Security You Should Know

All links and images can be found on CISO Series.

Traditional identity systems authenticate credentials and devices, but they can't verify who's actually behind them. Attackers use AI-generated IDs and deepfake videos to pass background checks, then clone voices to reset MFAs at the help desk. Identity has become the primary attack surface, and existing IAM platforms still trust the human layer far too easily.

In this episode, Fernanda Sottil, Senior Director of Strategy at Incode Technologies, explains how their solution adds a real-world identity layer that integrates seamlessly with existing IAM systems. Joining her are Nick Espinosa, host of the Deep Dive radio show and Bozidar Spirovski, CISO at Blue Dot.

• How does Incode comply with GDPR when training AI models on employee facial data?
• What happens when legitimate users get blocked, especially job candidates?
• How does Incode maintain accuracy across 4,600 document types in 200 countries?
• Can organizations see error rates and override the system when needed?
• How quickly can Incode patch new attack vectors as adversarial threats evolve?

Huge thanks to our sponsor, Incode Technologies

Incode Workforce helps enterprises stop deepfakes, prevent fraud, and secure every identity moment. By matching an ID to a selfie with AI-powered biometrics, Incode confirms the real person behind each IAM interaction, safeguarding onboarding, access, and recovery with frictionless verification that ensures workforce security and trust at scale.

All links and images can be found on CISO Series.

Modern application security has become a tangled mess of VPNs, proxies, DLP, CASBs, and remote browser tools—all creating friction for users and security teams alike. The root issue? Browsers were built for consumers, not enterprise security, forcing organizations to pile on complexity that undermines both protection and performance.

In this episode, Braden Rogers, chief customer officer at Island, explains how their enterprise browser platform rethinks application delivery by building security services natively into the browsing experience. Joining him are Nick Ryan, former CISO, and Janet Heins, CISO at ChenMed.

Want to know:

• How do you explain this approach to your CEO in plain English?
• What's the real architecture difference between enterprise browsers and traditional VDI?
• How do you deploy a new browser to 20,000 users without change management chaos?
• What happens to your existing security stack when you add an enterprise browser?
• Can users access personal apps while keeping corporate data protected?
• What's the offline experience when cloud services fail?
• How does this handle the surge of AI tools in your organization?
• What's the difference between browser enforcement and a full enterprise browser?
• How do you apply different security controls without overwhelming users?
• What does vendor support actually look like from pilot to production?

Watch our demo with Imprivata on our site.

In this episode, Chip Hughes, chief product officer at Imprivata, explains how the company addresses shared access management challenges with specialized solutions that prioritize both security and user experience. Joining him are Kathleen Mullin, former CISO at MyCareGorithm, and Howard Holton, CEO at GigaOm.

Want to know:

• Why does shared access management remain such a persistent challenge across industries?
• What does Imprivata's solution actually do versus traditional IAM tools?
• How does passwordless authentication work in high-security, high-speed environments?
• What authentication modalities beyond badges are organizations adopting?
• How can organizations integrate access management across devices, operating systems, and applications?
• What are the unique access challenges in healthcare, law enforcement, and manufacturing?
• Can shared mobile devices provide enterprise-grade security while reducing hardware costs?

Huge thanks to our sponsor, Imprivata

Imprivata delivers solutions that provide simple and secure access management for healthcare and other mission-critical industries to ensure every second of crucial work is both frictionless and secure. Imprivata solves complex security, workflow, and compliance challenges with solutions that facilitate seamless user access, protect against internal and external security threats, and reduce total cost of ownership. Learn more at https://www.imprivata.com/

All links and images can be found on CISO Series.

Identity has become the Gordian knot of cybersecurity. Threat actors no longer need to break in. They log in. As organizations manage increasingly complex ecosystems spanning cloud, on-premises, and hybrid environments, the challenge isn't just understanding who has access to what. It's about understanding how an attacker could chain together seemingly innocent permissions to escalate from an initially compromised user to full environment control.

The problem is compounded by privilege creep, where employees accumulate access over time as roles change and exceptions pile up without systematic review. Traditional security tools excel at protecting identities at rest or governing access for individual users. Still, they often miss the needle in the haystack: the cascading attack paths that adversaries actively exploit.

In this episode, Justin Kohler, chief product officer at SpecterOps, explains how Bloodhound Enterprise addresses these challenges by proactively uncovering and eliminating attack paths before adversaries can exploit them, transforming abstract permissions into visual maps that show precisely how attackers could move through your environment. Joining him are Angela Williams, SVP and CISO at UL Solutions, and Brett Conlon, CISO at American Century Investments.

Want to know:

• Why does identity security remain such a persistent challenge for organizations?
• What attack path management actually does versus traditional identity governance tools?
• How does Bloodhound Enterprise complement other solutions in your stack?
• How to visualize and prioritize the attack paths that matter most?
• What emerging identity-based threats should CISOs prioritize over the next 12 months?
• How has the definition of "identity" evolved beyond just human users?
• Can continuous attack path mapping keep pace with dynamic cloud environments?

Huge thanks to our sponsor, SpecterOps

SpecterOps' 2025 State of Attack Path Management report reveals how technical debt transforms into identity risk and provides actionable strategies for security teams. Drawing insights from the creators of BloodHound, this report outlines proven methods for strengthening identity directory security to prevent costly breaches. Learn more at https://specterops.io/.

All links and images can be found on CISO Series.

Earning and maintaining customer trust has become increasingly complex as organizations struggle with manual, repetitive security review processes that frustrate customers and slow revenue cycles. Despite decades of talking about customer trust in security, companies still rely on outdated approaches like sending spreadsheets back and forth for questionnaires. The challenge isn't just about having strong security programs. It's how do you enable sales teams to move deals forward without constantly pulling security experts into routine questions.

In this episode, Al Yang, CEO and Co-founder at SafeBase by Drata, explains how their trust center platform addresses these challenges by creating transparent, always up-to-date security portals that streamline NDAs, access requests, and security questionnaires through AI automation. Joining him are Dan Holden, CISO at Commerce, and Terry O'Daniel, former CISO at Amplitude.

Huge thanks to our sponsor, SafeBase by Drata

SafeBase by Drata is the leading Trust Center platform that helps companies showcase their security posture, streamline security reviews, and accelerate sales. By combining an enterprise-grade, customer-facing Trust Center with AI-powered Questionnaire Assistance, SafeBase enables organizations to share certifications, policies, and security documentation on demand while automating accurate, context-aware questionnaire responses. This reduces manual effort, shortens review cycles, and delivers the trust signals buyers need to move forward. Companies like Asana, Jamf, and OpenSpace use SafeBase to turn security transparency into a competitive advantage and make trust a growth driver. Learn more at https://safebase.io.