VIA Knowledge Hub Podcast

About VIA Knowledge Hub Podcast

Discussions, playbooks, and tech resources for teams building software for the DoD and other highly regulated industries, so you can ship fast, stay secure, and be compliant. www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast)

Publisher

VIA

Category

business · technology

Language

en

Explicit

No

First episode

12 Sept 2025

Latest episode

9 Oct 2026

Latest episodes

1 of 17 episodes have a transcript.

1. 

   9 Oct 2026

   Stop calling humans the weakest link with Perry Carpenter

   Perry Carpenter ran a deepfake test. One participant correctly flagged a video with a cloned voice as fake, then blamed glazed eyes and an odd shadow. Both were in the original footage. The answer was right. The reasoning was invented. That gap between what we see and what we believe is where Perry works. As Chief Deception Strategist at KnowBe4, he studies how attackers exploit human behavior. He’s also the author of three books and host of the 8th Layer Insights podcast. Perry and host Heidi explain why awareness alone never changes behavior, and why calling people the weakest link misses the point. They dig into the “happy valley,” an approach that gently guides users toward safe choices, and how attackers use that same principle to box people in and hide the way out. For builders, Perry’s advice is practical: make risky actions harder to take. Perry’s advice is simple: make risky things harder to do, and give people permission to slow down. Topics Covered 0:00 - Introduction2:00 - What a chief deception strategist actually does4:35 - From managing human risk to managing the human environment6:40 - Why every con is built around managing attention11:05 - Are regulated industries targets or collateral damage?12:05 - Pig butchering, rug pulls, and the loneliness exploit13:30 - How uncertainty leads to people choosing their own reality16:15 - The problem with “human firewall” and “weakest link”17:30 - Why awareness alone never changes behavior19:50 - What makes an organization’s culture harder to fool23:05 - The happy valley, dark patterns, and the attacker’s toolbox26:05 - Content provenance, C2PA, and where it breaks down31:00 - Why context shapes what people believe is fake About Perry Carpenter Perry Carpenter is a multi-award-winning author, podcaster, and speaker, with over two decades in cybersecurity focusing on how cybercriminals exploit human behavior. As the Chief Deception Strategist at KnowBe4, Perry helps build robust human-centric defenses against social engineering-based threats. His latest book, FAIK: A Practical Guide to Living in a World of Deepfakes, Disinformation, and AI-Generated Deceptions (Wiley: Oct 2024), explores AI’s role in deception. Perry also hosts the award-winning podcasts 8th Layer Insights and Digital Folklore. • Connect with our guest Perry Carpenter: https://www.linkedin.com/in/perrycarpenter/ (https://www.linkedin.com/in/perrycarpenter/) • Check out KnowBe4: https://www.knowbe4.com/ (https://www.knowbe4.com/) • Grab Perry’s books from Amazon: https://www.amazon.com/stores/author/B07PY1CWM6 (https://www.amazon.com/stores/author/B07PY1CWM6) Want to learn more about VIA? This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

2. 

   8 Sept 2026

   What happens when social engineering hits machine scale with Ariana Mirian

   Attackers used to send a link. Now they send “hey, are we still on for golf?” and wait days, sometimes months, before asking for money. That shift is the subject of this conversation with Ariana Mirian, co-founder of BeeSafe.ai, a company that sends undercover AI agents into the same channels attackers use to catch them before they reach a real victim. Ariana built her career on measurement, starting with a PhD at UC San Diego studying whether phishing simulation training actually works. It largely doesn’t. That rigor now drives BeeSafe’s approach: engaging scammers directly to trace the full attacker lifecycle. Her pilot data found trust-based scam conversations average eight days before a financial ask and go to great lengths to establish a relationship with victims. Many scams are organized crime operations, some staffed by trafficking victims. As Ariana says, there are often victims on both sides of the scam. Ariana and host Heidi dig into trust creep, the small asks that quietly earn an AI tool full access to your accounts, and how a multi-layered defense is required to combat fraud. BeeSafe operates near the last layer, stopping the money before it disappears. As Ariana puts it, scam operations are still human scale for now. What happens when they aren’t? Topics covered 0:00 - Introduction1:15 - How email deception evolved into slow, trust-based scam conversations3:00 - What phishing simulation training actually accomplishes (not much)6:10 - Why this works: billions in fraud losses and a room where most hands go up 10:10 - Inside BeeSafe.ai’s approach to engaging scammers with AI agents 11:55 - Eight days: what the BeeSafe pilot revealed about scam conversation length13:15 - Why people hand AI tools information they’d never give a stranger18:20 - Defining trust creep, from scam texts to everyday AI permissions20:00 - How incremental asks quietly expand an AI tool’s access21:30 - Pig butchering scams and the organized crime operations behind them24:35 - Why these attacks are still human scale, and what changes if they’re not 26:45 - The fear: LLMs making hyper-personalized spear phishing easier at scale29:25 - Money mule networks and why speed matters for remediation34:25 - The “Swiss cheese model” and why BeeSafe advocates for multiple layers of defense36:30 - Authorized push payment fraud, and the tension between usability and security About Ariana Mirian Ariana Mirian is a security researcher who has worked at the intersection of empirical measurement and security for over a decade, bringing a data driven lens to security decisions and intelligence. At BeeSafe AI, she is using this experience to drive novel methods that collect data on trust-based scams, in order to prevent victim losses. Prior to this, she worked as a senior security researcher at Censys, where she conducted measurement-driven research to map the Internet ecosystem. She earned her PhD in Computer Science and Engineering at UC San Diego, where she used Internet-scale measurement to study real-world security posture and develop data-driven methods across cybercrime, Internet-wide scanning, and enterprise security. * Connect with our guest Ariana Mirian: LinkedIn (https://www.linkedin.com/in/arianamirian/) * Check out BeeSafe AI: https://beesafe.ai/ (https://beesafe.ai/) Want to learn more about VIA? This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

3. 

