Unlock access to Thinkers360 AI to fast-track your search for analysts and influencers.
This feature is available for Enterprise Lite and Enterprise Members Only.
You have been temporarily restricted. Please be more thoughtful when adding content for your portfolio. Your portfolio and digital media kit and should be reflective of the professional image you wish to convey. Accounts may be temporarily restricted if we receive reports of spamming or if the system detects excessive entries.
Membership
Publish your original ideas on the Thinkers360 platform!
This feature is available for Pro and Pro-Plus Members Only.
Speaker Bureau functionality whereby individuals can be featured speakers within our Speaker Bureau service and enterprises can find and work with speakers.
This feature is available for Pro, Pro-Plus, Premium and Enterprise Members Only.
Highlight your featured products and services within our company directory for enhanced visibility to active B2B buyers worldwide. This feature is available for Pro, Pro Plus, Premium and Enterprise Members Only.
Contribute to the Thinkers360 Member Blog and have your thought leadership featured on our web site, newsletter and social channels. Reach our opt-in B2B thought leader community and influencer marketplace with over 100M followers on social media combined!
You’ve reached your daily limit for entering quotes. Please only add personally-authored content which is reflective of your digital media kit and thought leadership portfolio.
Thinkers360 Content Library
For full access to the Thinkers360 content library, please join our Content Plan or become a contributor by posting your own personally-authored content into the system via Add Publication or Import Publication.
Dashboard
Unlock your personalized dashboard including metrics for your member blogs and press releases as well as all the features and benefits of our member plans!
Interested in getting your own thought leader profile? Get Started Today.
Kayne McGladrey
Field CISO at Hyperproof
Bellingham, United States
I’m Kayne McGladrey, keynote speaker CISSP, the Field CISO for Hyperproof, senior IEEE member, and author of the GRC Maturity Model. With nearly three decades of experience in cybersecurity, I specialize in helping organizations navigate the intersection of governance, risk, and compliance (GRC) to build more secure and resilient businesses.
My work focuses on enabling CISOs, internal audit teams, and executives to align cybersecurity and business goals, communicate effectively with boards, and proactively address evolving global regulations. As a recognized thought leader, I’ve been spoken at events like Gartner IT Security & Risk, RSA, ISACA GRC, and the ISC2 Congress. My presentations are nuanced, accessible, and actionable, offering attendees practical guidance on current cybersecurity challenges and opportunities.
Throughout my career, I’ve advised Fortune 500 and Global 1000 companies, leveraging my ability to bridge the gap between business and technology. I’m passionate about reducing organizational friction, improving GRC maturity, and inspiring underrepresented communities to pursue cybersecurity careers.
Available For: Influencing, Speaking Travels From: Bellingham, WA
Speaking Topics: Cybersecurity, Compliance, Risk
· Working to increase the diversity of perspectives on enterprise cyber security challenges and opportunities.
· Dynamically responding to and anticipating the needs of the cyber security marketplace through unique and timely content.
· Serving as an “early explainer” to articulate “why” the subject matter is important to current practitioners and the next generation of cyber professionals.
An Analysis of Section 1C Disclosures in Q1 of 2024
Hyperproof
June 14, 2024
Late in 2023, the Securities and Exchange Commission (SEC) in the United States published Regulation S-K Item 106, which requires public companies to describe their processes for assessing, identifying, and managing material risks from cybersecurity threats. Historically, companies were not required to disclose these processes to investors or market regulators, and there were no established guidelines for what a “good” disclosure would look like. Hyperproof reviewed disclosures from nearly 3,000 companies across over three hundred industries and have identified trends for what goes into a robust, meaningful disclosure.
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Hyperproof
February 22, 2024
"Each year, our benchmark report provides invaluable insights into the evolving priorities and challenges facing IT and GRC professionals," said Kayne McGladrey, Field CISO at Hyperproof. "This year's findings underscore the growing need for organizations to streamline their GRC processes and adopt integrated solutions to effectively navigate the complex risk and compliance landscape."
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Dark Reading
April 13, 2023
A recent survey showed a surprising correlation between those who operate their businesses with risk and compliance data in silos and those who experienced data breaches in the last 24 months.
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
CSHub
March 29, 2021
Read this report on:
- Identifying accountability for cloud security across the enterprise
- Conceiving of a cloud security strategy to ensure that the business consults and informs the cyber security operation
- Gaining true visibility of the entire organization from on-prem to the cloud
- Adopting common language along with a newly assumed forward posture to find the edge of business innovation and enable it
North Dakota's New Financial Data Breach Rules
LinkedIn
May 23, 2025
North Dakota just raised the stakes for nonbank financial firms with new cybersecurity regulations. Starting August 2025, HB 1127 will require:
• Comprehensive security programs with encryption and multifactor authentication
• Qualified individuals overseeing implementation
• Notification to authorities within 45 days for breaches affecting 500+ consumers
While mirroring federal GLBA standards creates consistency, smaller institutions may struggle with resource constraints and tight implementation timelines.
The expanded scope brings alternative financing arrangements under broker licensing requirements too - a significant change for fintech providers operating in North Dakota.
Smart organizations will view these requirements not merely as compliance hurdles but as opportunities to strengthen security posture and build consumer trust in an increasingly regulated environment.
Work Product Protection in Data Breach Cases
LinkedIn
May 20, 2025
A recent court decision has created new challenges for organizations handling data breach investigations. In Morrill v. Lakeview Loan Servicing, the court ordered production of cybersecurity reports that were previously considered protected work product. Why? The company provided these same reports to regulators.
Maintaining legal protection while meeting regulatory requirements demands a strategic approach:
• Create separate investigation tracks - one for regulatory compliance, another for litigation preparation
• Develop distinct documentation for each purpose
• Have legal counsel directly engage forensic firms for the litigation track
This dual-track approach requires careful planning but offers protection that single-report strategies cannot. Courts are increasingly scrutinizing how breach investigations are structured and documented.
CCPA Compliance: Your Vendors, Your Responsibility
LinkedIn
May 19, 2025
The recent $345K CPPA fine against Todd Snyder reveals a harsh truth: businesses can't outsource responsibility for privacy compliance. For 40 days, Todd Snyder's consumer rights portal failed to process opt-out requests. Their defense? Blaming third-party compliance tools. The CPPA rejected this argument completely.
What this means for your business:
• Regularly test your privacy tools in real-world conditions
• Avoid excessive verification requirements for opt-out requests
• Maintain documentation of testing and monitoring
Gone are the days when regulators only reviewed written policies. Now they actively test your site functionality, submit rights requests, and track responses.
Smart organizations are shifting from compliance as a one-time project to ongoing technical validation.
Cybersecurity Pros: Krebs Case Raises Business Risk
LinkedIn
April 29, 2025
Top security experts warn Trump's targeting of Chris Krebs creates business risks, threatens government talent recruitment, and endangers election security.
AI Arbitration Case Tests Minors' Contract Rights
LinkedIn
April 28, 2025
Character Technologies case tests enforceability of arbitration clauses for minors using AI platforms. Court reserves key legal questions during arbitration.
CCPA Private Right of Action Expands to Cookies
LinkedIn
April 24, 2025
Court decisions expand CCPA liability beyond data breaches to include tracking cookies. Learn how to update your compliance strategy and minimize risk.
EU AI Act: New Model Clauses for Compliance
LinkedIn
April 23, 2025
New Model Contractual Clauses offer standardized templates for AI procurement, helping businesses meet EU AI Act compliance based on system risk levels.
Audit Committee Guide to GenAI Cybersecurity Risks
LinkedIn
April 18, 2025
Discover key oversight questions and practical strategies for audit committees navigating cybersecurity risks in the age of generative AI and geopolitical tension.
Musk's X Faces Record Fine Under Digital Services Act
LinkedIn
April 14, 2025
EU prepares historic penalties against X for DSA violations. The $1B+ fine and product changes could reshape tech regulation globally and test platform accountability.
CPPA to Narrow AI Decision-Making Regulations
LinkedIn
April 11, 2025
California's privacy agency is narrowing the scope of AI regulations after business backlash. Changes may reduce compliance costs while maintaining key protections.
AI Governance: The Key to Cybersecurity Compliance
LinkedIn
April 10, 2025
Discover how to implement AI governance frameworks that protect business value, ensure compliance, and transform security operations without restricting innovation.
FedRAMP 20x: Faster Federal Cloud Authorization
LinkedIn
April 07, 2025
FedRAMP 20x transforms federal cloud authorization from years to weeks, using automation to remove barriers for providers and accelerate agency adoption.
CPPA Revises ADMT and Cybersecurity Requirements
LinkedIn
April 02, 2025
Learn about CPPA's revised CCPA regulations on automated decision-making and cybersecurity audits, with extended timelines for California businesses to comply.
CLOs Emerge as Key Cybersecurity Leaders in 2025
LinkedIn
March 31, 2025
New ACC report shows 38% of CLOs now lead cybersecurity programs, up from 15% in 2020. Legal departments expand expertise as data breaches remain top concern.
Geolocation Data Privacy: Legal Risks & Compliance
LinkedIn
March 26, 2025
California is getting serious about location data privacy. Attorney General Bonta's enforcement sweep targets businesses collecting geolocation data without proper consumer consent.
What businesses need to know:
• Location data is classified as "sensitive personal information" under CCPA
• Recent Honda settlement reached $632,500 for privacy violations
• Regulators link location privacy to protection of vulnerable communities
Weekly news context for April 18th, 2025
LinkedIn
April 18, 2025
Get the latest on AI washing fraud, NIST's new incident response framework, and GenAI cybersecurity risks for audit committees. Stay informed on key industry developments.
Weekly Cybersecurity News: Regulatory Updates
LinkedIn
April 11, 2025
Updates on HIPAA audits, SEC rules, and privacy regulations that impact your security compliance. Stay ahead of regulatory changes to protect your business.
Weekly News Context: April 4 Key Updates
LinkedIn
April 04, 2025
HIPAA violations, NYDFS deadlines, and false security claims lead to millions in penalties. Get the latest cybersecurity news to protect your organization.
Weekly news context for March 14th, 2025
LinkedIn
March 14, 2025
Regulators are expanding their focus beyond data breaches to include AI systems and algorithmic accountability.
State AGs now investigate how AI decisions affect consumers, with special attention to bias and discrimination. Companies must implement technical safeguards, conduct bias testing, and document AI decision-making processes.
The stakes are high:
• Character.ai faces a landmark wrongful death lawsuit that could redefine AI company responsibilities
• Two Sigma paid $90 million in penalties after algorithmic manipulation created a $565 million performance gap between client accounts
The regulatory landscape for AI and algorithms continues to develop across multiple states, creating complex compliance requirements for organizations.
Weekly news context for March 7th, 2025
LinkedIn
March 07, 2025
The FTC has dropped its investigation into MGM Resorts’ cybersecurity practices, closing a case that raised concerns about regulatory authority and enforcement consistency. MGM had challenged the FTC’s jurisdiction and cited potential bias, highlighting the complexities of oversight in cybersecurity cases.
The California Privacy Protection Agency (CPPA) is taking a stronger stance on data broker compliance. A $3 billion-record breach at National Public Data led to fines, lawsuits, and bankruptcy after the company failed to register under the Delete Act. The case signals stricter enforcement of privacy laws and increased scrutiny of data handling practices.
In the EU, new standards under DORA now define which financial entities must undergo threat-led penetration testing. These regulations align with the TIBER-EU framework, ensuring that organizations with significant market impact strengthen their cyber resilience.
EU Halts AI Liability Directive, SEC Expands Cyber Focus
LinkedIn
February 28, 2025
The EU has halted its AI Liability Directive, leaving AI developers uncertain about future compliance obligations. Without this directive, liability for AI-related harm remains fragmented across jurisdictions. Companies must now navigate a mix of regional regulations while the EU explores alternative approaches.
A lawsuit under Washington’s My Health My Data Act challenges Amazon’s alleged collection of sensitive consumer data through an ad SDK. The case questions whether inferred health data falls under privacy protections, potentially reshaping compliance strategies for mobile applications.
The SEC has expanded its focus on cybersecurity risks in financial markets. Now rebranded as the Cyber and Emerging Technologies Unit, it will target fraud related to blockchain, social media, and the dark web. Companies handling digital assets face stricter enforcement.
Weekly news context for February 21st, 2025
Linkedln
February 22, 2025
Key quote: "The summit’s final declaration emphasized the importance of AI benefiting future work and sustainable growth, reflecting a strong commitment to ethical standards. However, the United States and the United Kingdom chose not to sign the document, highlighting differing international perspectives on AI regulation. "
AI Regulation Divide, EU DORA Deadline, & CMMC Updates
LinkedIn
February 21, 2025
AI regulation is splitting along regional lines. The EU is pushing for strict oversight, while the U.S. is taking a different approach. At the AI Global Summit in Paris, European leaders emphasized ethical standards and future growth. The U.S. and U.K. did not sign the final declaration, reflecting policy differences. Meanwhile, states like California and Texas are shaping their own AI rules.
Compliance deadlines are approaching. By April 30, financial entities operating in the EU must meet more Digital Operational Resilience Act (DORA) requirements. Organizations must register ICT service data and engage with regulators to avoid penalties.
The Department of Defense released new Cybersecurity Maturity Model Certification (CMMC) guidance. Contractors now face stricter assessments, complex waiver rules, and shifting compliance expectations.
Weekly news context for February 15th, 2025
LinkedIn
February 14, 2025
The European Commission clarified key aspects of the Digital Operational Resilience Act (DORA), expanding the definition of ICT services and financial entities’ responsibilities. With no transitional period, immediate action is necessary. Organizations should reassess contracts, refine risk management, and strengthen incident response plans.
