Cybersecurity debates, translated into operational judgment.
Defense in Depth is a cybersecurity management show built around one debate at a time. David Spark and co-hosts use community posts, examples, and sponsor-adjacent topics to test what actually works inside security programs.
PRESS PLAY
Defense in Depth is a practitioner-led cybersecurity discussion show about the arguments security teams keep having. It does not treat those arguments as abstract. A question about cloud management becomes a conversation about sprawl, developer autonomy, policy drift, and whether centralized intent can survive real-world complexity. A question about measuring CISOs turns into a discussion of goals, board language, loss expectancy, peer alignment, and the danger of metrics that look clean but point nowhere useful. The show is brisk. David Spark sets up the issue, reads community framing, and brings co-hosts and guests into a back-and-forth that usually lands on operational reality. The recurring posture is skeptical but constructive. It asks what a control changes, who has to live with it, and how the business would know the security program is improving. Vendor behavior gets the same treatment. Episodes about trade show engagement and overpromising in sales focus on trust, clear qualification, honest limits, and the fastest ways to lose a CISO's attention. Developer conflict is framed as a leadership and structure problem as much as a team problem. Zero trust is treated as a widely accepted idea that still fails when implementation gets hard. Vulnerability management is examined as a catching-up exercise that may need stronger preventive models around it. The tone is plainspoken, with enough dry banter to keep the room moving. It can wander. It usually comes back to the takeaway. Sponsor segments are frequent and sometimes deeply integrated with the subject matter, especially around endpoint protection, cloud security, breach recovery, and application security. That gives the show a trade-floor texture, but not a soft one. The useful part is the pressure testing. Defense in Depth is strongest when it turns cybersecurity language into decisions about people, process, incentives, and measurable outcomes.
Made for: Defense in Depth suits CISOs, security managers, AppSec leaders, cloud security practitioners, and vendors who need to understand how buyers think. It is especially useful for people who care about the business consequences of security decisions.
What sets it apart: The show builds each episode around a contested security question and lets practitioners work through it from several angles. Its edge is the repeated move from slogan to implementation: what changes, who owns it, and how success would be measured.
Defense in Depth promises clear talk on cybersecurity's most controversial and confusing debates. Once a week we choose one controversial and popular cybersecurity debate and use the InfoSec community's insights to lead our discussion.
Based on 6 episodes we listened to · September 2026
Defense in Depth turns cybersecurity disputes into practical conversations about controls, leadership, recovery, vendor trust, and the business consequences of technical decisions.
Defense in Depth takes a pointed security question and keeps narrowing it until the operational stakes come into view. David Spark sets up the dispute, then a guest co-host and another guest test it against the realities of security work.
A CISO walks up to a vendor booth; you hear the questions the booth should have asked.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A grounded look at whether cloud security can scale when each provider brings its own controls and vocabulary.
Defense in Depth looks at what "secure by design" really means when cloud security runs into day-to-day operating constraints. David Spark and Eddie Contreras, Senior EVP and CISO at FrostBank, tie the idea to multi-cloud sprawl and the strain of keeping up with…
A grounded discussion of how security performance becomes business-facing metrics.
Defense In-Depth asks a blunt business question: how can a company tell whether a CISO has done well enough to justify a raise or bonus? David Spark and Eddie Contreras shape the discussion around a Reddit prompt from Ross Young, who hosts CISO Tradecraft and is a CISO, then…
A practical look at security work that can consume time without clearly improving posture.
Defense in Depth looks at a familiar security problem: routines and frameworks that feel productive but may not be improving a program's posture.
A clear guide to the first handshake between a CISO and a booth staffer.
Defense In-Depth turns a familiar trade-show encounter into a useful look at how CISOs and vendors should meet on the floor. David Spark and Steve Zalewski keep returning to the same friction point: a CISO does not stop at a booth for the signage, and a vendor greeter should not…
False bravado may win attention, but trust still matters most in security sales.
Defense In-Depth turns a familiar sales habit into a trust problem. David Spark and Jeff Belknap open with Rinky Sethi, the CISO at Upwind Security, and the reaction to her LinkedIn post about lying salespeople, then stay with the core warning: in security, bluffing may win…
A CISO conversation on scope, business impact, and paths into cybersecurity.
Defense In-Depth turns a familiar title question into a clear look at scope: what belongs under cyber security, and what sits in the wider lane of information security.
Backups are treated as the safety net, with recovery and restoration kept firmly on practical ground.
Defense In-Depth keeps its attention on resilience after an attack, treating backups as a safety net that can still be exposed. David Spark and DJ Schleen move through recovery, restoration, business continuity, immutable systems, and infrastructure as code, so the conversation…
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
David Spark and Jeff Belknap challenge the traditional platformization vs best-of-breed dichotomy in cybersecurity, arguing it's a false choice.
CISO John Overbaugh discusses how to handle urgent compliance requests as opportunities to enable business rather than obstacles.
This episode of Defense in Depth focuses on protecting backups from ransomware, a critical component of cybersecurity resilience.
Host David Spark and guest co-host John Underwood, VP of Information Security at Big Five Sporting Goods, debate whether the CISO role is narrowly viewed as cybersecurity versus the broader scope of information security.
A discussion on whether native or third-party cloud management tools are more sustainable for maintaining security in multi-cloud environments.
David Spark and Eddie Contreras discuss how a CISO's performance should be measured for bonuses and salary raises, sparked by a Reddit post.
Ross Young discusses how cybersecurity frameworks can lead to unproductive busywork and introduces a MITRE ATT&CK-inspired framework to focus on effectiveness.
This episode discusses how vendors should engage with CISOs at trade shows, focusing on being strategic, outlining next steps, and connecting them to non-sales advisors.
This episode explores whether the friction between security teams and developers is a leadership problem rather than a team problem.
Octavia Howell of Equifax Canada and Jeff Belknap of Defense In-Depth both say a vendor earns trust by listening to requirements, not by leading with logos or a "100%" promise.
A discussion on why zero trust implementation lags despite widespread agreement on its principles.
A discussion on whether a secure software environment can be achieved without traditional vulnerability management by applying zero-trust principles.
This episode discusses how staff with no previous cybersecurity experience can contribute to improving a company's security posture through tasks like asset management and policy reviews.