   16 Jul 2026

   Protect, utilize, govern: mapping AI's new attack surface with Chris Cochran

   If someone asked you to prove, with evidence, that the AI in your product is secure, could you do it? Most teams can’t, and until recently there was no shared standard for what that proof even looks like. Chris Cochran, Field CISO and VP of AI Security at the SANS Institute, built one. After nine months of conversations with three to four hundred security leaders around the world, all asking the same questions, he authored the SANS AI Security Maturity Model, a framework already being used to map compliance requirements under the EU AI Act. Chris breaks down the model’s three pillars: protect, utilize, and govern, and explains why the most uncomfortable questions in the framework are the foundational ones. He also reveals the highest maturity stage of the model any company has claimed, why a small business can outrank an enterprise, and what developers shipping AI into regulated environments can’t afford to ignore. As Chris puts it, the genie is out of the bottle. AI does not care if you believe in it or not. Topics Covered 00:00 - Introducing Chris Cochran 02:20 - Why we need another framework 04:00 - The three pillars: protect, utilize, and govern 05:05 - Half of security leaders are AI skeptics, and why this mindset is unproductive 06:50 - The most uncomfortable question in the SANS AI Security Maturity Model 08:40 - Data classification as the prerequisite for any AI policy 10:30 - The highest maturity stage of the framework that someone has claimed 12:30 - Two ways to read the framework: front to back or scoring rubric first 13:25 - AI assisted adversaries will target everyone soon, what that means for small businesses 16:30 - Why SANS uses industry specific weighting 18:25 - What developers need to know about shipping the same AI tools in different industries 20:40 - Why developers should care about the AI Security Maturity Model About Chris Cochran Chris Cochran is the Field CISO and Vice President of AI Security at the SANS Institute, where he stands at the intersection of frontier AI innovation and real-world cybersecurity defense. A Marine Corps veteran and former leader at organizations like Netflix, Mandiant, the U.S. House of Representatives, Axonius, and NSA, Chris has spent his career translating complexity into clarity, whether guiding organizations through emerging AI threat landscapes, pioneering defensive AI workflows, or shaping the next generation of AI-security practitioners. His work blends deep operational cyber experience with cutting-edge research in AI governance, model risk, multi-agent systems, and adversarial AI, positioning him as one of the few leaders equally fluent in shaping AI strategy and securing it. Known for his storytelling, community leadership, and ability to distill fast-moving technical shifts into actionable insight, Chris is helping build the future where AI systems are both powerful and safe. * Connect with our guest Chris Cochran: LinkedIn (https://www.linkedin.com/in/chrishvm/) * Download the SANS AI Security Maturity Model: https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook (https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook) Want to learn more about VIA? This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

4. 

   10 Jun 2026

   The One Thing Devs Can’t Outsource to AI with Tanya Janca

   Security has never been a solved problem, but the 2025 OWASP Top 10 makes one thing clear: the rules have shifted again. AI is writing code at scale; developers are vibe-coding to production; and the data that trained those models came from an internet where security was largely optional. The result is a new generation of software that looks like it works, until it doesn’t. Tanya Janca, Secure Coding Trainer at She Hacks Purple Consulting and lead author of the 2025 OWASP Top 10, joins us this week on the VIA Knowledge Hub podcast. She has spent years training developers at large enterprises, and what she’s seeing right now should concern anyone shipping software in 2026. In this conversation, Tanya breaks down the vulnerabilities that matter most right now, why AI is making some of them significantly worse, and what developers can actually do about it starting today. She also shares her live training example of AI-generated code hiding its own security failures, and makes the case that developers themselves have become the new high-value target. Topics Covered 00:00 - Introduction 02:00 - What is The OWASP Top 10 and why does the 2025 update matter? 03:30 - Broken access control explained, and why it stays at number one 05:30 - AI trained on unsecured data, and what it learned about security 07:20 - Speed pressure, vibe coding, and the widening gap between developers and security teams 08:15 - Real-world vibe coded breaches and the logging and alerting problem 12:35 - Deterministic vs. probabilistic code and the case for rigorous code review 15:45 - Why code review is the new secure coding 18:25 - Prompt injection in AI systems, explained from first principles 21:10 - Threat modeling for agentic workflows: Adam Shostack’s four question threat modeling framework 23:00 - Are teams actually defending against prompt injection today? 27:35 - Are developers equipped to defend themselves from social engineering and targeting? 29:50 - The DevSec Station podcast: 5-minute training episodes 32:55 - Tanya teaches her book, “Alice and Bob Learn Secure Coding” for free, every month About Tanya Janca Tanya Janca, known online as SheHacksPurple, is the best-selling author of Alice and Bob Learn Secure Coding and Alice and Bob Learn Application Security. She is the CEO of She Hacks Purple Consulting, where she delivers high-impact, live, secure-coding training for engineering teams. She is also the host of DevSec Station Podcast. Over 29 years in the industry Tanya has received numerous awards, spoken at events worldwide, and built a reputation as one of the most approachable and influential voices in application security. She has trained thousands of developers and security practitioners through her academies and live programs. Her experience includes counter-terrorism work, leading security for the 42nd Canadian federal election, as well as building and securing a vast range of applications. Today, she is recognized internationally as a leading authority on the security of software * Connect with our guest Tanya Janca: LinkedIn (https://www.linkedin.com/in/tanya-janca) Make it secure and ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

5. 

   27 May 2026

   Financial Exclusion Is a Security Risk and Blockchain Confusion Is Making It Worse with Candace Kelly

   Most people think blockchain means Bitcoin. That misunderstanding has real consequences for regulators, developers building on it, and for the 1.3 billion people worldwide who still don’t have a bank account. Candace Kelly spent nearly two decades as a federal prosecutor at the DOJ and FBI before becoming Chief Legal Officer at the Stellar Development Foundation. In this episode, she breaks down how post-9/11 AML legislation inadvertently locked entire communities out of the banking system, and why financial exclusion is, in her view, a national security issue. For developers building in this space, the episode lands on the areas where the real work is still happening: privacy-preserving transactions via zero-knowledge proofs, agentic commerce with dispute resolution baked into smart contracts, and the challenge of harmonizing compliance frameworks across jurisdictions that don’t move at the same pace as the technology. Topics Covered 00:00 - Introducing Candace Kelly: DOJ, FBI, and the Stellar Development Foundation 02:15 - What blockchain actually is 03:15 - Rules still apply: why blockchain doesn’t create a lawless financial system 05:00 - Blockchain vs. cryptocurrency: the internet analogy and why conflating them matters 07:30 - What runs on Stellar: stablecoins, real-world assets, and tokenized securities 11:40 - Delivering US dollar aid to internally displaced Ukrainians via mobile wallets 13:00 - How the disbursement platform was built, tested, and open-sourced 15:30 - Haiti: 89% unbanked, cash insecurity, and a local merchant network accepting digital assets 17:00 - Why there is friction in moving from digital funds to fiat funds. 18:00 - How post-9/11 AML legislation excluded low-income communities, immigrants, and charities 22:00 - How blockchain addresses the compliance vs. access tradeoff, and its limitations 25:20 - Transparency vs. privacy: the challenge of open ledgers and user-controlled data 26:15 - Zero-knowledge proofs: proving facts without revealing identity 28:30 - Blockchain as the foundation for privacy features, not a barrier to them 30:05 - Real-world blockchain applications already in the wild 33:30 - Agentic commerce: smart contracts, micropayments, and baked-in dispute resolution 34:50 - Non-financial use cases for blockchain 36:30 - Supply chain fraud and why an immutable ledger changes export enforcement 37:30 - What makes Candace most hopeful: regulators, traditional finance, and proactive detection About Candace Kelly Candace Kelly is the Chief Legal and Policy Officer of the Stellar Development Foundation (SDF), a non-profit organization focused on working with and supporting changemakers to create equitable access to the global financial system through blockchain technology. She leads SDF’s legal team, that is responsible for all of SDF’s legal affairs and the policy team that is focused on bridging the gap between the public and private sectors and fostering dialogue with global regulators and policymakers. Prior to joining SDF, Candace worked for Uber Technologies, Inc., where she held a variety of positions, helping to navigate the company’s response to regulatory investigations and advising on safety, security, privacy, consumer protection, and law enforcement response. Candace brings many years of legal experience to SDF, most notably her 17 year career at the United States Department of Justice (DOJ), where she held positions as a legal and policy advisor on national security, criminal, and civil rights issues in leadership offices in Washington D.C. and as a prosecutor in the Northern District of California. During her time with DOJ, she also served as Special Counsel for National Security for the Director of the FBI. She holds a Bachelor of Arts in East Asian Studies from Williams College and a Juris Doctor from University of California (UC), Hastings College of the Law. Candace is a member of the Janet Reno Endowment Advisory Committee at the Center for Juvenile Justice Reform at the Georgetown University McCourt School of Public Policy, and an Advisory Board Member for the UC Hastings Center for Business Law. * Connect with our guest, Candace Kelly: LinkedIn (https://www.linkedin.com/in/candace-kelly) Make it secure and ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

