Cyber Security Business

The episode contains some substantive points - particularly on AI governance frameworks (ISO 42001, NIST RMF), non-human identity management, and the importance of storytelling for technical teams - but these are interspersed with significant filler (personal banter about age, podcast names, voice quality, tangents on education systems and parenting) and repetitive ideas. The signal-to-noise ratio is moderate; a B2B operator would extract useful concepts but has to work through considerable padding.

“The basic security controls still apply. The concepts of least privilege...Are you inventorying your systems? Do you have inventory control...All these things are still applicable as they were 20 years ago.”

“We build AI governance model, defines what we're going to use AI for. We evaluate risk. We figure out who's accountable for oversight...ISO 42001...will help you with that.”

The core ideas - that security fundamentals don't change, that storytelling matters, that governance must precede deployment - are sensible but well-trodden in CISO discourse. The framing around education systems' shift away from Renaissance-man thinking is mildly novel, but the overall perspective lacks contrarian or first-principles arguments. The episode mostly affirms conventional wisdom rather than challenging it.

“Nothing really changes. It's still about the basics.”

“Every CISO is so different...almost every board is different.”

Jason Loomis is a credible guest with genuine operating experience: a CISO at a public SaaS company (Freshworks), 20 years in security, CNBC Tech Executive Council member, and runs a podcast (Agent List). He speaks from direct experience managing a 70+ person security team, handling board interactions, and making real trade-offs. He is not a consultant or pure thought-leader, and his examples are grounded in actual organizational challenges he's navigating.

“CISO at Freshworks and a member of the prestigious CNBC Tech Executive Council.”

“I manage a 70 plus person team”

The episode includes some concrete frameworks (ISO 42001, NIST RMF) and specific operational examples (service accounts, non-human identity lifecycle, SIEMs, third-party risk management with AI), but largely avoids hard numbers, case studies, or named examples of breaches/incidents. Most claims remain at the pattern level rather than the granular level; the data points are few.

“Non-human identities outnumber our human accounts with people behind them by magnet 10x, 20x.”

“If I say ISO 42001, they know what I'm talking about.”

The host Kevin asks reasonable, open-ended questions and does follow up (e.g., on board dialogues, AI governance, identity management), but rarely pushes back or challenge the guest's claims. The conversation is friendly but lacks productive friction; most answers go unchallenged. The host allows long tangents (parenting, education systems, MTV) without redirecting, and the rapid-fire ending feels perfunctory rather than designed to sharpen insights.

“So I'd love to know how you think this AI era compares to some other massive periods of change that you experienced.”

“So when you interview now, I assume you're interviewing all the time with a 70 plus person team? Are you now starting to be a bit more discerning and looking for different skill sets?”