Unlock access to Thinkers360 AI to fast-track your search for analysts and influencers.
This feature is available for Enterprise Lite and Enterprise Members Only.
You have been temporarily restricted. Please be more thoughtful when adding content for your portfolio. Your portfolio and digital media kit and should be reflective of the professional image you wish to convey. Accounts may be temporarily restricted if we receive reports of spamming or if the system detects excessive entries.
Membership
Publish your original ideas on the Thinkers360 platform!
This feature is available for Pro and Pro-Plus Members Only.
Speaker Bureau functionality whereby individuals can be featured speakers within our Speaker Bureau service and enterprises can find and work with speakers.
This feature is available for Pro, Pro-Plus, Premium and Enterprise Members Only.
Highlight your featured products and services within our company directory for enhanced visibility to active B2B buyers worldwide. This feature is available for Pro, Pro Plus, Premium and Enterprise Members Only.
Contribute to the Thinkers360 Member Blog and have your thought leadership featured on our web site, newsletter and social channels. Reach our opt-in B2B thought leader community and influencer marketplace with over 100M followers on social media combined!
You’ve reached your daily limit for entering quotes. Please only add personally-authored content which is reflective of your digital media kit and thought leadership portfolio.
Thinkers360 Content Library
For full access to the Thinkers360 content library, please join our Content Plan or become a contributor by posting your own personally-authored content into the system via Add Publication or Import Publication.
Dashboard
Unlock your personalized dashboard including metrics for your member blogs and press releases as well as all the features and benefits of our member plans!
Interested in getting your own thought leader profile? Get Started Today.
Kayne McGladrey
Field CISO at Hyperproof
Bellingham, United States
I’m Kayne McGladrey, keynote speaker CISSP, the Field CISO for Hyperproof, senior IEEE member, and author of the GRC Maturity Model. With nearly three decades of experience in cybersecurity, I specialize in helping organizations navigate the intersection of governance, risk, and compliance (GRC) to build more secure and resilient businesses.
My work focuses on enabling CISOs, internal audit teams, and executives to align cybersecurity and business goals, communicate effectively with boards, and proactively address evolving global regulations. As a recognized thought leader, I’ve been spoken at events like Gartner IT Security & Risk, RSA, ISACA GRC, and the ISC2 Congress. My presentations are nuanced, accessible, and actionable, offering attendees practical guidance on current cybersecurity challenges and opportunities.
Throughout my career, I’ve advised Fortune 500 and Global 1000 companies, leveraging my ability to bridge the gap between business and technology. I’m passionate about reducing organizational friction, improving GRC maturity, and inspiring underrepresented communities to pursue cybersecurity careers.
Available For: Influencing, Speaking Travels From: Bellingham, WA
Speaking Topics: Cybersecurity, Compliance, Risk
· Working to increase the diversity of perspectives on enterprise cyber security challenges and opportunities.
· Dynamically responding to and anticipating the needs of the cyber security marketplace through unique and timely content.
· Serving as an “early explainer” to articulate “why” the subject matter is important to current practitioners and the next generation of cyber professionals.
An Analysis of Section 1C Disclosures in Q1 of 2024
Hyperproof
June 14, 2024
Late in 2023, the Securities and Exchange Commission (SEC) in the United States published Regulation S-K Item 106, which requires public companies to describe their processes for assessing, identifying, and managing material risks from cybersecurity threats. Historically, companies were not required to disclose these processes to investors or market regulators, and there were no established guidelines for what a “good” disclosure would look like. Hyperproof reviewed disclosures from nearly 3,000 companies across over three hundred industries and have identified trends for what goes into a robust, meaningful disclosure.
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Hyperproof
February 22, 2024
"Each year, our benchmark report provides invaluable insights into the evolving priorities and challenges facing IT and GRC professionals," said Kayne McGladrey, Field CISO at Hyperproof. "This year's findings underscore the growing need for organizations to streamline their GRC processes and adopt integrated solutions to effectively navigate the complex risk and compliance landscape."
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Dark Reading
April 13, 2023
A recent survey showed a surprising correlation between those who operate their businesses with risk and compliance data in silos and those who experienced data breaches in the last 24 months.
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
CSHub
March 29, 2021
Read this report on:
- Identifying accountability for cloud security across the enterprise
- Conceiving of a cloud security strategy to ensure that the business consults and informs the cyber security operation
- Gaining true visibility of the entire organization from on-prem to the cloud
- Adopting common language along with a newly assumed forward posture to find the edge of business innovation and enable it
ISO 27701:2025 - The Standalone Privacy Standard
LinkedIn
November 12, 2025
Discover how ISO 27701:2025 simplifies privacy management, adds AI and cross-border data controls, and boosts trust without needing an ISO 27001 certification.
Court Finds Data Breach Standing Must Show Concrete Harm
LinkedIn
November 10, 2025
Learn why Florida courts require proof of actual harm for data breach class actions, highlighting the need for concrete injury evidence to survive dismissal.
Tags: Cybersecurity, Legal and IP, Risk Management
Mt. Baker Imaging Data Breach Delayed Notification
LinkedIn
November 07, 2025
Learn how Mt. Baker Imaging's ten-month breach notice failed Washington patients, allegedly violating HIPAA and state law, and how firms can prevent similar lapses.
Tags: AI Governance, Cybersecurity, Risk Management
ISS2025: AI-Powered Threats and Security
LinkedIn
November 03, 2025
Discover how AI observability, identity security, and governance talks from ISS2025 cut breach risk and streamline DevSecOps for better cyber defenses.
Tags: AI Governance, Cybersecurity, Risk Management
ISC2 Congress 2025: AI-Driven GRC Insights
LinkedIn
October 29, 2025
Discover how AI automation, risk quantification, and extended supply-chain security reshape GRC at ISC2 Congress 2025, delivering faster, data-rich compliance.
AI Trust Index 2025: Global Concerns & Insights
LinkedIn
October 23, 2025
Explore the 2025 AI Trust Index and Pew survey findings on privacy, regulation, and cybersecurity, revealing key global concerns and actionable insights.
Tags: Cybersecurity, Digital Transformation, Risk Management
CCPA Privacy Risk Assessment Guide 2026-27
LinkedIn
October 21, 2025
Learn how to meet CCPA privacy risk assessment deadlines (2026-27), identify six trigger activities, and implement compliant governance for lasting trust.
UK Cybersecurity: Board-Level Governance & IR
LinkedIn
October 20, 2025
Learn how UK firms can boost resilience with board-level cyber governance, proactive incident response, NCSC guidance, and Cyber Essentials certification.
Tags: AI Governance, Cybersecurity, Risk Management
Securing Intellectual Property from AI Agent Data Leakage
Linkedin
October 16, 2025
Agentic AI systems promise potentially unprecedented efficiency by autonomously decomposing high-level objectives into action steps and collaborating across specialized agents, but they default to oversharing data. Common leak vectors include full “context dumps” between agents, fuzzy retrieval that over-includes nearby but irrelevant documents, broad tool permissions, unsegmented shared memories, verbose debug telemetry, and cross-tenant misconfigurations.
AI Agent Data Leakage: Protect Your IP
LinkedIn
October 16, 2025
Learn how proven security-by-default tactics like least-privilege, segmented memories, and cryptographic signing can stop AI agent data leaks and safeguard IP.
Tags: Cybersecurity, Legal and IP, Risk Management
California 30-Day Data Breach Notification Deadline
LinkedIn
October 10, 2025
Learn how SB 446 forces a 30-day breach notice, 15-day AG sample, and required consumer steps. Get a quick compliance checklist for incident response teams.
Hidden Costs of Data Security Compliance
LinkedIn
October 09, 2025
Learn how FINRA fines expose hidden costs of weak data security, with actionable risk‑management steps to protect customers and avoid costly penalties.
CMMC Readiness Gap: Urgent Steps for Defense Firms
LinkedIn
October 06, 2025
Over the weekend I read a couple reports about the chasm between perceived CMMC compliance and actual readiness. According to CyberSheath, only 1% feel fully prepared, while 69% claim they meet DFARS. And Kiteworks highlights missing end‑to‑end encryption in 44% of surveyed firms.
Technical controls such as MFA, EDR, and patch management sit below 40% adoption. Governance gaps persist, with 62% lacking formal tracking mechanisms.
What to do if you're in the DiB and have been whistling past the graveyard for the past few years?
Run a baseline SPRS self‑assessment to expose missing controls.
Deploy a KPI dashboard for weekly visibility of remediation progress.
Embed security clauses in supplier contracts within 30 days.
To stay competitive for DoD contracts, remediation is going to be a thing. Read the full article for my notes on the surveys, and a step‑by‑step action plan.
PS CMMC thought leaders: I did not write these surveys. If there's an error or you disagree with the survey results, please contact the survey authors.
Georgia Tech Settlement Highlights FCA Risks
LinkedIn
October 03, 2025
The DOJ settlement with Georgia Tech shows missing NIST SP 800‑171 controls can trigger a False Claims Act lawsuit.
* No data breach was proven, yet the university paid $875,000.
* Key gaps were no System Security Plan, absent antivirus on endpoints, and no formal assessment or POA&M.
* Because the SPRS score misrepresented compliance, whistle‑blowers earned a share of the recovery.
As CMMC certification becomes required, early preparation limits disruption. Avoiding FCA exposure protects reputation and future DoD contracts.
Tags: AI Governance, Cybersecurity, Risk Management
Weekly news context for October 3rd, 2025
LinkedIn
October 03, 2025
Recent regulatory moves highlight growing pressure on AI and cybersecurity.
* California's Transparency in Frontier AI Act forces large AI firms to disclose safety frameworks and model specs.
* Georgia Tech's $875K DOJ settlement shows missing NIST 800-171 controls can trigger False Claims Act liability.
* The Ascension ransomware case treats health data security as a fiduciary duty like clinical care.
Contractors must treat compliance as mandatory to avoid treble damages and loss of DoD work. MFA, strong passwords, network segmentation and immutable backups align with NIST and HIPAA standards.
Tags: AI Governance, Cybersecurity, Risk Management
Cyber News: CCPA Updates & NY Hospital Rules
LinkedIn
September 26, 2025
This week:
* The California Office of Administrative Law approved sweeping CCPA amendments. Firms must keep audit records for 24 months in immutable, searchable systems. Non‑compliance can trigger fines of $2,500 to $7,500 and possible injunctions.
* New York hospitals face a mandatory cyber risk program beginning Oct 2, 2025. Requirements include a dedicated CISO, MFA, encryption, IAM and annual penetration testing. Breaches must be reported within 72 hours or risk penalties and license loss.
* And AI‑generated prompts and logs are now discoverable evidence, so organizations should lock down privileged data before a legal hold.
Tags: AI Governance, Cybersecurity, Risk Management
News: Consumer Data Protection & AI Incident Response
LinkedIn
September 19, 2025
This week's news:
* New state regulators are turning the Global Privacy Control signal into law, forcing retailers to honor opt‑out requests. The GPC header, if ignored, can lead to multi‑million‑dollar penalties, as shown by the recent Sephora settlement.
* AI‑driven services bring fresh incident‑response challenges. Probabilistic outputs mean identical inputs may yield different results, complicating root‑cause analysis. Threat actors can poison training data or launch prompt‑injection attacks, raising privacy and liability risks.
* Compliance programs often become static checklists that satisfy auditors but fail during crises. Compliance teams that treat the function as a strategic asset, link incentives to risk reduction, and integrate AI governance can turn regulation into a competitive advantage.
Tags: AI Governance, Cybersecurity, Risk Management
Weekly news context for September 19th, 2025
Linkedln
September 19, 2025
Why it matters: State regulators in California, Colorado and Connecticut now require the Global Privacy Control signal, turning opt‑out into law. A recent study found thirty percent of major retailers ignore GPC, often because servers miss the Sec‑GPC header or consent platforms aren’t re‑configured.
Weekly Cyber News: SBOM, CMMC & AI Updates
LinkedIn
September 05, 2025
Weekly cybersecurity news: International SBOM standards, DFARS CMMC rule cleared, Colorado AI law delayed. Important compliance updates for security teams.
Tags: AI Governance, Cybersecurity, Risk Management
What the Butler Snow AI Sanctions Mean for Law Firm Governance
Linkedln
August 08, 2025
Judge Anna M. Manasco sanctioned three Butler Snow attorneys for filing fabricated ChatGPT citations, marking a shift from individual mistakes to institutional accountability failures.
Weekly news context for July 25th, 2025
Linkedln
July 25, 2025
Why it matters: S&P 500 companies have dramatically increased AI risk disclosures by over 473.5% since 2022. Seventy-five percent now cite AI-related risks in regulatory filings. Most telling: 57 companies explicitly warned they may never recoup their AI investments or realize expected benefits, despite widespread public enthusiasm about artificial intelligence capabilities. Corporate America's AI honeymoon phase appears to be definitively coming to an end.
Weekly news context for July 11th, 2025
LinkedIn
July 11, 2025
The SolarWinds settlement changed everything for cybersecurity executives. For the first time, the SEC charged a CISO individually for disclosure failures. Now security leaders face personal liability for how companies communicate cyber risks to investors.
Meanwhile, Trump's $500 billion AI investment is accelerating adoption across business functions. New vulnerabilities are emerging from algorithmic bias to data poisoning attacks. Traditional reactive approaches can't keep pace with AI-driven threats.
At the recent #RISK conference, experts revealed we've entered an AI arms race. Criminals weaponize artificial intelligence to create adaptive threats that outpace defensive systems. Success now requires:
• Real-time decision platforms operating at machine speed
• Predictive capabilities beyond traditional frameworks
• Learning to take smarter risks rather than avoiding all risks
Weekly news context for June 27th, 2025
LinkedIn
June 27, 2025
Three major legal developments this week highlight the complex landscape facing cybersecurity vendors and businesses.