6. 

   7 Apr 2026TRANSCRIPT

   In the end, it's all risk. An AppSec leader's guide to enterprise AI with Joshua Bregler

   What would you do if your AI agent deleted your production database because it decided that was the logical thing to do? That's not a hypothetical. It happened. And according to Joshua Bregler, it happened because someone gave an AI agent the same admin privileges they'd never hand to a new hire. Joshua is an application security leader at McKinsey, working at the intersection of AppSec, AI adoption, and risk. He spends his days helping some of the world's largest organizations figure out what to do when a shiny new AI tool shows up at their door — and what to do when they've already let the wrong one in. In this conversation, Joshua shares front-line stories from enterprise AI deployments gone wrong, breaks down the guardrail and access control decisions that teams consistently get wrong, and makes a case that's both simple and easy to miss: the right way to manage an AI agent is a lot like the right way to manage a junior developer. The fundamentals don't change. We just haven't learned how to apply them here yet. Topics Covered 01:20 - Why AI adoption fails when humans are removed from the loop entirely 02:30 - Real-world use cases: When AI fabricates data, and it admits it on the spot 04:30 - AI given admin privileges, and why it deleted the production database 06:00 - The three themes: human-in-the-loop, guardrails, and access control 07:00 - Treating AI like a junior developer: prompt guardrails, library restrictions, and code review that holds 09:30 - The old methods are still the right ones, we just need to apply them to AI 10:30 - Why ignoring business logic creates vulnerabilities that don't surface for weeks 12:00 - What good AI adoption actually looks like: small, purposeful agents over monolithic platforms 13:00 - Why an unused AI agent is an attack surface waiting to be activated 14:45 - Test, test, and retest: the only real advice for AI-powered compliance tooling 16:00 - An example where an AI-generated compliance report could be a huge liability trap 17:20 - The ROI question every executive asks first, and why the answer is always “it depends” 20:00 - "In the end, it's all risk:” money, lawsuits, reputational capital, and institutional knowledge 21:30 - What questions companies are (and aren't) asking about AI adoption 24:20 - Managing AI identities: why blanket permissions don't work, and granular access is harder than it sounds 27:00 - The AI agent inventory: from Excel spreadsheets to dashboards 28:30 - Don't ignore the frameworks: OWASP Application Security Verification Standard, OWASP AI Top 10, and why they apply more than you think About Joshua Bregler Joshua Bregler is a cybersecurity executive with deep expertise in application security, cloud architecture, and mission-critical systems. He currently serves as the Application Security Leader at McKinsey & Company, where he builds and scales firmwide application security capabilities, enabling secure product development and enterprise resilience. Before joining McKinsey, Joshua was a Principal Security Architect at Amazon Web Services, where he supported the U.S. Department of Defense and the Intelligence Community. In that role, he led secure cloud transformation initiatives, architected high-assurance systems, and partnered with national security stakeholders to advance zero-trust security models across classified and critical workloads. Joshua holds an MBA from Johns Hopkins University and is a U.S. Marine Corps veteran, bringing a mission-first mindset and disciplined leadership style to every engagement. His career reflects more than two decades of advancing cybersecurity strategy, designing secure digital ecosystems, and guiding organizations through complex technical and regulatory environments. Connect with our guest Joshua Bregler: LinkedIn — Join the VIA Knowledge Hub community on Substack: viaknowledgehub.com (http://viaknowledgehub.com) Get passwordless logins instantly with VIA's Zero Trust Fabric (ZTF): solvewithvia.com/via-ztf Test out VIA's Zero Trust Fabric on GitHub: github.com/viascience/ztf-tutorial This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

7. 

   18 Mar 2026

   The Four Ps every developer needs to know before their next product decision with Eve Maler

   Most teams treat identity like plumbing: invisible, unglamorous, and someone else’s problem… until something breaks. Eve Maler has spent thirty years proving that’s the wrong mental model, and it’s costing companies more than they realize. As the co-creator of SAML and User-Managed Access, former CTO of ForgeRock, and author of the forthcoming Mastering Digital Identity: From Risk to Revenue, Eve introduces a sharper lens: identity is a product. The teams that own it intentionally ship faster, convert better, and lose less to fraud. The ones that don’t are one incident away from finding out why it mattered. Eve shares her Four Ps framework: Protection, Personalization, Payment, and People, and explains why fraud is a design problem long before it becomes a detection problem. She also makes the case for why decentralized identity isn’t a future trend to monitor. It’s a present-tense decision your team is already making, whether you know it or not. Topics Covered * Why identity is part of your technology strategy * What “identity strategy” actually means for developers (not just CISOs) * The Four Ps framework: Protection, Personalization, Payment, and People * Why identity and payments are inseparable, and what’s at stake when they’re not designed together * Fraud as a design problem: modeling happy paths and unhappy paths * The cost of separating fraud teams from development teams * What changes when your org has a dedicated identity product owner * Decentralized identity: why it’s happening now, and what developers need to know * How to make the case for identity investment to a CEO or board * Baking identity in from the start vs. scrambling to fix it after launch About Eve Maler Eve Maler is President and Founder of Venn Factory and an award-winning Digital Identity Strategist, whose work has influenced how people, organizations, and technologies establish identity, exchange data, and operate securely at scale. From early Internet standards such as XML to identity-defining protocols including SAML and User-Managed Access, Eve has helped build the underlying systems that enterprises around the world rely on every day. Her career in identity spans 25+ years, from Technology Director at Sun Microsystems to Chief Technology Officer of ForgeRock, where she brought identity innovation strategy to dozens of Global 5000 brands. As a former Forrester Research security analyst and now founder of Venn Factory, Eve transforms companies’ digital identity strategies from a cost center into a growth engine by reducing friction, optimizing security and privacy protection, and unlocking new revenue opportunities. Her influence can be seen across global initiatives, including UK Open Banking and U.S. and Canadian health IT efforts. An author, speaker, and board member, Eve is known for connecting technical reality with business outcomes and for showing why, when identity is done right, it becomes one of the most powerful levers of competitive advantage. * Connect with our guest Eve Maler: https://www.linkedin.com/in/eve-maler (https://www.linkedin.com/in/eve-maler) Make it secure and ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

