Podcast: Play in new window | Download (Duration: 12:01 — 16.5MB)

Subscribe: RSS

Summary

In this episode of Chattinn Cyber, Marc Schein is chattin’ with AI acceleration expert, Walter Haydock. Their chat opens with Walter explaining how his background in the Marine Corps, the intelligence community, and Congress shaped his approach to cybersecurity and AI governance. He describes founding StackAware after seeing how quickly companies were struggling to manage the risks created by AI tools, especially as adoption accelerated and organizations needed practical, cost-effective controls. The conversation opens with the idea that the corporate world has introduced a new kind of chaos — one centered on cybersecurity and AI governance — that many teams are still trying to understand.

A major theme of their chat is what AI governance actually means. Walter defines it as the practice of measuring and managing risks caused or created by AI systems, especially risks tied to confidentiality, integrity, and availability. He breaks the space into three categories: AI for security, AI for hacking, and security for AI. The final category is his primary focus, and he frames it as protecting organizations from the risks that come from using AI systems themselves, rather than simply using AI as a defensive or offensive tool.

The chat then turns to how traditional risk management applies in an AI-driven world. Walter says the core choices — accept, avoid, mitigate, or transfer — still hold, but the way organizations think about risk must evolve because AI is non-deterministic. Unlike traditional systems, AI may not produce the same output every time, even with the same inputs. That means companies need to move toward a more probabilistic way of assessing risk, where some deviation from expected behavior is acknowledged and managed rather than assumed away.

A substantial portion of their chat focuses on ISO 42001, which Walter describes as the first global standard for AI management systems. He explains that the framework helps organizations build policies, procedures, and practices for governing AI responsibly and demonstrating that governance to regulators and customers. He also discusses supply chain exposure, warning that AI is already embedded in vendor ecosystems whether companies want it or not. Rather than trying to ban AI outright, he argues for a measured, quantitative approach that compares the risk of supplier AI usage to the business value those suppliers deliver.

The chat concludes with practical advice for CISOs and security teams. Walter recommends three starting actions: define clear AI policy guidelines, create a full inventory of AI systems in use, and then perform a risk assessment to determine which systems and uses deserve the strictest controls. He also notes that ISO 42001 can support regulatory compliance and, in some cases, provide a form of safe harbor under emerging AI laws such as Colorado’s SB 205. The interview ends with Walter inviting listeners to connect with him on LinkedIn, where he posts AI governance and security content regularly.

Key Points

1. AI governance is becoming a core security function. Walter frames AI governance as a way to manage cyber and operational risks created by AI systems.
2. AI changes the risk model because it is non-deterministic. Organizations can no longer assume identical inputs always produce identical outputs.
3. ISO 42001 is an important emerging standard. It provides a management-system framework for governing AI and demonstrating compliance.
4. AI risk in the supply chain is unavoidable. Walter argues for practical, risk-based supplier assessment rather than unrealistic bans.
5. Security teams need a structured starting point. Policies, inventory, and risk assessments are the first concrete steps to control AI usage.

Key Quotes

1. “I saw a whole new level of chaos, specifically when it comes to cybersecurity and AI governance.”
2. “AI governance is a practice related to measuring and managing the risk caused or created by AI systems.”
3. “We’re going to need to revise how we think about risk to be more probabilistic.”
4. “There’s no way that you’re going to avoid AI in the supply chain.”
5. “I would recommend three concrete actions to start.”

About Our Guest

Walter Haydock is the Founder of StackAware, where he helps organizations address the biggest cybersecurity and AI governance risks without wasting time or resources on distractions. Before entering the private sector, he served on the U.S. House Homeland Security Committee, at the National Counterterrorism Center, and as a Marine Corps reconnaissance and intelligence officer. He is a graduate of the U.S. Naval Academy, Georgetown University’s School of Foreign Service, and Harvard Business School.

