Cybersecurity leadership, argued in plain English.
CISO Series Podcast turns cybersecurity leadership into a lively argument about what actually works inside organizations. David Spark and co-hosts push past slogans toward practical judgment on risk, boards, vendors, AI, compliance, and trust.
PRESS PLAY
CISO Series Podcast is a cybersecurity leadership show with the rhythm of a hallway argument. It moves quickly. David Spark sets up the room with banter, sponsor reads, named co-hosts, and direct prompts before the conversation turns toward the real problem: making security decisions inside businesses that do not think in security terms. The show returns often to a simple idea. CISOs have to understand revenue, operations, executives, boards, and risk appetite before their controls can matter. That theme shows up in advice about getting closer to the front lines of the business and in stories about what happens when security loses sight of how the organization sees risk. It is practical without pretending that practice is tidy. A recurring game, What's Worse, puts two bad scenarios side by side and forces a choice. The format is playful, but the problems are recognizable: a CEO who wants zero risk, cyber insurance treated as a security replacement, a temp worker with domain admin, or nobody with domain admin when production is down. The appeal is in the back-and-forth. Andy Ellis often reframes the premise, looks for hidden assumptions, and pushes the question toward decision quality. Other named participants bring the discussion into live events, compliance, RSA predictions, AI red teaming, vendor claims, and the daily awkwardness of explaining why yesterday's protection architecture failed. The show is not a polished lecture. It sounds like working security people testing each other's thinking in public. That gives it texture. The jokes can be old, the pivots can be abrupt, and the sponsor segments are part of the furniture, but the center of gravity stays useful. Recent episodes spend serious time on business fluency, trust with boards and peers, automation, entry-level security work, SOC roles, compliance boxes, ransomware resilience, and the gap between best practices and what survives contact with a company. The language is plain. The assumptions are usually challenged. The result is a show for people who want cybersecurity treated as a leadership function, not just a pile of tools, alerts, and conference slogans.
Made for: Security leaders, aspiring CISOs, risk managers, vendors, and business executives who need cybersecurity translated into decisions, tradeoffs, and organizational consequences.
What sets it apart: Its strength is the roundtable pressure test: practical scenarios, recurring risk games, and co-host pushback that turn familiar security talking points into sharper business judgment.
Discussions, tips, and debates from security practitioners and vendors on how to work better together to improve security for themselves and everyone else.
Based on 6 episodes we listened to · September 2026
It makes cyber risk legible as a series of business decisions about money, people, accountability, and imperfect tradeoffs.
CISO Series Podcast turns security leadership into a business conversation, with David Spark steering Andy Ellis and guests through decisions where technical controls meet budgets, executive expectations, staffing, and operational risk.
What's worse: a temp with domain admin or production down with nobody holding domain admin access?
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A practical case for learning security where business goals, real systems, and decisions meet.
The CISO Series Podcast frames CISO advice around staying close to the business. Security leaders are pushed to understand how revenue is made, talk with executives and peers, and help business teams reach their goals securely.
A CEO's answer to zero risk reveals whether security has a role or is being edged out by insurance.
David Spark opens this CISO Series episode with Andy Ellis of DUHA, easing in with loose banter about Ellis returning to Hebrew in honor of a guest. The sharper material arrives in the What's Worse?
A brisk boardroom discussion about the certainty executives want and the risk language CISOs can actually defend.
CISO Series Podcast treats cybersecurity as a boardroom problem as much as a technical one. David Spark and Andy Ellis start with jokes about AWS failures and after-the-fact protections, then settle into a useful "What's Worse" debate: is it more dangerous when a board asks,…
A practical access-risk scenario turns CISO tradeoffs into a clear operational conversation.
The episode frames the CISO role as a job built around moving targets: defenses that made sense yesterday can look thin once attackers change shape.
A forced-choice security game connects cyber risk to the human pressure behind it.
The CISO Series Podcast turns its familiar "what's worse?" game toward two security failures where workplace strain matters as much as technical exposure. In one case, an employee's depleted mental health leads to a threat actor stealing three months' worth of payroll.
Security earns room to operate when leaders can explain the business value behind the umbrella.
A CISO's communication problem quickly turns into a business problem when security is heard only as warnings, headcount pressure, or another request for money.
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
The CISO Series podcast hosts David Spark and Andy Ellis welcome guest Gary Chan, CISO at SSM Health, to discuss communication and decision-making challenges for security leaders.
A CISO shares a personal security mistake involving a firewall change that took down a production website, leading into a discussion on DevSecOps and zero trust.
CISO Series Podcast pairs United Airlines VP CISO Deneen DeFiore with YL Ventures partner Andy Ellis on cyber resilience, AI output risk, hiring paths, and cyber insurance.
Ryan Lloyd says mobile-app protection requires code obfuscation, runtime checks, integrity validation, and server-side threat telemetry.
Security starts with the business.
Andy Ellis argues on CISO Series Podcast that quantitative risk management only helps when it stays comparative and human.
A live podcast episode where the host and guest discuss the importance of understanding business in security, sharing a personal mistake about losing sight of business context in risk management.
CISO Series podcast episode with predictions for RSA conference, focusing on business-aligned cybersecurity and humorous takes on AI and mainframe security.
A CISO podcast episode where hosts discuss the importance of building trust in security roles and introduce a new sponsor, Strike48.
David Spark and Andy Ellis open with a vendor trap: a proof of value can look successful, then die when the real buyer sees the contract.
CISO Series Podcast episode Our Security Team's Love Language is Buying New Tools opens with David Spark's definition of a CISO as someone who can explain why yesterday's protection architecture failed.
David Spark and Andy Ellis discuss the telltale signs of a panel session going south, with sponsor Vanta.
A CISO podcast episode discussing the challenge of communicating with business stakeholders, with banter about Esperanto and sponsor Vanta.
David Spark and Mike Johnson discuss the overuse of AI by security vendors and the phenomenon of vendor splaining at conferences like RSA.
A cybersecurity podcast host and co-host discuss conference food quality and introduce a sponsor.