Security Appreciation, The Human Firewall, and The Future of AI

AI Is About to Become Too Expensive for Small Businesses

AI used to feel like a flat-fee superpower. Now it is starting to behave like electricity: metered, variable, and tied to exactly how you use it. We dig into what that shift means for the people actually trying to run AI in the real world, from small businesses building their first workflows to sales, ops, and dev teams pushing tools like Microsoft Copilot, ChatGPT, Claude, and agents into daily work. Josh unpacks the move from per-seat pricing to usage-based billing, where cost is driven by tokens, context retrieval, tool calls, and how long a model “thinks” behind the scenes. That change forces a new set of business questions: which workflows burn the most tokens, when premium reasoning is worth it, and how to stop paying for AI habits that feel productive but do not produce ROI. We also talk about the uncomfortable incentives that come with token-based revenue models and why customers need clearer visibility into what they are being billed for. Then we zoom out to the market dynamics: if the best models become scarce at scale, enterprises with huge contracts may secure better pricing and reserved capacity while smaller teams get caps or slower access. Finally, we make it practical with an AI FinOps mindset: map workflows, set internal model tiers, put guardrails around agents, train teams to prompt efficiently, and tie spend to measurable outcomes. If you are trying to budget for AI, prove business value, or keep your AI bill from quietly exploding, this one will give you a clear framework. Subscribe, share this with a teammate who owns the budget, and leave a review with your biggest question about AI costs. Josh's LinkedIn [https://www.linkedin.com/in/joshbruyning/]

Word on the Street: Is SaaS Dead? Mythos and The AI Security Vendor Race

Richard Stiennon is back with the Word on the Street! AI isn’t just a chatbot tab anymore. It’s quietly becoming the interface inside the software we already rely on, and that shift changes how fast we can build, operate, and secure modern systems. We talk about what it feels like when AI is embedded directly into tools like AWS Route 53, guiding you through confusing workflows step by step instead of forcing you to bounce between docs and prompts. From there we zoom out to the “SaaS is dead” noise and what’s actually happening: products racing toward AI-native experiences that help you onboard, connect data, and get value fast. We share a concrete CRM example, why traditional CRMs feel painful, and how newer tools make setup and integrations like website form-to-CRM routing take minutes instead of hours. Then we get into the limbo stage a lot of teams are in with advanced AI engines like Mythos and the buzz around Fable 5. We break down a real cybersecurity use case: mapping an entire security stack to frameworks like MITRE ATT&CK, MITRE D3FEND, and the NIST Cybersecurity Framework, producing structured outputs that used to take consultants months. That leads to the hard question every software company asks next: how do you build fast with AI without touching customer data and putting HIPAA compliance or SOC 2 controls at risk? We walk through practical guardrails, including using synthetic data and keeping development environments separate. Finally, we sort out where “AI security vendors” actually fit, from governance and model protection to AI-powered email security, DLP, and SOC automation, and why this category may soon just be called security again. If you’re deciding how to adopt AI safely while still moving fast, this is for you. Subscribe, share this with a teammate, and leave a review with the biggest AI adoption blocker you’re facing. Visit IT Harvest [https://it-harvest.com/] Josh's LinkedIn [https://www.linkedin.com/in/joshbruyning/]

