"No Trust" by Zero Trust Forum

In this episode, Howard Holton joins the No Trust podcast team to discuss why AI governance may be one of the most important and misunderstood challenges facing cybersecurity today.

Drawing on decades of experience across IT, technology leadership, security, and emerging technologies, Howard shares his perspective on the rapid growth of the AI ecosystem, why organisations need to approach AI vendors and startups with a healthy degree of scepticism, and why applying traditional security and governance thinking to AI may not be enough.

The conversation explores the non-deterministic nature of AI, AI governance, vendor evaluation, technical debt, DevSecOps, AI-driven security operations, and the challenge of securing systems that may not behave exactly the same way twice. Howard explains why this fundamentally changes the way we need to think about identity, risk, testing, controls, and accountability.

The episode also looks at the importance of combining human judgement with AI capabilities rather than simply replacing people with automation. As organisations begin making more decisions at machine speed, understanding context, validating outcomes, and maintaining meaningful human oversight will become increasingly important.

Finally, the conversation turns to Black Hat, from navigating an increasingly crowded AI vendor landscape to the value of stepping away from the technology and experiencing the people, food, culture, and community that make conferences memorable.

Key Takeaways:

• AI governance is rapidly becoming one of the most important areas of cybersecurity and technology risk.
• AI is fundamentally non-deterministic, which challenges many traditional approaches to governance, testing, security, and assurance.
• Organisations need to understand how AI systems make decisions—not simply whether they produce the expected output.
• Traditional governance frameworks may need to evolve to deal with autonomous and non-human identities.
• Human oversight remains critical, particularly as AI systems are given greater autonomy and decision-making authority.
• AI security should be approached pragmatically, with strong DevSecOps, risk management, validation, and security fundamentals underneath it.
• The explosion of AI startups makes vendor evaluation increasingly important; organisations need to consider technical debt, long-term viability, architecture, and security rather than simply buying into the AI label.
• AI can strengthen cybersecurity operations, but organisations need to understand the variability and uncertainty inherent in AI-generated decisions.
• Pairing humans with AI can provide better security outcomes than simply attempting to automate people out of the process.
• Understanding context and gaining real-world experience remain essential—whether you're evaluating technology, managing security risk, or navigating Black Hat.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Evgeniy Karam joins the No Trust podcast team live at Black Hat in Las Vegas for a quick-fire conversation about AI, cybersecurity hype, emerging vendors and the challenges of cutting through the noise.

Evgeniy shares how he evaluates new security technologies, including why vendors should be able to explain in plain English what problem they solve, how they solve it and where they might fail. The conversation also explores why much of the AI security debate ultimately comes back to data protection and understanding the crown jewels organisations actually need to protect.

The team also discusses the pressure to adopt AI without clearly defined business outcomes, why AI isn't magic, and the importance of understanding where it genuinely adds value. Evgeniy finishes with advice for people entering cybersecurity, choosing the right conferences and continuing to learn as the industry evolves.

Key Takeaways:

• Black Hat is packed with new vendors, but don’t judge a company by its booth or its marketing.
• Ask vendors to explain in plain English what problem they solve and how they solve it.
• A great question for any vendor is: what would make your technology fail in a POC?
• AI security gets the headlines, but much of the real challenge still comes back to protecting data.
• Organisations need to understand their crown jewels, why they matter and what happens if they become unavailable.
• Security should protect business outcomes, not simply deploy more controls.
• AI needs a defined business problem, not just a mandate from the board.
• AI isn’t magic. Organisations need to understand where it genuinely adds value.
• If you’re starting in cybersecurity, smaller events and communities can sometimes offer more value than Black Hat.
• Whatever conference you attend, go with a plan or the sheer volume of information can quickly become overwhelming.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn [www.linkedin.com/company/zero-trust-forum/](http://www.linkedin.com/company/zero-trust-forum/).

Follow Jaye Tillson on LinkedIn - [www.linkedin.com/in/jaye-tillson/](http://www.linkedin.com/in/jaye-tillson/)

Follow John Spiegel on LinkedIn - [www.linkedin.com/in/john-spiegel-2011543/](http://www.linkedin.com/in/john-spiegel-2011543/)

In this episode, Ginny Yon joins the No Trust podcast team live at Black Hat in Las Vegas to discuss how Hacker Summer Camp is evolving, the explosion of AI and agentic security, and why separating genuine innovation from hype is becoming increasingly difficult.

The conversation explores how AI is accelerating cybersecurity startups and product development, why security leaders may need to make smaller and more calculated technology bets, and why understanding the company behind the technology is becoming just as important as evaluating the product itself.