When federal courts dismissed CrowdStrike passenger lawsuits from their July 2024 outage, Delta's $500 million lawsuit continued in Georgia state court. This split reveals how legal accountability varies dramatically by jurisdiction.
Meanwhile, AI call monitoring faces serious scrutiny. Against Cresta Intelligence, a federal lawsuit challenges standard "quality and training" disclosures. Apparently, these aren't sufficient when artificial intelligence analyzes conversations. At stake: $5000 penalties per call.
Offering cybersecurity safe harbor protections, Texas joins other states. Small businesses can avoid punitive damages by implementing recognized frameworks.
Rather than uniform standards, states keep building a confusing patchwork of cybersecurity laws.
Cyber News Weekly: AI Fraud & SEC Updates
LinkedIn
June 20, 2025
This week revealed how AI continues reshaping both fraud and regulation in unexpected ways.
Builder.ai's spectacular collapse exposes the dangers of mixing genuine innovation with financial deception. Despite raising $450 million from Microsoft and Qatar's sovereign wealth fund, the company fell apart when auditors discovered revenue projections inflated from $55 million to $250 million.
Meanwhile, North Korean operatives have weaponized AI-generated resumes to infiltrate Fortune 500 companies. Some groups collect over 70 paychecks monthly while stealing intellectual property and installing backdoors for future attacks.
Ironically, the SEC chose this moment to withdraw proposed AI regulations, including 48-hour incident reporting requirements for financial firms. While existing disclosure rules remain, the timing raises questions about regulatory priorities when AI-powered threats are accelerating.
These stories share a common thread: sophisticated technology amplifying traditional fraud schemes in ways that catch even experienced organizations off guard.
Weekly news context for June 20th, 2025
Linkedln
June 20, 2025
"Withdrawn proposals included potential 48-hour cybersecurity incident reporting requirements for investment advisers and broker-dealers. Withdrawn was the "predictive data analytics" rule that would have required these firms to "eliminate or neutralize" conflicts of interest arising from AI, machine learning, and algorithmic systems used in investor interactions. Financial institutions must understand what regulatory obligations remain in effect. Existing SEC cybersecurity disclosure rules for public companies (Form 8-K Item 1.05, adopted in July 2023) continue to require material incident reporting within four business days."
Cyber News Weekly: Gartner, Adidas, OpenAI
LinkedIn
June 13, 2025
This week's cybersecurity developments reveal some concerning gaps between investment and reality.
Data breaches now cost organizations $4.88 million on average. Even more troubling, companies need 277 days to identify and contain these incidents. Meanwhile, 74% of CEOs prioritize AI investments, yet only 3.3% of security leaders demonstrate the behaviors that actually drive effectiveness.
Two court cases highlight additional risks:
• Adidas faces a lawsuit after customer data was compromised through their third-party vendor
• A federal judge ordered OpenAI to preserve all ChatGPT conversations, including deleted ones
The Adidas case shows that outsourcing doesn't eliminate responsibility. Companies remain fully accountable when business partners fail. The OpenAI ruling creates new risks for organizations whose employees use personal ChatGPT accounts for work tasks.
Weekly news context for June 6th, 2025
LinkedIn
June 06, 2025
Three major cybersecurity developments are reshaping business operations this week. Unauthorized AI usage in professional services jumped from 48% to 72% in just one year. Secretly, one-third of professionals now use these tools daily, while over half lack proper technology support from their firms.
Starting April 2028, California's new CCPA cybersecurity audit requirements will impact large businesses. Personal liability now faces executives who must certify compliance under penalty of perjury. Companies with over $100 million in revenue should begin planning immediately.
Additionally, the FTC expanded COPPA rules to include biometric data like fingerprints and facial recognition patterns. Separate parental approval is now required when using children's information to train AI systems.
The disconnect between employee needs and corporate AI policies demands urgent attention from leadership teams.
Weekly news context for May 23rd, 2025
LinkedIn
May 23, 2025
Three major cybersecurity developments this week reveal changing industry standards.
* Courts now scrutinize data breach investigations when companies share reports with regulators. In Morrill v. Lakeview, forensic reports lost protected status after being provided to mortgage authorities. Separate documentation tracks are now essential for compliance versus litigation preparation.
* DORA implementation is leaving financial institutions struggling. Four months after taking effect, the EU regulation still has complexity around process identification and third-party risk management. Penalties reach 2% of global turnover for non-compliance.
* Delta's lawsuit against CrowdStrike cleared a major hurdle. After the faulty update cost Delta $550 million, a judge allowed negligence claims to proceed. Standard liability caps may not protect vendors when gross negligence occurs.
Weekly news context for April 18th, 2025
LinkedIn
April 18, 2025
Get the latest on AI washing fraud, NIST's new incident response framework, and GenAI cybersecurity risks for audit committees. Stay informed on key industry developments.
Weekly Cybersecurity News: Regulatory Updates
LinkedIn
April 11, 2025
Updates on HIPAA audits, SEC rules, and privacy regulations that impact your security compliance. Stay ahead of regulatory changes to protect your business.
Weekly News Context: April 4 Key Updates
LinkedIn
April 04, 2025
HIPAA violations, NYDFS deadlines, and false security claims lead to millions in penalties. Get the latest cybersecurity news to protect your organization.
Companies with mature GRC programs have an advantage over their competitors. However, something has been missing in the GRC world: the ability to truly understand an organization’s GRC maturity and the steps it would take to build the business case for change. That’s where the GRC Maturity Model comes in.
Hyperproof’s GRC Maturity model is a practical roadmap for organizations to improve their GRC maturity business processes to enter new markets and successfully navigate our rapidly changing regulatory and legal space. By providing a vendor-agnostic roadmap for how companies can improve key business operations, we can help even the playing field for everyone in GRC.
This extensive, peer-reviewed model written by Kayne McGladrey includes:
An overview and definition of Governance, Risk, and Compliance (GRC)
A summary of the four maturity levels defined in the model: Traditional, Initial, Advanced, and Optimal
An overview of the most common business practices associated with governance, risk, and compliance
A simplified maturity chart listing the attributes associated with each maturity level
A list of observable behaviors or characteristics associated with the maturity level to help you assess where your organization falls
A set of high-level recommendations for how to move from a lower level to a higher level
What’s new in cybersecurity for physical security systems?
Source Security
June 01, 2023
The article explores the growing cyber resilience in the physical security industry, highlighting increased customer demands for compliance testing, the burgeoning use of cyber-safe cloud services, and the global adoption of the zero trust framework. It underscores the role of robust cybersecurity controls and the impact of IoT technologies in transforming physical security systems' connectivity and security posture.
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Security Informed
June 01, 2023
Discover how manufacturers in the physical security industry are embracing enhanced cybersecurity measures and implementing them at scale. From streamlining maintenance and updates to integrating cloud solutions, these efforts aim to protect against evolving threats and human error. The article highlights the importance of compliance, secure communication, and training employees on best practices. Explore insights on zero trust principles, secure APIs, and evolving certifications, all contributing to the continuous improvement of cybersecurity in physical security systems.
Cyber Threat Prevention for PSOs: Credential Stuffing (Part 1 of 8)
PSVillage
May 17, 2017
Credential Stuffing, unfortunately, is not a new attack rather an existing attack that the bad guys have found a way to operate at economies of scale. Credential stuffing is a type of automated...
Cyber Threat Prevention for PSOs: Provisioning and De-provisioning (Part 2 of 8)
PSVillage
May 17, 2017
In this second episode of our 8 part series, Kayne McGladrey will be discussing Provisioning and De-Provisioning. In general, provisioning means "providing" or making a resource available. De-...
Cyber Threat Prevention for PSOs: Identity and Access Management (Part 3 of 8)
PSVillage
May 17, 2017
In this third episode of our 8 part series, Kayne McGladrey will walk you through three primary Identity and Access Management (IAM) systems available for your end users to have access to your...
Cyber Threat Prevention for PSOs: Privileged Access Management (Part 4 of 8)
PSVillage
May 17, 2017
In this fourth episode of our 8 part series, Kayne McGladrey will cover Identity Access Management system and a specific resource when it comes to where your client files are stored, or your...
Cyber Threat Prevention for PSOs: User and Entity Behavior Analysis (Part 5 of 8)
PSVillage
May 17, 2017
When a hacker has intercepted your credentials and login information and attempts to use that information, an effective User and Entity Behavior Analysis (UEBA) solution can be what saves you from...
Cyber Threat Prevention for PSOs: Multi-Factor Authentication (Part 6 of 8)
PSVillage
May 17, 2017
In this sixth episode of our 8 part series, Kayne McGladrey reviews Multi-Factor Authentication (MFA). MFA can be used in many instances to ensure the identity of a person trying to access or...
Cyber Threat Prevention for PSOs: Attestation Reporting (Part 7 of 8)
PSVillage
May 17, 2017
Kayne McGladrey discusses Attestation Reporting in the seventh video in this series. The goal of Attestation Reporting is to ensure that a user should have the access that has been requested and...
Cyber Threat Prevention for PSOs: Certification Campaigns (Part 8 of 8)
PSVillage
May 17, 2017
In this last video in the series of 8, We will see how the process of certification in consulting works. IGA, a governance administration tool, will produce certification reports and should work...
The proverbial endpoint is everywhere. Consumers have more IoT and mobile devices than ever before. Industrial IoT is becoming ubiquitous and IoT malware is as common as cell phones. While conveniences are making their way into every facet of life, so are malicious software, social engineering attack and all manner of bad actors.
Include Cybersecurity
Include Cybersecurity
January 05, 2018
Include Cybersecurity is a non-profit organization dedicated to changing the face of cybersecurity professionals. As a co-founder alongside Carmen Marsh, I am responsible for helping to find volunteers and speakers, moderating panel discussions, social media outreach, fundraising, and establishing connections with the many underrepresented communities in cybersecurity.
Senior member is the highest grade for which IEEE members can apply. IEEE members can self-nominate, or be nominated, for Senior Member grade.
To be eligible for application or nomination, candidates must:
* Be engineers, scientists, educators, technical executives, or originators in IEEE-designated fields
* Have experience reflecting professional maturity
* Have been in professional practice for at least ten years (with some credit for certain degrees)
* Show significant performance over a period of at least five of their years in professional practice
Top 50 IoT Influencers to follow in 2023
Engatica
November 08, 2022
Can IoT reach a level where businesses can build scalable solutions for the future? Will it help us have a better 2030? Well, the experts should know. And they should have a better idea of it.
Cloud Thought Leader of the Day ️
WhizLabs
July 09, 2021
Having 28+ years of experience in the field, Kayne McGladrey's role is to advise companies on how to uphold that social contract by managing risks and deterring and denying threat actors.
His consultative approach is the result of decades of experience working with Fortune 500 and Global 1000 companies. One of his career priorities is to inspire underrepresented communities to pursue careers in cybersecurity.
His simplification of complex concepts to non-tech audiences has given him more reach on his social platforms. His blogs are a must-read for both tech and non-tech people who are interested in cybersecurity.
Check out his blogs here: https://lnkd.in/efHU2Mp
Currently, he is working as Security Architect / Strategy and GRC Practice Lead at Ascent Solutions LLC, a premier productivity, security, and innovation consulting firm.
We thank Kayne for his exceptional contribution to the cloud discipline.
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
WhizLabs
April 19, 2021
Having 28+ years of experience in the field, Kayne’s expert approach on how to uphold that social contract by managing risks and deterring and denying threat actors is appreciated by many companies. One of his priorities is to inspire under-represented communities to pursue careers in cybersecurity. His simplification of complex concepts to non-tech audiences has given him more reach on his social platform. His blogs are must read for both technical and non-technical people who are interested in cybersecurity.
Top Cyber Pro Awards for 2020
Top Cyber Pro
December 01, 2020
Kayne McGladrey is a senior member of the IEEE and the cybersecurity strategist for Ascent Solutions. He has over two decades of experience in cybersecurity and has served as a CISO and advisory board member, and focuses on the policy, social, and economic effects of cybersecurity lapses to individuals, communities, and the nation.
How to Enhance Cloud Security Measures
Cyngular
May 14, 2024
In a post written by Kayne about what happens when agencies rely upon existing frameworks or rules that weren't originally designed for regulatory purposes, he states that there is the potential for complications: "Standards may evolve, leading to ambiguous regulations," he wrote, and, "In some cases, these standards could be outdated or not applicable to the current context."
Getting AI Right: 3 Challenges for the Future
IEEE Transmitter
October 25, 2023
AI systems need to be trained using data. But data sets are frequently made by people who can be biased or inaccurate. As a result, AI systems can perpetuate biases. This is especially true in hiring practices and in criminal justice, and managing those biases can be difficult.
“We can audit software code, manually or automatically, for privacy defects,” said IEEE Senior Member Kayne McGladrey. “Similarly, we can audit software code for security defects. We cannot currently audit software code for ethical defects or bias, and much of the coming regulation is going to screen the outcomes of AI models for discriminatory outcomes.”
Cybersecurity Concerns Continue
IEEE Transmitter
October 25, 2023
Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier 1 security operation center (SOC) analysts and incident responders. Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.
What is End-To-End Encryption? 7 Questions Answered
IEEE Transmitter
August 17, 2023
“End-to-end encryption is generally agreed upon as being a useful technology for protecting the data of businesses and consumers,” said IEEE Senior Member Kayne McGladrey. “Online shopping, for example, would not be as popular or feasible if a consumer’s payment information could easily be intercepted. Similarly, private video calls over the internet by senior executives or government officials would be far too risky if anyone could watch.”
Telehealth is Booming: Here’s What You Need to Know
IEEE Transmitter
October 26, 2020
Telehealth, often referred to as virtual doctor appointments, has been utilized in remote regions that do not have local medical resources for several decades. But when COVID-19 began impacting many countries across the globe, telehealth became the go-to method for checking in with your doctor about possible COVID-19 symptoms or other healthcare check-ups.