SEC cybersecurity incident filings from 2024 revealed that only 14% of reported events were deemed material. The average filing time exceeded the four-day requirement, highlighting the complexities of disclosure. As global regulations tighten, aligning reporting strategies with evolving requirements is essential.
Audit committees are prioritizing cybersecurity, with half ranking it as a top business risk. Stronger collaboration between CISOs and committees can improve oversight, response strategies, and compliance.
Weekly news context for February 7th, 2025
LinkedIn
February 07, 2025
Boards are increasing investments in AI while balancing cybersecurity and compliance risks. Directors see AI as a driver of growth, yet concerns about cyber threats and slow implementation remain. According to BDO, 41% plan to increase cybersecurity budgets, recognizing that risks extend beyond IT.
CISOs face growing challenges as AI reshapes industries. The International AI Safety Report emphasizes a layered security approach, ensuring compliance and mitigating risks like biased decision-making and privacy concerns.
The JCDC AI Cybersecurity Collaboration Playbook encourages voluntary sharing of AI-related incidents and vulnerabilities. A structured approach to information sharing helps organizations strengthen security and improve resilience against emerging threats.
Weekly news context for January 30th
LinkedIn
January 31, 2025
The past week brought important updates for compliance and security leaders:
- HIPAA enforcement: The Office for Civil Rights penalized two companies for inadequate risk assessments. Both suffered ransomware incidents that exposed ePHI vulnerabilities. Vendor CISOs must prioritize comprehensive risk analysis to maintain compliance.
- AI liability in court: Character.AI seeks to dismiss a lawsuit alleging its AI contributed to a user’s death. The defense argues that AI-generated speech falls under First Amendment protection. This case raises questions about AI safety and accountability.
- UK FCA compliance: With the 2025 operational resilience deadline approaching, firms must map critical services, set impact tolerances, and test scenarios. Managing third-party risks will be key to meeting expectations.
Security and compliance controls remain central to regulatory expectations.
#cybersecurity #risk #compliance #AI #law
Weekly news context for January 24th, 2024
LinkedIn
January 24, 2025
Stay updated on key compliance and cybersecurity topics this week:
- SEC Enforcement Actions: Recent penalties highlight the importance of aligning with disclosure requirements under the 2023 SEC Cybersecurity Rule. Companies have faced substantial fines for non-compliance.
- CPPA Data Broker Deadlines: Organizations must register by January 31. This includes submitting required documents, maintaining detailed records, and ensuring privacy policies are updated to avoid penalties.
- EU AI Act Compliance: February 2 brings new requirements, including AI literacy for staff and prohibitions on specific practices. Compliance demands training, audits, and robust controls to meet legal and ethical standards.
Weekly news context for January 17th, 2025
LinkedIn
January 17, 2025
Cybersecurity challenges this week highlight key areas for CISOs to focus on:
* Resilience strategies: The Global Cybersecurity Outlook 2025 underscores the need for risk-based approaches. Smaller organizations are vulnerable, with 35% reporting inadequate resilience. Understanding threats and their potential impacts is central to effective planning.
* AI governance: Oregon, Texas, and Massachusetts stress ethical AI use, targeting bias and enhancing transparency. This regulatory focus requires organizations to conduct risk assessments and establish data policies to ensure compliance.
* Compliance deadlines: With the DORA deadline now in effect, ICT risk management and incident reporting controls must align with strict requirements. Incident reports are due within hours, ensuring operational resilience.
Geopolitical tensions, AI vulnerabilities, and compliance frameworks remain significant themes as organizations address emerging risks.
#cybersecurity #risk #DORA #AI
Weekly news context for January 10th, 2025
LinkedIn
January 10, 2025
Key updates in cybersecurity this week:
* HIPAA rule changes: New proposals aim to enhance safeguards for electronic health data, including multi-factor authentication. The changes address audit gaps highlighted by the OIG. CISOs have 60 days to provide feedback on these updates, which could involve significant costs over five years.
* FCC and net neutrality: The Sixth Circuit court's ruling challenges the FCC's authority to enforce net neutrality. This decision, rooted in legal definitions, creates new regulatory challenges for organizations. Flexible compliance strategies are essential.
* Incident response planning: Preserving attorney-client privilege during cybersecurity incidents requires careful coordination with legal counsel. A “two-track” approach can separate business operations from litigation-focused investigations, protecting sensitive information. Regular updates and training are critical for readiness.
Companies with mature GRC programs have an advantage over their competitors. However, something has been missing in the GRC world: the ability to truly understand an organization’s GRC maturity and the steps it would take to build the business case for change. That’s where the GRC Maturity Model comes in.
Hyperproof’s GRC Maturity model is a practical roadmap for organizations to improve their GRC maturity business processes to enter new markets and successfully navigate our rapidly changing regulatory and legal space. By providing a vendor-agnostic roadmap for how companies can improve key business operations, we can help even the playing field for everyone in GRC.
This extensive, peer-reviewed model written by Kayne McGladrey includes:
An overview and definition of Governance, Risk, and Compliance (GRC)
A summary of the four maturity levels defined in the model: Traditional, Initial, Advanced, and Optimal
An overview of the most common business practices associated with governance, risk, and compliance
A simplified maturity chart listing the attributes associated with each maturity level
A list of observable behaviors or characteristics associated with the maturity level to help you assess where your organization falls
A set of high-level recommendations for how to move from a lower level to a higher level
What’s new in cybersecurity for physical security systems?
Source Security
June 01, 2023
The article explores the growing cyber resilience in the physical security industry, highlighting increased customer demands for compliance testing, the burgeoning use of cyber-safe cloud services, and the global adoption of the zero trust framework. It underscores the role of robust cybersecurity controls and the impact of IoT technologies in transforming physical security systems' connectivity and security posture.
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Security Informed
June 01, 2023
Discover how manufacturers in the physical security industry are embracing enhanced cybersecurity measures and implementing them at scale. From streamlining maintenance and updates to integrating cloud solutions, these efforts aim to protect against evolving threats and human error. The article highlights the importance of compliance, secure communication, and training employees on best practices. Explore insights on zero trust principles, secure APIs, and evolving certifications, all contributing to the continuous improvement of cybersecurity in physical security systems.
Cyber Threat Prevention for PSOs: Credential Stuffing (Part 1 of 8)
PSVillage
May 17, 2017
Credential Stuffing, unfortunately, is not a new attack rather an existing attack that the bad guys have found a way to operate at economies of scale. Credential stuffing is a type of automated...
Cyber Threat Prevention for PSOs: Provisioning and De-provisioning (Part 2 of 8)
PSVillage
May 17, 2017
In this second episode of our 8 part series, Kayne McGladrey will be discussing Provisioning and De-Provisioning. In general, provisioning means "providing" or making a resource available. De-...
Cyber Threat Prevention for PSOs: Identity and Access Management (Part 3 of 8)
PSVillage
May 17, 2017
In this third episode of our 8 part series, Kayne McGladrey will walk you through three primary Identity and Access Management (IAM) systems available for your end users to have access to your...
Cyber Threat Prevention for PSOs: Privileged Access Management (Part 4 of 8)
PSVillage
May 17, 2017
In this fourth episode of our 8 part series, Kayne McGladrey will cover Identity Access Management system and a specific resource when it comes to where your client files are stored, or your...
Cyber Threat Prevention for PSOs: User and Entity Behavior Analysis (Part 5 of 8)
PSVillage
May 17, 2017
When a hacker has intercepted your credentials and login information and attempts to use that information, an effective User and Entity Behavior Analysis (UEBA) solution can be what saves you from...
Cyber Threat Prevention for PSOs: Multi-Factor Authentication (Part 6 of 8)
PSVillage
May 17, 2017
In this sixth episode of our 8 part series, Kayne McGladrey reviews Multi-Factor Authentication (MFA). MFA can be used in many instances to ensure the identity of a person trying to access or...
Cyber Threat Prevention for PSOs: Attestation Reporting (Part 7 of 8)
PSVillage
May 17, 2017
Kayne McGladrey discusses Attestation Reporting in the seventh video in this series. The goal of Attestation Reporting is to ensure that a user should have the access that has been requested and...
Cyber Threat Prevention for PSOs: Certification Campaigns (Part 8 of 8)
PSVillage
May 17, 2017
In this last video in the series of 8, We will see how the process of certification in consulting works. IGA, a governance administration tool, will produce certification reports and should work...
The proverbial endpoint is everywhere. Consumers have more IoT and mobile devices than ever before. Industrial IoT is becoming ubiquitous and IoT malware is as common as cell phones. While conveniences are making their way into every facet of life, so are malicious software, social engineering attack and all manner of bad actors.
Include Cybersecurity
Include Cybersecurity
January 05, 2018
Include Cybersecurity is a non-profit organization dedicated to changing the face of cybersecurity professionals. As a co-founder alongside Carmen Marsh, I am responsible for helping to find volunteers and speakers, moderating panel discussions, social media outreach, fundraising, and establishing connections with the many underrepresented communities in cybersecurity.
Senior member is the highest grade for which IEEE members can apply. IEEE members can self-nominate, or be nominated, for Senior Member grade.
To be eligible for application or nomination, candidates must:
* Be engineers, scientists, educators, technical executives, or originators in IEEE-designated fields
* Have experience reflecting professional maturity
* Have been in professional practice for at least ten years (with some credit for certain degrees)
* Show significant performance over a period of at least five of their years in professional practice
Top 50 IoT Influencers to follow in 2023
Engatica
November 08, 2022
Can IoT reach a level where businesses can build scalable solutions for the future? Will it help us have a better 2030? Well, the experts should know. And they should have a better idea of it.
Cloud Thought Leader of the Day ️
WhizLabs
July 09, 2021
Having 28+ years of experience in the field, Kayne McGladrey's role is to advise companies on how to uphold that social contract by managing risks and deterring and denying threat actors.
His consultative approach is the result of decades of experience working with Fortune 500 and Global 1000 companies. One of his career priorities is to inspire underrepresented communities to pursue careers in cybersecurity.
His simplification of complex concepts to non-tech audiences has given him more reach on his social platforms. His blogs are a must-read for both tech and non-tech people who are interested in cybersecurity.
Check out his blogs here: https://lnkd.in/efHU2Mp
Currently, he is working as Security Architect / Strategy and GRC Practice Lead at Ascent Solutions LLC, a premier productivity, security, and innovation consulting firm.
We thank Kayne for his exceptional contribution to the cloud discipline.
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
WhizLabs
April 19, 2021
Having 28+ years of experience in the field, Kayne’s expert approach on how to uphold that social contract by managing risks and deterring and denying threat actors is appreciated by many companies. One of his priorities is to inspire under-represented communities to pursue careers in cybersecurity. His simplification of complex concepts to non-tech audiences has given him more reach on his social platform. His blogs are must read for both technical and non-technical people who are interested in cybersecurity.
Top Cyber Pro Awards for 2020
Top Cyber Pro
December 01, 2020
Kayne McGladrey is a senior member of the IEEE and the cybersecurity strategist for Ascent Solutions. He has over two decades of experience in cybersecurity and has served as a CISO and advisory board member, and focuses on the policy, social, and economic effects of cybersecurity lapses to individuals, communities, and the nation.
How to Enhance Cloud Security Measures
Cyngular
May 14, 2024
In a post written by Kayne about what happens when agencies rely upon existing frameworks or rules that weren't originally designed for regulatory purposes, he states that there is the potential for complications: "Standards may evolve, leading to ambiguous regulations," he wrote, and, "In some cases, these standards could be outdated or not applicable to the current context."
Getting AI Right: 3 Challenges for the Future
IEEE Transmitter
October 25, 2023
AI systems need to be trained using data. But data sets are frequently made by people who can be biased or inaccurate. As a result, AI systems can perpetuate biases. This is especially true in hiring practices and in criminal justice, and managing those biases can be difficult.
“We can audit software code, manually or automatically, for privacy defects,” said IEEE Senior Member Kayne McGladrey. “Similarly, we can audit software code for security defects. We cannot currently audit software code for ethical defects or bias, and much of the coming regulation is going to screen the outcomes of AI models for discriminatory outcomes.”
Cybersecurity Concerns Continue
IEEE Transmitter
October 25, 2023
Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier 1 security operation center (SOC) analysts and incident responders. Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.
What is End-To-End Encryption? 7 Questions Answered
IEEE Transmitter
August 17, 2023
“End-to-end encryption is generally agreed upon as being a useful technology for protecting the data of businesses and consumers,” said IEEE Senior Member Kayne McGladrey. “Online shopping, for example, would not be as popular or feasible if a consumer’s payment information could easily be intercepted. Similarly, private video calls over the internet by senior executives or government officials would be far too risky if anyone could watch.”
Telehealth is Booming: Here’s What You Need to Know
IEEE Transmitter
October 26, 2020
Telehealth, often referred to as virtual doctor appointments, has been utilized in remote regions that do not have local medical resources for several decades. But when COVID-19 began impacting many countries across the globe, telehealth became the go-to method for checking in with your doctor about possible COVID-19 symptoms or other healthcare check-ups.
How to Keep Your Video Conferences Secure From Intruders
IEEE Transmitter
April 16, 2020
As the world adjusts to a “new normal” of remote education and work, video conferencing services have surged in demand as people take to these platforms to connect digitally. Yet, these platforms are susceptible to a variety of intrusions that could lead to the theft of private and company data or inappropriately distracting calls and meetings that leave participants feeling they have no control.
To protect your students, employees, families and yourself from these types of cyber disruptions, we asked IEEE Member Kayne McGladrey for cybersecurity tips for safe video conferencing.
Decreasing Risk Through Enterprise Compliance
CSHub
March 02, 2020
Compliance is often viewed as a reaction for organizations. The auditing of compliance becomes the event that is anticipated with resources and preparation aligned to culminate in the audit itself. A famous approach used in product development is that launch is a process, not an event. The spirit of that message is important for security leaders to consider in building a sustainable business case for compliance. Compliance should be viewed as a continuous, organizational process.