8. 

   26 Feb 2026

   How to break into DevSecOps (without expensive bootcamps) with Damien Burks

   DevSecOps is everywhere right now, but most teams are still treating it like a tooling problem. Damien Burks says it's actually a culture problem. He's a DevSecOps expert and the founder of the DevSec Blueprint, a free, open-source learning guide with a 650+ member community. His mission: help people break into DevSecOps by focusing on foundations and systems thinking, not expensive bootcamps. In this episode, Damien explains why DevSecOps engineers are “the glue”, the people connecting developers, operations, legal, and compliance into a single security-minded team. He walks through the patterns that repeat across every cloud platform, why the first thing you should automate is your CI/CD pipeline, and how to think about LLM risks (hallucinations, data residency, prompt injection) when you’re working in regulated environments. He also shares the story of a woman in Africa who used the DevSec Blueprint to land her first internship, proof that accessible education works. The bottom line: security isn’t something you bolt on at the end. It’s a shared responsibility. And the sooner your team internalizes that, the faster (and safer) you’ll ship. Topics Covered Why DevSecOps is a cultural movement, not a job title DevSecOps engineers are “the glue”: connecting developers, operations, legal, and compliance The DevSec Blueprint: an open-source learning guide for breaking into DevSecOps Systems thinking over tool-chasing: recognizing patterns that work across platforms Why soft skills and communication matter as much as technical chops The #1 thing to automate this year: your CI/CD pipeline with security gates Build, test, scan, deploy: the repeatable pattern inside every secure pipeline LLM risks in regulated environments: hallucinations, data residency, and prompt injection Air-gapped AI as a strategy for heavily regulated industries Why prompt injection is still an unsolved problem and what that means for DevSecOps The DevSecOps Home Lab: buying two machines from a pawn shop and learning by doing One mindset shift: “Security is a shared responsibility” About Damien Burks Damien Burks is a DevSecOps leader, security engineer, educator, and the founder of the DevSec Blueprint, a free, open-source learning guide that helps people transition into DevSecOps and cloud security development. With a background in software development and experience working in heavily regulated environments, Damien focuses on making security education accessible, practical, and community-driven. His Discord community has grown to over 650 members who actively contribute projects and capstone exercises. Damien also creates content on YouTube covering cloud security, DevSecOps, and the tech career landscape. His philosophy: less tools, more foundations, and always lead with the mindset that security is a shared responsibility. Connect with our guest Damien Burks: LinkedIn (https://www.linkedin.com/in/damienburks) Check out The DevSec Blueprint: https://devsecblueprint.com (https://devsecblueprint.com) _ Join a community of developers on VIA Knowledge Hub’s Substack: https://www.viaknowledgehub.com/ (https://www.viaknowledgehub.com/) Get passwordless logins instantly with VIA’s Zero Trust Fabric (ZTF): https://www.solvewithvia.com/via-ztf/ (https://www.solvewithvia.com/via-ztf/) Test out VIA’s Zero Trust Fabric (ZTF) on GitHub: https://github.com/viascience/ztf-tutorial (https://github.com/viascience/ztf-tutorial) This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

9. 

   12 Feb 2026

   The one security practice most teams skip: tabletop exercises with Jeff Fields

   Most security teams aren’t underprepared because they lack tools, they’re underprepared because they haven’t rehearsed what happens when humans, systems, and pressure collide. Jeff Fields says that the single most important thing teams can do is run tabletop exercises. Fresh off a 20-year FBI career, Jeff explains why the most damaging incidents aren’t caused by “unknown threats,” but by breakdowns inside the organization, alerts going to the wrong people, missing owners, and teams operating in silos. Tabletop exercises expose those weak points early, forcing engineering, HR, legal, leadership, and comms to operate as one security team. The result is a security posture that assumes human error, limits blast radius, and lets teams ship faster with confidence. Topics Covered * Why “there’s no separating the digital from the human” in modern cyber attacks * Nation-state motivations: how PRC, Russia, North Korea, and others target differently * The “geopolitical layer cake” and why every builder is in it (whether they like it or not) * Security as a team sport: breaking silos between engineering, HR, legal, physical security, and leadership * Why basic information sharing is the cheapest “upgrade” most companies aren’t doing * The Sony hack lesson: when the alerts won’t stop… and someone turns them off * “Humans be humans”: designing systems that assume mistakes will happen * Bake security in from the start vs. bolting it on after launch * Zero Trust explained in plain English and why it can accelerate innovation * Why table top exercises/war games separate resilient teams from chaotic ones * Planning for the least likely, most catastrophic scenario (and why it covers everything else) * Where to get government resources: fbi.gov, dni.gov, and National Counterintelligence and Security Center (NCSC) support for private sector About Jeff Fields Jeff Fields (https://www.linkedin.com/in/jeff-f-63736a173/) is a newly retired FBI leader, most recently serving as Assistant Special Agent in Charge of the FBI’s Counterintelligence Branch in San Francisco, with 20 years of experience spanning counterintelligence, national security, and the defense industrial base including emerging tech and the innovation ecosystem. Now advising VCs, startups, and universities, Jeff brings a rare operator’s perspective on how real-world adversaries move and how builders can design security that supports speed instead of fighting it. In addition to being a technical advisor, Jeff is also a Senior Fellow of Practice at the Berkeley Institute for Security and Governance where he serves as a “Hacking for Defense” (H4D) instructor. H4D teaches students how to work with the government to rapidly address the nation’s emerging threats and to solve mission-critical problems at the speed of a startup. In his free time Jeff enjoys hiking with his two Belgian Malinois, volunteering with the non-profit Girl Security, or checking out a live opera or hip-hop show. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

10. 