How to Keep Your Video Conferences Secure From Intruders
IEEE Transmitter
April 16, 2020
As the world adjusts to a “new normal” of remote education and work, video conferencing services have surged in demand as people take to these platforms to connect digitally. Yet, these platforms are susceptible to a variety of intrusions that could lead to the theft of private and company data or inappropriately distracting calls and meetings that leave participants feeling they have no control.
To protect your students, employees, families and yourself from these types of cyber disruptions, we asked IEEE Member Kayne McGladrey for cybersecurity tips for safe video conferencing.
Decreasing Risk Through Enterprise Compliance
CSHub
March 02, 2020
Compliance is often viewed as a reaction for organizations. The auditing of compliance becomes the event that is anticipated with resources and preparation aligned to culminate in the audit itself. A famous approach used in product development is that launch is a process, not an event. The spirit of that message is important for security leaders to consider in building a sustainable business case for compliance. Compliance should be viewed as a continuous, organizational process.
Should You Be Worried About Airport Cybersecurity Threats?
IEEE Transmitter
February 13, 2020
Navigating and traveling through an airport can be stressful. Trying to get through security while searching for a boarding pass and assessing whether there’s enough time to jump on that long line for a desperately needed cup of coffee is a universal experience.
With all of that juggling going on, the last thing on your mind are the cybersecurity threats that you might encounter at the airport along the way. Luckily, cybersecurity experts have already put into place a variety of technologies to protect us and keep our cyber lives safe while we travel. So take a deep breath and focus on getting to your seat in a timely manner instead.
Passwords, Multi-Factor Authentication and Cybersecurity
IEEE Transmitter
April 16, 2018
Device location and user behavior can shed a lot more light on a login attempt, yet not all MFA solutions currently incorporate them, says McGladrey. If organizations switched to better access management systems, the cost to successfully infiltrate accounts would rise exponentially, barring “all but the best-funded nation-state actors and APTs.”
Why AI Could be Cybersecurity’s Next Big Thing
IEEE Transmitter
February 16, 2018
For many organizations, analysts in security operations centers spend their days sifting through hoards of log files for suspicious activity. The repetitive nature of this work makes AI an ideal replacement, says Kayne McGladrey, IEEE Member, Director of Information Security Services at Integral Partners (US): “Artificial intelligence has been shown to be good at pattern recognition and correlation over a vast number of data points, and can make connections faster than human analysts would.”
Smart Office Controls
IEEE Transmitter
April 20, 2017
Forget light switches and thermostat buttons in the office. IoT sensors can control when lights go on and off, as well as heating and cooling in the office. Lights can go on and off based on your location.
IOT and Big Data: A Day in a Connected Life
IEEE Transmitter
April 05, 2017
How could your data be used?
“Office workers often find that all the meeting rooms are booked, which can mean consulting teams that arrive to meet with a client must search for an unoccupied meeting room in which to squat. Regardless of reservation status, IoT sensors can impassively detect if meeting rooms are unoccupied and offer them on a first-come, first-served basis.”
What are the security and privacy concerns with this device?
“Insecure IoT heating, ventilation and air conditioning systems are a threat to buildings and cities. For example, in the summer, a hard-coded administrative password in an IoT thermostat deployed in smart buildings in New York City could be compromised by an adversary who forces the thermostats to continuously run cooling systems. The spike in electrical usage could cause a very costly, life-threatening blackout.”
Understanding Cybersecurity Breaches at Consulting Firms
IEEE Transmitter
March 30, 2017
Cybersecurity threats are affecting consulting and professional service firms causing substantial losses. Kayne McGladrey (@kaynemcgladrey), an IEEE Member and professional services director, weighed in on how consulting firms can mitigate threats, keep client data safe and learn from current breaches.
How AI Is Changing the GRC Game
ISC2
October 28, 2025
Agentic AI is opening new possibilities — and raising new questions — for Governance, Risk, and Compliance (GRC). As organizations experiment with AI-driven agents, the path forward is full of both opportunities. In this session, we’ll share real-world experiences, insights, and a forward-looking perspective on how AI is reshaping GRC. Whether you’re just beginning to explore AI or already testing use cases, this session will help you understand what’s working, what to watch out for, and what’s ahead. What we’ll cover: - Early learnings from applying agentic AI in GRC - Firsthand experiences with AI-driven agents in compliance workflows - Common pitfalls and risks to be aware of when using AI - The future of GRC in an AI-driven world and where the opportunities lie
Tags: AI Governance, Cybersecurity, Risk Management
Introducing Hyperproof AI: Changing the Game for AI in GRC
Hyperproof
October 09, 2025
Agentic AI is opening new possibilities — and raising new questions — for Governance, Risk, and Compliance (GRC). As organizations experiment with AI-driven agents, the path forward is full of both opportunities. In this session, we’ll share real-world experiences, insights, and a forward-looking perspective on how AI is reshaping GRC and introduce you to Hyperproof AI: a full suite of AI features that will change the way you manage GRC.
Whether you’re just beginning to explore AI or already testing use cases, this session will help you understand what’s working, what to watch out for, and what’s ahead.
What we’ll cover:
- Early learnings from applying agentic AI in GRC
- Firsthand experiences with AI-driven agents in compliance workflows
- Common pitfalls and risks to be aware of when using AI
- The future of GRC in an AI-driven world and where the opportunities lie
- Hyperproof’s new AI features and how we’re partnering with customers and leading organizations to shape the future together
Join us for an engaging conversation about the future of AI in GRC and to get a look at Hyperproof’s new and exciting AI capabilities.
Tags: AI Governance, Cybersecurity, Risk Management
Executive Keynote on Cyber Risk as a Business Imperative
IEEE Computer Society Florida West Coast Section
June 18, 2025
You’re Invited: Executive Keynote on Cyber Risk as a Business Imperative
Cyber risks are no longer just IT issues—they are core business challenges with serious financial and reputational stakes. Join us for a powerful keynote that explores how cybersecurity must be integrated into business strategy at the highest levels.
What to Expect
Gain practical insights on:
Framing cyber risks as business risks
Communicating security priorities to stakeholders
Integrating cybersecurity into enterprise strategy
Allocating resources and measuring effectiveness
Building resilience across your organization
With real-world examples and actionable frameworks, this session is designed to empower executives and business leaders to make informed decisions that balance cost, compliance, and risk reduction.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
ISC2 Southern Connecticut Chapter
May 29, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society Santa Clara Chapter
May 28, 2025
Abstract
Cyber risks are not just technical issues but fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks meaningfully.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
GRC Maturity Model: A Roadmap for Cybersecurity Leaders
Hampton Roads Chapter of ISSA
May 06, 2025
This presentation delivers three essential insights for cybersecurity professionals: a comprehensive understanding of how the GRC Maturity Model's four levels influence compliance strategies, risk management approaches, and business operations; practical methodologies for evaluating organizational maturity and overcoming implementation challenges; and proven techniques for embedding compliance within strategic planning, implementing automation solutions, and cultivating a culture that proactively addresses compliance requirements. Attendees will gain actionable knowledge to advance their organization's compliance maturity framework, directly contributing to reduced risk exposure and enhanced operational efficiency across the enterprise.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society Central Indiana Chapter
April 14, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with
profound financial and reputational implications. This keynote addresses the intersection of
cybersecurity and business strategy, offering practical insights to help executives and business
leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks,
communicate them effectively to stakeholders, and integrate them into broader organizational
strategies. Real-world examples and actionable frameworks will equip leaders with the tools to
translate technical threats into business priorities. This presentation will also explore how to
allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience
across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that
balances cost, compliance, and risk reduction, ensuring your organization is prepared for the
challenges of today’s complex risk landscape.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE CS Richland
April 04, 2025
In today’s business environment, cyber risk is a growing concern that goes beyond IT departments. It is a strategic issue that requires the attention of executives and business leaders. This keynote presentation offers a business-centric approach to understanding, managing, and mitigating cyber risks, enabling leaders to address these challenges with confidence.
Act One begins with an overview of the modern cyber risk landscape, positioning cybersecurity as a core business issue. We will examine the financial and reputational stakes of cyber incidents, grounding the conversation in tangible impacts that resonate with business decision-makers. The audience will leave this section with a clear understanding of why addressing cyber threats is critical to their organization’s success.
Act Two focuses on practical strategies for integrating cyber risk into business strategy. This includes defining cyber risks in business terms, aligning cybersecurity efforts with organizational goals, and translating technical concerns into actionable business insights. Attendees will learn how to communicate cyber risks effectively to stakeholders, including boards, executives, and external partners.
Key points will include:
Bridging the gap between IT and business through shared understanding.
Prioritizing cyber threats based on their business impact.
Building business-centric cybersecurity strategies that support enterprise objectives.
Act Three explores methods for reducing enterprise risk through focused cybersecurity efforts. This includes identifying critical areas for investment, implementing effective controls, and measuring the success of cybersecurity programs. Attendees will learn how to allocate resources efficiently, design controls with maximum impact, and track the business value of their cybersecurity initiatives.
By the end of the presentation, participants will have actionable insights and tools to:
View cyber risks through a business lens.
Communicate their significance to internal and external stakeholders.
Develop and implement strategies that prioritize business resilience.
This session is ideal for executives, board members, and business leaders looking to enhance their organization’s approach to cyber risk and align cybersecurity efforts with strategic goals.
Cyber Risk - a Business Imperative: Translate Threats into Strategic Action
ISC2 Seattle
April 03, 2025
Summary:
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
Cyber Risk as a Business Imperative
ISC2 SoAZ
March 20, 2025
The meeting will be held online via Zoom and you will receive the link when you register. In this meeting, we will have a cybersecurity-related presentation, an ISC2 Corporate and Chapter update, discuss recent cybersecurity news and community announcements, and have a group discussion on a cybersecurity topic.
When:
Thursday, March 20th, 6:00pm to 8:00pm
Agenda:
ISC2 Southern Arizona Chapter Meeting
Introductions
Chapter Business
ISC2 Corporate Update
Cybersecurity News
Community Announcements (Events, Jobs, etc.)
Presentation: Cyber Risk as a Business Imperative by Kayne McGladrey, CISSP
Group Discussion: Open Cybersecurity Topics
March ISC2 Boulder Chapter Meeting
ISC2 Boulder Chapter
March 20, 2025
Calling all cyber security professionals to the March Chapter meeting for the ISC2 Boulder Chapter. Guest speaker Kayne McGladrey will share a strategic look at translating cyber threats into business priorities, helping security leaders communicate risk effectively and integrate cybersecurity into organizational decision-making.
https://us02web.zoom.us/meeting/register/XZwV7C0BQ5O-JsW3TJctuA?_x_zm_rtaid=T-wxLuIMTFWKn1FJguURXw.1740686574566.c1dc2f2350c612f0cec2095b50f7ac37&_x_zm_rhtaid=6#/registration
IEEE CS Boise Section Chapter
March 17, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with
profound financial and reputational implications. This keynote addresses the intersection of
cybersecurity and business strategy, offering practical insights to help executives and business
leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks,
communicate them effectively to stakeholders, and integrate them into broader organizational
strategies. Real-world examples and actionable frameworks will equip leaders with the tools to
translate technical threats into business priorities. This presentation will also explore how to
allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience
across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that
balances cost, compliance, and risk reduction, ensuring your organization is prepared for the
challenges of today’s complex risk landscape.
Kayne McGladrey Presents: Cyber Risk as a Business Imperative
Rochester Professional Consultants Network
March 14, 2025
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
In today’s business environment, cyber risk is a growing concern that goes beyond IT departments. It is a strategic issue that requires the attention of executives and business leaders. This keynote presentation offers a business-centric approach to understanding, managing, and mitigating cyber risks, enabling leaders to address these challenges with confidence.
Cyber Risk as a Business Imperative
ISC2 Central Mississippi Chapter
March 11, 2025
I'm pleased to announce the March 2025 meeting of the ISC2 Central Mississippi Chapter. It will be held Tuesday, March 11th at 12:15 PM on Google Meet. This meeting will be virtual only.
Our speaker will be Kayne McGladrey, an ISC2 CISSP holder, a senior IEEE member, and author of the GRC Maturity Model. With nearly three decades of experience in cybersecurity, he specializes in helping organizations navigate governance, risk, and compliance (GRC). His presentation will be on "Cyber Risk as a Business Imperative".
Advancing Compliance with the GRC Maturity Model: A Roadmap for Cybersecurity Leaders
IEEE Rock River Valley Section
February 27, 2025
Organizations face increasing regulatory, contractual, and legal compliance requirements, yet many struggle with fragmented processes and reactive approaches. The Governance, Risk, and Compliance (GRC) Maturity Model provides a structured framework to assess and enhance compliance programs, aligning them with strategic business objectives.
This session will guide cybersecurity professionals through the four levels of GRC maturity—traditional, initial, advanced, and optimal—illustrating how each stage impacts risk management and operational efficiency. Attendees will learn how to evaluate their organization's current maturity level, identify gaps, and implement targeted improvements to streamline compliance efforts.
Through real-world examples and practical strategies, this presentation will demonstrate how advancing GRC maturity enhances collaboration, reduces compliance risks, and supports long-term business resilience. Whether an organization is starting to formalize compliance processes or aiming for an optimized, risk-based approach, attendees will gain actionable insights to drive meaningful improvements.
Unveiling the 2025 IT Risk and Compliance Benchmark Report: Top Findings to Start Your Year
Hyperproof
January 23, 2025
Join us on January 23rd at 11am PT / 2pm ET as we unveil the findings from Hyperproof’s sixth annual IT risk and compliance benchmark report. Each year, we ask over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to provide an in-depth view of the market’s current state and what to expect for the coming year.
2024 was a milestone year for governance, risk, and compliance (GRC). As companies grappled with increasing regulatory demands, growing stakeholder expectations, and an ever-expanding risk landscape, the importance of maturing GRC programs rose to prominence. Learn about how over the last year, the perception of GRC across organizations has transformed from merely a checkbox exercise to a driver of operational excellence and strategic growth — a trend that is strongly represented in the data.
