The Lock & Key Lounge - RIFF Edition 6

The Lock & Key Lounge - RIFF Edition 6

In this RIFF Edition, Navroop and Matt react to Field Notes, ArmorText's first annual user conference, held at the Classic Car Club in Manhattan under one rule — no vendor pitches, including from the vendor hosting it. From a keynote delivered by someone who has lived the failure mode ArmorText usually has to describe hypothetically, to three customer integrations that collapsed the barrier to entry, to a student project that became the most-requested follow-up of the event, the throughline is consistent: we planned a conference, and the room turned it into a roadmap.

Podcast #32 - Vendor Cooties

Should We Rethink the Practitioner/Vendor Relationship in Cybersecurity? There is a deeply ingrained, culturally accepted reflex in cybersecurity: Keep vendor sales and marketing people at arm's length during any serious evaluation or decision. Matt Calligan calls it "vendor cooties," and in this episode he argues the assumptions underneath it have not been true for a long time—and that they are actively costing practitioners. Before the internet, vendors held a genuine information advantage, and that asymmetry created real incentives to mislead. So the community built a wall. But buyers have become more educated now, AI has made comparative analysis table stakes, and the people working inside these companies have had to become genuine category experts just to get a meeting. Gianna Whitver, co-founder and CEO of the Cybersecurity Marketing Society, and Charles Gold, a four-time cybersecurity CMO, join Matt to examine where the stigma came from, what practitioners leave on the table by keeping vendors out of the room, where AI as the "objective consultant" falls short, and what a healthier vendor-practitioner relationship actually looks like.

Podcast #31 All Tools, No People: Cybersecurity Is Missing The Boring Human Investment

OT security spending is at an all-time high, yet all these tools do is fill the “do we have X product” hole if the organization isn't investing in a human-driven aggregation layer to curate and make decisions based on the telemetry and data pouring out of them. Danielle Jablanski has examined this problem from a rare intersection of vantage points: as a strategist working with asset owners at Nozomi Networks, as a leader of OT strategy inside CISA's Office of the Technical Director, and now as the OT cybersecurity consulting program lead at STV, an infrastructure-focused firm building security in from the start rather than bolting it on. She joins Matt Calligan to explain why treating cybersecurity as a technology problem instead of a people problem is dangerous in environments where the stakes couldn’t be higher - where failure doesn’t just interrupt data or access, it stops water, electricity, and the systems society runs on.

Podcast #30 Faster Than Human

Anthropic's Project Glasswing used a restricted AI model to surface over ten thousand high-severity vulnerabilities across more than a thousand open-source projects. The 2026 Verizon DBIR tells us vulnerability exploitation just became the number one initial access vector for breaches—up 55% in a single year. Only 26% of critical vulnerabilities were fully remediated last year, down from 38% the year before. Median time to resolution: 43 days, up from 32. That was the pre-Glasswing baseline—before AI-scale discovery even entered the equation. Tim Chase, Program Director at MFG-ISAC, and Brian Geffert, VP of Cyber Defense at 3M and former Global CISO at KPMG International, join Matt Calligan to confront what this means for an industry that has heavy OT interconnection, no regulatory floor equivalent to NERC CIP, and a security culture that has outsourced too much to tools that are now becoming the attack surface themselves.

Podcast #29 The Structures That Hold

Building Governance that Holds Because the Mission Demands It—Not Because Anyone Required It We have spent years in this industry talking about who belongs in the room—the board table, the executive suite, the security leadership track. What we have talked about far less is what it actually takes to get there, and whether the commitments organizations have made to broadening who leads are holding when the environment makes it easier to let them quietly lapse. Jameeka Green Aaron has operated at both levels simultaneously: as the CISO responsible for making security governance work inside a global digital health company serving millions of members, and as a board member whose job was to ask the harder questions about whether the organization was doing what it said it would. In this conversation with Navroop Mitter—recorded just one day after her move to Emerson Collective—Jameeka traces the arc from the South Side of Stockton to Black Hat MEA in Saudi Arabia, names the structural conditions that have kept the pipeline too thin for too long, and explains what it actually took to build AI governance at Headspace that held because people's wellbeing demanded it—not because regulation required it.