Should You Be Worried About Airport Cybersecurity Threats?
IEEE Transmitter
February 13, 2020
Navigating and traveling through an airport can be stressful. Trying to get through security while searching for a boarding pass and assessing whether there’s enough time to jump on that long line for a desperately needed cup of coffee is a universal experience.
With all of that juggling going on, the last thing on your mind are the cybersecurity threats that you might encounter at the airport along the way. Luckily, cybersecurity experts have already put into place a variety of technologies to protect us and keep our cyber lives safe while we travel. So take a deep breath and focus on getting to your seat in a timely manner instead.
Passwords, Multi-Factor Authentication and Cybersecurity
IEEE Transmitter
April 16, 2018
Device location and user behavior can shed a lot more light on a login attempt, yet not all MFA solutions currently incorporate them, says McGladrey. If organizations switched to better access management systems, the cost to successfully infiltrate accounts would rise exponentially, barring “all but the best-funded nation-state actors and APTs.”
Why AI Could be Cybersecurity’s Next Big Thing
IEEE Transmitter
February 16, 2018
For many organizations, analysts in security operations centers spend their days sifting through hoards of log files for suspicious activity. The repetitive nature of this work makes AI an ideal replacement, says Kayne McGladrey, IEEE Member, Director of Information Security Services at Integral Partners (US): “Artificial intelligence has been shown to be good at pattern recognition and correlation over a vast number of data points, and can make connections faster than human analysts would.”
Smart Office Controls
IEEE Transmitter
April 20, 2017
Forget light switches and thermostat buttons in the office. IoT sensors can control when lights go on and off, as well as heating and cooling in the office. Lights can go on and off based on your location.
IOT and Big Data: A Day in a Connected Life
IEEE Transmitter
April 05, 2017
How could your data be used?
“Office workers often find that all the meeting rooms are booked, which can mean consulting teams that arrive to meet with a client must search for an unoccupied meeting room in which to squat. Regardless of reservation status, IoT sensors can impassively detect if meeting rooms are unoccupied and offer them on a first-come, first-served basis.”
What are the security and privacy concerns with this device?
“Insecure IoT heating, ventilation and air conditioning systems are a threat to buildings and cities. For example, in the summer, a hard-coded administrative password in an IoT thermostat deployed in smart buildings in New York City could be compromised by an adversary who forces the thermostats to continuously run cooling systems. The spike in electrical usage could cause a very costly, life-threatening blackout.”
Understanding Cybersecurity Breaches at Consulting Firms
IEEE Transmitter
March 30, 2017
Cybersecurity threats are affecting consulting and professional service firms causing substantial losses. Kayne McGladrey (@kaynemcgladrey), an IEEE Member and professional services director, weighed in on how consulting firms can mitigate threats, keep client data safe and learn from current breaches.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
ISC2 Southern Connecticut Chapter
May 29, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society Santa Clara Chapter
May 28, 2025
Abstract
Cyber risks are not just technical issues but fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks meaningfully.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
GRC Maturity Model: A Roadmap for Cybersecurity Leaders
Hampton Roads Chapter of ISSA
May 06, 2025
This presentation delivers three essential insights for cybersecurity professionals: a comprehensive understanding of how the GRC Maturity Model's four levels influence compliance strategies, risk management approaches, and business operations; practical methodologies for evaluating organizational maturity and overcoming implementation challenges; and proven techniques for embedding compliance within strategic planning, implementing automation solutions, and cultivating a culture that proactively addresses compliance requirements. Attendees will gain actionable knowledge to advance their organization's compliance maturity framework, directly contributing to reduced risk exposure and enhanced operational efficiency across the enterprise.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society Central Indiana Chapter
April 14, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with
profound financial and reputational implications. This keynote addresses the intersection of
cybersecurity and business strategy, offering practical insights to help executives and business
leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks,
communicate them effectively to stakeholders, and integrate them into broader organizational
strategies. Real-world examples and actionable frameworks will equip leaders with the tools to
translate technical threats into business priorities. This presentation will also explore how to
allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience
across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that
balances cost, compliance, and risk reduction, ensuring your organization is prepared for the
challenges of today’s complex risk landscape.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE CS Richland
April 04, 2025
In today’s business environment, cyber risk is a growing concern that goes beyond IT departments. It is a strategic issue that requires the attention of executives and business leaders. This keynote presentation offers a business-centric approach to understanding, managing, and mitigating cyber risks, enabling leaders to address these challenges with confidence.
Act One begins with an overview of the modern cyber risk landscape, positioning cybersecurity as a core business issue. We will examine the financial and reputational stakes of cyber incidents, grounding the conversation in tangible impacts that resonate with business decision-makers. The audience will leave this section with a clear understanding of why addressing cyber threats is critical to their organization’s success.
Act Two focuses on practical strategies for integrating cyber risk into business strategy. This includes defining cyber risks in business terms, aligning cybersecurity efforts with organizational goals, and translating technical concerns into actionable business insights. Attendees will learn how to communicate cyber risks effectively to stakeholders, including boards, executives, and external partners.
Key points will include:
Bridging the gap between IT and business through shared understanding.
Prioritizing cyber threats based on their business impact.
Building business-centric cybersecurity strategies that support enterprise objectives.
Act Three explores methods for reducing enterprise risk through focused cybersecurity efforts. This includes identifying critical areas for investment, implementing effective controls, and measuring the success of cybersecurity programs. Attendees will learn how to allocate resources efficiently, design controls with maximum impact, and track the business value of their cybersecurity initiatives.
By the end of the presentation, participants will have actionable insights and tools to:
View cyber risks through a business lens.
Communicate their significance to internal and external stakeholders.
Develop and implement strategies that prioritize business resilience.
This session is ideal for executives, board members, and business leaders looking to enhance their organization’s approach to cyber risk and align cybersecurity efforts with strategic goals.
Cyber Risk - a Business Imperative: Translate Threats into Strategic Action
ISC2 Seattle
April 03, 2025
Summary:
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
Cyber Risk as a Business Imperative
ISC2 SoAZ
March 20, 2025
The meeting will be held online via Zoom and you will receive the link when you register. In this meeting, we will have a cybersecurity-related presentation, an ISC2 Corporate and Chapter update, discuss recent cybersecurity news and community announcements, and have a group discussion on a cybersecurity topic.
When:
Thursday, March 20th, 6:00pm to 8:00pm
Agenda:
ISC2 Southern Arizona Chapter Meeting
Introductions
Chapter Business
ISC2 Corporate Update
Cybersecurity News
Community Announcements (Events, Jobs, etc.)
Presentation: Cyber Risk as a Business Imperative by Kayne McGladrey, CISSP
Group Discussion: Open Cybersecurity Topics
March ISC2 Boulder Chapter Meeting
ISC2 Boulder Chapter
March 20, 2025
Calling all cyber security professionals to the March Chapter meeting for the ISC2 Boulder Chapter. Guest speaker Kayne McGladrey will share a strategic look at translating cyber threats into business priorities, helping security leaders communicate risk effectively and integrate cybersecurity into organizational decision-making.
https://us02web.zoom.us/meeting/register/XZwV7C0BQ5O-JsW3TJctuA?_x_zm_rtaid=T-wxLuIMTFWKn1FJguURXw.1740686574566.c1dc2f2350c612f0cec2095b50f7ac37&_x_zm_rhtaid=6#/registration
IEEE CS Boise Section Chapter
March 17, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with
profound financial and reputational implications. This keynote addresses the intersection of
cybersecurity and business strategy, offering practical insights to help executives and business
leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks,
communicate them effectively to stakeholders, and integrate them into broader organizational
strategies. Real-world examples and actionable frameworks will equip leaders with the tools to
translate technical threats into business priorities. This presentation will also explore how to
allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience
across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that
balances cost, compliance, and risk reduction, ensuring your organization is prepared for the
challenges of today’s complex risk landscape.
Kayne McGladrey Presents: Cyber Risk as a Business Imperative
Rochester Professional Consultants Network
March 14, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
In today’s business environment, cyber risk is a growing concern that goes beyond IT departments. It is a strategic issue that requires the attention of executives and business leaders. This keynote presentation offers a business-centric approach to understanding, managing, and mitigating cyber risks, enabling leaders to address these challenges with confidence.
Cyber Risk as a Business Imperative
ISC2 Central Mississippi Chapter
March 11, 2025
I'm pleased to announce the March 2025 meeting of the ISC2 Central Mississippi Chapter. It will be held Tuesday, March 11th at 12:15 PM on Google Meet. This meeting will be virtual only.
Our speaker will be Kayne McGladrey, an ISC2 CISSP holder, a senior IEEE member, and author of the GRC Maturity Model. With nearly three decades of experience in cybersecurity, he specializes in helping organizations navigate governance, risk, and compliance (GRC). His presentation will be on "Cyber Risk as a Business Imperative".
Advancing Compliance with the GRC Maturity Model: A Roadmap for Cybersecurity Leaders
IEEE Rock River Valley Section
February 27, 2025
Organizations face increasing regulatory, contractual, and legal compliance requirements, yet many struggle with fragmented processes and reactive approaches. The Governance, Risk, and Compliance (GRC) Maturity Model provides a structured framework to assess and enhance compliance programs, aligning them with strategic business objectives.
This session will guide cybersecurity professionals through the four levels of GRC maturity—traditional, initial, advanced, and optimal—illustrating how each stage impacts risk management and operational efficiency. Attendees will learn how to evaluate their organization's current maturity level, identify gaps, and implement targeted improvements to streamline compliance efforts.
Through real-world examples and practical strategies, this presentation will demonstrate how advancing GRC maturity enhances collaboration, reduces compliance risks, and supports long-term business resilience. Whether an organization is starting to formalize compliance processes or aiming for an optimized, risk-based approach, attendees will gain actionable insights to drive meaningful improvements.
Unveiling the 2025 IT Risk and Compliance Benchmark Report: Top Findings to Start Your Year
Hyperproof
January 23, 2025
Join us on January 23rd at 11am PT / 2pm ET as we unveil the findings from Hyperproof’s sixth annual IT risk and compliance benchmark report. Each year, we ask over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to provide an in-depth view of the market’s current state and what to expect for the coming year.
2024 was a milestone year for governance, risk, and compliance (GRC). As companies grappled with increasing regulatory demands, growing stakeholder expectations, and an ever-expanding risk landscape, the importance of maturing GRC programs rose to prominence. Learn about how over the last year, the perception of GRC across organizations has transformed from merely a checkbox exercise to a driver of operational excellence and strategic growth — a trend that is strongly represented in the data.
Join us as we explore:
- Our top findings, an in-depth look at the data from 2024, and an analysis of how these findings will impact GRC in 2025
- How organizations responded to new EU regulations and how these regulations might affect 2025
- Why and how organizations are making deliberate efforts to mature their GRC practices
- The drivers behind why GRC teams expanded in 2024 and why they are expected to continue to grow in 2025
- How organizations in 2024 leveraged generative AI to streamline their processes
Unveiling the 2025 IT Risk and Compliance Benchmark Report
ISC2
January 23, 2025
Join Erin Nelson and me for the unveiling of Hyperproof’s 2025 IT Risk and Compliance Benchmark Report. This year’s report captures the insights of over 1,000 GRC professionals and reflects a transformative year for governance, risk, and compliance. We’ll break down the data to reveal how organizations responded to evolving regulations, scaled their teams, and leveraged generative AI to optimize risk management processes.
You’ll also hear about the growing recognition of GRC’s role in driving strategic growth and operational excellence. Erin and I will walk through the drivers behind these trends, examine the impact of new EU regulations, and provide a forward-looking analysis of how these findings set the tone for 2025. Don’t miss this opportunity to gain practical insights that can help guide your organization’s approach to IT risk and compliance in the year ahead.
January 23, 2025 10:00 a.m. - 11:00 a.m. Eastern time
New Year, New Standards: Preparing for SEC Cybersecurity Disclosures in 2025 and Beyond
CIO & CISO Atlanta Summit
December 05, 2024
The SEC’s new cybersecurity disclosure requirements have set a new benchmark for transparency and accountability, compelling public companies to enhance their cybersecurity practices and reporting.
In this session, you’ll learn how to align your organizations with these evolving requirements and take proactive steps to stay ahead of regulatory expectations.
In this session, we’ll join Kayne McGladrey, Field CISO at Hyperproof, to discuss:
An overview of the 2024 SEC cybersecurity requirements
Best practices for cybersecurity disclosures
How to prepare for the 2025 disclosure season
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
ISC2
October 25, 2023
As CISOs make plans to secure operating budgets for the new financial year, they face the age-old challenge of convincing stakeholders, who often see cybersecurity and privacy as a cost center, to invest in this area. It's time to change the narrative. Discover how to drive more productive conversations about cybersecurity as a strategic growth enabler. Take home actionable ideas for proactively managing controls and risks, increasing efficiency and reducing costs.
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Hyperproof
February 23, 2023
Hyperproof conducts an annual survey to uncover the top challenges IT compliance professionals face and what hot topics they’re focused on in the coming year. We’ve asked over 1,000 survey respondents about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to provide an in-depth view of the market’s current state and what to prepare for this year.
We’ll cover:
The top five findings from the survey
How your peers are planning to handle compliance, audit management, and risk management in the midst of a volatile economy
What companies are doing differently in response to recent and highly publicized security breaches to avoid security lapses and compliance violations
Leading practices for ensuring security, compliance, and risk management today
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
SC Magazine
May 17, 2022
Whenever a key business function is hosted by a cloud-based vendor, your organization cedes a certain amount of control to the service provider. And that sometimes means that your security team lacks visibility into how this third party handles sensitive data and to what degree it successfully meets regulatory compliance standards around privacy and data security. This session will identify some of the most common gaps in visibility and compliance to develop between companies and their SaaS, PaaS and IaaS providers, and explain the root causes behind these lapses so that your own company hopefully can avoid some of these pitfalls.