Join us as we explore:
- Our top findings, an in-depth look at the data from 2024, and an analysis of how these findings will impact GRC in 2025
- How organizations responded to new EU regulations and how these regulations might affect 2025
- Why and how organizations are making deliberate efforts to mature their GRC practices
- The drivers behind why GRC teams expanded in 2024 and why they are expected to continue to grow in 2025
- How organizations in 2024 leveraged generative AI to streamline their processes
Unveiling the 2025 IT Risk and Compliance Benchmark Report
ISC2
January 23, 2025
Join Erin Nelson and me for the unveiling of Hyperproof’s 2025 IT Risk and Compliance Benchmark Report. This year’s report captures the insights of over 1,000 GRC professionals and reflects a transformative year for governance, risk, and compliance. We’ll break down the data to reveal how organizations responded to evolving regulations, scaled their teams, and leveraged generative AI to optimize risk management processes.
You’ll also hear about the growing recognition of GRC’s role in driving strategic growth and operational excellence. Erin and I will walk through the drivers behind these trends, examine the impact of new EU regulations, and provide a forward-looking analysis of how these findings set the tone for 2025. Don’t miss this opportunity to gain practical insights that can help guide your organization’s approach to IT risk and compliance in the year ahead.
January 23, 2025 10:00 a.m. - 11:00 a.m. Eastern time
New Year, New Standards: Preparing for SEC Cybersecurity Disclosures in 2025 and Beyond
CIO & CISO Atlanta Summit
December 05, 2024
The SEC’s new cybersecurity disclosure requirements have set a new benchmark for transparency and accountability, compelling public companies to enhance their cybersecurity practices and reporting.
In this session, you’ll learn how to align your organizations with these evolving requirements and take proactive steps to stay ahead of regulatory expectations.
In this session, we’ll join Kayne McGladrey, Field CISO at Hyperproof, to discuss:
An overview of the 2024 SEC cybersecurity requirements
Best practices for cybersecurity disclosures
How to prepare for the 2025 disclosure season
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
ISC2
October 25, 2023
As CISOs make plans to secure operating budgets for the new financial year, they face the age-old challenge of convincing stakeholders, who often see cybersecurity and privacy as a cost center, to invest in this area. It's time to change the narrative. Discover how to drive more productive conversations about cybersecurity as a strategic growth enabler. Take home actionable ideas for proactively managing controls and risks, increasing efficiency and reducing costs.
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Hyperproof
February 23, 2023
Hyperproof conducts an annual survey to uncover the top challenges IT compliance professionals face and what hot topics they’re focused on in the coming year. We’ve asked over 1,000 survey respondents about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to provide an in-depth view of the market’s current state and what to prepare for this year.
We’ll cover:
The top five findings from the survey
How your peers are planning to handle compliance, audit management, and risk management in the midst of a volatile economy
What companies are doing differently in response to recent and highly publicized security breaches to avoid security lapses and compliance violations
Leading practices for ensuring security, compliance, and risk management today
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
SC Magazine
May 17, 2022
Whenever a key business function is hosted by a cloud-based vendor, your organization cedes a certain amount of control to the service provider. And that sometimes means that your security team lacks visibility into how this third party handles sensitive data and to what degree it successfully meets regulatory compliance standards around privacy and data security. This session will identify some of the most common gaps in visibility and compliance to develop between companies and their SaaS, PaaS and IaaS providers, and explain the root causes behind these lapses so that your own company hopefully can avoid some of these pitfalls.
Opening keynote speech at the Seattle Electrical Conference
Seattle Electrical Conference
December 22, 2020
Our key note speaker Kayne McGladrey today will discuss Cybersecurity. Keeping our websites and our networks secure is one of our biggest challenges in our digital age.
Keynote speech at CIA Conference 2020
CIA Conference
October 26, 2020
Prepare and adapt yourself to evolving threat landscape by listening to our next keynote speaker Mr. Kayne McGladrey, will speak on "Deter, Deny and Defend Against Cyber Attacks."
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
Colloquium for Information Systems Security Education
September 28, 2020
On November 4th at 8:15 AM Pacific, Kayne McGladrey, CISSP, will give the keynote speech at the Colloquium for Information Systems Security Education and discuss the social and economic impacts of cyber security during a pandemic. Registration is free.
Why Phishing Training Doesn’t Work
IEEE Transmitter
October 10, 2025
IEEE Senior Member, Kayne McGladrey said that “AI-generated phishing removes all the traditional warning signs that training programs teach people to look for.” Typical training tells people to watch for bad grammar, weird formatting or implausible scenarios. “However, AI can now create emails that are grammatically perfect, properly formatted and believable. It can even personalize attacks using information scraped from social media or data breaches.”
Zero trust isn’t a feature, it’s a philosophy
SpiceWorks
September 18, 2025
That’s an excellent point. Hyperproof CISO in residence Kayne McGladrey observed, “The zero trust concept itself isn’t broken – it’s more about how it’s being implemented in practice.”
Digital twins are here…and cybersecurity risks are right behind them
IT Brew
September 17, 2025
Kayne McGladrey, CISO in residence at Hyperproof, added that intellectual property theft is another risk for organizations, as a malicious actor may seek to access a digital twin to find a way to gain a competitive advantage over another company.
Securing Smart Water
Water Online
September 05, 2025
In the following Q&A, I discuss these and other issues with Kayne McGladrey, IEEE senior member and field CISO at Hyperproof, who has more than 20 years of experience in building effective cybersecurity programs for organizations of all types, including Fortune 500 and Global 100 companies. But today Kayne is keen on water, addressing the developments, needs, and requirements regarding cybersecurity for those who steward the nation’s critical infrastructure.
Under siege: Why airlines have been prime targets for cyberattacks
Travel Weekly
September 02, 2025
As far as attacks by state espionage services, McGladrey said airlines aren't the only target within the travel industry. An attack on the reservation system of Marriott's Starwood brands in 2018, which exposed nearly 500 million customer records, is believed to have been perpetrated by China. Generally, espionage attacks aren't geared toward credit card fraud and personal account takeovers the way criminal cyberattacks can be, McGladrey said, but there's always a chance a government hacker will moonlight on the dark web.
How Agentic AI Could Expose Your Most Sensitive Personal Data
Business News this Week
August 28, 2025
The privacy risks associated with agentic AI are orders of magnitude greater than those we encounter today.
“Agentic AI requires comprehensive data integration that’s fundamentally different from today’s siloed approach, meaning the risk multiplies instead of simply adding up,” IEEE Senior Member Kayne McGladrey said.
Tags: AI Governance, Cybersecurity, Risk Management
Skepticism, Cybersecurity & AI: Leadership Lessons from Kayne McGladrey | Top Innovator Series
Top Innovator
August 26, 2025
In this Top Innovator episode, host Josef Martens interviews Kayne McGladrey, Hyperproof's CISO in residence and globally recognized cybersecurity thought leader, about his leadership journey. Kayne highlights two core traits - intellectual curiosity and skepticism - as essential for navigating today’s noisy, AI-driven business landscape. He credits mentors and extensive cultural travel for teaching him to seek others’ perspectives and avoid value-based assumptions about motives. To deepen empathy and organizational insight, he urges professionals to rotate through different functions, from help desk to marketing, even if only for short stints. Kayne also stresses the importance of adapting one’s communication style based on feedback and audience, especially for technically inclined leaders. He advises separating personal pride from recommendations, acknowledging that well-founded proposals may not always be acted upon. Looking ahead, Kayne is channeling his experiences into writing a book about risk management and believes AI will soon reshape how leaders learn, make decisions, and deliver value.
Tags: AI Governance, Cybersecurity, Risk Management
Dark Reading News Desk Is Back at Black Hat
Dark Reading
August 01, 2025
Dark Reading's 2025 News Desk marks a decade of Black Hat USA memories. We're making our return with a slate of interviews that help you stay up on the latest research from Black Hat — no trip to Las Vegas required.
Tags: AI Governance, Cybersecurity, Risk Management
How Agentic AI Could Expose Your Most Sensitive Personal Data
IEEE Transmitter
July 30, 2025
“Agentic AI requires comprehensive data integration that’s fundamentally different from today’s siloed approach, meaning the risk multiplies instead of simply adding up,” IEEE Senior Member Kayne McGladrey said.
The current crop of consumer algorithms processes data for specific purposes, and they usually ask for permission.
“Agentic AI proactively gathers information across multiple domains and makes autonomous decisions about how to use it,” McGladrey said. “Today’s systems typically require user approval for actions, but agentic AI is designed to operate independently with minimal human oversight, creating new categories of liability exposure.”
Tags: AI Governance, Cybersecurity, Risk Management
Microsoft hack risk spreads as cybercriminals and nation-states pile in
Axios
July 22, 2025
"Because the attack blends in with just normal, legitimate activity, it's quite hard to detect what's unusual and what's atypical," Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers, told Axios.
Local Governments Streamline Remote Access With SASE
State Tech Magazine
July 22, 2025
“State agencies facing budget constraints might appreciate SASE’s potential cost efficiency through reduced hardware investments and the ability to scale security services based on actual needs,” says IEEE Senior Member Kayne McGladrey.
AI, Business Risk & Threat Management: a CISO’s guide
Cyber Sidekicks
June 24, 2025
This week’s special guest Kayne McGladrey, (blog: kaynemcgladrey.com ), CISO-in-Residence at Hyperproof, outlines the business challenges that CISO's face, as we discuss new types of risk in daily threat management.
Bridging the AI Skills Gap: Top Strategies for IT Teams in 2025
ITPro Today
December 11, 2024
Kayne McGladrey, IEEE senior member and field CISO at Hyperproof, said AI ethics skills are important because they ensure that AI systems are developed and used responsibly, aligning with ethical standards and societal values.
How AI poses a threat to election security
Security Magazine
October 07, 2024
“We can anticipate a significant increase in disinformation and phishing attacks as the United States prepares for early or mail-in voting in the 2024 elections. The majority of these attacks will likely come from cybercriminals spreading disinformation about how and where to vote. This year’s phishing campaigns may be more sophisticated and widespread, as non-native English or Spanish speakers will be able to leverage large language models to produce realistic messaging,” says Kayne McGladrey, IEEE Senior Member.
AI’s Human Mimicry Spurs ‘Personhood Credential’ Proposal
PYMNTS
September 05, 2024
"Security concerns also loom. As McGladrey said, threat actors would likely constantly attack centralized personhood credential providers. However, the level of encryption used in such a system may improve current security measures."
How Safe and Secure Is GenAI Really?
Information Week
August 08, 2024
“After all, AI serves as both a force accelerator, as it will allow those threat actors to operate at large scale without having to increase the size of their workforce. At the same time, the ability of AI to generate convincing-enough speech in another language will serve to open new markets to threat actors who might have previously employed linguists,” says Kayne McGladrey, Field CISO a Hyperproof.
6 tips for consolidating your IT security tool set
CSO Online
July 11, 2024
All controls and tools should be linked to a reduction in the probability or likelihood of a risk that’s above the organization’s tolerance level, says Kayne McGladrey, CISO at risk management provider Hyperproof and a senior member of IEEE. If there’s no longer a need for a product, it should go.
SEC Cyber Risk Disclosures: What Companies Need to Know
ISMG
June 12, 2024
In this video interview with Information Security Media Group at the Cybersecurity Implications of AI Summit, McGladrey also discussed:
* Why companies should use tools and software to collect and automatically gather evidence of compliance;
* The consequences of false cyber risk disclosures;
* The impact that SEC requirements have on private companies and supply chains.
AI system poisoning is a growing threat — is your security regime ready?
CSO Online
June 10, 2024
Although motivations like that mean any organization using AI could be a victim, Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers (IEEE), a nonprofit professional association, and field CISO at Hyperproof, says he expects hackers will be more likely to target the tech companies making and training AI systems.
But CISOs shouldn’t breathe a sigh of relief, McGladrey says, as their organizations could be impacted by those attacks if they are using the vendor-supplied corrupted AI systems.
Lodi, Calif., Built a Ransomware Defense Matrix with Multiple Solutions
State Tech
June 04, 2024
“To defend against ransomware, organizations must adopt a comprehensive, layered approach to cybersecurity, encompassing people, technology and processes,” says IEEE Senior Member Kayne McGladrey.
In addition to identifying suspicious emails, “technologies such as anti-virus software, endpoint detection and response systems, automated patching, threat intelligence feeds, and encrypted offline backups further mitigate the risk of ransomware,” he says.
AI models inch closer to hacking on their own
Axios
April 26, 2024
The big picture: AI model operators don't have a good way of reigning in these malicious use cases, Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers (IEEE), told Axios. Allowing LLMs to digest and train on CVE data can help defenders synthesize the wave of threat alerts coming their way each day. Operators have only two real choices in this type of situation: allow the models to train on security vulnerability data or completely block them from accessing vulnerability lists, he added. "It's going to be a feature of the landscape because it is a dual-use technology at the end of the day," McGladrey said.
The Jobs of Tomorrow: Insights on AI and the Future of Work
CXOToday
April 23, 2024
Kayne McGladrey, IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions. “Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
Hacker Summer Camp at the Leatherneck Club
SemperSec
August 07, 2025
Get ready for an exciting in-person event at the Leatherneck Club! Join us for a weekend filled with hacking challenges, workshops, and networking opportunities. Whether you're a seasoned hacker or just starting out, there's something for everyone at Hacker Summer Camp. Don't miss out on this unique opportunity to learn, connect, and have fun with fellow hackers. See you there!
Tags: AI Governance, Cybersecurity, Risk Management
EU Regulations as a Strategic Compass for US Companies
#RISK New York
July 10, 2025
In an era of global uncertainty, EU regulations are emerging as a critical guidepost for US companies navigating complex compliance landscapes.