Ginny also shares her advice for getting the most from Black Hat, the importance of community and those unexpected hallway conversations, and why the next generation of cybersecurity professionals still needs strong foundations alongside an understanding of AI.

And, because it’s the No Trust podcast, there’s also time for oysters, mussels and the inevitable pineapple on pizza debate.

Key Takeaways:

• Black Hat is about the people and community as much as the technology.
• Go with a plan, but leave space for unexpected conversations and connections.
• AI and agentic security are everywhere, but separating innovation from hype is getting harder.
• AI is dramatically reducing the time it takes to build and launch new cybersecurity products.
• Security leaders need to understand the company behind the technology, not just the product.
• Smaller, calculated technology bets may make more sense in a rapidly changing market.
• Start with the problem you need to solve, not the latest AI terminology.
• Waiting for the AI security market to settle carries its own risk.
• AI is becoming a foundational cybersecurity skill, but traditional security disciplines still matter.
• Find the area of cybersecurity you enjoy, build strong foundations and keep learning.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about? It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn [www.linkedin.com/company/zero-trust-forum/](http://www.linkedin.com/company/zero-trust-forum/).

Follow Jaye Tillson on LinkedIn - [www.linkedin.com/in/jaye-tillson/](http://www.linkedin.com/in/jaye-tillson/)

Follow John Spiegel on LinkedIn - [www.linkedin.com/in/john-spiegel-2011543/](http://www.linkedin.com/in/john-spiegel-2011543/)

In this episode, Trey Ford joins the No Trust podcast team at Black Hat in Las Vegas to discuss how cybersecurity is evolving as AI accelerates software development, vulnerability discovery, and the speed of both attack and defence.

Drawing on decades of experience across offensive security, vulnerability research, and the Black Hat community, Trey shares his perspective on how the industry has changed, why the next 18–36 months could bring a significant increase in vulnerabilities, and why AI will allow us to make both good and bad decisions at machine speed.

The conversation explores AI-generated code, vulnerability management, open-source security, human oversight, patching pressure, and why strong foundations in networking, troubleshooting, debugging, and systems thinking will become even more important as AI takes on more of the traditional technical workload.

The episode also looks at the changing career path into cybersecurity, the importance of being able to think beyond individual technologies and vulnerabilities, and why Black Hat remains as much about people, relationships, and community as it is about research and technology.

Key Takeaways:

• Black Hat is about the people and community as much as the research and technology.
• Go to Black Hat with a purpose, but leave enough space for unexpected conversations and connections.
• The smaller vendors, startups, and researchers are often where you find the most interesting innovation.
• AI will let us work at machine speed, but it will also allow us to make bad decisions at machine speed.
• Human oversight, challenge and validation will remain critical as AI becomes more autonomous.
• The next 18–36 months could bring a significant increase in vulnerabilities as AI accelerates software development.
• Faster exploitation means organisations will increasingly have to balance the risk of patching quickly against the risk of waiting.
• Cybersecurity professionals need strong foundations in networking, systems, troubleshooting and debugging, not just specialist skills.
• The future belongs to people who can think across systems and understand how technology, security and business connect.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/

In this episode, Howard Holton joins the No Trust podcast team to discuss why AI is exposing long standing weaknesses across cybersecurity, identity, and IT operations.

Drawing on decades of experience as a CIO, CTO, and CISO, Howard shares practical insights into why organisations continue to struggle with security fundamentals, how technical debt has created massive hidden risk, and why AI is accelerating the impact of those problems rather than creating entirely new ones.

The conversation explores identity hygiene, least privilege access, blast radius reduction, Zero Trust principles, board level accountability, and the growing gap between business speed and secure delivery.

The episode also looks at why organisations need to rethink culture, governance, and leadership if they want to build sustainable security strategies in the AI era.

Key Takeaways:

• AI is exposing years of poor security hygiene.
• Identity and access control matter more than ever.
• Technical debt is becoming a major security risk.
• AI increases the speed and scale of attacks.
• Businesses still prioritise speed over security.
• Least privilege is critical in the AI era.
• Zero Trust helps reduce blast radius.
• Security must become part of doing things right.
• Boards need stronger cybersecurity understanding.
• Organisations need time to clean up legacy issues.

Follow & Subscribe on all Podcast platforms.

What is the Zero Trust Forum about?  It’s about empowering zero trust security professionals with strategies, architecture, and real world journeys to secure the digital future, the right way!

Follow the Zero Trust Forum on LinkedIn www.linkedin.com/company/zero-trust-forum/.

Follow Jaye Tillson on LinkedIn - www.linkedin.com/in/jaye-tillson/

Follow John Spiegel on LinkedIn - www.linkedin.com/in/john-spiegel-2011543/