In Episode 29, Doug Salah returns as DSP's first-ever repeat guest. We preview TRISS Pittsburgh 2026 (October 22nd, $118K+ in scholarships over 9 years), break down the real implications of the CMMC pause and class deviation, and debate whether pacing AI development makes any sense when adversaries won't slow down. Plus Angel's Envy Cask Strength 2026 and a surprise guest bottle. 🥃

⏱️ TIMESTAMPS:

00:00 – Intro & Welcome Back Doug Salah 🎉
02:32 – TRISS Pittsburgh 2026 Preview
10:35 – Scholarships, Sponsors & How to Get Involved
19:35 – CMMC Pause & Class Deviation Explained
27:00 – NIST Rev 3, Post-Quantum & Self-Reporting Risk
33:00 – Prime Supplier Readiness Programs
45:00 – C3PAOs: Still Auditing
55:56 – TPRM Is Dead — Teaser 👀
1:03:00 – 🥃 Angel's Envy Cask Strength 2026
1:15:17 – Should We Be Pacing AI?
1:23:10 – Pacing vs. Gating: What's the Right Move?
1:36:00 – Small Models, Nation States & AI Weapons
1:49:00 – Purpose Creep & Ungoverned Automation
2:02:29 – Wrap-Up

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

🎤 Guest
Doug Salah — linkedin.com/in/douglassalah

📬 Send Us Your Questions!
ask@distilledsecuritypodcast.com

🌐 Connect with Us
Website: distilledsecuritypodcast.com

X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for monthly security and compliance insights.

This episode covers the growing controversy around Flock cameras: what they are, how their centralized license plate reader network enables powerful searches across jurisdictions, the documented cases of abuse by law enforcement, and why the real problem isn't the technology itself but the lack of governance and oversight. We also explore the broader privacy implications of always-on surveillance in public spaces and where the line should be drawn.

Then we break down a coordinated cyberattack that hit 30+ water systems across 12 states, exposing just how vulnerable US critical infrastructure really is. With 90% of community water systems having zero IT security budget, we discuss what basic OT hygiene should look like and spotlight the volunteer group Water Watch Center doing incredible work to fill the gap.

And for something a little different we do a deep dive into how to actually pick a good bourbon. Red flags on the shelf, what terms like "small batch" and "handcrafted" really mean, why older isn't always better, the massive barrel surplus reshaping the industry, and the distillation process behind what's actually in your glass.

🥃 Spirit Review: Boondocks Port Finished Straight Bourbon Whiskey 6 years, finished in port wine barrels, picked up in Kentucky

Takeaways

• Flock cameras raise concerns about privacy, abuse, and the need for oversight
• The use of surveillance technology has broader ethical and societal implications
• Surveillance technology presents ethical and moral dilemmas
• The need for checks and balances and governance in surveillance technology
• Marketing gimmicks can influence consumer choices
• Proof and distillation process impact the quality of whiskey
• The whiskey industry is experiencing a surplus of barrels
• Water utilities face cybersecurity challenges due to limited budgets and resources
• Basic cybersecurity measures, such as removing unnecessary internet access, replacing default credentials, and using multi-factor authentication, are crucial for protecting critical infrastructure

Chapters

• 00:00 Introduction to Flock Cameras
• 03:00 Capabilities and Controversy
• 08:12 Ethical Implications and Privacy Concerns
• 16:00 Data Collection and Surveillance Technology
• 30:36 Challenges of Surveillance Technology
• 36:04 Ethical and Moral Considerations
• 41:43 Governance and Oversight
• 52:37 Privacy Concerns and Public Trust
• 57:24 Impact of Marketing Gimmicks
• 58:07 Significance of Proof and Distillation Process
• 01:00:42 Surplus of Barrels in the Whiskey Industry
• 01:07:11 Tasting Notes and Availability of Specific Bourbon
• 01:25:27 Hacking of Utilities and Water Systems
• 01:26:15 Challenges Faced by Water Utilities
• 01:38:24 Implications of Compromised Water Systems
• 01:43:17 Role of Volunteer Organizations and Basic Cybersecurity Measures

Hosts
Justin Leapline – @justinleapline
Joe Wynn – @wynnjoe
Rick Yocum – @rickyocum

Send Us Your Questions!
ask@distilledsecuritypodcast.com

Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

👍 Subscribe for monthly security and compliance insights.

In this episode of the Distilled Security Podcast, we dive into AI-driven vulnerability management, a massive breach hitting 9,000 educational institutions, and the future of GRC engineering, including a live preview of what autonomous compliance agents actually look like in practice.

🔹 AI & Vulnerability Management — Why the next 6–18 months will be a patching crisis, how AI models are accelerating zero-day discovery, the operational reality of back-to-back criticals, surge scenario planning, burnout risk, and Microsoft's M-Dash orchestrated agent approach

🔹 The Canvas/Instructure Breach — 275 million records exposed, finals week disrupted across 9,000 universities, a rumored $10M ransom negotiated by the SaaS provider, the ShinyHunters connection, and what this means for critical infrastructure concentration risk

🔹 GRC Engineering Meets AI — Deterministic vs. non-deterministic testing explained, why auditors can't rely on AI-generated evidence, autonomous agents with segregation of duties, the episki 2.0 platform preview, and the emerging role of the "orchestration conductor" in security teams

🥃 Spirit Review: Heaven Hill Grain to Glass (DSP KY-1)

⏱️ Timestamps
00:00 – Intro & Topics Overview
01:27 – AI & The Coming Vulnerability Surge
07:00 – Patching Windows, Burnout & Operational Reality
16:40 – Surge Scenarios, Fix-It Weeks & Recommendations
21:20 – Microsoft M-Dash: Orchestrated Agent Scanning
25:56 – The Canvas/Instructure Breach Breakdown
33:18 – Critical Infrastructure & Third-Party Concentration Risk
47:00 – Black Kite 2026: Third-Party Breach Report
53:11 – Spirit Review: Heaven Hill Grain to Glass
57:07 – BSides Pittsburgh 2026 Update
1:04:01 – GRC Engineering Meets AI
1:19:00 – Deterministic vs. Non-Deterministic Testing Explained
1:25:00 – episki 2.0 Platform Preview
1:47:00 – AI Segregation of Duties & Three Lines of Defense
1:53:00 – The Orchestration Conductor: A New Security Role
2:02:31 – Outro & Wrap-Up

🎙️ Hosts

• Justin Leapline – @justinleapline
• Joe Wynn – @wynnjoe
• Rick Yocum – @rickyocum

📬 Send Us Your Questions!
ask@distilledsecuritypodcast.com

🌐 Connect with Us
Website: distilledsecuritypodcast.com
X: @DisSecPod
Email: hello@distilledsecuritypodcast.com

👍 Like, comment, and subscribe for monthly security and compliance insights.