This panel will explore how aligning with EU regulatory standards can offer strategic advantages, from enhancing global market access to strengthening risk management and corporate governance.
Navigating the World of US Regulations: What You Need to Know
Data Protection World Forum
December 10, 2024
Navigating the complex web of US regulations is critical for organizations striving to ensure compliance and mitigate risk. This session will offer a comprehensive overview of the current US regulatory landscape, highlighting key regulations, trends, and their implications for businesses across various sectors.
Expert Predictions for 2024
GPSec
November 27, 2023
An illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion explores controversial key areas shaping the landscape in the coming year.
Cyber Budgets Taking a Step Back
Maturity in Vulnerability Management
AI Effects on Cybersecurity Job Market
Experts provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024.
Don’t miss the opportunity to stay ahead of the curve in a rapidly evolving digital world.
Keynote Panelists
Michael Fulton, Vernovis, Chief Information Officer
Warner Moore, Gamma Force, Founder & vCISO
Joe Otten, Fifth Third Bank, Sr. Director, Information Security
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
Whova
November 14, 2023
Join us for an illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion will explore controversial key areas shaping the landscape in the coming year.
- Microsoft Security Co-pilot Effects
- Cyber Budgets Taking a Step Back
- Impact of War Climate on Cybersecurity
- Maturity in Vulnerability Management
- AI Effects on Cybersecurity Job Market
Our panel of experts will provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024. Don’t miss this opportunity to stay ahead of the curve in a rapidly evolving digital world.
A 2023 Regulatory Round-Up and How to Prepare for 2024
ISACA
October 30, 2023
This year has brought a number of regulatory changes and updates. From the SEC’s new guidance to updates to the industry go-to standards of NIST CSF, 2023 was yet another year of cyber security and compliance evolution. With every shift in regulatory guidance or requirement, should come a shift in the way organizations are thinking about the way they are protecting their data and the data of their customers. Join our panel of experts as they not only discuss what we’ve seen change in 2023, but also how they suggest security and risk professionals strategically prepare for the year ahead.
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
ISACA
March 22, 2023
Emerging from a global pandemic, businesses must re-evaluate their processes and procedures to adapt to the new normal. This includes the Risk Management processes. It is more than an ever for businesses to implement processes that will safeguard the company’s assets which includes information. An asset is something of value and in today’s society information is very valuable and must be protected. How does an organization ensure the confidentiality, integrity, and availability of its information assets and the systems that support them? The digital transformation continues, and new technologies continue to emerge. This virtual summit will cover topics that will cover tools and techniques necessary to identify, assess and respond to risk associated with emerging technology and the company’s assets.
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
Compliance Week
February 15, 2023
* Deep dive look into interpreting the different emerging US data privacy state laws and the consequences of non-compliance
* Learn about the requirements of the SEC cybersecurity rules and the ramifications for public companies
* Discuss the security programs that need to be implemented to comply with local and international regulations and rules.
ISACA Virtual Summit 2022: Pursuing Digital Trust
ISACA
December 07, 2022
The digital space is the primary method of retaining data and transacting in today’s business landscape. But with the increase in cyberattacks, scams and security breaches, a secure digital world is more important than ever. Cybersecurity, risk, data privacy, governance and assurance are essential processes in the modern business landscape and are critical to helping enterprises become digitally trustworthy, enhance their reputations and increase their brand loyalty with consumers.
Streamlining GRC Controls to Optimize Cybersecurity
IT GRC Forum
November 17, 2022
On this webinar, we will discuss how to streamline GRC controls and optimize cybersecurity risk management processes, to enable leaders to determine what investments best reduce risk with the best return on investment (ROI). Attendees will learn how to:
* Simplify GRC and security operations by reducing the number of controls your organization has to deal with, therefore reducing its workload to test and audit the controls
* Develop a set of controls baselined to the internal and external requirements that your organization needs to meet
* Enable both security process automation and enterprise risk decision-making
* Shrink your organizations cybersecurity attack surface
Finding a long-term solution to curb Cybercrimes in the digital sphere: A Global Perspective
WebForum
November 08, 2022
This was the 7th series of WebForum which was in line with this year’s International CyberSecurity Awareness Month theme "See you in cyber - #becybersmart” held on 28th October 2022.
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
DotConnectAfrica
October 25, 2022
The findings of the webforum will inform African countries, businesses, and the global community of the key issues that need to be addressed in order to curb cyber crimes from ethical hacking, implications of data sovereignty and cloud, implications of metaverse and Web 3.0, and data privacy in the cloud. It will also demonstrate the global community’s commitment to the shared objective of protecting citizens, businesses, and organizations in the digital era. This will be imperative to prevent more damaging cyber-attacks, which could have devastating impacts.
SECtember 2022: Transforming Security Along with the Business
SECtember
September 28, 2022
As we all know, decisions that get made to transform the business are not always the best decisions for security. Especially with the accelerated digital transformation of the last few years, now is the time to reassess whether security teams have been properly tracking and addressing all cloud and digital assets that their organizations have taken on. This panel of experts will discuss the challenges of tracking cloud assets, if their risk is being properly measured, and ultimately whether security teams are properly supporting business transformation decisions.
The Future of Health Tracking Apps
CIO Tech Talk
September 01, 2022
Join us live on Twitter Spaces as we discuss:
* how safe patient medical information is with tech firms?
* the challenges health tracking apps present for users?
* how can users protect their data while still using health tracking apps
* red flags users should look out for when choosing or using health tracking apps
* What can tech firms do with data from health tracking apps
Cloud Adoption Outpaces Security
Sub-Four Capital
May 24, 2022
Cloud adoption has been rapidly rising for years and exploded as a result of the COVID-19 pandemic. With a remote workforce, companies needed the accessibility, flexibility, and scalability offered by cloud-based solutions. However, while many companies are moving rapidly to the cloud, security is lagging behind. Cloud infrastructure is very different from an on-premise data center, and these differences introduce unique security challenges. Many companies are still working to understand these differences, leaving their cloud deployments at risk. For many companies, the security of their public cloud infrastructure is a significant concern.
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Sub-Four Capital
May 24, 2022
When it comes to data breaches, they say not if but when. Preparing your business to quickly and competently respond to a data incident starts with the creation of an Incident Response Plan. Understanding the topics covered in an IRP and then making choices that are best for your business helps ensure that the IRP will work in your time of crisis response.
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Dark Reading
November 17, 2021
Today’s cybersecurity environment features a wide range of available threat intelligence, ranging from simple vulnerability alerts to commercial services that monitor threat actor behavior. But how can you use that data to assess the security posture of your own organization? How can you harness threat intel to measure cyber risk? In this panel, threat intelligence experts offer advice and recommendations on how threat intelligence can be used as a means to measure your attack surface.
Returning to the Office: Security Threats and Proactive Solutions
Ascent Solutions
May 13, 2021
A year after the pandemic began, employers are now considering how to welcome their employees back to the office. Join Ascent cybersecurity leaders, Derek Swenningsen and Kayne McGladrey for a discussion on the challenges and threats that are emerging in the modern workplace.
While there are obvious threats, such as threat actors sending phishing lures with fake return to work information, there are less obvious threats, such as IT assets that have not connected to your corporate LAN in a year.
Our experts will take audience questions and discuss the proactive cybersecurity steps that businesses and organizations can take to prepare for employees returning to offices in a hybrid working environment.
How Hackers Used and Abused the Pandemic to Profit
Infosecurity Magazine
March 24, 2021
In this session, a panel of experts will reflect on the various ways in which hackers have targeted the pandemic over the past 12 months, lifting a lid on the methods employed and outlining how businesses and users can best protect themselves from ongoing COVID-related attacks, scams and fraudulent activity.
CISO Perspectives: Zero Trust-As-A-Service
CSHub
November 05, 2020
Join Pulse Secure’s Global Chief Security Architect and Ascent Solutions cybersecurity strategist Kayne McGladrey, CISSP in this webcast to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
This webinar will take place on:
November 05, 2020
11:00 AM - 12:00 PM EST
#IDGTechtalk : A 2019 Recap and 2020 Predictions
IDG Communications, Inc.
December 19, 2019
We will be discussing 2019 trends and looking ahead to a new decade of amazing tech advancements at the final #IDGTechTalk of the year. Join us on Twitter by following #IDGTechTalk at 9 AM Pacific on December 19th, 2019.
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
Cyber Security Hub
November 13, 2019
Cyber Security is still primarily seen as an ‘IT issue’ and this often means that security often gets “bolted on” rather than embedded in a company’s ecosystem. In this panel discussion, discover why everyone within the business is responsible for Cyber Security and how to educate the enterprise on safeguarding customer data.
Key takeaways
- Improve security by creating a culture of healthy suspicion
- Encourage the executive board to communicate policies
- Ensure best practice is maintained throughout your business
Tags: AI Governance, Cybersecurity, Risk Management
CISOs, AI & Trust | Conor Sherman, Sysdig | InfoSec Pros on the Road
LinkedIn
September 25, 2025
Join us live from Black Hat 2025 as Kayne, CISO in Residence at Hyperproof, sits down with Conor Sherman, CISO in Residence at Sysdig, to explore the evolving role of CISOs in an era defined by AI adoption, enterprise trust, and cybersecurity leadership. In this conversation, we dive into defining agentic AI, how security leaders are adapting their responsibilities, and what new competencies are essential to balance AI safety, governance, and business continuity. We also discuss the challenges of building trust with executives and boards, the limitations of traditional risk frameworks, and the underestimated AI-related security opportunities organizations must prepare for. Whether you’re a security professional, business leader, or simply interested in the future of AI and cybersecurity, this episode of Infosec Pros offers valuable insights into how CISOs are shaping strategy, frameworks, and resilience in a rapidly changing threat landscape.
Tags: AI Governance, Cybersecurity, Risk Management
FedRAMP Readiness: Lessons for SaaS & Growing Enterprises | Drafting Compliance S2 Ep. 6
Hyperproof
August 29, 2025
FedRAMP compliance is one of the toughest challenges facing SaaS companies working with the federal government, and in this episode we explore the most common readiness gaps, misconceptions, and cultural shifts organizations must overcome to succeed. Drawing from extensive experience advising technology companies, we discuss why small SaaS firms often struggle with operational maturity, why FedRAMP compliance timelines frequently extend far beyond initial expectations, and how federal updates such as FedRAMP 20x and NIST 800-171 adoption are reshaping requirements across the supply chain. We cover strategies for managing executive accountability, building sustainable compliance programs, preventing compliance drift, and avoiding costly project delays. Whether you are a startup or a large enterprise seeking FedRAMP authorization, this conversation offers practical insights into achieving and maintaining compliance while adapting to evolving federal requirements.
Tags: AI Governance, Cybersecurity, Risk Management
Leadership in Cybersecurity and AI | Richard Bird, Singulr AI | InfoSec Pros on the Road
Hyperproof
August 20, 2025
In this RSA 2025 interview, Richard Byrd reflects on a “Benjamin Button” cybersecurity career that evolved from a win-at-all-costs mindset to a mission-driven leadership style focused on making the digital world safer. He emphasizes that top organizations unite cybersecurity, physical security, and enterprise risk under a capable CSO who speaks the language of business and the board. Effective governance, he argues, demands a full lifecycle approach—approval, monitoring, and decommissioning—to prevent persistent vulnerabilities. The democratization of AI has led to shadow apps and untracked code that static security frameworks like OSI and zero trust can’t adequately protect. Current regulatory efforts such as the EU AI Act and NIST guidelines are largely aspirational, lacking the prescriptive power needed to curb malicious AI use. Byrd warns against overreliance on encryption, noting that misconfigurations and AI’s relentless drive to fulfill its objectives can render traditional cryptographic safeguards obsolete. He calls for a renewed focus on foundational controls, proactive AI governance, and evidence-based regulation to meet the accelerating challenges of AI-enabled threats.
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
IEEE Computer Society of Chicago
February 27, 2025
Cyber threats continue to grow, but many organizations still treat them as technical problems instead of business risks. This presentation challenges that mindset, providing a business-centric approach to understanding, prioritizing, and mitigating cyber risks in a way that makes sense to executives, boards, and other key stakeholders.
I’ll be covering how to bridge the gap between cybersecurity and business strategy, helping leaders take a proactive role in cyber risk management. We’ll discuss how to effectively communicate risks in terms of financial and operational impact, integrate cybersecurity into broader business planning, and allocate resources where they matter most. With real-world examples and practical frameworks, I’ll outline how organizations can build a more resilient and risk-aware culture.
Whether you're a business executive, security leader, or decision-maker, this session will equip you with the tools to engage in meaningful conversations about cyber risk and ensure your organization is prepared for what’s next.
Feb 27th from 6 PM - 7 PM Central Time
#cybersecurity #risk #webinar #presentation
Kayne McGladrey Of Hyperproof On Cybersecurity Compliance in the Age of AI Threats
Authority Magazine
December 09, 2024
"Compliance with regulatory standards and industry-specific guidelines for product security is an indispensable part of cybersecurity. In an age where malicious AI poses a significant threat, how do organizations ensure their product security strategies are not just effective, but also fully compliant? As a part of this series, I had the pleasure of interviewing Kayne McGladrey."
Zero trust secures agile business transformation
CIO
October 30, 2023
CIOs should collaborate closely with CISOs to evaluate which zero trust controls will offer the most significant mitigation of agreed-upon business risks. Once specific controls are implemented, they can be centralized and reused across the various compliance standards like SOC 2 Type 2, ISO 27001, and PCI, delivering greater flexibility. “The key lies in the deliberate selection of zero trust controls aimed at reducing specific business risks while potentially streamlining existing compliance efforts,” explains Kayne McGladrey (@kaynemcgladrey), field CISO at Hyperproof and senior IEEE member.