    8 Jan 2026

    Decentralized identity in the age of AI agents with Kaliya Young

    What does decentralized identity really mean, and why is it becoming essential in a world of AI, deepfakes, and digital fraud? In this episode, we sit down with Kaliya Young (https://www.linkedin.com/in/kaliya/). Kaliya is widely known as the “Identity Woman” and is one of the earliest pioneers of decentralized and self-sovereign identity. With over 20 years in the field, Kaliya breaks down complex concepts like decentralized identifiers (DIDs) and verifiable credentials in practical, real-world terms. Kaliya explains how decentralized identity reshapes trust, privacy, and security across many different entities, including people, businesses, AI agents, and physical assets. From digital driver’s licenses and business wallets to supply chains and autonomous systems, this conversation offers a grounded look at how identity infrastructure is evolving. It is clear that old paper-based and centralized models are no longer enough for highly regulated industries. Topics covered * What decentralized identity actually means * How decentralized identifiers (DIDs) work * Verifiable credentials and why they matter * Trust and privacy in the age of AI and deepfakes * Business and enterprise use cases like know your customer (KYC) and know your business (KYB) * Identity for AI agents and autonomous systems * Digital wallets for people, businesses, and assets * Revocation, security, and privacy-preserving design * Where developers and organizations can get involved About Kaliya Young Kaliya Young, often called the “Identity Woman,” has been working on decentralized and self-sovereign identity for over 20 years. She works closely with developers, policymakers, and standards bodies to help make digital identity more secure, private, and human-centered. Kaliya is also the founder and host of the Internet Identity Workshop (IIW), an unconference that brings together identity practitioners from around the world to shape the future of digital identity. Through her writing, workshops, and advisory work, she plays a central role in how decentralized identity, verifiable credentials, and trust frameworks are evolving today. * Connect with our guest Kaliya Young: (https://identitywoman.net/)https://www.linkedin.com/in/kaliya/ (https://www.linkedin.com/in/kaliya/) * Join the Identity Woman newsletter: Make it secure and ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

11. 

    17 Dec 2025

    You can’t just unplug it: The reality of space resilience

    Space is where we have the opportunity to invent life-saving drugs, track natural disasters and national security threats, and connect the globe. But as we rely more on these assets, the threats from orbital debris and cyberattacks are mounting. The problem? You can’t just walk up to a satellite, unplug it, and plug it back in. Major General Kim Crider (ret.) (https://www.linkedin.com/in/criderkim), Founding Partner at Elara Nova, former Chief Technology and Innovation Officer, U.S. Space Force and former Chief Data Officer, U.S. Air Force, joins us to explain why a cyber incident in orbit isn’t just an annoyance, it’s a potential kinetic disaster. She explains why Zero Trust principles must be built into systems, and why the most dangerous “backdoor” to spacecraft often sits right here on Earth. Key takeaways: * The stakes are physical. If a cyberattack alters a trajectory, a satellite or spacecraft risks colliding with other critical assets or debris. * The “front door” is on the ground. While we worry about the asset in orbit, the easiest way to hack a satellite is often through the ground environment. Uplinks and downlinks (the invisible tethers controlling the system) are prime targets for spoofing and interception. * Zero Trust must launch with the rocket. You cannot easily patch a system once it leaves the atmosphere. Security principles like Zero Trust and rollback capabilities must be designed, tested, and baked in before launch day. * Digital airlocks. With complex supply chains, you can’t guarantee every component is secure or fail-safe. Systems must be designed to isolate compromised functions so a single failure doesn’t jeopardize the entire mission. * Know your bill of materials. Whether it’s a satellite or a UAV, supply chain opacity is a major risk. Rigorous verification, provenance tracking, and inspections of software and hardware are essential to keeping bad actors out of mission-critical systems. * Space is the next laboratory. Beyond surveillance, the vacuum and zero-gravity conditions of space offer a unique environment for manufacturing and scientific breakthroughs, such as inventing new, life-saving pharmaceuticals that aren’t possible to create on Earth. About Major General Kim Crider (ret.) Major General Kim Crider (https://www.linkedin.com/in/criderkim) is a Founding Partner at Elara Nova, a space consulting firm helping the government and industry navigate the space market. She previously served as the Chief Technology Innovation Officer for the United States Space Force and the Chief Data Officer for the United States Air Force. With 35 years of service, including eight years in active duty, she is a leading authority on data, space, and air defense. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

12. 

    3 Dec 2025

    The AI agent access problem

    AI agents aren’t magic coworkers. They’re powerful, error-prone systems that can be hijacked, over-permissioned, and “social-engineered” just like humans. Chris Hughes (https://www.linkedin.com/in/resilientcyber/), CEO of Aquia, Resilient Cyber (https://www.resilientcyber.io) podcast host, author of Securing AI Agents, and United States Air Force veteran, dives into why identity and access are brutally hard in an agentic AI world. He also explains how incentives, compliance, and culture shape what actually gets secured. AI agents: the fundamentals matter, but don’t miss the nuance * AI agents are risky “users” too. Agents make bizarre mistakes humans wouldn’t. And they can be taken over by threat actors. That means they need an identity, permissions, and access controls, not an all-access backstage pass. * Identity and access management (IAM) is hard.... and SaaS often makes it harder. Most orgs over-provision access, never clean it up, and struggle to keep permissions current. SaaS tools frequently miss the business context needed to do access right. Chris cautions that those IAM tools themselves become part of the attack surface. * The fundamentals still matter (a lot). Least privilege, micro-segmentation, and off-boarding are still important, even for agents. The goal? Minimize the damage agents can do and take away those permissions when they’re no longer needed. * Developers should be aware of the many flavors of context manipulation. Context manipulation is where malicious instructions entice the AI agent to perform actions or disclose information it shouldn’t. Bookmark the OWASP GenAI Security Project (https://genai.owasp.org/), which continually updates these risks. * Zero Trust applies to agents, but incentives fight it. Zero Trust principles map cleanly onto agentic AI use cases, but business leaders are focused on speed, revenue, and market expansion, rather than abstract security models. They start caring when Zero Trust and agent security are framed as compliance, regulatory, or market-entry requirements. Compliance is still a primary driver of cybersecurity headcount and tooling. Use that lever. * Agentic AI doesn’t change the need for good access control and security fundamentals, it just raises the stakes. As Chris says, “you can’t secure what you don’t understand,” so start by truly understanding how your agents act and what they have access to. If you’re in DevSecOps or application security, think about how you can make life easier for your dev team: “make doing the right thing the easy thing.” About Chris Hughes Chris Hughes is a United States Air Force veteran and the CEO and co-founder of Aquia, where he helps secure state and federal agencies as well as the Department of Defense. He is the host of the Resilient Cyber (https://www.resilientcyber.io) podcast (https://www.resilientcyber.io) and a recognized expert in application security, software supply chain security, vulnerability management, and DevSecOps. Chris previously served as a Cyber Innovation Fellow (CIF) at the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Check out Chris’s three books: * Effective Vulnerability Management: Managing Risk in the Vulnerable Digital Ecosystem (https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207/ref=sr_1_5?dib=eyJ2IjoiMSJ9.G4ny2zADk3PGPx_iibM4MG4uu7as8vW1xzqAYNaEeL6ZorFqEgP7Kc6Zf3ZW-duMitJX8NCOgQOhMX1-1cKmbUClpgO8p7AwU7wS0zzWFM9thgurnlwCIf34euy5s082y6fDLyjTrf0BfXIatjsouUd9lweZxPJX_r7PBItFU6WgnuYVdvfUyz--weRJS5Lfnyt7fJ7FJV3clh5miyEbArjgStbT15nU-oFIoSPPPk4.8h35H8lAr-b3aUcicajp-T37_Nmve0_9kneol8ls0mg&dib_tag=se&qid=1763429104&refinements=p_27%3AChris+Hughes&s=books&sr=1-5&text=Chris+Hughes) * Securing AI Agents: Foundations, Frameworks, and Real-World Deployment (https://www.amazon.com/Securing-Agents-Foundations-Frameworks-Real-World/dp/3032021294) * Software Transparency: Supply Chain Security in an Era of a Software-Driven Society (https://www.amazon.com/Software-Transparency-Security-Software-Driven-Society-ebook/dp/B0C4CM9BK2/ref=sr_1_1?crid=S828ZXTK9SWX&dib=eyJ2IjoiMSJ9.puhXwuJYNnGQ1GsgLAHs3OnGougvs_E0NKPbH5U2JVs.k8iP2XAhDh8CqOURYRuR_vi-qy67f3neBWcbO2qSqAI&dib_tag=se&keywords=software+transparency+chris+hughes&qid=1763429247&s=books&sprefix=software+transparency+chris+hughes%2Cstripbooks%2C186&sr=1-1) Make it secure and ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

