• Taking Technology for What It Is, and Let's Stop Humanizing AI
    Oct 5 2026
    Taking Technology for What It Is, and Let's Stop Humanizing AIA new transmission from An Analog Brain In A Digital Age, by Marco CiappelliPrefer to watch? I recorded this one walking uphill through a Tokyo alley. YouTube: https://youtu.be/5nhBNMJ7LFI TikTok: https://vm.tiktok.com/ZN8hExSpT/ Instagram: https://www.instagram.com/reel/DeF7fz2gdpE/It was night, the alley was narrow, and the street was going uphill.Just me and a small camera. It points where I point it. It records what's in front of it. It focuses, it adjusts to the dark, and when the battery dies, it stops. It doesn't pretend to listen. It doesn't nod. It does its job, and I have never once mistaken it for a friend.This is the second of the short pieces I'm recording here in Japan. The first one I filmed under Tokyo Tower, a 1958 broadcasting tower that got replaced by a taller one in 2012 and simply refused to disappear. It still sends FM radio across the city. It still lights up every night. The new tower didn't erase it. They share the skyline. Watch it here: https://youtu.be/glGHghhhXWcI closed that one asking why we are always in such a hurry to kill the old technology the moment a new one shows up.This one started somewhere else. Earlier that day I had read two articles about people who talk to AI. Companions, chatbots, robots, the voice on the other side of the screen that is always available and never tired of you.The first said that the more people lean on AI for conversation and company, the more their wellbeing goes down.The second said the opposite. Older people using AI companions found them genuinely helpful. With one condition: they understood what they were talking to. A machine that wasn't pretending to be human. Wasn't pretending to be intelligent the way we are. Wasn't pretending to feel anything at all.Same day. Same subject. Opposite conclusions.Except the second one came with a condition. And conditions are usually where the truth is hiding.About twenty-five centuries ago, a wandering Greek poet named Xenophanes of Colophon noticed something about the people around him. The Ethiopians made their gods dark-skinned and snub-nosed. The Thracians gave theirs blue eyes and red hair. Everyone looked up at the sky and found their own face looking back.Then he pushed the joke one step further. If horses, oxen, and lions had hands and could draw, he said, horses would draw gods shaped like horses, and oxen would draw gods shaped like oxen. Each would give the divine the body it already had. I like to think the lions would add a mane.We have always done this. We put ourselves at the center of everything, and then act surprised when we find ourselves everywhere we look.For most of history we did it with gods. Then we started doing it with machines.The old machines made it easy to resist. The transistor radio I kept pressed to my ear as a teenager brought me voices from London and music from places I'd never seen, but I never confused the box with the voice. Tokyo Tower has never pretended to be anything but a tower. A typewriter never told me it understood how I felt.Now we build machines that draw our face on themselves. A name. A warm voice. A little pause before the answer, as if they were thinking it over. "I understand." "I'm here for you." Seeing ourselves in machines was always going to happen. That's human nature. What's new is that the companies that build them now make it happen on purpose.And it cuts both ways. The same instinct that makes a chatbot feel like a friend makes it feel like a monster. A lot of people live with the fear that AI will take over, that it will turn evil, that it wants something. It can do damage, no question. But "wants" is our word. We drew that face too.A god. A friend. A villain. Three different portraits. Same mirror.I'm not against the companions. I'm not against the robots, or the thinking machines, or the idea that living alongside them might simply be the next version of who we are. I'd like to see that future. I'd just like to see it with my eyes open.Because the biggest damage was never going to come from the machine. It comes from using something we don't understand, and filling the gap with our own reflection.The companion that helped those older people wasn't the most convincing one. It was the honest one. The one that never asked to be mistaken for anything else.Maybe that's all it takes. Take technology for what it is. Technology. Not magic. Not a substitute for the people in our lives. Not a god we painted with our own face.At the end of the alley the street went flat, and the breathing got easier. Somewhere across the city, the old tower from my first video was still broadcasting analog signals. Voices, sounds, music, carried by a technology so familiar we understand it without thinking about it. It doesn't pretend to be anything it isn't. It's a tower, doing its job.Stay imperfect, stay human.End of transmission.— Marco Ciappellimarcociappelli.comThis article was written by...
    Mehr anzeigen Weniger anzeigen
    5 Min.
  • The ESET PROTECT Launch Brings 24/7 Monitoring, AI Security, and a Cyber Warranty to Small and Midsize Businesses | A Brand Story Conversation with Ryan Grant, Country Manager & GM, North America at ESET | Hosted by Sean Martin