Opening keynote speech at the Seattle Electrical Conference
Seattle Electrical Conference
December 22, 2020
Our key note speaker Kayne McGladrey today will discuss Cybersecurity. Keeping our websites and our networks secure is one of our biggest challenges in our digital age.
Keynote speech at CIA Conference 2020
CIA Conference
October 26, 2020
Prepare and adapt yourself to evolving threat landscape by listening to our next keynote speaker Mr. Kayne McGladrey, will speak on "Deter, Deny and Defend Against Cyber Attacks."
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
Colloquium for Information Systems Security Education
September 28, 2020
On November 4th at 8:15 AM Pacific, Kayne McGladrey, CISSP, will give the keynote speech at the Colloquium for Information Systems Security Education and discuss the social and economic impacts of cyber security during a pandemic. Registration is free.
Tags: COVID19, Cybersecurity, Diversity and Inclusion
TAG Cybersecurity - February 2020 Meeting
TAG NW
February 03, 2020
Featured Presentation:
"Best practices for cyber security training programs" by Kayne McGladrey, CISSP
Employees dread the meeting invitation that reads 'Annual mandatory cyber security training in the break room at 1 PM Wednesday'. In this presentation, we'll discuss best practices for creating a reality-based training program that encourages employee participation and builds organizational muscle memory for responding to active threats.
Deter, Deny, and Defend Against the Three Most Common Cyber Attacks
TagNW
November 08, 2019
Cyber attacks are bad and getting worse, and you’d like to turn things around before it’s too late. In this session, you’ll learn how the three most common attacks target people, how to deter and deny threat actors attacking your applications, and how to defend yourself and your community.
Cybersecurity Career Accelerator EXPO
Include Cybersecurity
December 01, 2018
The Cybersecurity Career Accelerator Expo 2018 program is an opportunity for anyone interested in cybersecurity to come receive – and share – useful and relevant information critical to launching – or advancing – a career in cybersecurity. This day-long symposium will be divided into two tracks with sessions designed to benefit novice, entry-level and advanced cybersecurity professionals. The content will be presented in a combination of lectures, workshops and expert panel formats.
Cybersecurity Career Accelerator Expo 2018 is part of the “Include Cybersecurity” initiative focusing on cybersecurity workforce development in the Sacramento Valley. Our mission is to spark interest within traditionally underrepresented groups in exploring an exciting and rewarding career in cybersecurity.
Bridging the AI Skills Gap: Top Strategies for IT Teams in 2025
ITPro Today
December 11, 2024
Kayne McGladrey, IEEE senior member and field CISO at Hyperproof, said AI ethics skills are important because they ensure that AI systems are developed and used responsibly, aligning with ethical standards and societal values.
How AI poses a threat to election security
Security Magazine
October 07, 2024
“We can anticipate a significant increase in disinformation and phishing attacks as the United States prepares for early or mail-in voting in the 2024 elections. The majority of these attacks will likely come from cybercriminals spreading disinformation about how and where to vote. This year’s phishing campaigns may be more sophisticated and widespread, as non-native English or Spanish speakers will be able to leverage large language models to produce realistic messaging,” says Kayne McGladrey, IEEE Senior Member.
AI’s Human Mimicry Spurs ‘Personhood Credential’ Proposal
PYMNTS
September 05, 2024
"Security concerns also loom. As McGladrey said, threat actors would likely constantly attack centralized personhood credential providers. However, the level of encryption used in such a system may improve current security measures."
How Safe and Secure Is GenAI Really?
Information Week
August 08, 2024
“After all, AI serves as both a force accelerator, as it will allow those threat actors to operate at large scale without having to increase the size of their workforce. At the same time, the ability of AI to generate convincing-enough speech in another language will serve to open new markets to threat actors who might have previously employed linguists,” says Kayne McGladrey, Field CISO a Hyperproof.
6 tips for consolidating your IT security tool set
CSO Online
July 11, 2024
All controls and tools should be linked to a reduction in the probability or likelihood of a risk that’s above the organization’s tolerance level, says Kayne McGladrey, CISO at risk management provider Hyperproof and a senior member of IEEE. If there’s no longer a need for a product, it should go.
SEC Cyber Risk Disclosures: What Companies Need to Know
ISMG
June 12, 2024
In this video interview with Information Security Media Group at the Cybersecurity Implications of AI Summit, McGladrey also discussed:
* Why companies should use tools and software to collect and automatically gather evidence of compliance;
* The consequences of false cyber risk disclosures;
* The impact that SEC requirements have on private companies and supply chains.
AI system poisoning is a growing threat — is your security regime ready?
CSO Online
June 10, 2024
Although motivations like that mean any organization using AI could be a victim, Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers (IEEE), a nonprofit professional association, and field CISO at Hyperproof, says he expects hackers will be more likely to target the tech companies making and training AI systems.
But CISOs shouldn’t breathe a sigh of relief, McGladrey says, as their organizations could be impacted by those attacks if they are using the vendor-supplied corrupted AI systems.
Lodi, Calif., Built a Ransomware Defense Matrix with Multiple Solutions
State Tech
June 04, 2024
“To defend against ransomware, organizations must adopt a comprehensive, layered approach to cybersecurity, encompassing people, technology and processes,” says IEEE Senior Member Kayne McGladrey.
In addition to identifying suspicious emails, “technologies such as anti-virus software, endpoint detection and response systems, automated patching, threat intelligence feeds, and encrypted offline backups further mitigate the risk of ransomware,” he says.
AI models inch closer to hacking on their own
Axios
April 26, 2024
The big picture: AI model operators don't have a good way of reigning in these malicious use cases, Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers (IEEE), told Axios. Allowing LLMs to digest and train on CVE data can help defenders synthesize the wave of threat alerts coming their way each day. Operators have only two real choices in this type of situation: allow the models to train on security vulnerability data or completely block them from accessing vulnerability lists, he added. "It's going to be a feature of the landscape because it is a dual-use technology at the end of the day," McGladrey said.
The Jobs of Tomorrow: Insights on AI and the Future of Work
CXOToday
April 23, 2024
Kayne McGladrey, IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions. “Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
The Evolution of the CISO Role in Modern Cybersecurity
Ask a CISSP
April 18, 2024
Welcome back to this week's "Ask A CISSP," where we dive deep into the evolving world of cybersecurity with key industry leaders. In a recent enlightening episode, we were joined by Kayne McGladrey, Field CISO at Hyperproof, to discuss the pressing challenges and transformations within the role of Chief Information Security Officers (CISOs).
For a larger overview of our conversation please check out, "Navigating the Future of Cybersecurity with Kayne McGladrey"
What are the biggest ethical considerations of security technology?
Source Security
April 04, 2024
Algorithmic bias is one of the primary risks associated with emerging physical surveillance technologies. While the risks of facial recognition software are well known and documented, efforts are being taken to adapt computer vision to new and novel use cases. For example, one of the more deeply flawed failures was an attempt to detect aggressive behaviour or body language, which was unfeasible as there was not enough training data available. Other physical security systems will face a similar challenge of not discriminating against individuals based on protected factors due to a lack of training data, or more likely, a lack of gender or racially unbiased training data. Companies considering purchasing advanced or emerging physical security systems should enquire about the training data used in the development of those systems to not be subject to civil penalties resulting from discrimination caused by using said systems.
The Evolving Landscape of Cybersecurity for Medium-Sized Businesses
Cyberfame
February 16, 2024
In recent years, we've seen a significant shift in the threats targeting businesses. "Everybody focused on the human harms, people couldn't check into their hotel rooms; people couldn't use an ATM... the nature of the technical exploits is not what we focus on in terms of harm... that's not what we focus on in terms of harm," states Kayne McGladrey, a field CISO at Hyperproof and senior IEEE member. This reiterates the transition from mere inconvenience to significant operational disruptions and economic consequences that cyber threats now pose.
Kayne McGladrey: The CISO’s Role Is To Advise on Business Risk
The PrOTect OT Cybersecurity Podcast
November 09, 2023
In this episode of The PrOTect OT Cybersecurity Podcast, Aaron and Kayne McGladrey discuss:
Strategic alignment of cybersecurity with business risk
Navigating the changing landscape of cybersecurity
Empowering CISOs in the evolving landscape of cybersecurity
The challenges and opportunities of generative AI
Key Takeaways:
The key to a successful cybersecurity strategy lies in reframing it as a business imperative, focusing on aligning security efforts with business risks, engaging with cross-functional teams, proactively obtaining certifications, and leveraging control design expertise, ensuring a competitive advantage and effective risk management beyond mere compliance and technology concerns.In today's dynamic cybersecurity landscape, CISOs must continually reassess their controls and their alignment with business risks, while also considering the personal liability they bear, making succession planning and strategic adaptability vital for maintaining effective security programs.The role of a CISO is crucial, yet often misunderstood; empowering and respecting CISOs' authority is essential to effectively manage cyber risks and avoid potential disasters, as generic approaches and AI-driven risk registers fall short of addressing the unique challenges faced by businesses.In a world where cybersecurity threats are inevitable, the key lies in fostering resiliency rather than aiming for an unattainable zero-risk goal; while a lot are excited about the potential of education and automation, the lack of regulatory control over generative AI poses a daunting challenge, risking societal upheaval and economic unrest.
"If we don't decide to manage the economic impacts of artificial intelligence, potentially a lot of industries could be at least partially automated. And that has the potential for a lot of social arm where people just don't have jobs. And when you get people who are automated out of a job, what are they going to go do? They're going to do something that everybody can do fine, but it doesn't pay well. Like you end up going and driving for a living or doing deliveries for a living. And you end up with a highly educated workforce that is unhappy. That's like a recipe right there for civil unrest." — Kayne McGladrey
Next-Generation Cybersecurity Defenses Coalesce for Space Systems
Via Satellite
October 23, 2023
“There's the cybersecurity threat and then there's the real threat,” explains Kayne McGladrey, field chief information security officer (CISO) of compliance company Hyperproof, and senior member of the Institute of Electrical and Electronics Engineers (IEEE). “A cybersecurity threat is disruption, like when we saw the Russians invade Ukraine as part of their illegal war, they took down Viasat and not by attacking the satellites themselves, instead, they attacked the firmware of satellite modems on the ground."
PCI Compliance & the Importance of Penetration Testing
StateTech Magazine
October 23, 2023
By asking the right questions and implementing appropriate controls according to a defined standard, state and local agencies can go a long way toward improving security. “If you're compliant with PCI, it really does reduce the likelihood of data breaches and the reputational damage associated with that,” says Kayne McGladrey, IEEE Senior Member and field CISO at compliance management platform Hyperproof.
Why a return to the office brings identity and mental health challenges
SDX Central
October 10, 2023
Another newer issue is that “the transition from a fully remote to a partially on-site work environment creates substantive cybersecurity concerns based on the ongoing mental health crisis,’’ said IEEE senior member Kayne McGladrey. As some businesses attempt to mandate a return to the office, they should be aware of the mental health challenges employees are facing, he said. “Research shows a significant decline in workers’ mental well-being, resulting in stress and anxiety. These mental states can negatively affect decision-making and lead to cybersecurity lapses.”
The Job Of Security Director Is Expanding: How Does It Impact Technology?
Security Informed
October 10, 2023
The enduring trend of allowing employees to work either partially or entirely from home has significantly impacted the role of the security director. No longer limited to overseeing an organization's physical office or campus, security director must look outside of their four walls to understand the full spectrum of modern risks. This expanded view necessitates close partnerships with cybersecurity experts to implement effective controls. For instance, while certain systems like operational technology systems (OT) remain bound to specific locations, many essential business tools, like laptops, often function remotely. The theft of an unencrypted laptop is often the cause of a security breach. In contrast, addressing the theft of an encrypted laptop simply involves filing a police report and replacing the affected device for the user. Additionally, security directors now find themselves working hand in hand with HR departments to enforce compliance measures, such as the heightened background checks and employee risk assessments mandated by FedRAMP and various financial regulations.
Is basic cyber hygiene enough in the age of AI?
APN News
September 27, 2023
IEEE Senior Member Kayne McGladrey said that “These threats are not merely theoretical, although at the moment, they are still relatively limited in their application. It is reasonable to expect that threat actors will continue to find innovative new uses of generative AI, extending beyond business email compromise, deepfakes and the generation of attack code.”
Emerging cyber threats in 2023 from AI to quantum to data poisoning
CSO Online
September 08, 2023
Kayne McGladrey, field CISO at Hyperproof, has seen the evidence. He worked with one organization whose executives received a contract for review and signature. "Nearly everything looked right," McGladrey says. The only noticeable mistake was a minor error in the company's name, which the chief counsel caught. But Gen AI isn't just boosting the hackers' speed and sophistication, it's also expanding their reach, McGladrey says. Hackers can now use gen AI to create phishing campaigns with believable text in nearly any language, including those that have seen fewer attack attempts to date because the language is hard to learn or rarely spoken by non-native speakers.
Universities Tap Student Talent to Support Security Operations
EdTech Magazine
August 25, 2023
“Not all high schools are promoting cybersecurity as a career option, and working in the SOC can have the knock-on effect of bringing people in who were unaware of the field before,” says Kayne McGladrey, a senior member at IEEE. Even if they don’t go on to take cyber jobs, “working in the SOC gives them exposure to some of the language and risks common in cybersecurity,” he says. “Then, if they’re working as developers, it’ll influence the direction by which they create things. They’ll at least have security in mind.”
Expert: Generative AI won’t harm cybersecurity workforce
SC Media
August 23, 2023
TechRepublic reports that generative artificial intelligence has been touted by Hyperproof Field Chief Information Security Officer Kayne McGladrey to not hamper employment opportunities in cybersecurity.