Follow Our Guest

Website | LinkedIn

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Podcast: Play in new window | Download (Duration: 52:38 — 72.3MB)

Subscribe: RSS

Summary

In this milestone 100th episode of Chattinn Cyber, Marc Schein sits down with one of the most influential figures in cyber insurance, Bob Parisi. Widely regarded as a pioneer in the space, Parisi reflects on the origins of cyber insurance, tracing its roots back to the late 1990s during the dot-com boom and the early recognition that traditional insurance products were not equipped to handle emerging digital risks.

Parisi shares a candid look at how cyber insurance evolved from a niche product designed for tech companies into a critical component of enterprise risk management. From the early days of privacy breach notification laws to the growing realization that business interruption and operational dependency on technology represent the true magnitude of cyber risk, the conversation highlights the key inflection points that shaped today’s market.

The discussion also explores how the insurance industry has responded to ongoing complexity and volatility. From “silent cyber” to the challenges of aligning capacity across a fragmented marketplace, Parisi explains why cyber insurance still exhibits characteristics of an emerging market—even after decades of development. He emphasizes the importance of integrating cyber coverage with broader risk management strategies rather than treating it as a standalone solution.

Looking ahead, Marc and Bob dive into some of the most pressing issues facing the industry today, including geopolitical risk, evolving privacy regulations, and the rapid rise of artificial intelligence. Parisi offers a grounded perspective, arguing that while AI introduces new complexities, it should ultimately be understood as another form of technology—one that must be managed thoughtfully rather than feared outright.

Throughout the conversation, Parisi reinforces a consistent theme: the importance of balance. Whether discussing underwriting practices, organizational governance, or emerging technologies, he highlights the need for measured, informed decision-making. As cyber risk continues to evolve, this episode provides valuable insight into how organizations, insurers, and brokers can navigate uncertainty with clarity and discipline.

5 Key Takeaways

1. Cyber insurance has deeper roots than most people realize. It began in the late 1990s and has evolved through multiple distinct phases—not just the post-2015 “boom” many reference.
2. The real risk isn’t privacy—it’s operational dependency on technology. Business interruption and reliance on digital infrastructure are the true drivers of loss.
3. Cyber should never be treated in isolation. It must be integrated with other lines of coverage and broader risk management strategies.
4. The market still struggles with fragmentation and alignment. Despite abundant capacity, insurers often cannot align on large risks due to differing approaches and models.
5. AI is not fundamentally different—it’s just another technology. The real concern is not AI itself, but the speed at which it is being adopted.

5 Key Quotes

1. “AI is technology. Plain and simple.”
2. “We’ve been doing this for almost 30 years… I’m not sure at what point it gets called a mature market.”
3. “The biggest problem has always been the dependence upon technology.”
4. “If you’re going to write cyber, do it with the appropriate policy, underwriting, pricing, and reserving.”
5. “It’s not the technology itself that concerns me—it’s the speed of adoption.”

About Our Guest

Bob Parisi is a widely recognized leader in the cyber insurance industry and one of the pioneers behind the development of modern cyber insurance products. With a career spanning nearly three decades, he has played a key role in shaping how insurers underwrite and manage cyber risk, from the early days of the dot-com era to today’s complex digital landscape. Currently serving in a senior underwriting role at Munich Re, Parisi is known for his deep expertise, practical perspective, and influence across the insurance and risk management community.

Follow Our Guest

LinkedIn

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Podcast: Play in new window | Download (Duration: 13:04 — 18.0MB)

Subscribe: RSS

Summary

On this episode of Chattinn Cyber, Marc is chattin’ with Ben Wilcox, Chief Technology Officer and Chief Information Security Officer at ProArch. Their chat opens by focusing on high-impact, practical ways organizations can reduce cyber risk. Ben highlights identity as the top priority: his team moved to passkeys to remove passwords and lower the attack surface. He stresses that threat actors increasingly use man-in-the-middle techniques and that AI has accelerated the automation of credential-theft, which makes strengthening identity controls essential.

The chat then moves to AI and data governance. Ben describes rolling out visibility tools to monitor internal AI use — what prompts users run and what data is fed into models — and pairing that with data labeling and classification. He warns organizations to restrict where AI tools are allowed and to implement compensating data controls to prevent accidental or intentional leaks of sensitive information.