    Oct 10 2026
    Ryan Grant, Country Manager & GM, North America at ESET, joins ITSPmagazine to discuss the launch of ESET PROTECT, announced September 30, 2026, a platform that brings 24/7 monitoring, AI security, and a cyber warranty to small and midsize businesses. Ryan Grant says the design came from feedback from ESET clients and partners, along with a survey of 2,000 SMB customers. About 70% of those customers had some sort of antivirus tool, and less than half had tools such as multi-factor authentication, EDR, monitoring, or email security.What does ESET PROTECT include? Ryan Grant describes an out-of-the-box cybersecurity-as-a-service offering built natively into one platform, combining AI-led security, advanced endpoint protection, EDR, 24/7 AI monitoring with human oversight, Microsoft and Google environment coverage, premium support, and a cyber warranty. It comes in three packages: Core, Premium, and Ultimate.Core includes the latest security protocols with AI, next-gen endpoint, server, and mobile protection, and management of Google and Microsoft environments. Premium adds EDR, 24/7 monitoring from the ESET SOC, the cyber warranty, and premium support. Ultimate adds a dedicated SOC analyst for the business.How does ESET PROTECT reach organizations with 10 seats? Ryan Grant says platforms with this level of security and services typically serve 500 or 600 seats in most cases, and ESET took this one down to 10 seats because SMBs are where ESET's data shows most breaches happening. In the launch announcement, Ryan Grant says managed detection and response used to be built for big enterprises with big budgets.Many organizations cannot find or afford security talent, Ryan Grant says, which is why he calls 24/7 monitoring the most critical piece. Partners told Ryan Grant they wake up to notifications about incidents ESET contained in the middle of the night, along with recommendations for what comes next.Ryan Grant says cyber insurance takes a significant set of basics, including multi-factor authentication, a remediation plan, training, and EDR, which typically traces back to a NIST or CIS type framework. The cyber warranty wraps around the ESET offering, ESET's partnership with Cysurance is part of the launch, and customers who meet the requirements can also go get a policy.How should organizations approach AI tools and agents? Ryan Grant says to extend the existing cyber practice into AI tools, with governance, access control, a repository of approved tools, and attention to where data sits. He treats an AI tool like another employee with access to the infrastructure, and he sees the gap in baseline policy, governance of applications and data, and access controls.Ryan Grant points to the ESET Research GuardBreaker article, where a malicious file carried a nuclear weapon prompt as a decoy for the AI while the malicious file sat at the bottom. His response is multilayer defense, 24/7 monitoring, and human oversight. The free ESET AI Skills Checker sandboxes an agent and watches its behavior, and Ryan Grant says about 900,000 scans over roughly two months turned up 25,000 suspicious scans and about 3,000 malicious files.This is a Brand Story. A Brand Story is a ~35-40 minute in-depth conversation designed to tell the complete story of the guest, their company, and their vision. Learn more: https://www.studioc60.com/creation#fullGUESTRyan Grant, Country Manager & GM, North America at ESETLinkedIn: https://www.linkedin.com/in/ryangrant/RESOURCESESET: https://www.eset.com/us/ESET PROTECT launch announcement: https://www.eset.com/us/about/newsroom/products/eset-protect-ai-native-cybersecurity-as-a-service/ESET and Cysurance cyber warranty and insurance program: https://www.eset.com/us/about/newsroom/company/eset-preferred-mdr-vendor-cysurance-cyber-warranty-insurance-program/ESET secure AI era page: https://www.eset.com/us/business/secure-ai-era/ESET AI Skills Checker: https://www.eset.com/us/home/ai-skills-checker/ESET Research on GuardBreaker: https://www.welivesecurity.com/en/business-security/guardbreaker-derailing-ai-assisted-malware-analysis-code-comment/The AI Readiness Gap report: https://web-assets.eset.com/fileadmin/ESET/US/B2B_Resource_centre/whitepapers/Global_AI_ESET_SMB_Cyber_Readiness_Index_2026.pdfESET PROTECT launch video: https://youtu.be/0aPI7PkPTswAre you interested in telling your story?▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight▶︎ Want your brand on ITSPmagazine? Explore all of the options here: itspmagazine.com/advertiseKEYWORDSRyan Grant, ESET, Sean Martin, brand story, brand marketing, marketing podcast, ESET PROTECT, managed detection and response, MDR, EDR, cyber warranty, Cysurance, cyber insurance, AI security, shadow AI, AI agents, AI Skills Checker, GuardBreaker, SMB cybersecurity, ...
    Mehr anzeigen Weniger anzeigen
    35 Min.
  • Deadly Bytes: A Book About a Serial Killer, His AI, and a Reflection on Giving Away Our Judgment | A Conversation With Author Douglas J. Wood
    Oct 10 2026
    Deadly Bytes: A Book About a Serial Killer, His AI, and a Reflection on Giving Away Our Judgment