Continuous cyberattack innovation and supply chain diversity among threat actors would ensure that humans will not be displaced by generative AI, said McGladrey in an interview at the Black Hat security conference.
"We're going to need to continuously adapt the tools that we have with the people we have in order to face the threats and risks that businesses and society continue to face," said McGladrey.
Navigating the World of US Regulations: What You Need to Know
Data Protection World Forum
December 10, 2024
Navigating the complex web of US regulations is critical for organizations striving to ensure compliance and mitigate risk. This session will offer a comprehensive overview of the current US regulatory landscape, highlighting key regulations, trends, and their implications for businesses across various sectors.
Expert Predictions for 2024
GPSec
November 27, 2023
An illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion explores controversial key areas shaping the landscape in the coming year.
Cyber Budgets Taking a Step Back
Maturity in Vulnerability Management
AI Effects on Cybersecurity Job Market
Experts provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024.
Don’t miss the opportunity to stay ahead of the curve in a rapidly evolving digital world.
Keynote Panelists
Michael Fulton, Vernovis, Chief Information Officer
Warner Moore, Gamma Force, Founder & vCISO
Joe Otten, Fifth Third Bank, Sr. Director, Information Security
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
Whova
November 14, 2023
Join us for an illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion will explore controversial key areas shaping the landscape in the coming year.
- Microsoft Security Co-pilot Effects
- Cyber Budgets Taking a Step Back
- Impact of War Climate on Cybersecurity
- Maturity in Vulnerability Management
- AI Effects on Cybersecurity Job Market
Our panel of experts will provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024. Don’t miss this opportunity to stay ahead of the curve in a rapidly evolving digital world.
A 2023 Regulatory Round-Up and How to Prepare for 2024
ISACA
October 30, 2023
This year has brought a number of regulatory changes and updates. From the SEC’s new guidance to updates to the industry go-to standards of NIST CSF, 2023 was yet another year of cyber security and compliance evolution. With every shift in regulatory guidance or requirement, should come a shift in the way organizations are thinking about the way they are protecting their data and the data of their customers. Join our panel of experts as they not only discuss what we’ve seen change in 2023, but also how they suggest security and risk professionals strategically prepare for the year ahead.
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
ISACA
March 22, 2023
Emerging from a global pandemic, businesses must re-evaluate their processes and procedures to adapt to the new normal. This includes the Risk Management processes. It is more than an ever for businesses to implement processes that will safeguard the company’s assets which includes information. An asset is something of value and in today’s society information is very valuable and must be protected. How does an organization ensure the confidentiality, integrity, and availability of its information assets and the systems that support them? The digital transformation continues, and new technologies continue to emerge. This virtual summit will cover topics that will cover tools and techniques necessary to identify, assess and respond to risk associated with emerging technology and the company’s assets.
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
Compliance Week
February 15, 2023
* Deep dive look into interpreting the different emerging US data privacy state laws and the consequences of non-compliance
* Learn about the requirements of the SEC cybersecurity rules and the ramifications for public companies
* Discuss the security programs that need to be implemented to comply with local and international regulations and rules.
ISACA Virtual Summit 2022: Pursuing Digital Trust
ISACA
December 07, 2022
The digital space is the primary method of retaining data and transacting in today’s business landscape. But with the increase in cyberattacks, scams and security breaches, a secure digital world is more important than ever. Cybersecurity, risk, data privacy, governance and assurance are essential processes in the modern business landscape and are critical to helping enterprises become digitally trustworthy, enhance their reputations and increase their brand loyalty with consumers.
Streamlining GRC Controls to Optimize Cybersecurity
IT GRC Forum
November 17, 2022
On this webinar, we will discuss how to streamline GRC controls and optimize cybersecurity risk management processes, to enable leaders to determine what investments best reduce risk with the best return on investment (ROI). Attendees will learn how to:
* Simplify GRC and security operations by reducing the number of controls your organization has to deal with, therefore reducing its workload to test and audit the controls
* Develop a set of controls baselined to the internal and external requirements that your organization needs to meet
* Enable both security process automation and enterprise risk decision-making
* Shrink your organizations cybersecurity attack surface
Finding a long-term solution to curb Cybercrimes in the digital sphere: A Global Perspective
WebForum
November 08, 2022
This was the 7th series of WebForum which was in line with this year’s International CyberSecurity Awareness Month theme "See you in cyber - #becybersmart” held on 28th October 2022.
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
DotConnectAfrica
October 25, 2022
The findings of the webforum will inform African countries, businesses, and the global community of the key issues that need to be addressed in order to curb cyber crimes from ethical hacking, implications of data sovereignty and cloud, implications of metaverse and Web 3.0, and data privacy in the cloud. It will also demonstrate the global community’s commitment to the shared objective of protecting citizens, businesses, and organizations in the digital era. This will be imperative to prevent more damaging cyber-attacks, which could have devastating impacts.
SECtember 2022: Transforming Security Along with the Business
SECtember
September 28, 2022
As we all know, decisions that get made to transform the business are not always the best decisions for security. Especially with the accelerated digital transformation of the last few years, now is the time to reassess whether security teams have been properly tracking and addressing all cloud and digital assets that their organizations have taken on. This panel of experts will discuss the challenges of tracking cloud assets, if their risk is being properly measured, and ultimately whether security teams are properly supporting business transformation decisions.
The Future of Health Tracking Apps
CIO Tech Talk
September 01, 2022
Join us live on Twitter Spaces as we discuss:
* how safe patient medical information is with tech firms?
* the challenges health tracking apps present for users?
* how can users protect their data while still using health tracking apps
* red flags users should look out for when choosing or using health tracking apps
* What can tech firms do with data from health tracking apps
Cloud Adoption Outpaces Security
Sub-Four Capital
May 24, 2022
Cloud adoption has been rapidly rising for years and exploded as a result of the COVID-19 pandemic. With a remote workforce, companies needed the accessibility, flexibility, and scalability offered by cloud-based solutions. However, while many companies are moving rapidly to the cloud, security is lagging behind. Cloud infrastructure is very different from an on-premise data center, and these differences introduce unique security challenges. Many companies are still working to understand these differences, leaving their cloud deployments at risk. For many companies, the security of their public cloud infrastructure is a significant concern.
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Sub-Four Capital
May 24, 2022
When it comes to data breaches, they say not if but when. Preparing your business to quickly and competently respond to a data incident starts with the creation of an Incident Response Plan. Understanding the topics covered in an IRP and then making choices that are best for your business helps ensure that the IRP will work in your time of crisis response.
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Dark Reading
November 17, 2021
Today’s cybersecurity environment features a wide range of available threat intelligence, ranging from simple vulnerability alerts to commercial services that monitor threat actor behavior. But how can you use that data to assess the security posture of your own organization? How can you harness threat intel to measure cyber risk? In this panel, threat intelligence experts offer advice and recommendations on how threat intelligence can be used as a means to measure your attack surface.
Returning to the Office: Security Threats and Proactive Solutions
Ascent Solutions
May 13, 2021
A year after the pandemic began, employers are now considering how to welcome their employees back to the office. Join Ascent cybersecurity leaders, Derek Swenningsen and Kayne McGladrey for a discussion on the challenges and threats that are emerging in the modern workplace.
While there are obvious threats, such as threat actors sending phishing lures with fake return to work information, there are less obvious threats, such as IT assets that have not connected to your corporate LAN in a year.
Our experts will take audience questions and discuss the proactive cybersecurity steps that businesses and organizations can take to prepare for employees returning to offices in a hybrid working environment.
How Hackers Used and Abused the Pandemic to Profit
Infosecurity Magazine
March 24, 2021
In this session, a panel of experts will reflect on the various ways in which hackers have targeted the pandemic over the past 12 months, lifting a lid on the methods employed and outlining how businesses and users can best protect themselves from ongoing COVID-related attacks, scams and fraudulent activity.
CISO Perspectives: Zero Trust-As-A-Service
CSHub
November 05, 2020
Join Pulse Secure’s Global Chief Security Architect and Ascent Solutions cybersecurity strategist Kayne McGladrey, CISSP in this webcast to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
This webinar will take place on:
November 05, 2020
11:00 AM - 12:00 PM EST
#IDGTechtalk : A 2019 Recap and 2020 Predictions
IDG Communications, Inc.
December 19, 2019
We will be discussing 2019 trends and looking ahead to a new decade of amazing tech advancements at the final #IDGTechTalk of the year. Join us on Twitter by following #IDGTechTalk at 9 AM Pacific on December 19th, 2019.
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
Cyber Security Hub
November 13, 2019
Cyber Security is still primarily seen as an ‘IT issue’ and this often means that security often gets “bolted on” rather than embedded in a company’s ecosystem. In this panel discussion, discover why everyone within the business is responsible for Cyber Security and how to educate the enterprise on safeguarding customer data.
Key takeaways
- Improve security by creating a culture of healthy suspicion
- Encourage the executive board to communicate policies
- Ensure best practice is maintained throughout your business
From Post-Quantum Computing to Space Systems | InfoSec Pros on the Road
Hyperproof
May 14, 2025
Filmed live at RSAC 2025 in San Francisco, we are joined by Scott Francis, a Principal Director and Americas Lead for Cyber Next, Accenture’s emerging tech security practice to discuss the future, from post-quantum computing to space systems.
Auditing: AI and the Future | Drafting Compliance S2 Ep. 4
Hyperproof
April 18, 2025
Kayne and Tom talk about an article on the future of auditing with consideration for AI and it’s uses. Along the way, they uncover where organizations should be considering strategic shifts around AI and where they need to exercise caution. Of course we all get to enjoy another face of disgust from an otherwise truly enjoyable beer.
AI and Privacy with Dustin Wilcox | Drafting Compliance Ep. 40
Hyperproof
March 07, 2025
Kayne and Tom talk about AI and regulatory consequences with a Special guest, and Tom’s brother, Dustin Wilcox, a Fortune 20 CISO with a Global Healthcare company. They knock back a delicious Porter beer and uncover the secrets of AI and regulatory management. A blockbuster of a good time.
All about DORA | Drafting Compliance Ep. 38
Hyperproof
December 12, 2024
Kayne and Tom talk about DORA and its applicability. Learn where DORA applies, how you may need to be concerned about DORA even if you think you don’t and why DORA is causing confusion in US companies. Kayne and Tom try an unusual option to drink and we come close on the scoring.
Controls, Questionnaires, and Risks with Eric Hammersley | Drafting Compliance Ep. 37
Hyperproof
November 19, 2024
On this episode, we're expanding the show to talk about more than FedRAMP. But before we get to that, I want to mention: we're sitting in the same room in San Diego, in front of a live audience at HyperConnect 2024 , with our special guest Eric Hammersley of Nutanix, and we have some beers.
Varun Prasad on Building trust in AI with ISO 42001
Hyperproof
November 07, 2024
How can an organization use ISO 42001 to build trust with AI? During this Hyperproof live stream series, leaders in information security shed light on crucial topics that shape the modern cybersecurity landscape. This month’s episode features Varun Prasad, Managing Director - Third Party Attestation at BDO, and our host, Kayne McGladrey, Field CISO at Hyperproof.
In the episode, Varun and Kayne will discuss topics around ISO 42001, its key components, and how it can be used to guide companies on the ethical complexities of AI. Plus, they'll discuss some of the latest regulation updates such as the EU AI act, NYDFS, GDPR and more! Audience interaction is encouraged and questions will be answered live from the comments.
Cybersecurity For Schools - Kayne McGladrey - PSW #850
Paul's Security Weekly
November 06, 2024
We chatted with Kayne about education systems security, funding for cyber tools and services, and what the future of education might look like to fill more cyber roles.
Bob Maley on AI Unplugged for Compliance and Security
Hyperproof
October 28, 2024
How is AI progressing and what does it mean for cybersecurity? During this Hyperproof live stream series, leaders in information security shed light on crucial topics that shape the modern cybersecurity landscape. This month’s episode features Bob Maley, Chief Security Officer at Black Kite, and our host, Kayne McGladrey, Field CISO at Hyperproof.
In the episode, Bob and Kayne will discuss topics around AI security such as asking vendors about AI use, personhood credentials, chatGPTzero.me, and why you should always say "please" and "thank you" to your AI chatbot (kidding, but only slightly). Audience interaction is encouraged and questions will be answered live from the comments.
Frameworks and Auditors with Lisa Hall | Drafting Compliance Ep. 36
Hyperproof
October 23, 2024
Kayne and Tom talk with Lisa Hall, CISO at Safebase. Recorded from Austin, Texas, they try a flight of local beer! They also take time to discuss Lisa's FedRAMP journey, talking with auditors, and the implications of the CrowdStrike disaster.
The Security Podcast In Silicon Valley
The Security Podcast In Silicon Valley
October 15, 2024
Join us in this episode of the Security Podcast in Silicon Valley, where host Jon McLachlan sits down with Kayne McGladrey, Field CISO at Hyperproof. shares his unique journey from theater to cybersecurity, offering insights into risk management, regulatory compliance, and the evolving landscape of cyber threats. Discover how his background in improv and theater has shaped his approach to cybersecurity, the importance of SEC 10-K disclosures, and practical advice for startups and security professionals. Don't miss this engaging and informative conversation!
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society of Chicago
February 27, 2025
Cyber threats continue to grow, but many organizations still treat them as technical problems instead of business risks. This presentation challenges that mindset, providing a business-centric approach to understanding, prioritizing, and mitigating cyber risks in a way that makes sense to executives, boards, and other key stakeholders.
I’ll be covering how to bridge the gap between cybersecurity and business strategy, helping leaders take a proactive role in cyber risk management. We’ll discuss how to effectively communicate risks in terms of financial and operational impact, integrate cybersecurity into broader business planning, and allocate resources where they matter most. With real-world examples and practical frameworks, I’ll outline how organizations can build a more resilient and risk-aware culture.