Ben cautions that AI and cybersecurity must be adopted in parallel, because AI will reveal existing misconfigurations and permission drift. He gives practical examples (like Copilot showing information a user shouldn’t see because of incorrect permissions) to illustrate how AI surfaces weaknesses in access controls. The takeaway is that AI can be a force-multiplier but also a magnifier of existing security gaps.

On leadership and tradeoffs, Ben explains how combining CTO and CSO responsibilities can be an enabler if balanced correctly. He argues for marrying a product/technology lens with a risk lens, leveraging internal expertise, and making business enablement and security complementary so organizations can move quickly while maintaining the right groundwork.

Finally, Ben addresses translating cyber risk into financial terms for CFOs and boards. He recommends business impact analysis—linking key system outages (e.g., Active Directory) to production downtime costs—to quantify risk and justify security investments. He shares real incident cost ranges (low seven figures to tens of millions in some cases), underscores the role of compensating controls, and concludes with a call to monitor industry trends, assess outage and reputational costs, and prioritize risk reduction.

Key Points

• Identity-first approach: move away from passwords (passkeys) and reduce reliance on MFA tokens that can be intercepted or automated by attackers.
• AI visibility and data controls: monitor internal AI usage, restrict sites/tools, and enforce labeling/classification to prevent data leakage.
• AI exposes existing weaknesses: adopting AI without fixing permission drift and misconfigurations surfaces risks rather than hiding them.
• Speed and detection advantage: AI can accelerate detection and response in SOCs—gaining even seconds can materially reduce impact.
• Translate risk to business terms: use business impact analysis to quantify downtime costs and build the financial case for security investments and insurance.

Key Quotes

• “Last year we took the initiative and we moved to pass keys.”
• “AI has sped up that weaponization and being able to turn that around and get those tokens automatically.”
• “AI is going to expose the weaknesses that are inherent within your security controls that you already have in place.”
• “If we can get even 5 seconds faster or 10 seconds faster or 20 seconds faster, sometimes that makes a difference.”
• “And that’s why they should have bought cyber insurance.”

About Our Guest

Ben Wilcox is a seasoned technology leader with over 25 years of experience driving innovation and solving complex business challenges. Serving as both Chief Technology Officer and Chief Information Security Officer at ProArch, Ben combines a forward-looking vision with a hands-on approach to cybersecurity. He is passionate about leveraging technology to accelerate business outcomes while embedding security best practices into organizational culture and operations. Ben’s strategic mindset and dedication to excellence have strengthened ProArch’s resilience and helped protect clients’ data and systems. Outside of work, Ben channels his relentless drive into racing as an instructor and competitor with the Northeast Audi Club, and enjoys gardening, cooking, and spending quality time with his family. As he puts it, “Security isn’t just about defending against threats—it’s about enabling trust, protecting growth, and ensuring every decision we make strengthens the foundation of the business.”

Follow Our Guest

LinkedIn | Website

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Podcast: Play in new window | Download (Duration: 12:09 — 16.7MB)

Subscribe: RSS

Summary

In this episode of Chattinn Cyber, Marc Schein is chattin’ with Mike Armistead, a seasoned cybersecurity expert with over 40 years of experience, including more than 20 years as a vendor in the cybersecurity space. The conversation opens with a discussion about the challenges security leaders face in 2026. Mike highlights the complexity of their role, comparing it to that of a CFO managing financial risk, but notes that cybersecurity leaders often lack the comprehensive management tools that CFOs have. He emphasizes the fragmented nature of cybersecurity tools and the difficulty in stitching together disparate signals to form a coherent security posture.

Mike further explains that the human element is the critical glue in cybersecurity programs. The effectiveness of security teams depends heavily on the leadership and the ability of individuals to contextualize technical signals within the business environment. This need for situational awareness is driving interest in AI technologies, particularly on the defender side, to augment human capabilities and expand the scope and depth of security operations.