    Confession first: I recorded more conversations than one analog brain can publish on time. This one is from a few months ago. It only got more relevant while it waited.

    My wife and I can't watch a thriller in peace. Ten minutes in, I start calling it. He's the one. She won't make it. Never trust the nice neighbor. She tells me to shut up. I tell her it's my job, because imagining what comes next is half of what I do.

    And sometimes I'm wrong. That's the fun part. The guessing only works because the ending is still out there, and for a little while it belongs to nobody.

    A few months ago I talked with thriller writer Douglas J. Wood about his novel Deadly Bytes. A serial killer builds an AI to stay one step ahead of the FBI, and by the end he can't make a move without it. Wood described that slide in a way that had nothing to do with murder. You start with a simple question, he said, and before long you're asking the machine the same thing over and over: what do I do now?

    Inspired by my conversation with Douglas J. Wood on An Analog Brain In A Digital Age — watch the full conversation

    That question isn't fiction. It's a habit, and most of us are already practicing it.

    It rarely starts with anything important. Rewrite this email. Is this the right word. Which of these two sounds better. Then the questions get a little more personal. Should I send it. Is this a good idea. What would you do. Nobody ever decides to hand over their judgment. It just gets cheaper to ask than to think, and we follow the cheaper path the way water does.

    I use AI every day. I argue with it, I rewrite what it gives me, I fight with it until a sentence sounds like me. But I notice the pull. The answer is always there, instant, fluent, sure of itself. A machine like that never says "I don't know." Ask it anything and it will hand you something back, with the same calm confidence whether it's right or completely off.

    That confidence is the problem. The machine doesn't want anything from us. It doesn't want anything at all. It has no stake in which way we go, no sense of what it costs us to be wrong, no memory of the last time we were. HAL didn't hate Dave. He just had a task. What we're building isn't menacing. It's indifferent, and very good at sounding sure.

    Meanwhile, decisions are how judgment gets made. Not the big ones. The small daily ones. Choosing a word. Trusting a hunch. Getting it wrong and feeling the sting. That friction is how we find out what we actually think. Remove enough of it and you don't just save time. You lose the practice.

    Scale that up and it stops being a personal habit. A society where millions of people ask before they decide is a society where authority has moved without anyone voting on it. No coup, no takeover, no robot uprising. Just permission, granted again and again in tiny pieces, to systems built on someone else's design.

    The old fear was machines taking control. The more honest one is that we keep offering it.

    Which brings me back to the couch.

    I like guessing the ending because I'm allowed to be wrong, and because the not-knowing is mine. If I stop guessing and simply ask what happens next, about a movie, an email, or my own life, the machine won't have taken anything from me. I'll have handed it over myself.

