Connecting Cyber Risks to Board Outcomes & BHUSA interviews from Mimecast & Zscaler - Leslie Nielsen, Brett Stone-Gross, Dan Bowden - BSW #462
Summary
Business Security Weekly episode 462 features Dan Bowden, Global Business CISO at Marsh, discussing how to align cyber risk with board outcomes through coordinated incident response and culture-driven metrics. The episode also includes pre-recorded interviews from Black Hat USA 2026 with Leslie Nielsen, CISO at Minecast, and a representative from Zscaler. Nielsen explores securing AI agents by treating them as non-human identities and addressing the risks of rapid adoption and shadow AI.
Topics discussed
Show intro and guest introduction
Host banter and Infosec World promotion
Dan Bowden's background and Marsh's data
Football analogy for cyber defense coordination
Connecting dots and telling the collective story
AI security and organizational buy-in
ThreatLocker ad break
Culture, tone from the top, and metrics
Crafting board-level metrics and outcomes
Marsh's Cyber Catalyst report and benchmarks
Incident response testing and industry comparisons
Ransomware trends and third-party dependencies
PCI bias and risk transfer decisions
Assessing third-party exposure and likelihood
Outsourcing services vs. outsourcing risk
Annual loss expectancy and closing remarks
Edge for Business ad and Black Hat intro
AI agent risks: speed, sprawl, and visibility
Non-human identity management for agents
The security pendulum and control enforcement
AI service catalogs and shadow AI
Framing AI risk for the board
Code42 acquisition and agent visibility
Training agents and acceptable use policies
Practical next steps for agent security
Exit policies and insider threat framing
Tanium ad and Brett Stone-Gross intro
Ransomware victim demographics and targeting
Targeting accounting and finance departments
Social engineering via fake IT support
Countermeasures and monitoring recommendations
Red flags in social engineering outreach
Origina ad break
Exploiting default behaviors and training gaps
AI exacerbating existing security problems
AI-generated phishing and code
Non-technical targets and threat modeling
Personal protection tips and future research
Show outro and subscription info
Listen ad-free on Castria