Risk before Technology

Risk before Technology

Secured with Dr. KJ — Season 4, Episode 1 Risk Before Technology with Nett Lynch Episode Summary Season 4 premiere, Dr. KJ sits down with Nett Lynch, CISO at Kraft Kennedy and Emperor of Legion, to explore what it truly means to get left of boom in cybersecurity. Nett shares how she helps organizations move beyond checkbox compliance by leading with risk instead of fear, uncertainty, and doubt. Drawing on 28 years of IT experience and nearly two decades in the managed service provider space, she breaks down why SMART goals should drive every security roadmap, how AI-powered threats are reshaping the attack landscape, and what it takes to earn executive trust through listening and long-term partnership. What You Will Learn Why compliance is not the same as security and how the treasure and crown jewels analogy helps executives understand where their real risk lives. How AI-powered threats have shifted from technical sophistication to credibility and speed, and why passwordless authentication should be at the top of every organization's priority list. The importance of including the CFO in tabletop exercises and how to build security roadmaps that align to three- and five-year business goals. Top 3 Takeaways 1. Lead with risk, not fear, uncertainty, and doubt. Clients who feel scared into a decision walk away uncomfortable and are less eager to have the next conversation. Framing security as a business enabler through SMART goals creates lasting partnerships. 2. Identity is now the primary attack surface. Threat actors are using AI to conduct faster reconnaissance and build attacks that are indistinguishable from real business activity. Passwordless authentication and strong multifactor are no longer optional. 3. Trust is built through listening, not credentials. Asking open-ended questions, understanding the politics and growth plans of a business, and meeting clients where they are will always outperform a list of certifications. Memorable Quotes "Compliance is not security. They are not the same thing. It is kind of like a Venn diagram. There is a little bit of overlap, but there is stuff on either side that one does not equal the other." "All of their data is treasure. It is all valuable, but not all treasure are the crown jewels." "It is not your credentials. It is not your experience. It is how much you care." "You have one mouth and two ears. You should listen more than you speak." Connect with the Guest Nett Lynch on LinkedIn: https://www.linkedin.com/in/nett-s-lynch-mba [https://www.linkedin.com/in/nett-s-lynch-mba] Listen and Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com [https://swdrkj.riverside.com] Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 [https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517] Spotify YouTube Support the Show If this episode brought you value, share it with a colleague, leave a review, and help us grow the community. Securing tomorrow, one episode at a time.

Security is not a Checkbox

Episode Summary In this episode, Dr. KJ sits down with Kimberly, a product and engineering leader in the insurance industry, to talk about what it really takes to build secure products at enterprise scale. From managing security consistency across legacy and cloud applications to rolling out AI responsibly in a highly regulated environment, Kimberly brings a practitioner's perspective grounded in transparency, least privilege, and bringing people along on the journey. The conversation covers the tension between shipping fast and staying secure, the role of AI in transforming insurance products, and the leadership principles that make security culture stick. What You'll Learn In this episode, you will learn how a seasoned product leader approaches security consistency across applications of different ages and architectures, why least privilege is not just a technical control but a cultural practice, how to lead a phased AI rollout in a regulated industry while keeping InfoSec at the table from day one, what it looks like when security design reviews become a celebration rather than a checkpoint, and how to translate technical vulnerabilities into business risk language that resonates with stakeholders and leadership. Top 3 Takeaways Security has to be built in from the start. Treating it as a checklist item at the end of a development cycle creates inconsistency and opens the door to costly exposures. The why matters more than the what. Whether you are enforcing least privilege, rearchitecting vendor integrations, or rolling out AI, helping your team understand the reasoning behind a decision is what prevents corner-cutting and builds lasting security culture. AI is an accelerator, not a free pass. Organizations that are seeing real value from AI are the ones that stage their rollouts, measure outcomes, and keep security embedded in the design process from the beginning. Memorable Quotes "A small book could turn into a $5 million bigger issue." "I don't look at security as the last thing that we do when we're getting ready to ship." "There's no role or no space that's small. Security impacts every role." "We catch security flaws early and design phases are celebrated — it's a win for all of us." Connect with the Guest Connect with Kimberly on LinkedIn: https://www.linkedin.com/in/kimberly-w-4841923aa/ [https://www.linkedin.com/in/kimberly-w-4841923aa/] Listen & Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com [https://swdrkj.riverside.com] Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 [https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517] Spotify: Search Secured with Dr. KJ YouTube: Search Secured with Dr. KJ Support the Show If this episode added value, share it with a colleague, leave a review, and help grow the Secured with Dr. KJ community. Every share puts these conversations in front of the practitioners who need them most. Securing tomorrow, one episode at a time.