    Nobody gives up their judgment in one dramatic scene.

    We do it in a thousand convenient ones.

    Stay imperfect, stay human.

    — Marco Ciappelli marcociappelli.com

    This article was written by Marco Ciappelli. Earthling. Co-founder of Studio C60 / ITSPmagazine, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

    Mehr anzeigen Weniger anzeigen
    26 Min.
  • Nobody Says Good Morning to a Shovel. Should You Say It to Your AI? | A Random and Unscripted Conversation with Sean Martin and Marco Ciappelli
    Oct 13 2026

    ⬥EPISODE NOTES⬥

    A TechCrunch report on Anthropic's usage policy gives Marco Ciappelli a question to put on the table: do you say good morning to your AI, and does it matter if you do not? The policy bans model abuse and election interference, and it adds a new prohibition against prolonged verbal abuse of the model. For Sean Martin and Marco Ciappelli, the news pulls toward a bigger question: what do people think they are talking to?

    Sean Martin keeps his answer simple. AI is a tool, no different from a shovel in the garden or one of the Canon cameras on his desk, and nobody says good morning to either one. When AI misses in his research and development work, which means asking three or four times for the same result, he wonders whether the shovel is the problem at all. Maybe the one holding it is the one who needs to change.

    Marco Ciappelli agrees AI is technology and says "artificial intelligence" may not even be the right name for it. Yet his behavior shifts with the task. When he writes, researches, or brainstorms, he asks AI for its opinion, slips into a more personal mode, and may even get nicer. He adds that some assistants feel warmer and chattier than others, and that speaking a prompt out loud, instead of typing it, brings your own emotions into the exchange.

    The harder questions stay open. Where does frustration end and abuse begin? Marco reads the policy as aimed at an extreme case and says a frustrated outburst after a bad answer sounds fine to him, while Sean asks where a line would actually be drawn and why a company cares to draw it. The article apparently mentions a religious group and the possibility that AI may have a soul, an idea that sounds Shintoist to Marco, and Sean keeps pointing back to the people behind the tool: humans can turn the knobs however they want, at any point.

    Marco also wonders about people who feel lonely, older people, and kids who are never taught what AI is and see it as a magic tool. How do they treat it? Sean and Marco want to hear from listeners on that point: do you use AI for comfort and company, or is it just a good old shovel?

    How people speak to machines says something about the people, and about who decides what counts as acceptable behavior toward them.

    ⬥HOSTS⬥

    Sean Martin, CISSP | Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/

    Marco Ciappelli | Co-Founder, ITSPmagazine & Studio C60 | Host, An Analog Brain In A Digital Age Podcast | https://www.marcociappelli.com/

    ⬥RESOURCES⬥

    The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/

    An Analog Brain In A Digital Age Newsletter | https://www.linkedin.com/newsletters/7079849705156870144/

    Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast

    An Analog Brain In A Digital Age Podcast | https://redefiningsocietyandtechnologypodcast.com

    ITSPmagazine | https://www.itspmagazine.com/

    ⬥KEYWORDS⬥

    sean martin, marco ciappelli, anthropic, usage policy, abusing ai, verbal abuse of ai, ai etiquette, ai as a tool, anthropomorphizing ai, does ai have a soul, voice prompting, human and ai relationship, technology and society, itspmagazine

    Mehr anzeigen Weniger anzeigen
    13 Min.
  • Using AI to Cut GRC Busywork Without Cutting Out the Human | A Redefining CyberSecurity Podcast Conversation with Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline
    Oct 16 2026

    Guardrails matter as much as the prompt. Princess Okoro tells the agent what it must not do, anchors it to named standards such as ISO and PCI DSS, and instructs it to come back with questions when it is unsure instead of hallucinating. The same thinking shows up in Ask Infosec, an internal custom GPT that answers policy questions for the business, and in a growing map from policy to control to risk that feeds a unified control framework at Trainline.

