CISO Stories Podcast

The episode surfaces a couple of genuinely interesting ideas - AI up-levelling threat actors across tiers, and a speculative 'no patch Tuesday' future - but they are surrounded by heavy padding, filler phrases, and standard CISO boilerplate (crown jewels, assumed breach, tabletop exercises). Insight-per-minute rate is low for a 31-minute run.

“What used to be categorized as very low level non sophisticated actors. Now with AI toolset having um, having the ability to gain um, such efficiency that they are now a mid tier actor.”

“vulnerability is now just equal exposure, um, because of the transparency that a lot of these AI models have and discovering vulnerabilities”

The 'no patch Tuesday' secure-by-design future is a mildly interesting provocation, and the tiered-actor AI up-level framing is memorable, but almost everything else - assumed breach, resiliency rings, crown jewels, geopolitics driving threat activity - is well-worn CISO circuit material with no contrarian angle.

“Can we imagine that, you know, uh, there comes a day that you know, we may not even need a patch Tuesday, and that everything that comes out um, you know, is going to be in a state, I don't want to say of perfection”

“You're taking mid tier actors and because of this tool set, um, they are now becoming a very advanced actor. And you're taking the advanced actors um, that have had knowledge and experience and tool set and already existing tool sets and potential zero days and you are up leveling them to something that we haven't seen yet.”

Jason Manar is a genuine practitioner - 16 years at the FBI in cybersecurity supervisory roles and first-ever CISO at a major MSP - giving him real, relevant authority. However, the conversation fails to extract the depth his résumé promises, leaving much of his direct operational knowledge untapped.

“Over a thousand different intrusions. Uh, took that experience of working with some of the best CISOs and best companies worldwide.”

“I was the first ever CISO at Kaseya. Been there for about five years.”

The anonymised ransomware case study provides the episode's best evidence - concrete timelines and dollar-range losses - and a handful of real references (Vault Typhoon, CISA advisory, Iran-linked group count) add credibility. Too many other claims are speculative or unattributed, and the absence of named companies limits verifiability.

“It took them uh two and a half weeks uh before they got back online. They were offline and uh, were impacted every day millions of dollars by being offline.”

“it cost them tens of millions of dollars, almost on the verge of hundreds of millions of dollars”

The host asks broad, leading questions, rarely follows up on specific claims, and closes with the obligatory 'advice to your 18-year-old self' question that wastes the final segment. There is no genuine pushback, no drilling into FBI case specifics, and no challenge to vague or speculative assertions.

“So that sounds doom and gloom too,”

“what advice would you give your 18 year old self, Jason Minar, if you could just give some out of everything?”