Whether you're a business executive, security leader, or decision-maker, this session will equip you with the tools to engage in meaningful conversations about cyber risk and ensure your organization is prepared for what’s next.
Feb 27th from 6 PM - 7 PM Central Time
#cybersecurity #risk #webinar #presentation
Kayne McGladrey Of Hyperproof On Cybersecurity Compliance in the Age of AI Threats
Authority Magazine
December 09, 2024
"Compliance with regulatory standards and industry-specific guidelines for product security is an indispensable part of cybersecurity. In an age where malicious AI poses a significant threat, how do organizations ensure their product security strategies are not just effective, but also fully compliant? As a part of this series, I had the pleasure of interviewing Kayne McGladrey."
Zero trust secures agile business transformation
CIO
October 30, 2023
CIOs should collaborate closely with CISOs to evaluate which zero trust controls will offer the most significant mitigation of agreed-upon business risks. Once specific controls are implemented, they can be centralized and reused across the various compliance standards like SOC 2 Type 2, ISO 27001, and PCI, delivering greater flexibility. “The key lies in the deliberate selection of zero trust controls aimed at reducing specific business risks while potentially streamlining existing compliance efforts,” explains Kayne McGladrey (@kaynemcgladrey), field CISO at Hyperproof and senior IEEE member.
AI lifts workforces to new heights of efficiency and innovation
CIO
February 07, 2025
Kayne McGladrey, Field CISO at Hyperproof and Senior IEEE Member, says cybersecurity is also fertile ground for AI. “CISOs are looking at AI and automation solutions that handle common cybersecurity tasks. These include collecting evidence of control operations for the internal audit team, testing that evidence automatically, and producing regular reports on such things as false-positive cybersecurity events. These tasks help overworked cybersecurity analysts and engineers to focus on the parts of the job that they love without burdening them with excessive paperwork.”
How to Protect and Secure Your Data in 10 Ways
TechRepublic
January 28, 2025
“Companies should conduct thorough risk assessments to identify and mitigate potential harms associated with AI products, understanding their limitations and potential misuse,” McGladrey said. “Maintaining clear documentation of AI system metrics and methodologies, along with disclosing any known risks or limitations to customers, is essential for transparency.”
Data Privacy Day 2025: Insights from Over 50 Industry Experts
Solutions Review
January 28, 2025
“To protect their personal data, consumers can take several practical steps to remove their information from data broker websites and opt-out of marketing. First, they should identify where their data is held by searching major data broker sites, public records, and credit reports. Once identified, consumers can use the “Opt Out” or “Remove My Data” links provided on these websites to submit removal requests, ensuring they confirm their identity and track the progress.
Additionally, they should familiarize themselves with regulations like the California Consumer Privacy Act (CCPA), which allows them to request the deletion of their personal data and opt-out of its sale. Consumers can also use online tools and services designed to automate the opt-out process from marketing lists and data brokers.
How Can The Industry Do A Better Job Of Promoting Emerging Technologies In Physical Security Environments?
Security Informed
November 25, 2024
The security industry can do a better job of promoting emerging technologies in security environments by linking their solutions to measurable outcomes that matter to CISOs. Those outcomes could be to either reduce sales friction or to show measurable progress in key risk indicators that board members care about. For example, while according to the recent "The Impact of Technology in 2025 and Beyond: an IEEE Global Study,” 48% of technologists said that the top application for AI in 2025 will be real-time cybersecurity vulnerability identification and attack prevention, vendors should still be prepared to explain how investments in their solutions can produce progress over time and support agreed-upon business objectives, outside of the technical benefits. Unfortunately, most emerging technologies primarily discuss technical benefits and features, not business outcomes. For example, if a CISO cares about multifactor authentication coverage, vendors should explain how their solution improves coverage and ties that to higher business resiliency. That would also reduce friction in B2B sales where a high degree of MFA coverage could be cited as a key control in a SOC 2 type 2 report, for example.
How AI could change threat detection
Techtarget
September 13, 2024
Early threat detection practices mostly involved identifying "something bad on a device by detecting that it matched a known signature," explained Kayne McGladrey, a senior member of IEEE, a nonprofit professional association, and field CISO at Hyperproof. This signature-based detection was, and still is, a key part of threat detection, but other rules-based detection practices -- where computer activities are analyzed to determine if they follow set rules -- have become foundational components of threat detection over the years, too.
How are wearable technologies impacting the security market?
SourceSecurity
August 29, 2024
Wearable technologies offer many benefits but pose unique security challenges requiring robust controls and for users to keep their devices updated. These devices collect large amounts of personal data, such as health metrics and location information. As a result, manufacturers should implement robust encryption, provide frequent updates, and establish transparent data policies that maintain compliance with Europe’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). Similarly, consumers should request stronger security controls from manufacturers, and should regularly update software, use strong passwords, and monitor app permissions.
AI in Cybersecurity: The Good and the Bad
Builtin
August 22, 2024
“[AI] allows a threat actor to scale a lot faster and across multiple channels,” Kayne McGladrey, chief information security officer at compliance management company Hyperproof, told Built In. “And the defensive tools haven’t quite caught up. Unfortunately, none of this stuff is going away. This has now become a fixture of the landscape. It’s part of our new, modern cybersecurity hellscape that we inhabit continuously.”
Quantum and AI: Safeguards or Threats to Cybersecurity?
IEEE Transmitter
July 29, 2024
AI models are vulnerable to numerous threats. One common attack involves data poisoning, in which malicious data is introduced into an AI’s training data set, causing it to learn incorrect patterns or behaviors and leading to inaccurate or harmful outputs. Watermarking and metadata embedding can help to support the integrity of training data and model outputs. These methods can be cryptographically verified and authenticated, ensuring the trustworthiness and traceability of the data used in AI models.
What Are The Benefits, And Drawbacks, Of AI In Security
Security Informed
June 21, 2024
By automating routine tasks and improving threat detection and response capabilities in cybersecurity, AI allows security teams to focus on more strategic activities. It is likely that cybersecurity professionals will soon use AI tools as an interface to less-familiar tools, similar to how programmers are currently using AI to generate code based on a task description when writing code for unfamiliar programming languages. However, one drawback of the rapid adoption of AI in enterprise security applications is that the accelerated development cycle and limited user base mean these tools have not seen extensive real-world security testing. As a result, some AI security tools may include vulnerabilities that can be exploited by threat actors. This is like the latest trends of enterprise file transfer applications or enterprise VPNs being compromised, which happened before the current increased development cycle to incorporate AI based on investor demands. It's very likely we will see zero-days used against AI-powered cybersecurity solutions in the short term.
AI Summit: Fortifying Cyber Defense Amid Privacy Challenges
BankInfoSecurity
April 30, 2024
A session by Kayne McGladrey, field CISO of Hyperproof, and Casey Allen, CIO of Concentric, discussed the importance of privacy regulations when maturing organizational security programs. McGladrey and Allen shared methodologies for CIOs and CISOs to embed privacy into security initiatives in the age of AI and digital transformation.
The Jobs of Tomorrow: Insights on AI and the Future of Work
IEEE Transmitter
January 19, 2024
Kayne McGladrey, Field CISO at Hyperproof and IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions.
“Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
What Will Be The Biggest Surprise For Security In 2024?
Security Informed
December 26, 2023
"In 2024, the most significant cybersecurity surprise will be the widespread recognition that Chief Information Security Officers (CISOs) are primarily risk advisors, not risk owners. This distinction contrasts with some companies' previous perceptions and the operational reality. With cybersecurity concerns such as data center vulnerability, cloud vulnerability, and ransomware attacks still being a top concern for business leaders in 2024, this distinction is important to keep in mind to ensure the success of corporate security. Business systems are managed by business owners, whose performance is measured based on the system's effectiveness. Historically, some companies have incorrectly assumed that the CISO is responsible for authorizing or mitigating some of the risks associated with these business systems. This is a misconception. The business owner, likely the individual who has approved the business continuity plan or is most affected by operational disruptions, also bears the responsibility of deciding how to address each risk. While CISOs can identify and propose mitigation strategies for business risks related to cybersecurity, they do not and should not accept or authorize the mitigation of risks for systems outside their ownership."
Article: Experts advise on how to build a successful hybrid work security strategy
CIO
December 15, 2023
Next, commit to solving the complexity issue. In practice, this involves consolidation and integration of tools while striking “a balance between robust protection and user convenience,” said Kayne McGladrey (@kaynemcgladrey), Field CISO at Hyperproof and Senior IEEE Member. For example, “automation and integration of security controls are crucial in achieving scalability and simplifying validation of efficient control operations.”
We’ve compiled the best VPNs for Netflix to show you those that have secure servers, optimum speed and allow you to stream Netflix on different devices.
How to develop an application modernization strategy that delivers tangible results
CIO
November 17, 2023
Kayne McGladrey, (@kaynemcgladrey), senior IEEE member and field CISO at Hyperproof, which provides SaaS-based compliance and security operations solutions, says: “Developing an application modernization strategy requires careful assessment, planning and execution. First, you must understand your business goals and objectives. Only then can you create an aligned business and application roadmap.”
Using AI Isn’t As Easy As It Seems
CXOToday
November 12, 2023
“Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier one analysts in the security operation center,” said IEEE Senior Member Kayne McGladrey. “Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.”
Data loss prevention vendors tackle gen AI data risks
CSO
October 31, 2023
“Employees across industries are finding new and innovative ways to perform their tasks at work faster,” says Kayne McGladrey, IEEE senior member and field CISO at Hyperproof. “However, this can lead to the sharing of confidential or regulated information unintentionally. For instance, if a physician sends personal health information to an AI tool to assist in drafting an insurance letter, they may be in violation of HIPAA regulations.” The problem is that many public AI platforms are continually trained based on their interactions with users. This means that if a user uploads company secrets to the AI, the AI will then know those secrets — and will spill them to the next person who asks about them. It's not just public AIs that have this problem. An internal large language model that ingested sensitive company data might then provide that data to employees who shouldn’t be allowed to see it.
Zero trust from edge to cloud: not one-and-done
CIO Magazine
August 30, 2023
“The only meaningful consideration of zero trust adoption is when the board and CEO are willing to trust and partner with the CISO to effectively mitigate business risks. A recent Gartner study found that a CISO who can effectively tie business outcomes to a material reduction in business risk through practical implementation of zero trust controls will make security an asset for their organization that enables them to compete more effectively.” — Kayne McGladrey, field CISO, Hyperproof
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Geospatial World
November 02, 2022
While homomorphic encryption can require lots of computing power, it has a few big upsides. For one thing, according to Kayne McGladrey, IEEE Senior Member, it allows companies in highly regulated industries, such as finance or healthcare, to store data on a public cloud. “As the data remains encrypted in all phases, even a data breach of a third party will not provide a threat actor with access to encrypted data,” McGladrey said.
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
Fortune
July 22, 2022
“As a result, those companies with solutions and products in the cybersecurity industry are heavily reinvesting their profits into research and development of artificial intelligence-based solutions intended to automatically detect and remediate actions from these increasingly well-funded adversaries,” McGladrey tells Fortune. “This cycle will continue so long as it remains profitable for cybercrime actors, barring remarkable changes in how companies prioritize and address their cyber risks.”
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
CIO
November 04, 2021
“Organizational collaboration is difficult when different data protection tools perform similar functions, as it may be unclear how to allow a collaborator to access or modify data. Something as simple as data classification and labeling becomes overly complex and a nuisance to end users if they need to set a label in multiple locations, particularly when the labels are not consistent across tools.” — Kayne McGladrey (@kaynemcgladrey), Cybersecurity Strategist at Ascent Solutions
Sinclair TV Stations Targeted in Weekend Ransomware Attack
GovInfoSecurity
October 18, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, says once the incident is resolved, Sinclair "should do an internal hot-wash" to identify lessons learned - allowing them to strengthen technical defenses and update/validate their incident response plan.
New Legislation Eyes Both Ransom, Incident Reporting
GovInfoSecurity
September 30, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, tells ISMG, "These [various legislative efforts] all stem from the issue that there is no single source of truth on the volume or scope of cyberattacks, which has led to the perception that it is difficult to apply commensurate public and private policy responses."
Experts Weigh In on Data-First Modernization
CIO
September 30, 2021
“This will vary by industry and size of business,” notes Kayne McGladrey, cybersecurity strategist at Ascent Solutions. “A social media company losing control of their content for an hour has a very different risk profile than a manufacturing company being unable to manufacture products.”
Transforming Security Compliance from Cost Center to Competitive Edge
Hyperproof
October 22, 2024
Enterprise security professionals face pressure to minimize spending on risk and compliance while maximizing efficiency and security. Traditionally seen as cost centers, security compliance solutions have untapped potential for better decision-making and competitive advantage. In this session. you will discover how adopting new cybersecurity frameworks can save money and enable market entry, how automation reduces engineering's role in evidence collection for control operations, and how to convey the value of cybersecurity investments to the board.
Kayne McGladrey, FIELD CISO, Hyperproof
Andrew Cunje, CHIEF INFORMATION SECURITY OFFICERT, Appian
Tuesday, October 22, 2024 / 12:05 PM - 12:25 PM EDT at Gartner IT XPO
Communicating Risk with Your Leadership Team
FutureCon
December 06, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
In this presentation, you’ll learn:
● What the 2023 risk landscape looks like
● How risk managers are planning on updating their risk workflows to adapt
● How to communicate risk to leadership
December 6th at 10:45 AM at FutureCon in Atlanta, GA
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
ISACA
August 21, 2023
In a world where compliance and engineering teams must work together to build compliant products, competing goals and philosophies can make collaboration frustrating for both sides. Join representatives from Instacart as they share their story on how they worked with engineering to build a compliant product, best practices for collaborating across teams to build scalable, compliant solutions and how to foster a culture of security and compliance across your organization.