13. 

    13 Nov 2025

    Making Zero Trust work for teams who actually ship code

    George Finney, (https://www.linkedin.com/in/georgefinney/) CISO at The University of Texas System and author of Project Zero Trust, asserts Zero Trust isn’t just a strategy, it’s the “only strategy when it comes to cybersecurity.” Like all good researchers, we went straight to Reddit to see what people were really saying about Zero Trust. Turns out, a lot of teams were over it. They were tired of gatekeepers who slowed everyone down. Sure, plenty of Redditors could riff on principles like least privilege, but most were focused on what they already knew, not the bigger picture that makes Zero Trust not only work, but actually work seamlessly for teams shipping code under tight deadlines. What Zero Trust is (and isn’t) George sets the record straight on Zero Trust, tackling the most common misconceptions. * Zero Trust isn’t about not trusting people. Collaboration still matters. John Kindervaag, (https://www.linkedin.com/in/john-kindervag-40572b1/) the creator of Zero Trust, describes it as “a strategy for preventing or containing breaches by removing the trust relationships we have in digital systems.” Listen to John Kindervaag break down Zero Trust principles in 60 seconds (https://youtube.com/shorts/9MtY54q_1u8?si=ALfdIQwGqRQkBSBp). * It’s not a product you can buy. There’s no one-size-fits-all architecture. Zero Trust is a strategy, not a tool. If a vendor tells you they “do Zero Trust,” the real question is: how will they integrate, secure data, and prove they’re trustworthy? * Least privilege is the how, Zero Trust is the what. Least privilege, separation of duties, and role-based access control are just building blocks. Zero Trust is the strategy that defines the desired end state. * The four Zero Trust design principles outlined in Project Zero Trust (https://www.amazon.com/Project-Zero-Trust-Strategy-Aligning/dp/1119884845?ref_=ast_author_dp) are simple, but powerful. * “Define business outcomes. * Design from the inside out. Start with data. * Determine who or what needs access. * Inspect and log all traffic.” * You may already be asking “What can go wrong?” But what must go right? Security teams often use threat modeling to anticipate failures. Zero Trust requires teams to model the critical business success path: the systems, access, and safeguards that have to stay intact no matter what. * Yes, Zero Trust can feel painful. But that’s a design problem, not a strategy problem. If Zero Trust makes one team the bottleneck for every permission request, the issue isn’t Zero Trust, it’s poor automation and governance. Good Zero Trust reduces friction. * Zero Trust and AI are inseparable. George uses a restaurant analogy: you have ingredients (data), recipes (models), system components (kitchen equipment), and end users (diners). You need to protect the ingredients, recipes, and different parts of the system. And diners should probably be kept out of the kitchen. If you think about AI this way, George says, it can help your focus on “securing trust relationships where different systems interact.” About George Finney George Finney (https://www.linkedin.com/in/georgefinney/) is the Chief Information Security Officer at the University of Texas System, Co-Chair of the CSO Strategic Advisory AI Safety Committee at the Cloud Security Alliance, and Founder of Well Aware Security. He is the author of multiple books, including: * Project Zero Trust: A Story About a Strategy for Aligning Security and the Business (https://www.amazon.com/Project-Zero-Trust-Strategy-Aligning/dp/1119884845?ref_=ast_author_dp)(Cybersecurity Canon Hall of Fame winner) * Rise of the Machines: A Project Zero Trust Story (https://www.amazon.com/Rise-Machines-Project-Trust-Story/dp/1394303718?ref_=ast_author_dp) * Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future (https://www.amazon.com/Well-Aware-Master-Cybersecurity-Protect/dp/1966629001?ref_=ast_author_dp) * No More Magic Wands (https://www.amazon.com/More-Magic-Wands-George-Finney/dp/1535538929?ref_=ast_author_dp) George’s books skip the jargon and focus on stories. You might just find yourself rethinking Zero Trust and how it can help your team ship faster while keeping your organization and customers safe. Security AND ship faster? Yes, please. We built the easy button for military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

14. 