Diversity is a Security Advantage

Episode Summary In this episode of Secured with Dr. KJ, Alexandra Kruse joins Dr. KJ to make a case the security industry needs to hear diversity is not a fairness initiative — it is a security advantage. Drawing from her experience as a cybersecurity professional, immigrant, and working mother of two, Alex unpacks how homogenous teams create blind spots that put entire communities at risk, how AI systems inherit the biases of those who build them, and what it truly looks like to lead in a profession that was not always designed with you in mind. From facial recognition failures to the pressure of school drop-offs between back-to-back meetings, this episode brings the human side of security to the forefront. What You Will Learn Why leaving diverse voices out of the room is not just a fairness problem but a security risk with measurable consequences, how AI systems reflect the biases in their training data and what that means for underrepresented users at scale, and what real resilience looks like for working mothers navigating leadership in tech. Top 3 Takeaways 1. Diverse teams build stronger security. When everyone in the room shares the same background and experiences, blind spots form. Communities that are not represented during design and development are the ones most likely to be left unprotected or actively harmed by the tools that are supposed to serve them. 2. AI outputs reflect who built it and what it was trained on. From facial recognition disparities to image generation defaults, the evidence is consistent: AI systems that lack diverse input produce output that fails underrepresented users. In an agentic world where those outputs run without a human reviewing every result, the stakes are even higher. 3. You are in the room because your voice matters, and that is enough. For women earlier in their careers, the pressure to show up perfectly or earn the right to take up space is real. Alex's message is direct: give yourself grace, advocate for others the way you wish someone had advocated for you, and do not confuse rest with weakness. Memorable Quotes "Bringing diverse voices into the room is not just about fairness. It is critical to building stronger security for everyone." — Alexandra Kruse "We need to stop treating diversity as a nice-to-have and start seeing it as a security advantage." — Alexandra Kruse "You are in the room because your voice matters, and that is enough." — Alexandra Kruse "I do not need to deserve rest. I can just take the rest because I am human and that is allowed." — Alexandra Kruse Connect with the Guest Alexandra Kruse, MSML — Cybersecurity Professional and Advocate LinkedIn: https://www.linkedin.com/in/alexandra-kruse-msml [https://www.linkedin.com/in/alexandra-kruse-msml] Listen & Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com [https://swdrkj.riverside.com] 🎙 Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 [https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517] 🎵 Spotify 📺 YouTube Support the Show If this episode brought value, share it with a peer in your network. Every share helps grow a community built on substance over sales — real practitioners, real insights, no pitches. Securing tomorrow, one episode at a time.