Dr. Zero Trust Talks AI Threats, Fraud Detection, AI Entrepreneurship

Fraud doesn’t hide because it’s clever. It hides because our models keep looking for “normal” instead of interrogating “wrong.” That’s where this conversation with Dr. Chase Cunningham (known to many as “Dr. Zero Trust”) gets practical fast. We talk about his recent patent work using deterministic math to surface fraud inside huge systems, and why the usual data science playbook of finding enough “good” data to train on can be a trap when the real signal is buried in what shouldn’t be happening at all. From there, we zoom out to the AI toolchain most teams are using today. LLMs like Claude and ChatGPT can be powerful, but they’re often optimized to produce the next best-looking answer, not the most adversarial truth. We dig into how to “turn the system on its head” with better prompting, correlation thinking, and agentic AI swarms that behave like a room full of specialists attacking one problem from different angles. If you’re wondering what the next step is beyond using AI for emails, this is the blueprint: orchestration, role clarity, and tight feedback loops. Then we hit the elephant in the room: AI security. Shadow AI, sensitive data leakage, and agents that can accidentally expose HR documents or internal secrets all come back to fundamentals like identity and access management, least privilege, micro-segmentation, and non-human identities. Zero trust principles still apply, but the speed and scale of agentic systems make every gap matter more. We close with what keeps Chase up at night, including deepfakes and the erosion of shared reality, plus where to follow for more. Subscribe, share this with a teammate who’s rolling out AI, and leave a review if it helps. What’s the one AI use case you want, but you’re not deploying yet because security feels messy? Josh's LinkedIn [https://www.linkedin.com/in/joshbruyning/]

Humans vs. AI, Who is The Bigger Business Risk?

AI feels like a shortcut until it becomes a liability. We sit down with Nikki Robinson, STSM of AI and Platform at IBM and co author of Human Factors and Cybersecurity, plus security and risk executive Jennifer Baca, to get brutally practical about responsible AI use, data privacy, and what “secure” even means when the tooling changes weekly. We start with the basics that too many teams skip: due diligence, responsible disclosure, and why you should learn prompt engineering by experimenting in safe sandboxes. Then we dig into the real world problem of families and coworkers pasting sensitive data into chatbots. Nikki explains why LLMs are company owned systems, why terms of service matter, and why you cannot treat AI outputs as truth. Hallucinations, made up citations, and overconfidence are not edge cases, they are daily hazards that demand critical thinking and verification. From there, the conversation turns to work and careers. We talk about LLMs as interactive partners that can accelerate cloud learning, generate Terraform, and turn developers into “10x” builders when used thoughtfully. The employment takeaway is clear: you may not be replaced by AI, but you can be replaced by someone who knows how to use AI to improve workflows and communicate outcomes to leadership. Finally, we connect human factors, psychology, and cybersecurity culture. Instead of blaming people, we explore secure by default design, psychological safety, broken metrics in SOC environments, and how emerging frameworks like the NIST AI Risk Management Framework point toward future AI compliance. If you lead a small or mid sized business, we close with concrete steps using AI features already inside tools like Copilot and Slack AI without creating dangerous tool sprawl. Subscribe, share this with a teammate, and leave a review if it helps. What is one AI rule you want your organization to adopt this month? To get ready for the AI economy, visit Cybernomics.io [https://cybernomics.io/] Josh's LinkedIn [https://www.linkedin.com/in/joshbruyning/]

The Hiring Process Is Broken And We Have To Fix It

Ten months of job hunting can mess with your identity, even when you know you’re good at what you do. We sit down with Jennifer “Jen” T. Baca, a cybersecurity risk leader and single mom, to talk honestly about what it feels like to be qualified, visible, and still stuck in the silence of today’s hiring market. We get into the mental weight of layoffs, the endless loop of applications, and the weird reality that finding a job now demands its own set of skills: LinkedIn strategy, resume tactics, interviewing stamina, and relentless networking.   Jen also shares the silver linings she didn’t expect: conference exposure, community leadership, and the kind of communication and empathy that can turn a solid cybersecurity manager into a truly effective security leader. We talk imposter syndrome, culture fit, and why “overqualified” is often just a polite way of saying “not our person.” If you’re in governance, risk, and compliance (GRC) or cybersecurity leadership, you’ll recognize the tension between wanting meaningful work and needing stability now.   Then we shift into the work itself: real-world healthcare cybersecurity risks, the business cost of phishing and account compromise, and how to translate security risk into board-level language tied to revenue, trust, and HIPAA. We also dig into women in cybersecurity, minority experiences in male-dominated rooms, and why soft skills and emotional intelligence are not optional in modern security teams.   If you’ve ever been ghosted after a great interview, this one will hit. Subscribe to Cybernomics, share this with someone in the job hunt, and leave a review if you want more conversations that tell the truth and push the industry to do better. Josh's LinkedIn [https://www.linkedin.com/in/joshbruyning/]