    30 Oct 2025

    Devs, your favorite metrics are holding you back

    “You can’t measure that” is just business-speak for “we’re guessing and hoping nobody notices.” Doug Hubbard notices. And then he brings math. The kind that turns million-dollar guesswork into real decisions, and lets software teams prove they delivered value, not just code. And security? Also measurable. Start with defining what security means for your product (most teams miss this step!). Then get resourceful on where you get the data you need to reduce uncertainty. * Measurement is about reducing uncertainty. One tiny drop in uncertainty can change a million-dollar decision. * Developers love measuring speed… but speed by itself is often the least important thing. Ask questions like: * Did it create value? * Did it cost us more in fixes than it saved in speed? * Should we repeat, adjust, or stop investing in this feature? * If someone says “that’s impossible to measure,” spoiler: it’s 100% measurable. Doug says, “you already have more data than you think, and you need way less data than you assume.” * Spend more time planning for how you will leverage AI. Doug advises, “Spend more time thinking about where AI is going and options for ways you can use it.” In fact, one of the best ways you can use AI is to brainstorm and model thousands of alternative solutions. * Security isn’t a vibe. It’s measurable. Breach databases, vulnerability scores, and near-miss data are just a few examples of hard evidence hiding in plain sight. Doug recommends starting out with Cyentia Institute’s Information Risk Insights Study (IRIS) and Verizon’s Data Breach Investigations report. * Simple math beats expert intuition again and again. Basic statistical models often outperform seasoned pros when choosing what to build or what to fix. * The first step for any developer: ask “What decision will this metric change?” If the metric doesn’t change a decision, it’s just noise. About Doug Hubbard Doug Hubbard (https://www.linkedin.com/in/dwhubbard/) grew up in a small rural town, became a Captain in the Army National Guard, and went on to build a career solving one of the hardest problems in business: measuring the things everyone else says can’t be measured. He’s the inventor of Applied Information Economics, founder of Hubbard Decision Research, and the guy companies call when they need to reduce uncertainty in the most uncertain environments. Doug literally makes the immeasurable… measurable. Doug is the author of: * How to Measure Anything in Project Management (https://www.amazon.com/How-Measure-Anything-Project-Management/dp/1394239815/ref=books_amazonstores_desktop_mfs_aufs_ap_sc_dsk_0?_encoding=UTF8&pd_rd_w=W0mVL&content-id=amzn1.sym.299f645c-0a78-440a-94a2-fb482e7cb326&pf_rd_p=299f645c-0a78-440a-94a2-fb482e7cb326&pf_rd_r=143-5097382-5161257&pd_rd_wg=dCpNB&pd_rd_r=b2b7eed5-ae02-4488-a2be-61f3db10cd50) * How to Measure Anything: Finding the Value of Intangibles in Business (https://www.amazon.com/How-Measure-Anything-Intangibles-Business/dp/1118539273/ref=books_amazonstores_desktop_mfs_aufs_ap_sc_dsk_3?_encoding=UTF8&pd_rd_w=W0mVL&content-id=amzn1.sym.299f645c-0a78-440a-94a2-fb482e7cb326&pf_rd_p=299f645c-0a78-440a-94a2-fb482e7cb326&pf_rd_r=143-5097382-5161257&pd_rd_wg=dCpNB&pd_rd_r=b2b7eed5-ae02-4488-a2be-61f3db10cd50) * The Failure of Risk Management: Why It’s Broken and How to Fix It (https://www.amazon.com/Failure-Risk-Management-Why-Broken/dp/111952203X?ref_=ast_author_dp&th=1&psc=1&dib=eyJ2IjoiMSJ9.iqy-iFKa8Zn-3JpP1UpDnANr346gbPxLBY1qBkIdwYOOEQC-8thVsvqpAq57jeFbW38xUtUHeCtTAXZXvFKueWItKgX79IcHGllSMV9BN_RSiXs3AuxPlaBEllJvI6oM.E7yVm0rANMSmsPyP2DiD0qXdLr357wqIfxdfEqOGbPI&dib_tag=AUTHOR) * How to Measure Anything in Cybersecurity Risk (https://www.amazon.com/How-Measure-Anything-Cybersecurity-Risk/dp/1119892309/ref=tmm_hrd_swatch_0?_encoding=UTF8&dib_tag=AUTHOR&dib=eyJ2IjoiMSJ9.qAycvrJI0z9Qx06n3Ko93exg3hHDaWFpeyzkFA7b4ObmdBc-DYupugt-yoXxRPzc62U_nfz3HnUcpvJzHc6LpWZ84uUkCj2F11Z9ZF-2B0N9HBDS3Em9e4yey-RtQTlhrXmSmbNYsxQ9Ea7IxthyVJS2SKFpIa_hEUKp5P9rPWsBFStah4gzvsdg9AYzgxmevtwpKmdh4jQWzLH-BX5Zfw.jxazs8DRN2zIqXRuqQu1pVRAa4tfg4BLa4xvlDP49H8) * Pulse: The New Science of Harnessing Internet Buzz to Track Threats and Opportunities Dread authentication setup? Not anymore. Authentication in 5 Minutes. (No seriously, we timed it.) This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

15. 

    15 Oct 2025

    Top three mobile security fails (and how to fix them)

    Think Apple and Google are doing deep security reviews of your app? Think again. While the App Store and Google Play scan for known malware, they completely miss big security gaps like API misconfigurations and vulnerabilities in third-party tools. Mobile app security expert Andrew Hoog (https://www.linkedin.com/in/andrewhoog/) breaks down the top “gotcha” moments for mobile developers and the quick, actionable steps your team can take to secure your apps and protect your users. Top three mobile security fails * Skipping security reviews. Most teams either skip security reviews or use tools built for web apps. But web app scanners miss a whole range of mobile-specific vulnerabilities. * Using sketchy third-party SDKs. Andrew estimates 60–70% of vulnerabilities come from free, well-documented SDKs, which are “like catnip” for developers. These can send unencrypted data, use weak keys, or leak user data to foreign entities. * Ignoring AI risks. You, or the SDKs you rely on, might be using personally identifiable information (PII) in ways that break privacy laws, violate contracts, or erode user trust. What you can do today * Get the right tools. Use security tools built for mobile apps. Andrew recommends: * Radare (https://www.nowsecure.com/radare/) (open-source reverse engineering toolkit, binary and static analysis) * Frida (https://www.nowsecure.com/frida/) (open-source dynamic instrumentation toolkit) * Both have great documentation to get you started. * Involve your team and stakeholders. Try NowSecure’s Mobile Application Risk Checker (https://www.nowsecure.com/marc-app/). It reports on sensitive data, privacy declarations, and network connections. Your app might already be listed! Start including mobile app security and privacy risks (https://www.nowsecure.com/mobile-app-breach-news/) in your threat intel program. * Leverage free learning resources. Explore OWASP Mobile Application Security (https://mas.owasp.org/), NowSecure Academy (https://academy.nowsecure.com/), or tools like Claude for contextual security insights. About Andrew Hoog Andrew Hoog (https://www.linkedin.com/in/andrewhoog/) is a developer’s go-to security person. He’s been in the trenches of mobile security and forensics for over a decade, building, breaking, and securing apps long before it was cool. He co-founded NowSecure (https://www.nowsecure.com/), wrote two books on mobile forensics and security, and holds three patents in the field. When he’s not deep in code or court (he’s also an expert witness in U.S. Federal Courts), he’s helping shape the future of mobile app security at NowSecure. Andrew’s mission? Help developers build apps that are not just awesome but are secure by design. See how VIA’s Zero Trust Fabric delivers military-grade authentication. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

16. 