After completing this session, participants will be able to:
• Build more credibility with engineering teams.
• Incorporate features that enable compliance into products.
• Work with your engineering team—not against them—to build high-quality, compliant products.
• Make long-term continuous compliance a reality with automation tools.
Cyber security for Bellingham families and neighborhoods
Eventbrite
October 13, 2019
Americans are buying and installing smart speakers, virtual assistants, smart electrical plugs, smart garage door openers, smart light bulbs and connected children's toys at an unprecedented rate. We know to lock the physical doors to our homes, but fewer people appreciate how smart devices can act like unlocked doors for cyber criminals into our homes, our social networks, and our bank accounts.
The lack of communications and understanding between professionals who work in cyber security and their neighbors who don't is one of the reasons cyber crime has grown for fifteen years. There are simple things we can each do to protect our families against the risks to our privacy and security.
In this session, you'll learn:
- how cyber criminals hack into smart devices, bank accounts, and cloud services
- two easy ways you can protect your family's accounts
This session includes a live hacking demo, so please bring your mobile phone (Android or Apple) if you’d like to participate. This is not a sponsored event and there is no cost. Any solutions recommended will be free, and there will be time for questions at the end of the presentation.
Cyber Leaders S02 E03 (Feat. Kayne McGladrey)
The Decloaked Podcast
February 05, 2025
It's time we heard from people who live and breathe cybersecurity. Join me as we discuss the highs and lows of working in this industry, the topics that need clarifying, and those that need the B.S. removed. Kayne is active in the community and has offered some GRC maturity models to help anyone.
All about DORA | Drafting Compliance Ep. 38
Hyperproof
December 13, 2024
Kayne and Tom talk about DORA and its applicability. Learn where DORA applies, how you may need to be concerned about DORA even if you think you don’t and why DORA is causing confusion in US companies. Kayne and Tom try an unusual option to drink and we come close on the scoring.
Controls, Questionnaires, and Risks with Eric Hammersley | Drafting Compliance Ep. 37
Hyperproof
November 19, 2024
On this episode, we're expanding the show to talk about more than FedRAMP. But before we get to that, I want to mention: we're sitting in the same room in San Diego, in front of a live audience at HyperConnect 2024 , with our special guest Eric Hammersley of Nutanix, and we have some beers.
How digital wallets work, and best practices to use them safely
Help Net Security
September 19, 2024
In this Help Net Security video, Kayne McGladrey, IEEE Senior Member, discusses best practices for using digital wallets safely. With the adoption of digital wallets and the increasing embedding of consumer digital payments into daily life, ensuring security measures is essential. According to a McKinsey report, digital payments are now mainstream and continually evolving, bringing advancements and new data protection and fraud prevention challenges.
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
Western Washington University
February 17, 2021
On February 17th, 2021 Kayne McGladrey, CISSP will be leading a tabletop exercise for the students of CISS 471 at Western Washington University. The tabletop exercise explores the ethical decisions associated with a ransomware attack at a fictional international organization.
How to Overcome Policy Challenges
Hyperproof
April 22, 2025
Policies are the backbone of effective governance, yet many organizations struggle with implementation, oversight, and adaptation. In this webinar, we will explore strategies organizations can use to mature their approach to policy and see where they sit on the Policy Maturity Model. We’ll unveil Hyperproof’s new policy capabilities and how they can help you navigate the complexities of policy governance. In this webinar, we’ll discuss:
- Common challenges associated with policy and real-world examples of policy failures.
- How to assess your organization's policy maturity and identify gaps through the Policy Maturity Model.
- Hyperproof’s new policy capabilities and how they can help your organization scale with confidence.
InfoSec Pros: Joe Erle on Cyberinsurance Key Controls and AI Considerations
LinkedIn
February 21, 2025
When a company experiences a cyber incident, cyberinsurance can make a significant difference in financial recovery—but only if the right controls are in place. In this episode of Hyperproof’s live stream series, Joe Erle from C3 Risk & Insurance Services joins Kayne McGladrey to discuss how organizations can approach cyberinsurance in a landscape shaped by artificial intelligence and evolving threats. We will explore the controls insurance providers require, how claims are handled when AI-driven fraud is involved, and what businesses need to prepare for in the event of a breach. We will also dig into the latest trends in financial fraud, including fake invoicing and social engineering attacks. Questions from the audience are welcome, so join the conversation and get real-time insights from an expert in the field.
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
ISC(2)
April 09, 2024
Is your IT risk and compliance program ready for 2024 and beyond?
For the last five years, Hyperproof has asked over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more. We then compare results from the previous year, and provide an in-depth view of the market’s current state in our annual benchmark report. The 2024’s IT Risk and Compliance Benchmark report highlights a fascinating change in the overarching narrative of cybersecurity: respondents and key stakeholders from other departments are thinking about cybersecurity compliance as a key competitive differentiator rather than just a cost center.
Join Hyperproof and ISC2 April 9, 2024 at 1:00 p.m. Eastern/10:00 a.m. Pacific to learn:
-How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
-Key trends for cybersecurity in 2024
-How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
-Why cybersecurity decision-making is becoming more collaborative with an integrated view of risk and compliance data.
From Cost Center to Competitive Edge: Operationalizing GRC
Hyperproof
April 02, 2024
Enterprise GRC professionals are often pressured to minimize spend on risk and compliance initiatives while still maximizing their efficiency and keeping their organizations secure and compliant. Fortunately, there's a growing realization that the right GRC solution, traditionally seen as a cost center, holds untapped potential for better decision-making, unlocking a significant competitive advantage. As a result, they need to break down the data silos between risk and compliance activities to get a transparent, holistic view of their compliance and risk postures, but they aren’t always sure where to start.
Join our experts Cheri Hotman, Partner, vCISO, Hotman Group and Kayne McGladrey, Field CISO from Hyperproof to learn more about:
- The drivers creating a growing need for transition from viewing GRC as a compliance obligation to operationalizing it as a strategic solution
- Practical strategies for transforming GRC operations, with a focus on breaking down silos
- Best practices for unifying risk and compliance data
- How to best prioritize GRC initiatives
Elevating Security: The Power of CIS Critical Security Controls
Hyperproof
December 05, 2023
Presented by
Kayne McGladrey, Field CISO - Hyperproof | Charity Otwell, Director, Critical Security Controls - CIS
Dec 05 2023, 11:00am PST
CIS Critical Security controls are a prescriptive, prioritized, and simplified set of best practices that can strengthen your cybersecurity posture. The CIS Controls include foundational security measures that you can use to achieve essential hygiene and protect yourself against a cyber attack. Are you curious whether CIS Critical Security Controls is the right choice for your organization? Or are you currently using CIS Critical Security Controls and wondering how to maximize your experience? Join Charity Otwell, Director at Critical Security Controls - CIS, and Kayne McGladrey, Field CISO at Hyperproof, to discuss areas of focus for CIS controls and how they can best apply to organizational security.
Participants will:
- Learn the basic foundation of CIS Controls
- Understand how to assess applicability for their organization
- Learn how to adopt best practices around CIS Controls
- Learn the upcoming changes that will be made to the CIS Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
BrightTalk
June 15, 2023
As generative AI tools like ChatGPT continue to evolve and impact various industries, compliance experts are left wondering about the potential security implications for their businesses. Join us for this enlightening webinar as we discuss the dos and don'ts of working with ChatGPT and similar technologies to equip compliance experts with the knowledge to navigate the security challenges presented by generative AI. We’ll also explore how you can ensure the safe and secure implementation of AI technologies within your organization and what security threats to anticipate.
Join speakers Kayne McGladrey, Field CISO at Hyperproof, and Dr. Rebecca Wynn, Global Chief Security Strategist & CISO at Click Solutions group, as they discuss:
- Valid use cases for using generative AI tools like ChatGPT in your business practices
- How to teach your organization to responsibly use AI tools how they can negatively impact enterprise risk and liability
- Security policy considerations that organizations should examine before incorporating ChatGPT or similar AI technologies
Insights into enterprise risk management frameworks that can help manage this new risk
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
ISC(2)
April 11, 2023
Maintaining cybersecurity compliance and building reliable risk management practices isn’t a simple to-do item you check off anymore. The livelihood (and ultimately the growth) of your business depends on resilient security and compliance programs. Add in changing regulatory requirements, and the challenge becomes exponentially more complex.
Join Hyperproof and (ISC)2 on April 11, 2023 at 1:00 p.m. Eastern/10:00 a.m. Pacific to hear more about:
• The value of connecting compliance and risk
• Optimizing stakeholder visibility and communication
• Using GRC tools to scale your business
• Long-term impacts of streamlining compliance, security, and risk management workflows
Communicating Risk With Your Leadership Team
FutureCon
March 22, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
Scale Your Security Questionnaire Response and Audit Preparedness Processes
BrightTalk
October 26, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio and Hyperproof to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
Kayne McGladrey, Field CISO - Hyperproof and John Forsyth, Director, Data & Infrastructure in Engineering - Loopio
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Hyperproof
October 05, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio, Hyperproof, and our special guest to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
The CISO Experience
The CISO Experience
July 26, 2022
Save the date for a very special “The CISO Experience” hosted by myself with our star guest Kayne McGladrey taking a Macro Economic view of the industry.
Very honoured to have Kayne as a speaker where we will be discussing a variety of topics including:
- Industry hiring practises
- Gatekeeping
- Burnout
Followed by a LIVE Q and A for the audience to participate
Tags: Cybersecurity, Diversity and Inclusion, Security
6 Steps to Prepare Your Company for CMMC 2.0
Ascent
June 22, 2022
Join us this Wednesday for an actionable six-step roadmap, prioritized under CMMC 2.0 and aligned to Zero Trust tenets, to improve your cyber program and reduce cyber risks to your business. #cybersecurity
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Supply Chain Brain
November 19, 2021
Global supply chains have been under intense strain in recent months, a situation that has been made even worse by the growth of cyber attacks, especially in the form of ransomware. The transportation sector, which has been largely deregulated, needs to adopt recommendations by industry and government organizations for implementing measures that they might have overlooked in years. The price of failing to do so can be high, with ransomware attacks threatening to shut down critical logistics operations for days or even longer.
Webinar: Zero Trust-As-A-Service
CSHub
November 05, 2020
Gain perspective on: The shift in security challenges, current security concerns, and future challenges; Main components of Zero Trust-as-a-Service; Zero Trust-as-a-Service implementation and deployment best practice; How Zero Trust-as-a-Service solving security challenges in a hybrid IT environment.
This is a pre-recorded webinar.
CISO Perspectives: Zero Trust-As-A-Service
Cybersecurity Hub
October 26, 2020
The rapid shift to work-from-home has accelerated the adoption of Zero Trust frameworks. Zero Trust-as-a-Service will be a necessary component of security strategies for 2021 and beyond.
Join Pulse Secure's Global Chief Security Architect, Mike Riemer and industry veteran Kayne McGladrey in this webinar to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
Futureproofing Now (Season #2, Ep. 11) - Cybersecurity & Cybertrust - Predictions & Implications
Futureproofing
July 14, 2020
“Bob Gourley emphasized that despite the dark topic of cyberthreats, we all leave with optimism. Carol Tang addressed the importance of continuous learning as part of a business leader’s proactive approach to mitigating risk and providing safety for customers. Kayne McGladrey emphasized the dual responsibility of today’s corporate decision makers with regard to cybersecurity: understand the complexity but act with transparency and specificity. It’s important to integrate cybersecurity awareness into the fabric of the organization, not sequester cybertrust solely within the domain of technology.”
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Hyperproof
March 01, 2024
It’s that time again! Hyperproof’s fifth annual benchmark survey is here. Each year, we ask over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to compare results from the previous year, provide an in-depth view of the market’s current state, and prepare for this year and into the future. What we found this year is highly interesting: there’s been a change in the overarching narrative of cybersecurity — long relegated to the role of a cost center — to make cybersecurity compliance a key competitive differentiator.
Join us for our webinar to learn:
* The top findings from the survey (hint: trust and transparency are top-of-mind in 2024)
* How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
* How highly publicized breaches in 2023 have made business operations more challenging for both B2B and B2C companies
* How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
* Why cybersecurity decision-making among organizations with an integrated view of risk and compliance data is becoming more collaborative
Kayne's Top Five in Five for April 2023
Hyperproof
April 05, 2023
April has brought a range of important cybersecurity developments to my attention. Here are the key takeaways:
• ChatGPT Risk Solutions: Addressing confidentiality, intellectual property, and compliance risks with practical recommendations.
• CISO Preparedness: Discussing generative AI risks and governance with senior executives, while considering supply chain disclosures.
• National Cybersecurity Strategy: Exploring breach responsibility, potential market regulation, and guidance from the NIST Secure Software Development Framework.
• Board Expertise Trends: Analyzing cybersecurity representation on Fortune 500 boards and the impact of SEC proposed rule changes.
• Credit Rating Implications: Evaluating the effect of cyber risk on companies' and municipalities' credit ratings.
CISO Strategies & Tactics For Incident Repsonse
CSHub
August 31, 2020
“Your incident response plan will be examined during discovery, period, point blank. Keep that in mind. It’s your policy and your plan that are going to be examined by our discovery, and make sure that you can actually do what that policy says and make sure you can do what the procedures say.”
Kayne McGladrey, Cybersecurity Strategist at Ascent Solutions
Enterprise Cyber Security Trends and Predictions 2020
Cyber Security Hub
November 27, 2019
“Effective defense in depth is not just shiny overlapping technical controls,” said Director of IT and Security Kayne McGladrey. “Rather, it’s the combination of culture, documented and tested processes, policies, and technical controls. For example, an organization with a policy of least privilege, a process for approving account privileges, and a process for auditing and harvesting unused privileges does not need multiple technical controls to implement the desired outcome.” It’s best to start with policy and then enact that in culture, where feasible.
