, Chief Marketing Officer at Cyberr and a cybersecurity practitioner with 27 years of experience spanning technical support, incident response, product development, industry roles and marketing. Samantha brings the kind of perspective that is difficult to acquire from a marketing handbook because she has spent years working alongside the people who buy, use and defend security technology. The conversation centers on a remarkable hiring incident at Cyberr. A candidate applying for a back-end engineering role arrived with a strong CV, a polished professional profile and apparently relevant experience. On paper, the match looked almost perfect. During the video interview, however, small inconsistencies began to appear. The voice and image were slightly out of sync, the candidate looked unusually processed, nonverbal sounds exposed a different accent, and answers about Cyberr were weaker than the carefully prepared technical responses. The interviewer's personal connection to Moldova and knowledge of Romanian produced another unexpected test. When he offered to continue the interview in Romanian, the candidate declined. The final check came when the applicant was asked to place a hand in front of his face. Samantha explains that this type of movement can break a live facial filter, and the candidate refused. The call ended soon afterward. The follow-up investigation found a recently created LinkedIn profile that soon disappeared, a purchasable Romanian phone number and an email address disconnected from the identity being presented. An investigative journalist familiar with nation-state activity told Samantha that elements of the email format resembled known tactics, but he could not confirm the source with certainty. That distinction matters. The attempt may have involved a state-linked actor, another criminal group or an individual using similar methods. The verified point is that Cyberr was targeted by somebody attempting to enter the company under a false identity. We discuss why the security response cannot depend on spotting visual glitches forever. Deepfake audio and video will continue to improve, and legitimate candidates should not be made to feel guilty before an interview begins. Samantha recommends starting identity and background checks earlier, matching the level of scrutiny to the access and risk attached to the role, and using video from the first talent-acquisition conversation. Hiring teams also need guidance on what information they can share because an applicant may begin social engineering before the technical interview. The risk continues after an offer is made. Criminal groups can pay local accomplices to receive company laptops, install software or forward devices, creating a believable local presence for a remote employee. This turns equipment delivery, identity checking and employee monitoring into connected parts of the same security process. We finish by discussing cybersecurity hiring, nontraditional career routes, ID-verified professional communities and the need for smaller businesses to access trusted security expertise without enterprise-sized budgets. If a candidate, product or professional profile looks perfect, what additional evidence would earn your trust? Share your thoughts and experiences with me.

2. 

   21 Oct 2026

   Cyber Risk Is a Myth and the Business Owns the Outcome

   Who owns a technology-related business risk when revenue, operations, customer trust or regulatory standing are at stake? In this episode of Business of Cybersecurity, I speak with Kayne McGladrey, a two-time CISO, independent fractional and virtual CISO, Senior Member of IEEE, and author of Cyber Risk Is a Myth: A Business Approach to Integrated Risk Management. Kayne argues that calling something a cyber risk can create distance between the people who understand the technology and the people who own the business outcome. When the CISO is expected to accept a risk attached to someone else’s profit and loss statement, accountability becomes blurred and business leaders may make decisions without seeing the security dependencies beneath them. We discuss how companies can replace technical severity scores and vulnerability counts with a shared language based on financial exposure, operations, reputation and regulatory impact. Kayne explains why each entry in a risk register should have a named business owner, while the security team identifies, quantifies, translates and monitors the exposure. The conversation also covers the difference between documenting risk and using it to guide investment. A useful risk register should help executives compare exposure across business areas, connect controls to expected outcomes and track residual risk over time. This reframes the budget conversation from how much security costs to how much risk an investment reduces. Kayne also explains why clean audits, insurance policies and written controls do not prove that a company can recover from an incident. Tabletop exercises, technical recovery tests and rehearsed decision paths provide stronger evidence of readiness. For board members, he offers practical questions about ownership, integrated reporting, business metrics and cross-functional reviews after incidents. What evidence would show that cybersecurity is part of enterprise risk management in your organization, rather than a separate technical function? Listen to the conversation and share your thoughts with me.

3. 

   18 Oct 2026

   When Voice and Face No Longer Prove Identity With HYPR

   What happens to identity security when an attacker can copy an executive's voice, face, and employment history using inexpensive tools? In this episode of The Business of Cybersecurity, I speak with Bojan Simic, CEO and co-founder of HYPR, about the effect of generative AI on impersonation, credential recovery, and help desk security. HYPR is a New York cybersecurity company focused on identity-based attacks. Bojan says identity-related events account for between 60 and 80 percent of incidents, depending on the security report being used, and his team helps organizations find and repair weak points across the identity chain. The demonstration during our conversation makes the risk unusually tangible. Bojan changes his on-screen face into mine using software running on his local computer. The result is not flawless, but it is convincing enough to show why a familiar face on a video call can no longer be accepted as evidence by itself. With additional preparation, an attacker can also clone a voice, gather employment details from public profiles, and automate much of the reconnaissance that previously required repeated manual calls. Bojan argues that asking employees to recognize every deepfake repeats an old cybersecurity mistake. Phishing simulations showed how quickly people return to normal working habits after training. Help desk staff are trying to resolve problems, support colleagues, and close tickets. They should not be expected to determine whether a distressed caller, senior executive, or remote employee has been digitally recreated. One hospital example illustrates the weakness of knowledge-based checks. According to Bojan, an attacker called the help desk while pretending to be a doctor but did not know the required four-digit PIN. The attacker then called the doctor while posing as the IT team, obtained the PIN, returned to the help desk, and gained access to the account. The process technically followed policy, yet the policy relied on information that could be socially engineered. We discuss how the same attack can become faster through AI. A system can call the help desk, discover which questions are asked, search public sources for the answers, call the employee when information remains missing, and return with the required details. Requiring video does not solve the problem when faces can also be recreated. The conversation also covers continuous identity proofing. Instead of treating verification as an event completed during onboarding, companies can request stronger evidence when behavior changes. A new device, unfamiliar operating system, first-time access to a sensitive application, return from a long absence, or promotion into privileged access can all justify another check. Routine work from a known device should remain straightforward, allowing friction to appear when the risk changes rather than during every action. Privacy deserves equal attention. Bojan acknowledges that employees in some countries may resist location, document, or biometric checks. His recommendation is to explain what is collected, whether it is retained, and what alternatives exist. An employee who declines remote verification can be offered an in-person process. That gives people a choice while preserving the security requirement. The most immediate action is to test password recovery and credential reset. Bojan advises moving those functions away from phone-based help desks and into a self-service process that combines device, location, or document verification. He says credential resets account for roughly 30 to 40 percent of help desk calls, so the change may also reduce support demand. Could a cloned executive, remote worker, or doctor pass your current recovery checks, and which independent signal would stop them? Listen to the episode and share your thoughts with me.

Who has been a guest on The Business of Cybersecurity

Names identified in recent episode analyses. Showing up to five guests.

• Tim MalcomVetter
• Steven Furnell
• Jim Lippie
• Harman Kaur
• Michel Jacobs

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

YouTube views

602,988

Score snapshot 15 Sept 2025

Apple Podcasts (US)

5.0 / 5

1 ratings

Podcast Authority Score: 60 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

86

Social presence

0

YouTube

86

Engagement

0

Contact The Business of Cybersecurity

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Questions about The Business of Cybersecurity