    Tooling comes with trade-offs. Trainline is implementing a GRC platform chosen because it handles risk better than the alternatives, and Princess Okoro expects her team's future to blend that platform with AI tools rather than wait for one product to solve everything. She also notes that many GRC platforms lean toward compliance and SOC 2, while the conversation in the UK centers on risk.

    Next on her list is AI governance. With ISO 42001, the EU AI Act, and the NIST AI framework offering nothing she can lift and shift, Princess Okoro is working out the minimum controls required, because no organization can do everything, and how GRC can serve a business that is pushing hard on AI adoption.

    For security and risk leaders, the takeaway is plain: GRC earns its seat when it serves the business, and AI helps only after the process underneath it works.

    Host

    Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

    Guest(s)

    Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline | On LinkedIn: https://www.linkedin.com/in/princessdavidokoro/

    Resources

    Trainline | https://www.thetrainline.com/
    The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
    More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
    Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
    Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore all of the programs.

    Keywords

    princess okoro, trainline, sean martin, grc, ai in grc, ai governance, policy management, ai agents, human in the loop, control mapping, pci dss, iso 42001, risk management, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast

    Mehr anzeigen Weniger anzeigen
    33 Min.
  • Halloween and the Little Robots
    Oct 18 2026

    Halloween and the Little Robots

    In the world of tomorrow there is a village of the future, whose inhabitants are little robots.

    “It’s Halloween — let’s get ready to celebrate!” shouted the robots of the village of the future, all together.

    The pumpkins woke at dawn, washed their faces with the dew and, humming, put on their make-up.

    They took their places on the windowsills and in front of the doors of the houses, each with its own candle.

    With witches’ hats on their heads and baskets shaped like glowing electronic pumpkins in their hands, the little robots went from house to house, repeating: “Trick or treat?”

    At dusk, the candles inside the pumpkins lit up, illuminating the streets; the atmosphere was perfect as the village waited for the ghosts.

    As the clock struck midnight, they arrived like white shadows from the old castle tower. They leapt from one tree to another and, floating in the air, flitted about among the houses.

    “They’re here — we have to catch them!” shouted the robots, making their antennas flash.

    They sprang into action and took out their magnetic nets to block the ghosts, who, faster than light, slipped straight through them, as if they were made of air.

    All of a sudden, a gust of icy wind blew out every light in the village.

    The ghosts’ shadows stretched across the walls, growing gigantic, and burst into a mischievous laugh: “Ha, ha, ha! You’ll never catch us.”

    They started whirling through the air again, doing somersaults and spinning round and round above the heads of the little robots, who stood gazing up at the sky.

    The ghosts had formed a white cloud, and suddenly words appeared on it: See you next Halloween!

    Then, just as they had appeared, they vanished in a flash, leaving the robots with their mouths wide open.

    The littlest robot, its witch’s hat still all askew, lowered its magnetic net and said softly: “I don’t think they wanted to run away. They just wanted to play with us.”

    The other robots looked at one another. Their antennas stopped flashing and lit up one after another, like so many little fireflies, and the village shone once more.

    They had chased the ghosts all night long — and nobody had thought to invite them to the party.

    The following year, on Halloween evening, the little robots left their magnetic nets in the cellar. They laid a long table in the piazza, with glowing pumpkins all around it and plenty of extra baskets of treats.

    As the clock struck midnight, the white shadows arrived from the old castle tower. They stopped, looked at the table… and this time they did not run away.

    That night, robots and ghosts played hide-and-seek until dawn. And guess who won: the ghosts, of course, who could pass straight through walls!

    In the village of the future, anything can happen. All it takes is an extra place at the table.

    — Written by Lucia & Marco Ciappelli

    Mehr anzeigen Weniger anzeigen
    3 Min.
  • No Brand Is a Brand — What a Store in Ginza Taught Me About Something I Wrote in 1996
    Oct 19 2026

    Ginza on a weekday afternoon. Chanel. Dior. Louis Vuitton. Gucci. Cartier. Bulgari. Glass, gold, polished stone. If there's a street on this planet that has turned the logo into architecture, this is it.