The chat then shifts to the role of AI in cybersecurity products. Mike observes that while AI is increasingly integrated into detection tools, the industry has largely shifted focus away from prevention. He advocates for a strategic return to prevention, where AI can play a significant role in helping security leaders develop and implement risk mitigation strategies tailored to their organizations. Mike stresses the importance of a holistic approach that goes beyond real-time detection to include employee training, access control, and disaster recovery.

Addressing the challenges faced by middle-market organizations, Mike points out that these companies are often expected to meet the same cybersecurity standards as large enterprises but with far fewer resources. He advises middle-market CISOs to prioritize protecting their most critical assets—their “crown jewels”—and to have candid conversations with leadership about realistic security goals. This pragmatic approach helps ensure that limited resources are focused on the highest risks rather than attempting to cover every possible threat.

Finally, Mike shares information about a community he helped start called the Security Impact Circle, which focuses on cybersecurity leadership issues such as board engagement. This community facilitates workshops that bring together CSOs and board directors to bridge the communication gap and align security priorities with business needs. Mike encourages listeners to visit securityimpactcircle.org to learn more and get involved.

Five Key Points Covered

1. Cybersecurity leaders face complex challenges similar to CFOs but lack equivalent management tools.
2. Human expertise is essential to contextualize technical security signals within the business environment.
3. AI is increasingly used in detection but should also be leveraged to enhance prevention strategies.
4. Middle-market organizations must prioritize protecting their most critical assets due to limited resources.
5. The Security Impact Circle community helps improve communication and alignment between security leaders and boards.

Five Key Quotes from the Conversation

1. “Security leaders have a tough job… it’s not unlike what a CFO has to think about, right? That risk happens to be financial, and the CISOs really happens to be in cyber.”
2. “The security teams are really bound by how good not only their leader, but the deputies, the managers, the architects, those individual contributors that really help lead it.”
3. “I think the opportunity is to swing it back to prevention… AI can really start to help on the prevention strategy side of cybersecurity.”
4. “Middle-market leaders are expected to do everything that the largest enterprises do, but they don’t have the resources to cover all the ground.”
5. “We bring in a director from a public company’s audit committee to run workshops… it’s less about what a CSO thinks they should say and more about what the director thinks they need to hear.”

About Our Guest

Mike Armistead brings nearly 40 years of business experience marked by a proven track record of building companies, navigating strategic acquisitions, and leading growth at every stage. As co-founder and CEO of Respond Software, acquired by Mandiant for $200 million, and co-founder of Fortify Software, acquired by HP for $285 million, Mike has played pivotal roles in multiple successful startups, including serving as SVP on the turnaround team at WhoWhere (acquired by Lycos for $133 million) and contributing to Pure Software’s IPO. His post-acquisition leadership includes key roles as VP of Products & UX at Mandiant, Director at Google Cloud, and VP & GM for Fortify and ArcSight business groups at HPE, where he drove significant expansion and over $400 million in revenue impact. Alongside these successes, Mike gained valuable insights from two brief ventures, including leading InLeague through post-9/11 financial challenges and emphasizing product-market fit in another startup. Beginning his career as a Product Manager at HP in the late 1980s, Mike’s multifaceted experience spans diverse industries and company sizes. Today, he remains passionate about building high-performing teams and tackling complex, noble challenges.

Follow Our Guest

LinkedIn

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn

Podcast: Play in new window | Download (Duration: 19:13 — 26.4MB)

Subscribe: RSS

Summary

Today Marc is chattin’ with Alex Niejelow, a respected figure in cybersecurity. The episode opens with Marc highlighting Alex’s unique background growing up in Philly and his diverse career path. Alex shares how his early career as a Durham police officer and later as a lawyer shaped his mindset around public service and supporting people and businesses. He then transitioned into federal and state government roles, including significant positions in the Obama administration and Homeland Security, focusing on trade, customs, and national security issues such as counterfeit semiconductors in supply chains.

They then chat about Alex’s role on the National Security Council, where he worked on the intersection of trade and cybersecurity, a concept that was not widely recognized in the early 2010s but has since become central to government policy. Alex explains his involvement in developing the first-ever cyber sanctions regime, a tool designed to economically disincentivize cybercriminals and nation-states from monetizing stolen intellectual property and trade secrets. This approach was innovative in addressing the asymmetry in cyber threats, where traditional law enforcement and diplomatic tools were insufficient.