    30 Sept 2025

    A tale of two ATOs

    Getting an Authorization to Operate (ATO) can be a slow and expensive hurdle for developers trying to deploy software for the government. In this episode, Dave Raley (https://www.linkedin.com/in/daveraley/), Digital Program Manager at Marine Corps Community Services (MCCS), explains how he’s revolutionizing this process with Operation StormBreaker (https://operationstormbreaker.usmc-mccs.org/). Instead of a months-long process, StormBreaker provides a pre-authorized DevSecOps platform that allows mission owners and contractors to deploy their code into production in as little as 15 minutes. By shifting from a traditional “checklist” mindset to one of continuous risk assessment, StormBreaker focuses on the ultimate goal: securely and resiliently delivering mission-critical capabilities. Key Takeaways * Stormbreaker is an alternative to an old checklist model. The traditional Risk Management Framework (RMF) acts like a static checklist. StormBreaker takes a more modern approach, one underscored in the recently-released Cybersecurity Risk Management Construct, and uses advanced tooling to continuously monitor the software’s actual risk posture at any given moment. * Focus on outcomes. The most important question isn’t “Did we complete the checklist?” but rather, “Did we get a secure and resilient workload into production?” Understand the pain point before trying to build a solution. * Contractors can’t get an ATO alone. A commercial company is always dependent on its government partner to secure an ATO. * Ask early, ask often. Software teams should ask their mission owners right away, “What’s the plan to get this into production?” That exposes roadblocks before time and money disappear. About Dave Raley Ever wonder how some leaders just get it when it comes to modernizing big organizations? Then you need to meet Dave Raley (https://www.linkedin.com/in/daveraley/), who has been with the Marine Corps as a civilian since 2010. Dave is the Digital Program Manager at Marine Corps Community Services (MCCS) and he totally transformed how Marines and their families get services. But here’s the best part: he didn’t just manage change, he ignited it. Dave actually founded MCCS’s innovation capability and launched their whole customer experience (CX) strategy. He pioneered something called Operation StormBreaker (https://operationstormbreaker.usmc-mccs.org/). Why? To cut down on software development headaches, save money, and get critical missions done faster. And get this: StormBreaker is gaining traction beyond MCCS, making secure cloud deployments scalable for services across national security. Like this podcast episode? We’d love if you shared it! Building software for the DoD shouldn’t be a constant battle with access. We know, because we’ve been there. We built VIA’s Zero Trust Fabric to fix all that. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

17. 

    12 Sept 2025

    DoD tech: speed, security, and strategic partnerships

    Want to build software for the DoD? You won’t get better guidance than from Michael Frank (https://www.linkedin.com/in/mfrank174/), Deputy CTO, Department of the Navy, who works with entrepreneurs, non-traditional DoD contractors, and private capital to connect mission needs with commercial solutions. Mike says the best partners are adaptable and communicate relentlessly. While they might push back on “bespoke everything,” they still respect real DoD constraints. They’re fluent in risk, laying out crisp assessments of what’s accepted, what’s been mitigated, and why. Bottom line: know the mission, know your product, and flash your risk math prowess. That’s how commercial teams win in defense. Key takeaways: * DoD work = hardest, most meaningful problems. The kind that attracts top talent and spins out dual-use breakthroughs. * Use dual-use to your advantage. Navy focus areas (cyber, threat intel, AI, quantum/PQC) let you build once and win in both defense and commercial markets. * One product, one UX. There shouldn’t be an “optimal UX for commercial” and “suboptimal UX for DoD.” Great UX should be universal. * Speed vs. security is a choice. Understand and own it. In other words, skip controls now, pay the price later. Mike says it’s important for teams to understand “Everything we engineer, everything we build, must be secure from day one. That must be the priority.” * Mike’s team embraces “secure by design.” Engineering and security leaders take note: bake in compliance up front and give engineers paved roads, not bolt-ons. * Great partners adapt and communicate. Just like in any healthy, thriving relationship, they learn how to work with the government, they’re great communicators, they know how to push back (the DoD doesn’t expect “bespoke everything”) but also remain flexible and recognize there are DoD-specific constraints. * Get fluent in risk. Conduct a risk assessment, have a deep understanding of what risks exist and what you’re doing about them. This is evidence you understand both your product and the broader mission. About Michael Frank Michael Frank is the Deputy Chief Technology Officer for the Department of the Navy. In addition to his role as Deputy CTO, he’s also currently Cyber Portfolio Lead for the Marine Innovation Unit as a Marine Reservist. Mike is an expert at navigating the unique challenges of the DoD and part of his role is helping organizations work successfully with the Department of the Navy. In other words, Mike's the person you want on your team! What's especially great about Mike is his 360-degree view. He's consulted for both public and private sectors, so he truly understands the landscape. He's seen it all. After college, Mike served for four years on active duty in the Marine Corps as a communications officer. He continued (and continues!) his service in the reserves, where he established Defensive Cyber Operations (DCO) Companies. Simultaneously, he earned his MBA and worked in consulting at Accenture and Boston Consulting Group (BCG). At Accenture and BCG, Mike worked with various DoD organizations, consulted on cyber issues for the Department of Energy and Department of State, and advised banks, insurance companies, and healthcare companies. Basically, he's got a ton of experience understanding and solving critical problems for all sorts of organizations. Like this podcast episode? We’d love if you shared it! Building software for the DoD shouldn't be a constant battle with access. We know, because we've been there. We built VIA's Zero Trust Fabric to fix all that. Try it out for free at https://www.solvewithvia.com/ztf-platform/ (https://www.solvewithvia.com/ztf-platform/) This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.viaknowledgehub.com (https://www.viaknowledgehub.com?utm_medium=podcast&utm_campaign=CTA_1)

Inside a recent episode

In the end, it's all risk. An AppSec leader's guide to enterprise AI with Joshua Bregler

Published 7 Apr 2026 · Transcript excerpt

[…] Yes, the AI should develop code. Yes, a senior developer should check and review that code before it gets merged to main, right? Before the PR is approved. The old methods are still the right ones. We just need to understand how to apply them to AI better. It sounds like a lot of what you're saying are like the considerations that would go into if you were hiring like a junior developer, right? Like use these libraries. I'm not going to give you admin privileges to the whole company. You're basically going to operate within this lane, helping them understand this is the way that we do things. Here's the way that we develop things. […]

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

2 ratings

Contact VIA Knowledge Hub Podcast

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Questions about VIA Knowledge Hub Podcast