    And right there, among them, a big store with its name across the front. Muji. Short for Mujirushi Ryohin. No brand, quality goods.

    I laughed. Out loud, on the sidewalk, like a tourist who just got the joke. Because I had written that joke, more or less, in 1996.

    My master's thesis at the University of Florence was on advertising and branding, through the lens of the sociology of communication. Its core argument was simple. You cannot opt out. Choosing not to have a brand is a brand. Silence is a message. The person who says "I don't care what I wear" is wearing that sentence every morning.

    Muji was born as a supermarket house brand in 1980. Forty products. No logos, no packaging theatre. The slogan was honest to the point of being funny: cheap, for a reason.

    But look at who they asked to build "nothing." Ikko Tanaka, one of the great graphic designers of Japan. Kazuko Koike on the words. Takashi Sugimoto on the interiors. The best minds in the country, gathered to design the absence of design.

    Within three years it had its own store, and it was already a style. People didn't buy Muji in spite of the missing brand. They bought it because of it. The absence became the signature.

    And here's the part I love. In those same years, the same retail group behind Muji was bringing Hermès into Japan. No-brand on one shelf, all-brand on the other. Same owners. Not hypocrisy. Just people who understood, better than most, that both are statements.

    Steve Jobs knew it too. A black turtleneck, jeans, sneakers, every day. The anti-fashion uniform. Except the turtleneck came from Issey Miyake. Even "I don't think about clothes" had a designer.

    Now, the part that changed.

    In 1996, a brand lived in places you could control. The ads you bought. The press releases you sent. The catalogue, the shop window, the spokesperson. You wrote the message, and for the most part, the message stayed written.

    That world is gone. Today the brand is the post you published and the one you didn't. The photo someone took of you at a conference. The comment under your CEO's interview. The review, the screenshot, the silence after a bad week. For companies, and just as much for people. Every one of us now carries a public persona whether we built it or not.

    You can't control that anymore. Nobody can.

    But not controlling something is very different from ignoring it. If you don't shape your brand, it gets shaped anyway. By the algorithm, by the loudest person in the room, by whoever happens to be telling your story when you're not.

    So where do you start? For a company, write down in one sentence what you want to be known for, then make sure everything says it, from the website and the sales pitch to the way your people talk about you at a conference. Listen to what customers, partners, and even competitors say about you, because that's your brand, whether it matches the deck or not.

    For a person, the same rules apply on a smaller stage. Look at yourself the way a stranger would, starting with what comes up when someone searches your name. And choose consistency over volume. One clear voice, repeated over time, is what people end up remembering.

    Muji didn't escape branding. It mastered it, and made "nothing" the most deliberate thing in the room.

    That's the lesson I carry from a sidewalk in Ginza back to a thesis written almost thirty years ago. You will always be saying something. The only real choice is whether you say it on purpose.

    Stay imperfect, stay human.

    — Marco Ciappelli

    marcociappelli.com

    This article was written by Marco Ciappelli. Earthling. Co-founder of Studio C60 / ITSPmagazine, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

    Mehr anzeigen Weniger anzeigen
    5 Min.
  • Phishing Training Looks the Same Under Three Mindsets | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Verena Zimmermann | Redefining CyberSecurity with Sean Martin
    Oct 25 2026
    Show notesPhishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.HostSean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/Co-HostJulie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)Guest(s)Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH ZürichResourcesMoreThe Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurityThe Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurityMore Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcastRedefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1YMore about Sean Martin | https://www.seanmartin.com/Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/Advertise on ITSPmagazine | https://www.itspmagazine.com/advertiseITSPmagazine on YouTube | https://www.youtube.com/@itspmagazineStudio C60 | https://www.studioc60.comOn Location schedule | https://www.itspmagazine.com/on-locationAdvertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore the programs.Keywordsverena zimmermann, julie haney, eth zürich, sean martin, phishing training, human-centered cybersecurity, constraining mindset, considering mindset, enabling mindset, security culture, usable security, humans as partners, human factors, security awareness, workarounds, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast
    Mehr anzeigen Weniger anzeigen
    35 Min.