The chat then shifts to the challenges Alex faced working across multiple government agencies with differing priorities, which, while complex, ultimately led to better outcomes through collaboration and creative problem-solving. Alex emphasizes the importance of reducing asymmetry in cybersecurity, noting that companies remain vulnerable at their weakest points. He highlights the evolution of the cyber insurance industry, which has become more sophisticated with risk engineers engaging deeply with clients to improve cybersecurity postures and insurance terms.

Alex explains his motivation for founding Hilco Global Cyber Advisors, driven by the need to support middle-market companies that often lack adequate cybersecurity resources despite their sophistication and capital. He critiques the cybersecurity industry’s tendency to self-silo and stresses the importance of aligning cybersecurity solutions with the nature of the products and services businesses provide to increase adoption and effectiveness.

Finally, the chat turns to artificial intelligence (AI) as a major cybersecurity topic in 2025. Alex acknowledges both the threats and opportunities AI presents, noting that threat actors are leveraging AI to scale traditional cyberattacks like phishing. He expresses optimism about the cybersecurity community’s commitment to addressing these challenges and highlights regulatory efforts, such as guidance issued to the insurance industry on AI use in underwriting, to mitigate risks including bias. The episode closes with Alex sharing a personal anecdote from his time at the White House and providing contact information for Hilco Global Cyber Advisors.

Key Points

1. Alex’s career journey from police officer to cybersecurity expert in public and private sectors
2. Development of the first-ever cyber sanctions regime to economically deter cybercrime
3. The importance of collaboration across government agencies to address complex cyber challenges
4. The evolution and sophistication of the cyber insurance industry in reducing asymmetry
5. The dual impact of AI on cybersecurity: expanding threats and fostering innovative defenses.

Key Quotes

1. “The idea that cybersecurity issues and economic issues were actually interconnected was not widely accepted [in 2010]. It was still emerging. Fast forward to today. It is abundantly clear the intersectionality of those issues.”
2. “Companies are always as weak as their weakest link.”
3. “If you let the nature of the products and services that are being provided better inform and drive the cybersecurity solutions instead of vice versa, I think there will be a greater adoption.”
4. “Threat actors are expanding their capacity and capabilities leveraging AI … but it is the speed and scale at which it is becoming exacerbated that I think is most concerning.”

About Our Guest

Alexander Niejelow is Executive Director of Global Cyber Advisors at Hilco Global, bringing deep expertise in cybersecurity, fintech, and digital policy from leadership roles in both the private sector and government. He previously served as Deputy Superintendent for Innovation Policy at the New York Department of Financial Services, leading initiatives on AI and emerging fintech. At Mastercard, he was Senior Vice President for Cybersecurity Coordination and Advocacy, overseeing global cybersecurity and technology policy efforts. Alex also held key government positions, including Director of Cybersecurity Policy at the White House National Security Council and Chief of Staff to the U.S. Intellectual Property Enforcement Coordinator. He began his career as a litigator and holds a JD from the University of Pennsylvania and a BA from Duke University. Alex actively contributes to cybersecurity policy through board roles with the Center for Cybersecurity Policy and Blue Star Families, and has led global coalitions focused on cyber risk reduction and digital protection.

Follow Our Guest

Website | LinkedIn

About Our Host

National co-chair of the Cyber Center for Excellence, Marc Schein, CIC,CLCS is also a Risk Management Consultant at Marsh McLennan Agency. He assists clients by customizing comprehensive commercial insurance programs that minimize the burden of financial loss through cost effective transfer of risk. By conducting a Total Cost of Risk (TCoR) assessment, he can determine any gaps in coverage. As part of an effective risk management insurance team, Marc collaborates with senior risk consultants, certified insurance counselors, and expert underwriters to examine the adequacy of existing client programs and develop customized solutions to transfer risk, improve coverage and minimize premiums.

Follow Our Host

Website | LinkedIn