AI lifts workforces to new heights of efficiency and innovation
CIO
February 07, 2025
Kayne McGladrey, Field CISO at Hyperproof and Senior IEEE Member, says cybersecurity is also fertile ground for AI. “CISOs are looking at AI and automation solutions that handle common cybersecurity tasks. These include collecting evidence of control operations for the internal audit team, testing that evidence automatically, and producing regular reports on such things as false-positive cybersecurity events. These tasks help overworked cybersecurity analysts and engineers to focus on the parts of the job that they love without burdening them with excessive paperwork.”
How to Protect and Secure Your Data in 10 Ways
TechRepublic
January 28, 2025
“Companies should conduct thorough risk assessments to identify and mitigate potential harms associated with AI products, understanding their limitations and potential misuse,” McGladrey said. “Maintaining clear documentation of AI system metrics and methodologies, along with disclosing any known risks or limitations to customers, is essential for transparency.”
Data Privacy Day 2025: Insights from Over 50 Industry Experts
Solutions Review
January 28, 2025
“To protect their personal data, consumers can take several practical steps to remove their information from data broker websites and opt-out of marketing. First, they should identify where their data is held by searching major data broker sites, public records, and credit reports. Once identified, consumers can use the “Opt Out” or “Remove My Data” links provided on these websites to submit removal requests, ensuring they confirm their identity and track the progress.
Additionally, they should familiarize themselves with regulations like the California Consumer Privacy Act (CCPA), which allows them to request the deletion of their personal data and opt-out of its sale. Consumers can also use online tools and services designed to automate the opt-out process from marketing lists and data brokers.
How Can The Industry Do A Better Job Of Promoting Emerging Technologies In Physical Security Environments?
Security Informed
November 25, 2024
The security industry can do a better job of promoting emerging technologies in security environments by linking their solutions to measurable outcomes that matter to CISOs. Those outcomes could be to either reduce sales friction or to show measurable progress in key risk indicators that board members care about. For example, while according to the recent "The Impact of Technology in 2025 and Beyond: an IEEE Global Study,” 48% of technologists said that the top application for AI in 2025 will be real-time cybersecurity vulnerability identification and attack prevention, vendors should still be prepared to explain how investments in their solutions can produce progress over time and support agreed-upon business objectives, outside of the technical benefits. Unfortunately, most emerging technologies primarily discuss technical benefits and features, not business outcomes. For example, if a CISO cares about multifactor authentication coverage, vendors should explain how their solution improves coverage and ties that to higher business resiliency. That would also reduce friction in B2B sales where a high degree of MFA coverage could be cited as a key control in a SOC 2 type 2 report, for example.
How AI could change threat detection
Techtarget
September 13, 2024
Early threat detection practices mostly involved identifying "something bad on a device by detecting that it matched a known signature," explained Kayne McGladrey, a senior member of IEEE, a nonprofit professional association, and field CISO at Hyperproof. This signature-based detection was, and still is, a key part of threat detection, but other rules-based detection practices -- where computer activities are analyzed to determine if they follow set rules -- have become foundational components of threat detection over the years, too.
How are wearable technologies impacting the security market?
SourceSecurity
August 29, 2024
Wearable technologies offer many benefits but pose unique security challenges requiring robust controls and for users to keep their devices updated. These devices collect large amounts of personal data, such as health metrics and location information. As a result, manufacturers should implement robust encryption, provide frequent updates, and establish transparent data policies that maintain compliance with Europe’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). Similarly, consumers should request stronger security controls from manufacturers, and should regularly update software, use strong passwords, and monitor app permissions.
AI in Cybersecurity: The Good and the Bad
Builtin
August 22, 2024
“[AI] allows a threat actor to scale a lot faster and across multiple channels,” Kayne McGladrey, chief information security officer at compliance management company Hyperproof, told Built In. “And the defensive tools haven’t quite caught up. Unfortunately, none of this stuff is going away. This has now become a fixture of the landscape. It’s part of our new, modern cybersecurity hellscape that we inhabit continuously.”
Quantum and AI: Safeguards or Threats to Cybersecurity?
IEEE Transmitter
July 29, 2024
AI models are vulnerable to numerous threats. One common attack involves data poisoning, in which malicious data is introduced into an AI’s training data set, causing it to learn incorrect patterns or behaviors and leading to inaccurate or harmful outputs. Watermarking and metadata embedding can help to support the integrity of training data and model outputs. These methods can be cryptographically verified and authenticated, ensuring the trustworthiness and traceability of the data used in AI models.
What Are The Benefits, And Drawbacks, Of AI In Security
Security Informed
June 21, 2024
By automating routine tasks and improving threat detection and response capabilities in cybersecurity, AI allows security teams to focus on more strategic activities. It is likely that cybersecurity professionals will soon use AI tools as an interface to less-familiar tools, similar to how programmers are currently using AI to generate code based on a task description when writing code for unfamiliar programming languages. However, one drawback of the rapid adoption of AI in enterprise security applications is that the accelerated development cycle and limited user base mean these tools have not seen extensive real-world security testing. As a result, some AI security tools may include vulnerabilities that can be exploited by threat actors. This is like the latest trends of enterprise file transfer applications or enterprise VPNs being compromised, which happened before the current increased development cycle to incorporate AI based on investor demands. It's very likely we will see zero-days used against AI-powered cybersecurity solutions in the short term.
AI Summit: Fortifying Cyber Defense Amid Privacy Challenges
BankInfoSecurity
April 30, 2024
A session by Kayne McGladrey, field CISO of Hyperproof, and Casey Allen, CIO of Concentric, discussed the importance of privacy regulations when maturing organizational security programs. McGladrey and Allen shared methodologies for CIOs and CISOs to embed privacy into security initiatives in the age of AI and digital transformation.
The Jobs of Tomorrow: Insights on AI and the Future of Work
IEEE Transmitter
January 19, 2024
Kayne McGladrey, Field CISO at Hyperproof and IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions.
“Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
What Will Be The Biggest Surprise For Security In 2024?
Security Informed
December 26, 2023
"In 2024, the most significant cybersecurity surprise will be the widespread recognition that Chief Information Security Officers (CISOs) are primarily risk advisors, not risk owners. This distinction contrasts with some companies' previous perceptions and the operational reality. With cybersecurity concerns such as data center vulnerability, cloud vulnerability, and ransomware attacks still being a top concern for business leaders in 2024, this distinction is important to keep in mind to ensure the success of corporate security. Business systems are managed by business owners, whose performance is measured based on the system's effectiveness. Historically, some companies have incorrectly assumed that the CISO is responsible for authorizing or mitigating some of the risks associated with these business systems. This is a misconception. The business owner, likely the individual who has approved the business continuity plan or is most affected by operational disruptions, also bears the responsibility of deciding how to address each risk. While CISOs can identify and propose mitigation strategies for business risks related to cybersecurity, they do not and should not accept or authorize the mitigation of risks for systems outside their ownership."
Tags: Cybersecurity, Business Continuity, Data Center
Article: Experts advise on how to build a successful hybrid work security strategy
CIO
December 15, 2023
Next, commit to solving the complexity issue. In practice, this involves consolidation and integration of tools while striking “a balance between robust protection and user convenience,” said Kayne McGladrey (@kaynemcgladrey), Field CISO at Hyperproof and Senior IEEE Member. For example, “automation and integration of security controls are crucial in achieving scalability and simplifying validation of efficient control operations.”
We’ve compiled the best VPNs for Netflix to show you those that have secure servers, optimum speed and allow you to stream Netflix on different devices.
How to develop an application modernization strategy that delivers tangible results
CIO
November 17, 2023
Kayne McGladrey, (@kaynemcgladrey), senior IEEE member and field CISO at Hyperproof, which provides SaaS-based compliance and security operations solutions, says: “Developing an application modernization strategy requires careful assessment, planning and execution. First, you must understand your business goals and objectives. Only then can you create an aligned business and application roadmap.”
Using AI Isn’t As Easy As It Seems
CXOToday
November 12, 2023
“Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier one analysts in the security operation center,” said IEEE Senior Member Kayne McGladrey. “Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.”
Data loss prevention vendors tackle gen AI data risks
CSO
October 31, 2023
“Employees across industries are finding new and innovative ways to perform their tasks at work faster,” says Kayne McGladrey, IEEE senior member and field CISO at Hyperproof. “However, this can lead to the sharing of confidential or regulated information unintentionally. For instance, if a physician sends personal health information to an AI tool to assist in drafting an insurance letter, they may be in violation of HIPAA regulations.” The problem is that many public AI platforms are continually trained based on their interactions with users. This means that if a user uploads company secrets to the AI, the AI will then know those secrets — and will spill them to the next person who asks about them. It's not just public AIs that have this problem. An internal large language model that ingested sensitive company data might then provide that data to employees who shouldn’t be allowed to see it.
Zero trust from edge to cloud: not one-and-done
CIO Magazine
August 30, 2023
“The only meaningful consideration of zero trust adoption is when the board and CEO are willing to trust and partner with the CISO to effectively mitigate business risks. A recent Gartner study found that a CISO who can effectively tie business outcomes to a material reduction in business risk through practical implementation of zero trust controls will make security an asset for their organization that enables them to compete more effectively.” — Kayne McGladrey, field CISO, Hyperproof
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Geospatial World
November 02, 2022
While homomorphic encryption can require lots of computing power, it has a few big upsides. For one thing, according to Kayne McGladrey, IEEE Senior Member, it allows companies in highly regulated industries, such as finance or healthcare, to store data on a public cloud. “As the data remains encrypted in all phases, even a data breach of a third party will not provide a threat actor with access to encrypted data,” McGladrey said.
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
Fortune
July 22, 2022
“As a result, those companies with solutions and products in the cybersecurity industry are heavily reinvesting their profits into research and development of artificial intelligence-based solutions intended to automatically detect and remediate actions from these increasingly well-funded adversaries,” McGladrey tells Fortune. “This cycle will continue so long as it remains profitable for cybercrime actors, barring remarkable changes in how companies prioritize and address their cyber risks.”
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
CIO
November 04, 2021
“Organizational collaboration is difficult when different data protection tools perform similar functions, as it may be unclear how to allow a collaborator to access or modify data. Something as simple as data classification and labeling becomes overly complex and a nuisance to end users if they need to set a label in multiple locations, particularly when the labels are not consistent across tools.” — Kayne McGladrey (@kaynemcgladrey), Cybersecurity Strategist at Ascent Solutions
Sinclair TV Stations Targeted in Weekend Ransomware Attack
GovInfoSecurity
October 18, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, says once the incident is resolved, Sinclair "should do an internal hot-wash" to identify lessons learned - allowing them to strengthen technical defenses and update/validate their incident response plan.
New Legislation Eyes Both Ransom, Incident Reporting
GovInfoSecurity
September 30, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, tells ISMG, "These [various legislative efforts] all stem from the issue that there is no single source of truth on the volume or scope of cyberattacks, which has led to the perception that it is difficult to apply commensurate public and private policy responses."
Experts Weigh In on Data-First Modernization
CIO
September 30, 2021
“This will vary by industry and size of business,” notes Kayne McGladrey, cybersecurity strategist at Ascent Solutions. “A social media company losing control of their content for an hour has a very different risk profile than a manufacturing company being unable to manufacture products.”
Tags: AI Governance, Cybersecurity, Risk Management
Transforming Security Compliance from Cost Center to Competitive Edge
Hyperproof
October 22, 2024
Enterprise security professionals face pressure to minimize spending on risk and compliance while maximizing efficiency and security. Traditionally seen as cost centers, security compliance solutions have untapped potential for better decision-making and competitive advantage. In this session. you will discover how adopting new cybersecurity frameworks can save money and enable market entry, how automation reduces engineering's role in evidence collection for control operations, and how to convey the value of cybersecurity investments to the board.
Kayne McGladrey, FIELD CISO, Hyperproof
Andrew Cunje, CHIEF INFORMATION SECURITY OFFICERT, Appian
Tuesday, October 22, 2024 / 12:05 PM - 12:25 PM EDT at Gartner IT XPO
Communicating Risk with Your Leadership Team
FutureCon
December 06, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
In this presentation, you’ll learn:
● What the 2023 risk landscape looks like
● How risk managers are planning on updating their risk workflows to adapt
● How to communicate risk to leadership
December 6th at 10:45 AM at FutureCon in Atlanta, GA
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
ISACA
August 21, 2023
In a world where compliance and engineering teams must work together to build compliant products, competing goals and philosophies can make collaboration frustrating for both sides. Join representatives from Instacart as they share their story on how they worked with engineering to build a compliant product, best practices for collaborating across teams to build scalable, compliant solutions and how to foster a culture of security and compliance across your organization.
After completing this session, participants will be able to:
• Build more credibility with engineering teams.
• Incorporate features that enable compliance into products.
• Work with your engineering team—not against them—to build high-quality, compliant products.
• Make long-term continuous compliance a reality with automation tools.
Cyber security for Bellingham families and neighborhoods
Eventbrite
October 13, 2019
Americans are buying and installing smart speakers, virtual assistants, smart electrical plugs, smart garage door openers, smart light bulbs and connected children's toys at an unprecedented rate. We know to lock the physical doors to our homes, but fewer people appreciate how smart devices can act like unlocked doors for cyber criminals into our homes, our social networks, and our bank accounts.
The lack of communications and understanding between professionals who work in cyber security and their neighbors who don't is one of the reasons cyber crime has grown for fifteen years. There are simple things we can each do to protect our families against the risks to our privacy and security.
In this session, you'll learn:
- how cyber criminals hack into smart devices, bank accounts, and cloud services
- two easy ways you can protect your family's accounts
This session includes a live hacking demo, so please bring your mobile phone (Android or Apple) if you’d like to participate. This is not a sponsored event and there is no cost. Any solutions recommended will be free, and there will be time for questions at the end of the presentation.
