Not every DLP alert tells the full story, and the ones that do are usually the tip of a much larger iceberg. Paul Zimmerman joins Owahn Bazydlo and Paul Marco for a wide-ranging, education-grounded conversation about AI governance, intellectual property risk, user behavior, and why the next phase of cybersecurity will be shaped as much by optimism and design as by fear.

The episode centers on a sharp finding from the 2026 Verizon Data Breach Investigations Report: in 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorized AI systems, creating direct intellectual property risk exposure. Paul Zimmerman, a technology director based in Hailey, Idaho, whose career began in Air Force encryption work and moved through MSP operations before landing in K-12 technology leadership, brings a practitioner’s eye to the number. The panel is clear that 3.2% is almost certainly a significant undercount, representing only what current DLP tooling can actually see, with the real exposure likely sitting several multiples higher.

You will discover why the threat model behind this statistic is far more complex than a single user pasting a single document into a free AI tool, and why the real exposure now extends through chains of subprocessors embedded in every modern SaaS platform. The group examines why FERPA, HIPAA, and other regulatory frameworks are already struggling to keep pace with frontier model capabilities, why organizations that fail to provide sanctioned AI tools inevitably drive their people toward unauthorized ones, and why transparency across the data processor chain has become one of the most important and least enforced controls in enterprise cybersecurity.

The conversation then widens into the broader AI governance question, drawing parallels to Google’s early days when similar outrage over data harvesting ultimately gave way to an entire economy built around responsible data use. Paul Zimmerman challenges the industry’s reflexive doom and gloom with a reminder that the automobile arrived in a world with no rules, and that human beings built the guardrails as they went. The group explores the collapse of traditional bug bounty programs under the weight of AI-generated spam submissions, the shift from expert-driven vulnerability discovery to tool-enabled participation, and the ongoing erosion of research spaces that once depended on expert curation.

The episode closes on a shared philosophy that Paul Zimmerman calls “freedom in a box.” Build the box through policy, technical controls, user training, and sanctioned AI tooling, then let people operate freely inside it. The organizations that embrace this model, that treat statistics as directional rather than definitive, and that pair governance with genuine curiosity about what AI can enable, will be the ones that turn today’s risk into tomorrow’s advantage.

Essential listening if you care about data loss prevention, AI governance, intellectual property protection, FERPA and HIPAA compliance, or the future of responsible AI adoption in regulated industries. If you are responsible for protecting people, systems, or data, this conversation gives you both the realism and the optimism to think more clearly about what comes next.

https://www.talas.io/podcast

Twenty-seven seconds. That is the fastest e-crime breakout time on record in the 2026 CrowdStrike Global Threat Report, and it reframes almost every assumption we make about defensive response. Albert Galeas joins Owahn Bazydlo and Paul Marco for a candid, education-grounded conversation about cyber hygiene, governance, the limits of security tooling, and why the fundamentals still decide who wins when the attack clock is measured in seconds.

The episode centers on the CrowdStrike finding and what it actually reveals: that the fastest observed pivot from initial access to a second system in the environment took less than half a minute. Albert, a technology director whose career began in the classroom and moved into IT leadership during COVID, brings a practitioner’s eye to the number. Paul and Owahn draw the line from that measurement to the preconditions that make it possible, including flat networks, shared admin credentials, missing access segmentation, and unrotated built-in accounts. The panel is clear that 27 seconds is not a story about attacker genius, it is a story about defender hygiene.

You will discover why the CIS Group 1 Controls remain one of the most under-utilized defensive frameworks available to resource-constrained organizations, why security awareness training continues to deliver outsized returns even in environments with mature email filtering, and why asset inventory and governance are the real foundation beneath every other control. Albert walks through a seemingly small operational change, routing all new devices through a central configuration office before they ever touch the production network, as a reminder that defensive maturity is built from procedural discipline, not from product acquisition.

The conversation then widens into the near-term future, with the group examining how agentic AI is likely to compress breakout times further, why defenders will need their own agentic blue-team capability to keep pace, and why the current wave of AI-enabled attacks is likely to shift the industry’s focus from end-user compromise back toward automated vulnerability exploitation. Albert, Owahn, and Paul also return repeatedly to the attacker’s advantage: the adversary needs only one way in, while the defender is responsible for the entire perimeter.

The episode closes on a shared conviction that simplicity, discipline, and self-knowledge are the durable foundation beneath every new wave of tooling. Attackers will keep getting faster. The organizations that keep their house in order, that know their inventory, that patch consistently, that disable accounts on exit, and that make the environment annoying enough to drive the adversary elsewhere, will keep buying themselves the time their analysts need to respond.

Essential listening if you care about cyber hygiene, foundational controls, security awareness, agentic AI threats, or the future of defensive operations. If you are responsible for protecting people, systems, or data, this conversation gives you both the urgency and the perspective to think more clearly about what comes next.

https://www.talas.io/podcast

There is finally a bright spot in the AI governance conversation, and it comes from an unexpected place: the companies themselves. Michael Brady joins Paul Marco for a candid, financial-services-grounded conversation about AI governance, shadow AI, third-party risk, and why defense remains one of the hardest jobs in cybersecurity.

The episode centers on an encouraging finding from the 2026 World Economic Forum Global Cybersecurity Outlook: 64% of organizations now have a process to assess the security of AI tools before deployment, nearly double the 37% reported in 2025. Michael, a CIO and CISO in the financial services industry with over 25 years of experience across verticals ranging from armored cars to satellites, brings a practitioner's eye to the number. Paul draws the line from written policy to operational reality, pressing on whether these processes are actually trained, executed, and enforced inside the business, or whether they are simply AI-generated artifacts sitting in a governance folder.

You will discover why Fannie Mae and Freddie Mac's AI governance letters are forcing the entire mortgage banking ecosystem to formalize its posture, why vendor renewals have become one of the most under-managed risks in financial services, and why cascading subprocessor terms and conditions are quietly transferring AI data exposure down a chain that most legal teams cannot keep up with. Michael walks through how healthcare underwriters that turned AI fully on and removed humans from the loop ended up making biased decisions that cost them their business, as a cautionary tale for any organization tempted to let AI replace human judgment in high-stakes workflows.

The conversation widens into the cloud parallel, with Michael and Paul tracing how AI adoption is moving at a velocity that makes early cloud adoption look slow, and why that velocity is itself a risk factor. The group examines why shadow AI, personal accounts, and fly-by-night wrapper tools remain a major blind spot even in mature programs, why sales teams are being overwhelmed by shiny-object technology bundles, and why prompt injection and model manipulation are only the first wave of a longer attack surface problem. Michael also makes a strong case for managed services and global threat visibility, arguing that no single organization can staff its way through the current pace of change.

Michael and Paul close on the deeper reality underneath all of it: the asymmetry of cyber defense, the invisibility of successful protection, and the budget conversations that follow when nothing goes wrong. It is a practical reminder that cybersecurity leaders are judged by outcomes they can rarely show, and that AI will not change the fundamental math of defending complex, human-built environments.

Essential listening if you care about AI governance, shadow AI, third-party and subprocessor risk, financial services cybersecurity, or the future of defense in a machine-accelerated world. If you are responsible for protecting people, systems, or data, this conversation gives you both the optimism and the operational urgency to think more clearly about what comes next.

https://www.talas.io/podcast