Blast Radius: How MSPs Secure the many by Protecting One

Episode Summary In this episode, Dr. KJ sits down with Doug Turpin, a seasoned managed service provider leader, to unpack the unique security challenges MSPs face at scale. Doug breaks down the concept of "blast radius" — what happens when the tools designed to protect clients become an attacker's greatest advantage — and shares how his organization builds a security-first culture grounded in stewardship, not fear. The conversation also digs into AI's role as an amplifier, and why ungoverned AI may be one of the most underestimated risks in security today. What You'll Learn * Why blast radius is the defining security challenge for managed service providers * How security gaps most often start with people — not technology * The difference between using AI as an operational advantage versus accelerating your own mistakes * What a security-first culture actually looks like from the inside out * How to handle and learn from team mistakes without creating a culture of fear * Why AI without guardrails is a compliance and security liability Top 3 Takeaways 1. Blast radius is real — and it scales fast. MSPs hold privileged access to dozens or hundreds of client environments. A single compromised identity or remote management tool doesn't just affect one network — it can cascade across your entire client base. Least privilege, strong isolation, and constant visibility aren't optional; they're foundational. 2. AI amplifies what's already there — good or bad. AI can surface better signals, reduce noise, and free your sharpest people for judgment calls. But if your fundamentals are weak — bad data, poor identity hygiene, broken processes — AI will accelerate your mistakes, not fix them. Governance comes first, use cases second. 3. Security culture is built on stewardship, not enforcement. When your team understands they're protecting people's livelihoods — not just systems — behavior changes naturally. Clear expectations, shared ownership, and psychological safety to speak up create instinctive security, not performative compliance. Memorable Quotes "The tools that we use are designed to be trusted — and attackers love those as hands-on intrusion kits." — Doug Turpin "AI in reality doesn't fix bad data or identity hygiene or broken processes. If your fundamentals are weak, your AI is just going to make you accelerate your mistakes." — Doug Turpin "Once you see that security is part of doing the right thing — not just following the rules — your behavior changes, and it changes naturally." — Doug Turpin Connect with the Guest Doug Turpin — Managed Service Provider Leader and Senior Security Engineer Listen & Subscribe Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com [https://swdrkj.riverside.com] * 🎙 Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 [https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517] * 🎵 Spotify * 📺 YouTube Support the Show If this episode brought value, share it with a peer in your network. Every share helps grow a community built on substance over sales — real practitioners, real insights, no pitches. Securing tomorrow, one episode at a time.

Security at Scale: Identity, AI, and Culture

Episode Title: Security at Scale: Identity, AI, and Culture Host: Dr. Kenneth "KJ" Johnson Guest: Nicole Darden Ford Guest Title: Vice President and Customer Security Officer, Microsoft Duration: ~19 minutes Keywords: identity security, AI security, security culture, Microsoft, enterprise security EPISODE SUMMARY Nicole Darden Ford joins Dr. KJ for a wide-ranging conversation on what it truly means to lead security at global scale. Drawing on over 25 years of experience across corporate and federal environments, Nicole unpacks the three converging forces keeping security leaders up at night — identity, software supply chain, and AI — and why the industry's mindset has fundamentally shifted from reactive to prevention-first. She shares her framework for balancing AI-powered defenses against AI-enabled attacks, why data governance remains the industry's most unresolved challenge, and how the most successful organizations are building security cultures where ownership and accountability belong to everyone. Nicole closes with a lesson from the golf course that every security leader can apply. WHAT YOU'LL LEARN * Why identity, software supply chain, and AI are the three converging forces redefining enterprise security risk * How to think about AI as a tier zero asset — and what that means for how you govern and protect it * Why building a security culture rooted in ownership and accountability matters more than any policy or control TOP 3 TAKEAWAYS 1. AI should advise broadly, decide narrowly, and act autonomously only when the blast radius has been clearly defined — organizations that skip this discipline are taking on significant risk 2. Data governance is no longer just a CIO or CISO issue — it belongs to the CEO, CFO, and the board, and it must be solved before AI can be deployed safely and effectively 3. Security culture beats security policy every time — when every employee feels accountable and empowered, security becomes part of how the business operates, not a barrier to it MEMORABLE QUOTES > "When everything looks authorized, it's really hard to figure out where the breach is." — Nicole Darden Ford > "AI should advise broadly, decide narrowly, and act autonomously only when the blast radius has been clearly defined." — Nicole Darden Ford > "Clarity beats consensus every time." — Nicole Darden Ford CONNECT WITH THE GUEST Nicole Darden Ford LinkedIn: https://www.linkedin.com/in/nicolendardenford/ [https://www.linkedin.com/in/nicole-darden-ford/] Company: www.microsoft.com [http://www.microsoft.com] LISTEN & SUBSCRIBE Like, follow, and subscribe to Secured with Dr. KJ: https://swdrkj.riverside.com [https://swdrkj.riverside.com] Apple Podcasts: https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517 [https://podcasts.apple.com/us/podcast/secured-with-dr-kj/id1805058517] Spotify: Search "Secured with Dr. KJ" YouTube: Search "Secured with Dr. KJ" SUPPORT THE SHOW If this episode helped you, share it with your team, leave a quick rating/review, and follow the show for new episodes on AI, identity security, security culture, and more. Securing tomorrow, one episode at a time.