All about DORA | Drafting Compliance Ep. 38
Hyperproof
December 13, 2024
Kayne and Tom talk about DORA and its applicability. Learn where DORA applies, how you may need to be concerned about DORA even if you think you don’t and why DORA is causing confusion in US companies. Kayne and Tom try an unusual option to drink and we come close on the scoring.
Controls, Questionnaires, and Risks with Eric Hammersley | Drafting Compliance Ep. 37
Hyperproof
November 19, 2024
On this episode, we're expanding the show to talk about more than FedRAMP. But before we get to that, I want to mention: we're sitting in the same room in San Diego, in front of a live audience at HyperConnect 2024 , with our special guest Eric Hammersley of Nutanix, and we have some beers.
How digital wallets work, and best practices to use them safely
Help Net Security
September 19, 2024
In this Help Net Security video, Kayne McGladrey, IEEE Senior Member, discusses best practices for using digital wallets safely. With the adoption of digital wallets and the increasing embedding of consumer digital payments into daily life, ensuring security measures is essential. According to a McKinsey report, digital payments are now mainstream and continually evolving, bringing advancements and new data protection and fraud prevention challenges.
From Cost Center to Competitive Edge: Operationalizing GRC
Hyperproof
July 07, 2025
This presentation from Hotman Group and Hyperproof explains how to transform governance, risk, and compliance (GRC) from a reactive cost center into a strategic advantage. Kayne and Cheri stress understanding your organization’s core drivers—such as avoiding risk, meeting regulatory demands, and supporting financial disclosures—to justify executive sponsorship and resource allocation.
Threat Model Updates, AI, and LLMs | Bill Dougherty, Omada Health | InfoSec Pros on the Road
Hyperproof
June 12, 2025
Filmed live at RSAC 2025 in San Francisco, we are joined by Bill Dougherty, CISO at Omada Health, to discuss an update to his threat model to include AI and LLMs and more!
Scalable Risk Management and GRC | Paul Kunas, Accenture | InfoSec Pros on the Road
Hyperproof
June 06, 2025
Filmed live at RSAC 2025 in San Francisco, we are joined by Paul Kunas, Director and Global Lead of Cyber Risk, Regulations and Standards with Accenture, to discuss his evolution from internal GRC to client-facing consultant, scalable risk management across budget constraints, and more!
Cyber Leaders S02 E03 (Feat. Kayne McGladrey)
The Decloaked Podcast
February 05, 2025
It's time we heard from people who live and breathe cybersecurity. Join me as we discuss the highs and lows of working in this industry, the topics that need clarifying, and those that need the B.S. removed. Kayne is active in the community and has offered some GRC maturity models to help anyone.
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
Western Washington University
February 17, 2021
On February 17th, 2021 Kayne McGladrey, CISSP will be leading a tabletop exercise for the students of CISS 471 at Western Washington University. The tabletop exercise explores the ethical decisions associated with a ransomware attack at a fictional international organization.
How to Overcome Policy Challenges
Hyperproof
April 22, 2025
Policies are the backbone of effective governance, yet many organizations struggle with implementation, oversight, and adaptation. In this webinar, we will explore strategies organizations can use to mature their approach to policy and see where they sit on the Policy Maturity Model. We’ll unveil Hyperproof’s new policy capabilities and how they can help you navigate the complexities of policy governance. In this webinar, we’ll discuss:
- Common challenges associated with policy and real-world examples of policy failures.
- How to assess your organization's policy maturity and identify gaps through the Policy Maturity Model.
- Hyperproof’s new policy capabilities and how they can help your organization scale with confidence.
InfoSec Pros: Joe Erle on Cyberinsurance Key Controls and AI Considerations
LinkedIn
February 21, 2025
When a company experiences a cyber incident, cyberinsurance can make a significant difference in financial recovery—but only if the right controls are in place. In this episode of Hyperproof’s live stream series, Joe Erle from C3 Risk & Insurance Services joins Kayne McGladrey to discuss how organizations can approach cyberinsurance in a landscape shaped by artificial intelligence and evolving threats. We will explore the controls insurance providers require, how claims are handled when AI-driven fraud is involved, and what businesses need to prepare for in the event of a breach. We will also dig into the latest trends in financial fraud, including fake invoicing and social engineering attacks. Questions from the audience are welcome, so join the conversation and get real-time insights from an expert in the field.
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
ISC(2)
April 09, 2024
Is your IT risk and compliance program ready for 2024 and beyond?
For the last five years, Hyperproof has asked over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more. We then compare results from the previous year, and provide an in-depth view of the market’s current state in our annual benchmark report. The 2024’s IT Risk and Compliance Benchmark report highlights a fascinating change in the overarching narrative of cybersecurity: respondents and key stakeholders from other departments are thinking about cybersecurity compliance as a key competitive differentiator rather than just a cost center.
Join Hyperproof and ISC2 April 9, 2024 at 1:00 p.m. Eastern/10:00 a.m. Pacific to learn:
-How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
-Key trends for cybersecurity in 2024
-How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
-Why cybersecurity decision-making is becoming more collaborative with an integrated view of risk and compliance data.
From Cost Center to Competitive Edge: Operationalizing GRC
Hyperproof
April 02, 2024
Enterprise GRC professionals are often pressured to minimize spend on risk and compliance initiatives while still maximizing their efficiency and keeping their organizations secure and compliant. Fortunately, there's a growing realization that the right GRC solution, traditionally seen as a cost center, holds untapped potential for better decision-making, unlocking a significant competitive advantage. As a result, they need to break down the data silos between risk and compliance activities to get a transparent, holistic view of their compliance and risk postures, but they aren’t always sure where to start.
Join our experts Cheri Hotman, Partner, vCISO, Hotman Group and Kayne McGladrey, Field CISO from Hyperproof to learn more about:
- The drivers creating a growing need for transition from viewing GRC as a compliance obligation to operationalizing it as a strategic solution
- Practical strategies for transforming GRC operations, with a focus on breaking down silos
- Best practices for unifying risk and compliance data
- How to best prioritize GRC initiatives
Elevating Security: The Power of CIS Critical Security Controls
Hyperproof
December 05, 2023
Presented by
Kayne McGladrey, Field CISO - Hyperproof | Charity Otwell, Director, Critical Security Controls - CIS
Dec 05 2023, 11:00am PST
CIS Critical Security controls are a prescriptive, prioritized, and simplified set of best practices that can strengthen your cybersecurity posture. The CIS Controls include foundational security measures that you can use to achieve essential hygiene and protect yourself against a cyber attack. Are you curious whether CIS Critical Security Controls is the right choice for your organization? Or are you currently using CIS Critical Security Controls and wondering how to maximize your experience? Join Charity Otwell, Director at Critical Security Controls - CIS, and Kayne McGladrey, Field CISO at Hyperproof, to discuss areas of focus for CIS controls and how they can best apply to organizational security.
Participants will:
- Learn the basic foundation of CIS Controls
- Understand how to assess applicability for their organization
- Learn how to adopt best practices around CIS Controls
- Learn the upcoming changes that will be made to the CIS Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
BrightTalk
June 15, 2023
As generative AI tools like ChatGPT continue to evolve and impact various industries, compliance experts are left wondering about the potential security implications for their businesses. Join us for this enlightening webinar as we discuss the dos and don'ts of working with ChatGPT and similar technologies to equip compliance experts with the knowledge to navigate the security challenges presented by generative AI. We’ll also explore how you can ensure the safe and secure implementation of AI technologies within your organization and what security threats to anticipate.
Join speakers Kayne McGladrey, Field CISO at Hyperproof, and Dr. Rebecca Wynn, Global Chief Security Strategist & CISO at Click Solutions group, as they discuss:
- Valid use cases for using generative AI tools like ChatGPT in your business practices
- How to teach your organization to responsibly use AI tools how they can negatively impact enterprise risk and liability
- Security policy considerations that organizations should examine before incorporating ChatGPT or similar AI technologies
Insights into enterprise risk management frameworks that can help manage this new risk
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
ISC(2)
April 11, 2023
Maintaining cybersecurity compliance and building reliable risk management practices isn’t a simple to-do item you check off anymore. The livelihood (and ultimately the growth) of your business depends on resilient security and compliance programs. Add in changing regulatory requirements, and the challenge becomes exponentially more complex.
Join Hyperproof and (ISC)2 on April 11, 2023 at 1:00 p.m. Eastern/10:00 a.m. Pacific to hear more about:
• The value of connecting compliance and risk
• Optimizing stakeholder visibility and communication
• Using GRC tools to scale your business
• Long-term impacts of streamlining compliance, security, and risk management workflows
Communicating Risk With Your Leadership Team
FutureCon
March 22, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
Scale Your Security Questionnaire Response and Audit Preparedness Processes
BrightTalk
October 26, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio and Hyperproof to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
Kayne McGladrey, Field CISO - Hyperproof and John Forsyth, Director, Data & Infrastructure in Engineering - Loopio
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Hyperproof
October 05, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio, Hyperproof, and our special guest to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
The CISO Experience
The CISO Experience
July 26, 2022
Save the date for a very special “The CISO Experience” hosted by myself with our star guest Kayne McGladrey taking a Macro Economic view of the industry.
Very honoured to have Kayne as a speaker where we will be discussing a variety of topics including:
- Industry hiring practises
- Gatekeeping
- Burnout
Followed by a LIVE Q and A for the audience to participate
Tags: Cybersecurity, Diversity and Inclusion, Security
6 Steps to Prepare Your Company for CMMC 2.0
Ascent
June 22, 2022
Join us this Wednesday for an actionable six-step roadmap, prioritized under CMMC 2.0 and aligned to Zero Trust tenets, to improve your cyber program and reduce cyber risks to your business. #cybersecurity
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Supply Chain Brain
November 19, 2021
Global supply chains have been under intense strain in recent months, a situation that has been made even worse by the growth of cyber attacks, especially in the form of ransomware. The transportation sector, which has been largely deregulated, needs to adopt recommendations by industry and government organizations for implementing measures that they might have overlooked in years. The price of failing to do so can be high, with ransomware attacks threatening to shut down critical logistics operations for days or even longer.
Webinar: Zero Trust-As-A-Service
CSHub
November 05, 2020
Gain perspective on: The shift in security challenges, current security concerns, and future challenges; Main components of Zero Trust-as-a-Service; Zero Trust-as-a-Service implementation and deployment best practice; How Zero Trust-as-a-Service solving security challenges in a hybrid IT environment.
This is a pre-recorded webinar.
CISO Perspectives: Zero Trust-As-A-Service
Cybersecurity Hub
October 26, 2020
The rapid shift to work-from-home has accelerated the adoption of Zero Trust frameworks. Zero Trust-as-a-Service will be a necessary component of security strategies for 2021 and beyond.
Join Pulse Secure's Global Chief Security Architect, Mike Riemer and industry veteran Kayne McGladrey in this webinar to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
Futureproofing Now (Season #2, Ep. 11) - Cybersecurity & Cybertrust - Predictions & Implications
Futureproofing
July 14, 2020
“Bob Gourley emphasized that despite the dark topic of cyberthreats, we all leave with optimism. Carol Tang addressed the importance of continuous learning as part of a business leader’s proactive approach to mitigating risk and providing safety for customers. Kayne McGladrey emphasized the dual responsibility of today’s corporate decision makers with regard to cybersecurity: understand the complexity but act with transparency and specificity. It’s important to integrate cybersecurity awareness into the fabric of the organization, not sequester cybertrust solely within the domain of technology.”
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Hyperproof
March 01, 2024
It’s that time again! Hyperproof’s fifth annual benchmark survey is here. Each year, we ask over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to compare results from the previous year, provide an in-depth view of the market’s current state, and prepare for this year and into the future. What we found this year is highly interesting: there’s been a change in the overarching narrative of cybersecurity — long relegated to the role of a cost center — to make cybersecurity compliance a key competitive differentiator.
Join us for our webinar to learn:
* The top findings from the survey (hint: trust and transparency are top-of-mind in 2024)
* How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
* How highly publicized breaches in 2023 have made business operations more challenging for both B2B and B2C companies
* How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
* Why cybersecurity decision-making among organizations with an integrated view of risk and compliance data is becoming more collaborative
Understanding CMMC - It’s a Process, Not a Project
GovWhitepapers
May 22, 2025
“ If a manufacturing strategy can be exfiltrated from even one part of the supply chain it gives enemies an inside look at how equipment works. If they leverage that knowledge, warfighter lives are at risk. ”
- Kayne McGladrey, Hyperproof
Kayne's Top Five in Five for April 2023
Hyperproof
April 05, 2023
April has brought a range of important cybersecurity developments to my attention. Here are the key takeaways:
• ChatGPT Risk Solutions: Addressing confidentiality, intellectual property, and compliance risks with practical recommendations.
• CISO Preparedness: Discussing generative AI risks and governance with senior executives, while considering supply chain disclosures.
• National Cybersecurity Strategy: Exploring breach responsibility, potential market regulation, and guidance from the NIST Secure Software Development Framework.
• Board Expertise Trends: Analyzing cybersecurity representation on Fortune 500 boards and the impact of SEC proposed rule changes.
• Credit Rating Implications: Evaluating the effect of cyber risk on companies' and municipalities' credit ratings.
CISO Strategies & Tactics For Incident Repsonse
CSHub
August 31, 2020
“Your incident response plan will be examined during discovery, period, point blank. Keep that in mind. It’s your policy and your plan that are going to be examined by our discovery, and make sure that you can actually do what that policy says and make sure you can do what the procedures say.”
Kayne McGladrey, Cybersecurity Strategist at Ascent Solutions
Enterprise Cyber Security Trends and Predictions 2020
Cyber Security Hub
November 27, 2019
“Effective defense in depth is not just shiny overlapping technical controls,” said Director of IT and Security Kayne McGladrey. “Rather, it’s the combination of culture, documented and tested processes, policies, and technical controls. For example, an organization with a policy of least privilege, a process for approving account privileges, and a process for auditing and harvesting unused privileges does not need multiple technical controls to implement the desired outcome.” It’s best to start with policy and then enact that in culture, where feasible.