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
Cyber Security Hub
September 23, 2019
Data has historically been contained to the computing devices that accessed it within the enterprise campus perimeter. The traditional network endpoint was isolated to desktop PCs, laptop computers and most server components that attached to the organization’s network. In recent years, a dramatic increase in mobile devices has broadened the endpoint definition. Mobile devices require access to a company’s data anytime and from anywhere. With the addition of always-connected, sensor-powered Internet of Things (IoT) devices, the range of endpoints can now include everything from IP cameras to smart vending machines to biomedical devices.
The original definition still holds true to this day; however, the presence of more sophisticated devices requesting an IP address from the network, and often without a user interface, also suggests that the approach to endpoint defense must change. Bi-directional communications means the endpoint can be an entry point into a network or application. What does the device need to communicate with? Does it require internet connectivity? Does a device with an embedded OS provide some form of protection?
The Phishing Phenomenon: How To Keep Your Head Above Water
CSHub
January 30, 2019
Phishing is the lowest cost way for a threat actor to gain access to an organization’s network and assets, according to Kayne McGladrey, an IEEE member and director of Security and IT at Pensar Development. “While it might be fashionable to worry about the latest zero-day, or shadowy nation-state threat actors developing crippling remote exploits, the fact is that it’s cheaper to ask users for their passwords.”
The fact that nearly a billion people had their personal information exposed in November 2018 “has further helped threat actors to develop more compelling and targeted phishing content,’’ McGladrey adds.
Charting a new course: AT&T Cybersecurity report volume 8
AT&T
October 31, 2018
“Organizations that don’t have cybersecurity as a core business differentiator, or as a core business function, are often struggling to adapt modern cybersecurity practices,” says Kayne McGladrey, Director of Security and IT at Pensar Development.
AT&T Cybersecurity Insights, Vol. 7
AT&T
April 16, 2018
Migration is a transformative process, which means it needs the full backing of the C-suite. Kayne McGladrey, Director of Information Security Services for Integral Partners, LLC, says it is vital to offer “an effective presentation to the board about the benefits and challenges associated with
the migration, and it has to have a narrative. You have to find stories of success and failure inside
of your industry in order to present the full picture to the board.”
“There are many lessons that the enterprise will learn through piloting—whether it’s identified
security risks, user communication risks, or education risks—all of which provide future guidance,” says Kayne McGladrey, Director of Information Security Services for Integral Partners LLC. “By the time you get to the harder transition elements, including full infrastructure rollout, you’ve already sorted through the main issues, thanks to your pilot-based learning journey.”
In response to increasing regulatory burdens and the risk of civil litigation, successful companies in 2024 will lean into enhancements in their compliance operations. They will actively collect and test evidence of security control effectiveness, linking these controls directly to their risks, across all critical assets or systems. This approach ensures companies are confident in accurately describing how well they manage their risk portfolio, including in SEC filings. The automation of compliance operations enables security and audit professionals to spend more time doing the parts of their jobs that they love. Furthermore, as supply chain risks intensify scrutiny of B2B transactions, companies will efficiently repurpose many of their controls and control evidence. This strategy not only allows companies to secure additional attestations or certifications such as ISO or SOC 2 without increasing their workforce, but it also provides a significant competitive business advantage.
A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation state APTs. Instead, 2023 will be the year where multiple regulatory bodies express their mounting frustration with public and private companies' collective inability to reduce the volume and impact of prior cyber attacks. In short, 2023 will be the year of risk.
An unprecedented six regulatory entities all have announced separate plans to enact additional rules in 2023 to instruct companies on how to manage their risks. These are the Department of Defense (DOD), the Federal Reserve, the Federal Trade Commission (FTC), the New York Department of Financial Services (NYDFS), the Office of the Comptroller of the Currency (OCC, part of Treasury), and the Securities and Exchange Commission (SEC). These entities wouldn’t be telling companies how to manage their risks if they believed that there was adequate risk management being conducted today. Instead, the pending regulatory changes are intended to cover perceived systemic shortcomings associated with cyber risk management.
Ransomware threat actors will continue to find new and innovative ways of generating revenue for their criminal operations throughout 2022. If organizations deploy adequate governance and technical controls in 2022 alongside an effective multinational policy response, we can anticipate a gradual ransomware slowdown in the fourth quarter as those threat actors not in prison re-skill as part of a workforce transition to other profitable criminal enterprises. Those countries giving license to ransomware threat actors inside their borders have a unique opportunity to provide a path to legitimate careers for those criminals who choose to voluntarily leave the market, and while this should not necessarily relieve them of any legal actions pending, it may be a useful incentive when considering sentencing.
Venture capitalists will accelerate feature development via mergers and acquisitions. In recent years, VCs have funded point solution vendors for technologies like SOAR and UEBA. These are features, not stand-alone technologies, and it’s often cheaper for market leaders to buy rather than build new features. CISOs should be aware of this market reality, as buying early-stage cybersecurity from a startup carries the risk of unintentionally having a business relationship with a much larger vendor within two years, and consequently needing to either buy the larger technology solution or rip and replace after the acquisition closes.
Cloud computing will continue to grow despite the frequency of breaches due to a lack of administrative controls and unintentional configuration errors. When an administrator had access to an on-premises server, they could only administer that server; a “cloud administrator” can administer all the assets in a given cloud instance, including backing up and exfiltrating entire servers. This is like the unintentional configuration errors that have plagued so many Amazon S3 buckets in 2019, where organizations have stored PII in S3 in a default configuration, and then those data have been accessed by security researchers.
The Internet of Things is a dumpster fire and upcoming regulatory controls aren’t going to put it out. Putting a sticker on a box with a username and random password and providing an updated privacy policy that consumers ignore isn’t adequate, although it is compliant. Manufacturers need to invest in user behavior analysis, require multi factor authentication, and to force patching of IoT devices. Otherwise, threat actors will continue to violate the privacy of people’s homes and nation states will built botnets as part of battlespace preparations.
Media source for expertise on AI, Cybersecurity, IoT
Location: Virtual Fees: 0
Service Type: Service Offered
As a CISSP I have an ethical responsibility to help educate the public about cybersecurity issues, and have been featured in Reader's Digest, USA Today, Fast Company, the Philadelphia Inquirer, Dark Reading, Cyber Security Hub, CIO.com, Robotics Business Review, The Institute, and more. Please contact me via email if you need a source for a story, an alternate perspective, or a longer-form piece. It'd be favorite if I had at least a day to reply.
Join Thinkers360 for free! Are you a Reader/Writer, Thought Leader/Influencer (looking to increase your earnings), or an Enterprise User (looking to work with experts)?
Cyber Security Hub Advisory Board
An Analysis of Section 1C Disclosures in Q1 of 2024
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
EU AI Act: New Model Clauses for Compliance
Audit Committee Guide to GenAI Cybersecurity Risks
NIST CSF 2.0: Overhauled Incident Response Guide
Vohra Lawsuit Shows Value of Healthcare Compliance
AI Washing Fraud: Nate Startup Case Exposed
Musk's X Faces Record Fine Under Digital Services Act
Navigating SEC Cybersecurity Disclosure Rules
OCR Restarts HIPAA Audits: What You Need to Know
FedRAMP 20x: Faster Federal Cloud Authorization
CPPA Revises ADMT and Cybersecurity Requirements
Top Cybersecurity News: DBIR, CCPA & FFIEC CAT
Weekly news context for April 18th, 2025
Weekly news context for March 7th, 2025
EU Halts AI Liability Directive, SEC Expands Cyber Focus
Weekly news context for February 21st, 2025
Weekly news context for February 7th, 2025
Weekly news context for January 24th, 2024
Weekly news context for January 17th, 2025
Weekly news context for January 10th, 2025
The GRC Maturity Model
What’s new in cybersecurity for physical security systems?
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Educated Endpoints
Senior IEEE Member
Top 50 IoT Influencers to follow in 2023
Cloud Thought Leader of the Day ️
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
Top Cyber Pro Awards for 2020
Top 50 Global Thought Leaders and Influencers on Internet of Things
100 B2B Thought Leaders and Influencers to Follow in 2020
ISSA Article of the Year 2017
How to Enhance Cloud Security Measures
Getting AI Right: 3 Challenges for the Future
Cybersecurity Concerns Continue
What is End-To-End Encryption? 7 Questions Answered
Telehealth is Booming: Here’s What You Need to Know
How to Keep Your Video Conferences Secure From Intruders
Decreasing Risk Through Enterprise Compliance
Should You Be Worried About Airport Cybersecurity Threats?
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
Unveiling the 2025 IT Risk and Compliance Benchmark Report: Top Findings to Start Your Year
Unveiling the 2025 IT Risk and Compliance Benchmark Report
New Year, New Standards: Preparing for SEC Cybersecurity Disclosures in 2025 and Beyond
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
Opening keynote speech at the Seattle Electrical Conference
Keynote speech at CIA Conference 2020
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
TAG Cybersecurity - February 2020 Meeting
Deter, Deny, and Defend Against the Three Most Common Cyber Attacks
Cybersecurity Career Accelerator EXPO
Bridging the AI Skills Gap: Top Strategies for IT Teams in 2025
How AI poses a threat to election security
AI’s Human Mimicry Spurs ‘Personhood Credential’ Proposal
How Safe and Secure Is GenAI Really?
6 tips for consolidating your IT security tool set
SEC Cyber Risk Disclosures: What Companies Need to Know
AI system poisoning is a growing threat — is your security regime ready?
Lodi, Calif., Built a Ransomware Defense Matrix with Multiple Solutions
AI models inch closer to hacking on their own
The Jobs of Tomorrow: Insights on AI and the Future of Work
The Evolution of the CISO Role in Modern Cybersecurity
What are the biggest ethical considerations of security technology?
The Evolving Landscape of Cybersecurity for Medium-Sized Businesses
Kayne McGladrey: The CISO’s Role Is To Advise on Business Risk
Next-Generation Cybersecurity Defenses Coalesce for Space Systems
PCI Compliance & the Importance of Penetration Testing
Why a return to the office brings identity and mental health challenges
The Job Of Security Director Is Expanding: How Does It Impact Technology?
Is basic cyber hygiene enough in the age of AI?
What's a Red Flag When Applying for a Cybersecurity Job?
Emerging cyber threats in 2023 from AI to quantum to data poisoning
Universities Tap Student Talent to Support Security Operations
Generative AI: Cybersecurity Weapon, But Not Without Adaptable, Creative (Human) Thinkers
Expert: Generative AI won’t harm cybersecurity workforce
2025 DoD Utilities Privatization Post Award Workshop
Navigating the World of US Regulations: What You Need to Know
How Will AI Impact the Jobs of the Future?
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
A 2023 Regulatory Round-Up and How to Prepare for 2024
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
ISACA Virtual Summit 2022: Pursuing Digital Trust
Streamlining GRC Controls to Optimize Cybersecurity
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
SECtember 2022: Transforming Security Along with the Business
The Future of Health Tracking Apps
Cloud Adoption Outpaces Security
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Returning to the Office: Security Threats and Proactive Solutions
How Hackers Used and Abused the Pandemic to Profit
CISO Perspectives: Zero Trust-As-A-Service
#IDGTechtalk : A 2019 Recap and 2020 Predictions
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
TagNW Closing Panel and Comments
Diversity of Mindset: Why It’s Not Just About Gender, Race, or Age
Future of the Security Operations Center
HUD with a bombshell requirement?
The Security Podcast In Silicon Valley
Zero trust secures agile business transformation
AI lifts workforces to new heights of efficiency and innovation
How Can The Industry Do A Better Job Of Promoting Emerging Technologies In Physical Security Environments?
How are wearable technologies impacting the security market?
AI in Cybersecurity: The Good and the Bad
Quantum and AI: Safeguards or Threats to Cybersecurity?
What Are The Benefits, And Drawbacks, Of AI In Security
AI Summit: Fortifying Cyber Defense Amid Privacy Challenges
The Jobs of Tomorrow: Insights on AI and the Future of Work
Article: Experts advise on how to build a successful hybrid work security strategy
How to develop an application modernization strategy that delivers tangible results
Integration of AI: A strategic imperative for organizations
Using AI Isn’t As Easy As It Seems
Data loss prevention vendors tackle gen AI data risks
Zero trust from edge to cloud: not one-and-done
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
Sinclair TV Stations Targeted in Weekend Ransomware Attack
New Legislation Eyes Both Ransom, Incident Reporting
Experts Weigh In on Data-First Modernization
Transforming Security Compliance from Cost Center to Competitive Edge
Communicating Risk with Your Leadership Team
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
Cyber security for Bellingham families and neighborhoods
IoT & Ethical Obligations of Engineers
Another UK deadline! #UK #news #FCA #thirdpartyrisk #CISO #cybersecurity
The EU’s updated Product Liability Directive now includes software and AI! #EU #AI #cybersecurity
Top cybersecurity news for September 19th, 2024
How digital wallets work, and best practices to use them safely
Top cybersecurity news for September 11, 2024
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
InfoSec Pros: Joe Erle on Cyberinsurance Key Controls and AI Considerations
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
From Cost Center to Competitive Edge: Operationalizing GRC
Elevating Security: The Power of CIS Critical Security Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
Communicating Risk With Your Leadership Team
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Scale Your Security Questionnaire Response and Audit Preparedness Processes
The CISO Experience
6 Steps to Prepare Your Company for CMMC 2.0
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Webinar: Zero Trust-As-A-Service
CISO Perspectives: Zero Trust-As-A-Service
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Kayne's Top Five in Five for April 2023
CISO Strategies & Tactics For Incident Repsonse
Enterprise Cyber Security Trends and Predictions 2020
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