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
Cyber Security Hub
September 23, 2019
Data has historically been contained to the computing devices that accessed it within the enterprise campus perimeter. The traditional network endpoint was isolated to desktop PCs, laptop computers and most server components that attached to the organization’s network. In recent years, a dramatic increase in mobile devices has broadened the endpoint definition. Mobile devices require access to a company’s data anytime and from anywhere. With the addition of always-connected, sensor-powered Internet of Things (IoT) devices, the range of endpoints can now include everything from IP cameras to smart vending machines to biomedical devices.
The original definition still holds true to this day; however, the presence of more sophisticated devices requesting an IP address from the network, and often without a user interface, also suggests that the approach to endpoint defense must change. Bi-directional communications means the endpoint can be an entry point into a network or application. What does the device need to communicate with? Does it require internet connectivity? Does a device with an embedded OS provide some form of protection?
The Phishing Phenomenon: How To Keep Your Head Above Water
CSHub
January 30, 2019
Phishing is the lowest cost way for a threat actor to gain access to an organization’s network and assets, according to Kayne McGladrey, an IEEE member and director of Security and IT at Pensar Development. “While it might be fashionable to worry about the latest zero-day, or shadowy nation-state threat actors developing crippling remote exploits, the fact is that it’s cheaper to ask users for their passwords.”
The fact that nearly a billion people had their personal information exposed in November 2018 “has further helped threat actors to develop more compelling and targeted phishing content,’’ McGladrey adds.
Charting a new course: AT&T Cybersecurity report volume 8
AT&T
October 31, 2018
“Organizations that don’t have cybersecurity as a core business differentiator, or as a core business function, are often struggling to adapt modern cybersecurity practices,” says Kayne McGladrey, Director of Security and IT at Pensar Development.
AT&T Cybersecurity Insights, Vol. 7
AT&T
April 16, 2018
Migration is a transformative process, which means it needs the full backing of the C-suite. Kayne McGladrey, Director of Information Security Services for Integral Partners, LLC, says it is vital to offer “an effective presentation to the board about the benefits and challenges associated with
the migration, and it has to have a narrative. You have to find stories of success and failure inside
of your industry in order to present the full picture to the board.”
“There are many lessons that the enterprise will learn through piloting—whether it’s identified
security risks, user communication risks, or education risks—all of which provide future guidance,” says Kayne McGladrey, Director of Information Security Services for Integral Partners LLC. “By the time you get to the harder transition elements, including full infrastructure rollout, you’ve already sorted through the main issues, thanks to your pilot-based learning journey.”
The EU will lean hard into enforcement of the EU AI Act after August 2nd, 2026, which is when the bulk of the rules begin to apply for high-risk AI systems. This will follow the same pattern as the EU’s initial GDPR enforcement motions, with splashy news headlines and high fines. Under the EU AI Act, we can expect high-profile companies being fined up to €15?million or?3?% of worldwide annual turnover, whichever is higher. We can similarly expect regulators to find flaws in the documentation accompanying AI systems provided by deployers or providers, which will incur fines up to €7.5 million or 1% of global annual turnover. This documentation must include risk management, resilience, adversarial testing, cybersecurity controls for the underlying infrastructure, and more.
In response to increasing regulatory burdens and the risk of civil litigation, successful companies in 2024 will lean into enhancements in their compliance operations. They will actively collect and test evidence of security control effectiveness, linking these controls directly to their risks, across all critical assets or systems. This approach ensures companies are confident in accurately describing how well they manage their risk portfolio, including in SEC filings. The automation of compliance operations enables security and audit professionals to spend more time doing the parts of their jobs that they love. Furthermore, as supply chain risks intensify scrutiny of B2B transactions, companies will efficiently repurpose many of their controls and control evidence. This strategy not only allows companies to secure additional attestations or certifications such as ISO or SOC 2 without increasing their workforce, but it also provides a significant competitive business advantage.
A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation state APTs. Instead, 2023 will be the year where multiple regulatory bodies express their mounting frustration with public and private companies' collective inability to reduce the volume and impact of prior cyber attacks. In short, 2023 will be the year of risk.
An unprecedented six regulatory entities all have announced separate plans to enact additional rules in 2023 to instruct companies on how to manage their risks. These are the Department of Defense (DOD), the Federal Reserve, the Federal Trade Commission (FTC), the New York Department of Financial Services (NYDFS), the Office of the Comptroller of the Currency (OCC, part of Treasury), and the Securities and Exchange Commission (SEC). These entities wouldn’t be telling companies how to manage their risks if they believed that there was adequate risk management being conducted today. Instead, the pending regulatory changes are intended to cover perceived systemic shortcomings associated with cyber risk management.
Ransomware threat actors will continue to find new and innovative ways of generating revenue for their criminal operations throughout 2022. If organizations deploy adequate governance and technical controls in 2022 alongside an effective multinational policy response, we can anticipate a gradual ransomware slowdown in the fourth quarter as those threat actors not in prison re-skill as part of a workforce transition to other profitable criminal enterprises. Those countries giving license to ransomware threat actors inside their borders have a unique opportunity to provide a path to legitimate careers for those criminals who choose to voluntarily leave the market, and while this should not necessarily relieve them of any legal actions pending, it may be a useful incentive when considering sentencing.
Venture capitalists will accelerate feature development via mergers and acquisitions. In recent years, VCs have funded point solution vendors for technologies like SOAR and UEBA. These are features, not stand-alone technologies, and it’s often cheaper for market leaders to buy rather than build new features. CISOs should be aware of this market reality, as buying early-stage cybersecurity from a startup carries the risk of unintentionally having a business relationship with a much larger vendor within two years, and consequently needing to either buy the larger technology solution or rip and replace after the acquisition closes.
Cloud computing will continue to grow despite the frequency of breaches due to a lack of administrative controls and unintentional configuration errors. When an administrator had access to an on-premises server, they could only administer that server; a “cloud administrator” can administer all the assets in a given cloud instance, including backing up and exfiltrating entire servers. This is like the unintentional configuration errors that have plagued so many Amazon S3 buckets in 2019, where organizations have stored PII in S3 in a default configuration, and then those data have been accessed by security researchers.
The Internet of Things is a dumpster fire and upcoming regulatory controls aren’t going to put it out. Putting a sticker on a box with a username and random password and providing an updated privacy policy that consumers ignore isn’t adequate, although it is compliant. Manufacturers need to invest in user behavior analysis, require multi factor authentication, and to force patching of IoT devices. Otherwise, threat actors will continue to violate the privacy of people’s homes and nation states will built botnets as part of battlespace preparations.
Media source for expertise on AI, Cybersecurity, IoT
Location: Virtual Fees: 0
Service Type: Service Offered
As a CISSP I have an ethical responsibility to help educate the public about cybersecurity issues, and have been featured in Reader's Digest, USA Today, Fast Company, the Philadelphia Inquirer, Dark Reading, Cyber Security Hub, CIO.com, Robotics Business Review, The Institute, and more. Please contact me via email if you need a source for a story, an alternate perspective, or a longer-form piece. It'd be favorite if I had at least a day to reply.
Join Thinkers360 for free! Are you a Reader/Writer, Thought Leader/Influencer (looking to increase your earnings), or an Enterprise User (looking to work with experts)?
Cyber Security Hub Advisory Board
An Analysis of Section 1C Disclosures in Q1 of 2024
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
2025 Cybersecurity & AI Disclosure Trends
ISC2 Congress 2025: AI-Driven GRC Insights
Securing Intellectual Property from AI Agent Data Leakage
Hidden Costs of Data Security Compliance
CMMC Readiness Gap: Urgent Steps for Defense Firms
Georgia Tech Settlement Highlights FCA Risks
Weekly news context for October 3rd, 2025
News: Consumer Data Protection & AI Incident Response
Weekly news context for September 19th, 2025
Weekly news context for August 22nd, 2025
What the Butler Snow AI Sanctions Mean for Law Firm Governance
Weekly news context for August 8th, 2025
Weekly News Context: Corporate Risk & Compliance edition
Weekly news context for July 25th, 2025
Weekly news context for July 18th, 2025
Weekly news context for July 11th, 2025
Weekly news context for June 27th, 2025
Cyber News Weekly: AI Fraud & SEC Updates
Weekly news context for June 20th, 2025
Weekly news context for May 23rd, 2025
Top Cybersecurity News: DBIR, CCPA & FFIEC CAT
Weekly news context for April 18th, 2025
The GRC Maturity Model
What’s new in cybersecurity for physical security systems?
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Educated Endpoints
Senior IEEE Member
Top 50 IoT Influencers to follow in 2023
Cloud Thought Leader of the Day ️
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
Top Cyber Pro Awards for 2020
Top 50 Global Thought Leaders and Influencers on Internet of Things
100 B2B Thought Leaders and Influencers to Follow in 2020
ISSA Article of the Year 2017
How to Enhance Cloud Security Measures
Getting AI Right: 3 Challenges for the Future
Cybersecurity Concerns Continue
What is End-To-End Encryption? 7 Questions Answered
Telehealth is Booming: Here’s What You Need to Know
How to Keep Your Video Conferences Secure From Intruders
Decreasing Risk Through Enterprise Compliance
Should You Be Worried About Airport Cybersecurity Threats?
Introducing Hyperproof AI: Changing the Game for AI in GRC
Cyber Risk as a Business Imperative: Translating Threats into Strategic Action
Unveiling the 2025 IT Risk and Compliance Benchmark Report: Top Findings to Start Your Year
Unveiling the 2025 IT Risk and Compliance Benchmark Report
New Year, New Standards: Preparing for SEC Cybersecurity Disclosures in 2025 and Beyond
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
Opening keynote speech at the Seattle Electrical Conference
Keynote speech at CIA Conference 2020
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
Under siege: Why airlines have been prime targets for cyberattacks
How Agentic AI Could Expose Your Most Sensitive Personal Data
Microsoft hack risk spreads as cybercriminals and nation-states pile in
AI, Business Risk & Threat Management: a CISO’s guide
Bridging the AI Skills Gap: Top Strategies for IT Teams in 2025
How AI poses a threat to election security
AI’s Human Mimicry Spurs ‘Personhood Credential’ Proposal
How Safe and Secure Is GenAI Really?
6 tips for consolidating your IT security tool set
SEC Cyber Risk Disclosures: What Companies Need to Know
AI system poisoning is a growing threat — is your security regime ready?
Lodi, Calif., Built a Ransomware Defense Matrix with Multiple Solutions
AI models inch closer to hacking on their own
The Jobs of Tomorrow: Insights on AI and the Future of Work
EU Regulations as a Strategic Compass for US Companies
2025 DoD Utilities Privatization Post Award Workshop
Navigating the World of US Regulations: What You Need to Know
How Will AI Impact the Jobs of the Future?
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
A 2023 Regulatory Round-Up and How to Prepare for 2024
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
ISACA Virtual Summit 2022: Pursuing Digital Trust
Streamlining GRC Controls to Optimize Cybersecurity
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
SECtember 2022: Transforming Security Along with the Business
The Future of Health Tracking Apps
Cloud Adoption Outpaces Security
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Returning to the Office: Security Threats and Proactive Solutions
How Hackers Used and Abused the Pandemic to Profit
CISO Perspectives: Zero Trust-As-A-Service
#IDGTechtalk : A 2019 Recap and 2020 Predictions
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
TagNW Closing Panel and Comments
Zero trust secures agile business transformation
AI lifts workforces to new heights of efficiency and innovation
How Can The Industry Do A Better Job Of Promoting Emerging Technologies In Physical Security Environments?
How are wearable technologies impacting the security market?
AI in Cybersecurity: The Good and the Bad
Quantum and AI: Safeguards or Threats to Cybersecurity?
What Are The Benefits, And Drawbacks, Of AI In Security
AI Summit: Fortifying Cyber Defense Amid Privacy Challenges
The Jobs of Tomorrow: Insights on AI and the Future of Work
Article: Experts advise on how to build a successful hybrid work security strategy
How to develop an application modernization strategy that delivers tangible results
Integration of AI: A strategic imperative for organizations
Using AI Isn’t As Easy As It Seems
Data loss prevention vendors tackle gen AI data risks
Zero trust from edge to cloud: not one-and-done
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
Sinclair TV Stations Targeted in Weekend Ransomware Attack
New Legislation Eyes Both Ransom, Incident Reporting
Experts Weigh In on Data-First Modernization
Transforming Security Compliance from Cost Center to Competitive Edge
Communicating Risk with Your Leadership Team
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
Cyber security for Bellingham families and neighborhoods
IoT & Ethical Obligations of Engineers
The EU’s updated Product Liability Directive now includes software and AI! #EU #AI #cybersecurity
Top cybersecurity news for September 19th, 2024
How digital wallets work, and best practices to use them safely
Top cybersecurity news for September 11, 2024
#Meta shareholders just settled an eight billion dollar #privacy lawsuit? #cybersecurity #news
A #CISO charged? #solarwinds #SEC #news #cybersecurity #america #security
Another UK deadline! #UK #news #FCA #thirdpartyrisk #CISO #cybersecurity
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
InfoSec Pros: Joe Erle on Cyberinsurance Key Controls and AI Considerations
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
From Cost Center to Competitive Edge: Operationalizing GRC
Elevating Security: The Power of CIS Critical Security Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
Communicating Risk With Your Leadership Team
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Scale Your Security Questionnaire Response and Audit Preparedness Processes
The CISO Experience
6 Steps to Prepare Your Company for CMMC 2.0
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Webinar: Zero Trust-As-A-Service
CISO Perspectives: Zero Trust-As-A-Service
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Kayne's Top Five in Five for April 2023
CISO Strategies & Tactics For Incident Repsonse
Enterprise Cyber Security Trends and Predictions 2020
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
ISO 27701:2025 - The Standalone Privacy Standard
